A new user account 'tempAdmin' was created with elevated privileges. This account is suspected to be part of an attacker’s persistence strategy to maintain access to the network and move laterally undetected.