From Domain Users to Ransomware in 20 Minutes 🇸🇪