njrat | 6d0e095cb5f0fd693e669d0cf4cdf02a917818aa3b1371db9e49bc530bdf2a4c

Analysis

max time kernel
89s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
01/02/2024, 23:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
87f601a021e88fff2a4f20b0e6336415.exe
Size 3.1MB
Sample240201-3ltsaagfd6
SHA256 6d0e095cb5f0fd693e669d0cf4cdf02a917818aa3b1371db9e49bc530bdf2a4c
MD5 87f601a021e88fff2a4f20b0e6336415
SHA1 bc1409a0e6e550558f74d233b320c9158a63b193
SHA512 ec90c2e1d3432138f18d1d37a12ec636a9981ff32dff56bb6f24adeaa7927bd05abb8a9b5a2aeec38e8084f6200b2acd73a935160880992dca44158a45d05104
SSDEEP 384:t8ad4y/bct3ccgzrwrlsjlwqeTRoCI32pF/SbZiHGWPEGcGjQ9N9sUwobCFkkaJf:gyjn
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

njrat client evasion persistence trojan

Malware Config

Extracted

Family

njrat

Version

0.7.3

Botnet

Client

dontreachme3.ddns.net:3604

Mutex

EdgeBrowser.exe

Attributes

reg_key
EdgeBrowser.exe
splitter
123

Signatures

Modifies Windows Defender Real-time Protection settings 3 TTPs 4 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	powershell.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	powershell.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	powershell.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	powershell.exe

Turns off Windows Defender SpyNet reporting 2 TTPs
evasion

Disable or Modify Tools
T1562.001

Modify Registry
T1112

UAC bypass 3 TTPs 4 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	powershell.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	3y17bRb9681eL7Z8Ak86wcf7b.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	EdgeBrowser.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	3y17bRb9681eL7Z8Ak86wcf7b.exe

Windows security bypass 2 TTPs 5 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths	powershell.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\87f601a021e88fff2a4f20b0e6336415.exe = "0"	powershell.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\3y17bRb9681eL7Z8Ak86wcf7b.exe = "0"	powershell.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\Resources\Themes\2bc88ei9J91bLK7Vsa5cad7dbgCa\svchost.exe = "0"	powershell.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\EdgeBrowser.exe = "0"	EdgeBrowser.exe

njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat

Nirsoft 1 IoCs

resource	yara_rule
behavioral2/files/0x00070000000231fd-14.dat	Nirsoft

Stops running service(s) 3 TTPs
evasion

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Checks computer location settings 2 TTPs 7 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\Control Panel\International\Geo\Nation	3y17bRb9681eL7Z8Ak86wcf7b.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\Control Panel\International\Geo\Nation	87f601a021e88fff2a4f20b0e6336415.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\Control Panel\International\Geo\Nation	3y17bRb9681eL7Z8Ak86wcf7b.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\Control Panel\International\Geo\Nation	AdvancedRun.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\Control Panel\International\Geo\Nation	87f601a021e88fff2a4f20b0e6336415.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\Control Panel\International\Geo\Nation	EdgeBrowser.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\Control Panel\International\Geo\Nation	3y17bRb9681eL7Z8Ak86wcf7b.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\3y17bRb9681eL7Z8Ak86wcf7b.exe	powershell.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\3y17bRb9681eL7Z8Ak86wcf7b.exe	powershell.exe

Executes dropped EXE 14 IoCs

pid	Process
1792	powershell.exe
516	AdvancedRun.exe
5104	3y17bRb9681eL7Z8Ak86wcf7b.exe
3056	AdvancedRun.exe
4904	Conhost.exe
5324	3y17bRb9681eL7Z8Ak86wcf7b.exe
5732	EdgeBrowser.exe
5880	3y17bRb9681eL7Z8Ak86wcf7b.exe
5976	AdvancedRun.exe
4180	AdvancedRun.exe
4088	EdgeBrowser.exe
4676	3y17bRb9681eL7Z8Ak86wcf7b.exe
844	3y17bRb9681eL7Z8Ak86wcf7b.exe
5792	AdvancedRun.exe

Windows security modification 2 TTPs 1 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\EdgeBrowser.exe = "0"	EdgeBrowser.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\3y17bRb9681eL7Z8Ak86wcf7b = "C:\\Windows\\Resources\\Themes\\2bc88ei9J91bLK7Vsa5cad7dbgCa\\svchost.exe"	EdgeBrowser.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\3y17bRb9681eL7Z8Ak86wcf7b = "C:\\Windows\\Resources\\Themes\\2bc88ei9J91bLK7Vsa5cad7dbgCa\\svchost.exe"	3y17bRb9681eL7Z8Ak86wcf7b.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\3y17bRb9681eL7Z8Ak86wcf7b = "C:\\Windows\\Resources\\Themes\\2bc88ei9J91bLK7Vsa5cad7dbgCa\\svchost.exe"	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\3y17bRb9681eL7Z8Ak86wcf7b = "C:\\Windows\\Resources\\Themes\\2bc88ei9J91bLK7Vsa5cad7dbgCa\\svchost.exe"	3y17bRb9681eL7Z8Ak86wcf7b.exe

Checks whether UAC is enabled 1 TTPs 6 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	EdgeBrowser.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	3y17bRb9681eL7Z8Ak86wcf7b.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	3y17bRb9681eL7Z8Ak86wcf7b.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	3y17bRb9681eL7Z8Ak86wcf7b.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	3y17bRb9681eL7Z8Ak86wcf7b.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	EdgeBrowser.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 49 IoCs

pid	Process
3924	powershell.exe
3924	powershell.exe
3924	powershell.exe
3924	powershell.exe
3924	powershell.exe
3924	powershell.exe
3924	powershell.exe
3924	powershell.exe
3924	powershell.exe
3924	powershell.exe
3924	powershell.exe
3924	powershell.exe
3924	powershell.exe
5104	3y17bRb9681eL7Z8Ak86wcf7b.exe
5104	3y17bRb9681eL7Z8Ak86wcf7b.exe
5104	3y17bRb9681eL7Z8Ak86wcf7b.exe
5104	3y17bRb9681eL7Z8Ak86wcf7b.exe
5104	3y17bRb9681eL7Z8Ak86wcf7b.exe
5104	3y17bRb9681eL7Z8Ak86wcf7b.exe
5104	3y17bRb9681eL7Z8Ak86wcf7b.exe
5104	3y17bRb9681eL7Z8Ak86wcf7b.exe
5104	3y17bRb9681eL7Z8Ak86wcf7b.exe
5104	3y17bRb9681eL7Z8Ak86wcf7b.exe
5104	3y17bRb9681eL7Z8Ak86wcf7b.exe
5104	3y17bRb9681eL7Z8Ak86wcf7b.exe
5732	EdgeBrowser.exe
5732	EdgeBrowser.exe
5732	EdgeBrowser.exe
5732	EdgeBrowser.exe
5732	EdgeBrowser.exe
5732	EdgeBrowser.exe
5732	EdgeBrowser.exe
5732	EdgeBrowser.exe
5732	EdgeBrowser.exe
5732	EdgeBrowser.exe
5732	EdgeBrowser.exe
5732	EdgeBrowser.exe
5880	3y17bRb9681eL7Z8Ak86wcf7b.exe
5880	3y17bRb9681eL7Z8Ak86wcf7b.exe
5880	3y17bRb9681eL7Z8Ak86wcf7b.exe
5880	3y17bRb9681eL7Z8Ak86wcf7b.exe
5880	3y17bRb9681eL7Z8Ak86wcf7b.exe
5880	3y17bRb9681eL7Z8Ak86wcf7b.exe
5880	3y17bRb9681eL7Z8Ak86wcf7b.exe
5880	3y17bRb9681eL7Z8Ak86wcf7b.exe
5880	3y17bRb9681eL7Z8Ak86wcf7b.exe
5880	3y17bRb9681eL7Z8Ak86wcf7b.exe
5880	3y17bRb9681eL7Z8Ak86wcf7b.exe
5880	3y17bRb9681eL7Z8Ak86wcf7b.exe

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 3924 set thread context of 5468	3924	powershell.exe	131
PID 5104 set thread context of 5324	5104	3y17bRb9681eL7Z8Ak86wcf7b.exe	141
PID 5732 set thread context of 4088	5732	EdgeBrowser.exe	231
PID 5880 set thread context of 4676	5880	3y17bRb9681eL7Z8Ak86wcf7b.exe	241

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\Resources\Themes\2bc88ei9J91bLK7Vsa5cad7dbgCa\svchost.exe	powershell.exe
File created	C:\Windows\EdgeBrowser.exe	87f601a021e88fff2a4f20b0e6336415.exe
File opened for modification	C:\Windows\EdgeBrowser.exe	EdgeBrowser.exe

Launches sc.exe 64 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
1536	sc.exe
3992	sc.exe
4708	sc.exe
5136	sc.exe
4732	sc.exe
880	sc.exe
6048	sc.exe
2228	sc.exe
3912	sc.exe
4376	sc.exe
5852	sc.exe
4984	sc.exe
2692	sc.exe
1808	sc.exe
4740	sc.exe
5180	sc.exe
2252	sc.exe
1584	sc.exe
2724	sc.exe
688	sc.exe
3976	sc.exe
560	sc.exe
936	sc.exe
3716	sc.exe
2476	sc.exe
5264	sc.exe
6072	sc.exe
4620	sc.exe
4684	sc.exe
4652	sc.exe
6100	sc.exe
1028	sc.exe
772	sc.exe
1220	sc.exe
1124	sc.exe
2820	sc.exe
2848	sc.exe
1228	sc.exe
2248	sc.exe
4680	sc.exe
5724	sc.exe
1148	sc.exe
3636	sc.exe
3488	sc.exe
2448	sc.exe
3852	sc.exe
6140	sc.exe
5272	sc.exe
2696	sc.exe
2296	sc.exe
3904	sc.exe
1532	sc.exe
2828	sc.exe
5236	sc.exe
2700	sc.exe
536	sc.exe
5208	sc.exe
3752	sc.exe
4272	sc.exe
5388	sc.exe
6044	sc.exe
5220	sc.exe
6064	sc.exe
548	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 5 IoCs

pid	pid_target	Process	procid_target
5724	3924	WerFault.exe	84
5360	5104	WerFault.exe	101
2448	5732	WerFault.exe	149
5888	5880	WerFault.exe	150
4832	844	WerFault.exe	242

Creates scheduled task(s) 1 TTPs 5 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
5596	schtasks.exe
5676	schtasks.exe
4264	schtasks.exe
5644	schtasks.exe
3724	schtasks.exe

Delays execution with timeout.exe 5 IoCs

evasion

pid	Process
5968	timeout.exe
4724	timeout.exe
6112	timeout.exe
5832	timeout.exe
6116	timeout.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1792	powershell.exe
1792	powershell.exe
1792	powershell.exe
1792	powershell.exe
516	AdvancedRun.exe
516	AdvancedRun.exe
516	AdvancedRun.exe
516	AdvancedRun.exe
3884	powershell.exe
3884	powershell.exe
3916	powershell.exe
3916	powershell.exe
2744	powershell.exe
2744	powershell.exe
5056	powershell.exe
5056	powershell.exe
1200	powershell.exe
4188	powershell.exe
1200	powershell.exe
4188	powershell.exe
2360	powershell.exe
2360	powershell.exe
3744	powershell.exe
3744	powershell.exe
3916	powershell.exe
3916	powershell.exe
3884	powershell.exe
3884	powershell.exe
3056	AdvancedRun.exe
3056	AdvancedRun.exe
3056	AdvancedRun.exe
3056	AdvancedRun.exe
2744	powershell.exe
4904	Conhost.exe
4904	Conhost.exe
4904	Conhost.exe
4904	Conhost.exe
2360	powershell.exe
5056	powershell.exe
1200	powershell.exe
4188	powershell.exe
3744	powershell.exe
3924	powershell.exe
3924	powershell.exe
1236	powershell.exe
1236	powershell.exe
4432	powershell.exe
4432	powershell.exe
4612	powershell.exe
4612	powershell.exe
2872	schtasks.exe
2872	schtasks.exe
1792	powershell.exe
1792	powershell.exe
1236	powershell.exe
4432	powershell.exe
1792	powershell.exe
4612	powershell.exe
2872	schtasks.exe
3924	powershell.exe
3924	powershell.exe
5104	3y17bRb9681eL7Z8Ak86wcf7b.exe
5104	3y17bRb9681eL7Z8Ak86wcf7b.exe
5104	3y17bRb9681eL7Z8Ak86wcf7b.exe

Suspicious use of AdjustPrivilegeToken 58 IoCs

description	pid	Process
Token: SeDebugPrivilege	1792	powershell.exe
Token: SeImpersonatePrivilege	1792	powershell.exe
Token: SeDebugPrivilege	516	AdvancedRun.exe
Token: SeImpersonatePrivilege	516	AdvancedRun.exe
Token: SeDebugPrivilege	3916	powershell.exe
Token: SeDebugPrivilege	3884	powershell.exe
Token: SeDebugPrivilege	2744	powershell.exe
Token: SeDebugPrivilege	5056	powershell.exe
Token: SeDebugPrivilege	1200	powershell.exe
Token: SeDebugPrivilege	4188	powershell.exe
Token: SeDebugPrivilege	2360	powershell.exe
Token: SeDebugPrivilege	3744	powershell.exe
Token: SeDebugPrivilege	3056	AdvancedRun.exe
Token: SeImpersonatePrivilege	3056	AdvancedRun.exe
Token: SeDebugPrivilege	4904	Conhost.exe
Token: SeImpersonatePrivilege	4904	Conhost.exe
Token: SeDebugPrivilege	3924	powershell.exe
Token: SeDebugPrivilege	1236	powershell.exe
Token: SeDebugPrivilege	4432	powershell.exe
Token: SeDebugPrivilege	1792	powershell.exe
Token: SeDebugPrivilege	4612	powershell.exe
Token: SeDebugPrivilege	2872	schtasks.exe
Token: SeDebugPrivilege	5104	3y17bRb9681eL7Z8Ak86wcf7b.exe
Token: SeDebugPrivilege	5976	AdvancedRun.exe
Token: SeImpersonatePrivilege	5976	AdvancedRun.exe
Token: SeDebugPrivilege	4180	AdvancedRun.exe
Token: SeImpersonatePrivilege	4180	AdvancedRun.exe
Token: SeDebugPrivilege	2052	powershell.exe
Token: SeDebugPrivilege	892	powershell.exe
Token: SeDebugPrivilege	3304	powershell.exe
Token: SeDebugPrivilege	3836	powershell.exe
Token: SeDebugPrivilege	1380	powershell.exe
Token: SeDebugPrivilege	1088	powershell.exe
Token: SeDebugPrivilege	5488	powershell.exe
Token: SeDebugPrivilege	468	powershell.exe
Token: SeDebugPrivilege	5804	powershell.exe
Token: SeDebugPrivilege	5732	EdgeBrowser.exe
Token: SeDebugPrivilege	5880	3y17bRb9681eL7Z8Ak86wcf7b.exe
Token: SeDebugPrivilege	4088	EdgeBrowser.exe
Token: 33	4088	EdgeBrowser.exe
Token: SeIncBasePriorityPrivilege	4088	EdgeBrowser.exe
Token: 33	4088	EdgeBrowser.exe
Token: SeIncBasePriorityPrivilege	4088	EdgeBrowser.exe
Token: 33	4088	EdgeBrowser.exe
Token: SeIncBasePriorityPrivilege	4088	EdgeBrowser.exe
Token: 33	4088	EdgeBrowser.exe
Token: SeIncBasePriorityPrivilege	4088	EdgeBrowser.exe
Token: 33	4088	EdgeBrowser.exe
Token: SeIncBasePriorityPrivilege	4088	EdgeBrowser.exe
Token: SeDebugPrivilege	5792	AdvancedRun.exe
Token: SeImpersonatePrivilege	5792	AdvancedRun.exe
Token: 33	4088	EdgeBrowser.exe
Token: SeIncBasePriorityPrivilege	4088	EdgeBrowser.exe
Token: SeDebugPrivilege	5636	powershell.exe
Token: SeDebugPrivilege	2580	powershell.exe
Token: SeDebugPrivilege	2828	powershell.exe
Token: SeDebugPrivilege	3492	powershell.exe
Token: SeDebugPrivilege	3924	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3924 wrote to memory of 1792	3924	87f601a021e88fff2a4f20b0e6336415.exe	125
PID 3924 wrote to memory of 1792	3924	87f601a021e88fff2a4f20b0e6336415.exe	125
PID 3924 wrote to memory of 1792	3924	87f601a021e88fff2a4f20b0e6336415.exe	125
PID 1792 wrote to memory of 516	1792	powershell.exe	86
PID 1792 wrote to memory of 516	1792	powershell.exe	86
PID 1792 wrote to memory of 516	1792	powershell.exe	86
PID 3924 wrote to memory of 3916	3924	powershell.exe	95
PID 3924 wrote to memory of 3916	3924	powershell.exe	95
PID 3924 wrote to memory of 3916	3924	powershell.exe	95
PID 3924 wrote to memory of 3884	3924	powershell.exe	93
PID 3924 wrote to memory of 3884	3924	powershell.exe	93
PID 3924 wrote to memory of 3884	3924	powershell.exe	93
PID 3924 wrote to memory of 2744	3924	powershell.exe	97
PID 3924 wrote to memory of 2744	3924	powershell.exe	97
PID 3924 wrote to memory of 2744	3924	powershell.exe	97
PID 3924 wrote to memory of 5056	3924	powershell.exe	98
PID 3924 wrote to memory of 5056	3924	powershell.exe	98
PID 3924 wrote to memory of 5056	3924	powershell.exe	98
PID 3924 wrote to memory of 4188	3924	powershell.exe	100
PID 3924 wrote to memory of 4188	3924	powershell.exe	100
PID 3924 wrote to memory of 4188	3924	powershell.exe	100
PID 3924 wrote to memory of 5104	3924	powershell.exe	101
PID 3924 wrote to memory of 5104	3924	powershell.exe	101
PID 3924 wrote to memory of 5104	3924	powershell.exe	101
PID 3924 wrote to memory of 2360	3924	powershell.exe	102
PID 3924 wrote to memory of 2360	3924	powershell.exe	102
PID 3924 wrote to memory of 2360	3924	powershell.exe	102
PID 3924 wrote to memory of 1200	3924	powershell.exe	104
PID 3924 wrote to memory of 1200	3924	powershell.exe	104
PID 3924 wrote to memory of 1200	3924	powershell.exe	104
PID 3924 wrote to memory of 3744	3924	powershell.exe	106
PID 3924 wrote to memory of 3744	3924	powershell.exe	106
PID 3924 wrote to memory of 3744	3924	powershell.exe	106
PID 5104 wrote to memory of 3056	5104	3y17bRb9681eL7Z8Ak86wcf7b.exe	108
PID 5104 wrote to memory of 3056	5104	3y17bRb9681eL7Z8Ak86wcf7b.exe	108
PID 5104 wrote to memory of 3056	5104	3y17bRb9681eL7Z8Ak86wcf7b.exe	108
PID 3056 wrote to memory of 4904	3056	AdvancedRun.exe	126
PID 3056 wrote to memory of 4904	3056	AdvancedRun.exe	126
PID 3056 wrote to memory of 4904	3056	AdvancedRun.exe	126
PID 3924 wrote to memory of 2128	3924	powershell.exe	113
PID 3924 wrote to memory of 2128	3924	powershell.exe	113
PID 3924 wrote to memory of 2128	3924	powershell.exe	113
PID 2128 wrote to memory of 4724	2128	cmd.exe	119
PID 2128 wrote to memory of 4724	2128	cmd.exe	119
PID 2128 wrote to memory of 4724	2128	cmd.exe	119
PID 1752 wrote to memory of 936	1752	cmd.exe	120
PID 1752 wrote to memory of 936	1752	cmd.exe	120
PID 5104 wrote to memory of 1236	5104	3y17bRb9681eL7Z8Ak86wcf7b.exe	121
PID 5104 wrote to memory of 1236	5104	3y17bRb9681eL7Z8Ak86wcf7b.exe	121
PID 5104 wrote to memory of 1236	5104	3y17bRb9681eL7Z8Ak86wcf7b.exe	121
PID 5104 wrote to memory of 4432	5104	3y17bRb9681eL7Z8Ak86wcf7b.exe	123
PID 5104 wrote to memory of 4432	5104	3y17bRb9681eL7Z8Ak86wcf7b.exe	123
PID 5104 wrote to memory of 4432	5104	3y17bRb9681eL7Z8Ak86wcf7b.exe	123
PID 5104 wrote to memory of 1792	5104	3y17bRb9681eL7Z8Ak86wcf7b.exe	125
PID 5104 wrote to memory of 1792	5104	3y17bRb9681eL7Z8Ak86wcf7b.exe	125
PID 5104 wrote to memory of 1792	5104	3y17bRb9681eL7Z8Ak86wcf7b.exe	125
PID 5104 wrote to memory of 2872	5104	3y17bRb9681eL7Z8Ak86wcf7b.exe	237
PID 5104 wrote to memory of 2872	5104	3y17bRb9681eL7Z8Ak86wcf7b.exe	237
PID 5104 wrote to memory of 2872	5104	3y17bRb9681eL7Z8Ak86wcf7b.exe	237
PID 5104 wrote to memory of 4612	5104	3y17bRb9681eL7Z8Ak86wcf7b.exe	129
PID 5104 wrote to memory of 4612	5104	3y17bRb9681eL7Z8Ak86wcf7b.exe	129
PID 5104 wrote to memory of 4612	5104	3y17bRb9681eL7Z8Ak86wcf7b.exe	129
PID 3924 wrote to memory of 5468	3924	powershell.exe	131
PID 3924 wrote to memory of 5468	3924	powershell.exe	131

System policy modification 1 TTPs 3 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	3y17bRb9681eL7Z8Ak86wcf7b.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	EdgeBrowser.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	3y17bRb9681eL7Z8Ak86wcf7b.exe

C:\Users\Admin\AppData\Local\Temp\87f601a021e88fff2a4f20b0e6336415.exe
"C:\Users\Admin\AppData\Local\Temp\87f601a021e88fff2a4f20b0e6336415.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3924
- C:\Users\Admin\AppData\Local\Temp\81ad38d3-361b-485a-855a-84a933123673\AdvancedRun.exe
  "C:\Users\Admin\AppData\Local\Temp\81ad38d3-361b-485a-855a-84a933123673\AdvancedRun.exe" /EXEFilename "C:\Users\Admin\AppData\Local\Temp\81ad38d3-361b-485a-855a-84a933123673\test.bat" /WindowState ""0"" /PriorityClass ""32"" /CommandLine "" /StartDirectory "" /RunAs 8 /Run
  2⤵
  PID:1792
- - C:\Users\Admin\AppData\Local\Temp\81ad38d3-361b-485a-855a-84a933123673\AdvancedRun.exe
    "C:\Users\Admin\AppData\Local\Temp\81ad38d3-361b-485a-855a-84a933123673\AdvancedRun.exe" /SpecialRun 4101d8 1792
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:516
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\87f601a021e88fff2a4f20b0e6336415.exe" -Force
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3884
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\87f601a021e88fff2a4f20b0e6336415.exe" -Force
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3916
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\3y17bRb9681eL7Z8Ak86wcf7b.exe" -Force
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2744
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\3y17bRb9681eL7Z8Ak86wcf7b.exe" -Force
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5056
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\87f601a021e88fff2a4f20b0e6336415.exe" -Force
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4188
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\3y17bRb9681eL7Z8Ak86wcf7b.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\3y17bRb9681eL7Z8Ak86wcf7b.exe"
  2⤵
  - UAC bypass
  - Checks computer location settings
  - Executes dropped EXE
  - Adds Run key to start application
  - Checks whether UAC is enabled
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:5104
- - C:\Users\Admin\AppData\Local\Temp\f8befcc2-5e80-4a3f-ae0a-a5bcb8794b48\AdvancedRun.exe
    "C:\Users\Admin\AppData\Local\Temp\f8befcc2-5e80-4a3f-ae0a-a5bcb8794b48\AdvancedRun.exe" /EXEFilename "C:\Users\Admin\AppData\Local\Temp\f8befcc2-5e80-4a3f-ae0a-a5bcb8794b48\test.bat" /WindowState ""0"" /PriorityClass ""32"" /CommandLine "" /StartDirectory "" /RunAs 8 /Run
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:3056
  - - C:\Users\Admin\AppData\Local\Temp\f8befcc2-5e80-4a3f-ae0a-a5bcb8794b48\AdvancedRun.exe
      "C:\Users\Admin\AppData\Local\Temp\f8befcc2-5e80-4a3f-ae0a-a5bcb8794b48\AdvancedRun.exe" /SpecialRun 4101d8 3056
      4⤵
      PID:4904
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\f8befcc2-5e80-4a3f-ae0a-a5bcb8794b48\test.bat"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:1752
      - C:\Windows\system32\sc.exe
        
        sc stop windefend
        6⤵
        Launches sc.exe
        
        PID:936
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\3y17bRb9681eL7Z8Ak86wcf7b.exe" -Force
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1236
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\3y17bRb9681eL7Z8Ak86wcf7b.exe" -Force
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4432
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4904
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Windows\Resources\Themes\2bc88ei9J91bLK7Vsa5cad7dbgCa\svchost.exe" -Force
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1792
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\3y17bRb9681eL7Z8Ak86wcf7b.exe" -Force
    3⤵
    PID:2872
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Windows\Resources\Themes\2bc88ei9J91bLK7Vsa5cad7dbgCa\svchost.exe" -Force
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4612
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c timeout 1
    3⤵
    PID:6064
  - - C:\Windows\SysWOW64\timeout.exe
      timeout 1
      4⤵
      Delays execution with timeout.exe
      PID:6112
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\3y17bRb9681eL7Z8Ak86wcf7b.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\3y17bRb9681eL7Z8Ak86wcf7b.exe"
    3⤵
    - Executes dropped EXE
    PID:5324
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /create /tn NYAN /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\3y17bRb9681eL7Z8Ak86wcf7b.exe" /sc minute /mo 1
      4⤵
      Creates scheduled task(s)
      PID:5676
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /Delete /tn NYAN /F
      4⤵
      PID:5376
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5104 -s 900
    3⤵
    - Program crash
    PID:5360
  - - C:\Windows\SysWOW64\timeout.exe
      timeout 1
      4⤵
      Delays execution with timeout.exe
      PID:5832
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Windows\Resources\Themes\2bc88ei9J91bLK7Vsa5cad7dbgCa\svchost.exe" -Force
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2360
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\87f601a021e88fff2a4f20b0e6336415.exe" -Force
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1200
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Windows\Resources\Themes\2bc88ei9J91bLK7Vsa5cad7dbgCa\svchost.exe" -Force
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3744
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c timeout 1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2128
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    - Delays execution with timeout.exe
    PID:4724
- C:\Users\Admin\AppData\Local\Temp\87f601a021e88fff2a4f20b0e6336415.exe
  "C:\Users\Admin\AppData\Local\Temp\87f601a021e88fff2a4f20b0e6336415.exe"
  2⤵
  - Checks computer location settings
  - Drops file in Windows directory
  PID:5468
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /Delete /tn NYAN /F
    3⤵
    PID:5536
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn NYAN /tr "C:\Users\Admin\AppData\Local\Temp\87f601a021e88fff2a4f20b0e6336415.exe" /sc minute /mo 1
    3⤵
    - Creates scheduled task(s)
    PID:5596
- - C:\Windows\EdgeBrowser.exe
    "C:\Windows\EdgeBrowser.exe"
    3⤵
    - UAC bypass
    - Windows security bypass
    - Checks computer location settings
    - Executes dropped EXE
    - Windows security modification
    - Adds Run key to start application
    - Checks whether UAC is enabled
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Suspicious use of SetThreadContext
    - Suspicious use of AdjustPrivilegeToken
    - System policy modification
    PID:5732
  - - C:\Users\Admin\AppData\Local\Temp\9c776feb-62d2-40f9-84a3-191aee6e91b2\AdvancedRun.exe
      "C:\Users\Admin\AppData\Local\Temp\9c776feb-62d2-40f9-84a3-191aee6e91b2\AdvancedRun.exe" /EXEFilename "C:\Users\Admin\AppData\Local\Temp\9c776feb-62d2-40f9-84a3-191aee6e91b2\test.bat" /WindowState ""0"" /PriorityClass ""32"" /CommandLine "" /StartDirectory "" /RunAs 8 /Run
      4⤵
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      PID:5976
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\9c776feb-62d2-40f9-84a3-191aee6e91b2\test.bat"
        5⤵
        
        PID:5984
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Windows\EdgeBrowser.exe" -Force
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:2052
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Windows\EdgeBrowser.exe" -Force
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:892
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Windows\EdgeBrowser.exe" -Force
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:3836
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Windows\Resources\Themes\2bc88ei9J91bLK7Vsa5cad7dbgCa\svchost.exe" -Force
      4⤵
      PID:3520
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Windows\Resources\Themes\2bc88ei9J91bLK7Vsa5cad7dbgCa\svchost.exe" -Force
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:3304
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c timeout 1
      4⤵
      PID:5360
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 5732 -s 1976
      4⤵
      Program crash
      PID:2448
  - - C:\Windows\EdgeBrowser.exe
      "C:\Windows\EdgeBrowser.exe"
      4⤵
      Executes dropped EXE
      Drops file in Windows directory
      Suspicious use of AdjustPrivilegeToken
      PID:4088
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3924 -s 1952
  2⤵
  - Program crash
  PID:5724

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3924 -ip 3924
1⤵
PID:5668

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 5104 -ip 5104
1⤵
PID:5312

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\3y17bRb9681eL7Z8Ak86wcf7b.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\3y17bRb9681eL7Z8Ak86wcf7b.exe"
1⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- System policy modification
PID:5880
- C:\Users\Admin\AppData\Local\Temp\cabb6558-d3c8-4645-a8bb-05a70c8c232b\AdvancedRun.exe
  "C:\Users\Admin\AppData\Local\Temp\cabb6558-d3c8-4645-a8bb-05a70c8c232b\AdvancedRun.exe" /EXEFilename "C:\Users\Admin\AppData\Local\Temp\cabb6558-d3c8-4645-a8bb-05a70c8c232b\test.bat" /WindowState ""0"" /PriorityClass ""32"" /CommandLine "" /StartDirectory "" /RunAs 8 /Run
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:4180
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\cabb6558-d3c8-4645-a8bb-05a70c8c232b\test.bat"
    3⤵
    PID:1276
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Windows\Resources\Themes\2bc88ei9J91bLK7Vsa5cad7dbgCa\svchost.exe" -Force
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:5804
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:4728
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\3y17bRb9681eL7Z8Ak86wcf7b.exe" -Force
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:468
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Windows\Resources\Themes\2bc88ei9J91bLK7Vsa5cad7dbgCa\svchost.exe" -Force
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:5488
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\3y17bRb9681eL7Z8Ak86wcf7b.exe" -Force
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1380
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\3y17bRb9681eL7Z8Ak86wcf7b.exe" -Force
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1088
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c timeout 1
  2⤵
  PID:4080
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5880 -s 1820
  2⤵
  - Program crash
  PID:5888
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\3y17bRb9681eL7Z8Ak86wcf7b.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\3y17bRb9681eL7Z8Ak86wcf7b.exe"
  2⤵
  - Executes dropped EXE
  PID:4676

C:\Windows\system32\sc.exe
sc stop usosvc
1⤵
- Launches sc.exe
PID:6048

C:\Windows\system32\sc.exe
sc config SDRSVC start= disabled
1⤵
- Launches sc.exe
PID:6100

C:\Windows\system32\sc.exe
sc stop InstallService
1⤵
- Launches sc.exe
PID:3716

C:\Windows\system32\sc.exe
sc stop usosvc
1⤵
- Launches sc.exe
PID:2696

C:\Windows\system32\sc.exe
sc config InstallService Start= disabled
1⤵
- Launches sc.exe
PID:1536

C:\Windows\system32\sc.exe
sc stop InstallService
1⤵
- Launches sc.exe
PID:5208

C:\Windows\system32\sc.exe
sc config WdiSystemHost start= disabled
1⤵
- Launches sc.exe
PID:4680

C:\Windows\system32\sc.exe
sc stop WdiSystemHost
1⤵
PID:3048

C:\Windows\system32\sc.exe
sc config WdiServiceHost start= disabled
1⤵
- Launches sc.exe
PID:2692

C:\Windows\system32\sc.exe
sc stop WdiServiceHost
1⤵
- Launches sc.exe
PID:3636

C:\Windows\system32\sc.exe
sc config wscsvc start= disabled
1⤵
- Launches sc.exe
PID:4272

C:\Windows\system32\sc.exe
sc stop wscsvc
1⤵
PID:4644

C:\Windows\system32\sc.exe
sc config SDRSVC start= disabled
1⤵
PID:1004

C:\Windows\system32\sc.exe
sc stop SDRSVC
1⤵
- Launches sc.exe
PID:2448

C:\Windows\system32\sc.exe
sc config SecurityHealthService start= disabled
1⤵
- Launches sc.exe
PID:3992

C:\Windows\system32\sc.exe
sc stop SecurityHealthService
1⤵
PID:1688

C:\Windows\system32\sc.exe
sc config WaasMedicSvc start= disabled
1⤵
PID:2568

C:\Windows\system32\sc.exe
sc stop WaasMedicSvc
1⤵
- Launches sc.exe
PID:4708

C:\Windows\system32\sc.exe
sc config usosvc start= disabled
1⤵
- Launches sc.exe
PID:1220

C:\Windows\system32\sc.exe
sc config wuauserv start= disabled
1⤵
- Launches sc.exe
PID:2228

C:\Windows\system32\sc.exe
sc stop wuauserv
1⤵
- Launches sc.exe
PID:560

C:\Windows\system32\sc.exe
sc config Sense start= disabled
1⤵
- Launches sc.exe
PID:3912

C:\Windows\system32\sc.exe
sc stop Sense
1⤵
- Launches sc.exe
PID:5136

C:\Windows\system32\sc.exe
sc config windefend start= disabled
1⤵
- Launches sc.exe
PID:3976

C:\Windows\system32\sc.exe
sc stop windefend
1⤵
- Launches sc.exe
PID:2296

C:\Windows\system32\sc.exe
sc config InstallService Start= disabled
1⤵
- Launches sc.exe
PID:1124

C:\Windows\system32\sc.exe
sc config WdiSystemHost start= disabled
1⤵
PID:2924

C:\Windows\system32\sc.exe
sc stop WdiSystemHost
1⤵
PID:5116

C:\Windows\system32\sc.exe
sc config WdiServiceHost start= disabled
1⤵
- Launches sc.exe
PID:2476

C:\Windows\system32\sc.exe
sc stop WdiServiceHost
1⤵
- Launches sc.exe
PID:3852

C:\Windows\system32\sc.exe
sc config wscsvc start= disabled
1⤵
- Launches sc.exe
PID:2820

C:\Windows\system32\sc.exe
sc stop wscsvc
1⤵
PID:4260

C:\Windows\system32\sc.exe
sc stop SDRSVC
1⤵
- Launches sc.exe
PID:6140

C:\Windows\system32\sc.exe
sc config SecurityHealthService start= disabled
1⤵
- Launches sc.exe
PID:3904

C:\Windows\system32\sc.exe
sc stop SecurityHealthService
1⤵
PID:5400

C:\Windows\system32\sc.exe
sc config WaasMedicSvc start= disabled
1⤵
- Launches sc.exe
PID:1532

C:\Windows\system32\sc.exe
sc stop WaasMedicSvc
1⤵
- Launches sc.exe
PID:2828

C:\Windows\system32\sc.exe
sc config usosvc start= disabled
1⤵
- Launches sc.exe
PID:5388

C:\Windows\system32\sc.exe
sc config wuauserv start= disabled
1⤵
- Launches sc.exe
PID:4376

C:\Windows\system32\sc.exe
sc stop wuauserv
1⤵
PID:4728

C:\Windows\system32\sc.exe
sc config Sense start= disabled
1⤵
- Launches sc.exe
PID:4740

C:\Windows\system32\sc.exe
sc stop Sense
1⤵
- Launches sc.exe
PID:5724

C:\Windows\system32\sc.exe
sc config windefend start= disabled
1⤵
- Launches sc.exe
PID:6044

C:\Windows\system32\sc.exe
sc stop windefend
1⤵
PID:5680

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 5732 -ip 5732
1⤵
PID:4708

C:\Windows\SysWOW64\schtasks.exe
schtasks /Delete /tn NYAN /F
1⤵
PID:3992

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
1⤵
PID:2692

C:\Windows\SysWOW64\schtasks.exe
schtasks /create /tn NYAN /tr "C:\Windows\EdgeBrowser.exe" /sc minute /mo 1
1⤵
- Creates scheduled task(s)
PID:4264

C:\Windows\SysWOW64\timeout.exe
timeout 1
1⤵
- Delays execution with timeout.exe
PID:6116

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 5880 -ip 5880
1⤵
PID:5240

C:\Windows\SysWOW64\schtasks.exe
schtasks /Delete /tn NYAN /F
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2872

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
1⤵
PID:5376

C:\Windows\SysWOW64\schtasks.exe
schtasks /create /tn NYAN /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\3y17bRb9681eL7Z8Ak86wcf7b.exe" /sc minute /mo 1
1⤵
- Creates scheduled task(s)
PID:5644

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\3y17bRb9681eL7Z8Ak86wcf7b.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\3y17bRb9681eL7Z8Ak86wcf7b.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
PID:844
- C:\Users\Admin\AppData\Local\Temp\74c478b5-6ab0-4e2c-81f3-a1b8dab66aa7\AdvancedRun.exe
  "C:\Users\Admin\AppData\Local\Temp\74c478b5-6ab0-4e2c-81f3-a1b8dab66aa7\AdvancedRun.exe" /EXEFilename "C:\Users\Admin\AppData\Local\Temp\74c478b5-6ab0-4e2c-81f3-a1b8dab66aa7\test.bat" /WindowState ""0"" /PriorityClass ""32"" /CommandLine "" /StartDirectory "" /RunAs 8 /Run
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:5792
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\3y17bRb9681eL7Z8Ak86wcf7b.exe" -Force
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:5636
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\3y17bRb9681eL7Z8Ak86wcf7b.exe" -Force
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2580
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Windows\Resources\Themes\2bc88ei9J91bLK7Vsa5cad7dbgCa\svchost.exe" -Force
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2828
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\3y17bRb9681eL7Z8Ak86wcf7b.exe" -Force
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:3492
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Windows\Resources\Themes\2bc88ei9J91bLK7Vsa5cad7dbgCa\svchost.exe" -Force
  2⤵
  - Modifies Windows Defender Real-time Protection settings
  - UAC bypass
  - Windows security bypass
  - Drops startup file
  - Adds Run key to start application
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious use of SetThreadContext
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3924
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:2296
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c timeout 1
  2⤵
  PID:684
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    - Delays execution with timeout.exe
    PID:5968
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\3y17bRb9681eL7Z8Ak86wcf7b.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\3y17bRb9681eL7Z8Ak86wcf7b.exe"
  2⤵
  PID:5856
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /Delete /tn NYAN /F
    3⤵
    PID:1276
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn NYAN /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\3y17bRb9681eL7Z8Ak86wcf7b.exe" /sc minute /mo 1
    3⤵
    - Creates scheduled task(s)
    PID:3724
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 844 -s 1744
  2⤵
  - Program crash
  PID:4832

C:\Windows\system32\sc.exe
sc config Sense start= disabled
1⤵
- Launches sc.exe
PID:4732

C:\Windows\system32\sc.exe
sc config WdiSystemHost start= disabled
1⤵
- Launches sc.exe
PID:5180

C:\Windows\system32\sc.exe
sc config InstallService Start= disabled
1⤵
- Launches sc.exe
PID:880

C:\Windows\system32\sc.exe
sc stop InstallService
1⤵
PID:5464

C:\Windows\system32\sc.exe
sc stop WdiSystemHost
1⤵
- Launches sc.exe
PID:5264

C:\Windows\system32\sc.exe
sc config WdiServiceHost start= disabled
1⤵
- Launches sc.exe
PID:3488

C:\Windows\system32\sc.exe
sc stop WdiServiceHost
1⤵
PID:2504

C:\Windows\system32\sc.exe
sc config wscsvc start= disabled
1⤵
- Launches sc.exe
PID:6072

C:\Windows\system32\sc.exe
sc stop wscsvc
1⤵
- Launches sc.exe
PID:5236

C:\Windows\system32\sc.exe
sc config SDRSVC start= disabled
1⤵
- Launches sc.exe
PID:2252

C:\Windows\system32\sc.exe
sc stop SDRSVC
1⤵
- Launches sc.exe
PID:5852

C:\Windows\system32\sc.exe
sc config SecurityHealthService start= disabled
1⤵
- Launches sc.exe
PID:2848

C:\Windows\system32\sc.exe
sc stop SecurityHealthService
1⤵
- Launches sc.exe
PID:1584

C:\Windows\system32\sc.exe
sc config WaasMedicSvc start= disabled
1⤵
- Launches sc.exe
PID:1148

C:\Windows\system32\sc.exe
sc stop WaasMedicSvc
1⤵
- Launches sc.exe
PID:2700

C:\Windows\system32\sc.exe
sc config usosvc start= disabled
1⤵
PID:1372

C:\Windows\system32\sc.exe
sc stop usosvc
1⤵
- Launches sc.exe
PID:4984

C:\Windows\system32\sc.exe
sc config wuauserv start= disabled
1⤵
- Launches sc.exe
PID:4620

C:\Windows\system32\sc.exe
sc stop wuauserv
1⤵
- Launches sc.exe
PID:5220

C:\Windows\system32\sc.exe
sc stop Sense
1⤵
- Launches sc.exe
PID:1228

C:\Windows\system32\sc.exe
sc config windefend start= disabled
1⤵
PID:4424

C:\Windows\system32\sc.exe
sc stop windefend
1⤵
- Launches sc.exe
PID:6064

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\74c478b5-6ab0-4e2c-81f3-a1b8dab66aa7\test.bat"
1⤵
PID:2148

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 844 -ip 844
1⤵
PID:3352

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\3y17bRb9681eL7Z8Ak86wcf7b.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\3y17bRb9681eL7Z8Ak86wcf7b.exe"
1⤵
PID:5376
- C:\Users\Admin\AppData\Local\Temp\a5fa893c-4c16-4c93-b7d3-0f2933a4fccd\AdvancedRun.exe
  "C:\Users\Admin\AppData\Local\Temp\a5fa893c-4c16-4c93-b7d3-0f2933a4fccd\AdvancedRun.exe" /EXEFilename "C:\Users\Admin\AppData\Local\Temp\a5fa893c-4c16-4c93-b7d3-0f2933a4fccd\test.bat" /WindowState ""0"" /PriorityClass ""32"" /CommandLine "" /StartDirectory "" /RunAs 8 /Run
  2⤵
  PID:5216
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\a5fa893c-4c16-4c93-b7d3-0f2933a4fccd\test.bat"
    3⤵
    PID:5460
  - - C:\Windows\system32\sc.exe
      sc stop windefend
      4⤵
      PID:1040
  - - C:\Windows\system32\sc.exe
      sc config windefend start= disabled
      4⤵
      Launches sc.exe
      PID:548
  - - C:\Windows\system32\sc.exe
      sc stop Sense
      4⤵
      Launches sc.exe
      PID:536
  - - C:\Windows\system32\sc.exe
      sc config Sense start= disabled
      4⤵
      PID:4504
  - - C:\Windows\system32\sc.exe
      sc stop wuauserv
      4⤵
      Launches sc.exe
      PID:4684
  - - C:\Windows\system32\sc.exe
      sc config wuauserv start= disabled
      4⤵
      PID:5784
  - - C:\Windows\system32\sc.exe
      sc stop usosvc
      4⤵
      PID:1492
  - - C:\Windows\system32\sc.exe
      sc config usosvc start= disabled
      4⤵
      Launches sc.exe
      PID:3752
  - - C:\Windows\system32\sc.exe
      sc stop WaasMedicSvc
      4⤵
      Launches sc.exe
      PID:1808
  - - C:\Windows\system32\sc.exe
      sc config WaasMedicSvc start= disabled
      4⤵
      PID:3844
  - - C:\Windows\system32\sc.exe
      sc stop SecurityHealthService
      4⤵
      Launches sc.exe
      PID:4652
  - - C:\Windows\system32\sc.exe
      sc config SecurityHealthService start= disabled
      4⤵
      Launches sc.exe
      PID:772
  - - C:\Windows\system32\sc.exe
      sc stop SDRSVC
      4⤵
      PID:1880
  - - C:\Windows\system32\sc.exe
      sc config SDRSVC start= disabled
      4⤵
      Launches sc.exe
      PID:2724
  - - C:\Windows\system32\sc.exe
      sc stop wscsvc
      4⤵
      Launches sc.exe
      PID:1028
  - - C:\Windows\system32\sc.exe
      sc config wscsvc start= disabled
      4⤵
      PID:5564
  - - C:\Windows\system32\sc.exe
      sc stop WdiServiceHost
      4⤵
      PID:5152
  - - C:\Windows\system32\sc.exe
      sc config WdiServiceHost start= disabled
      4⤵
      PID:5568
  - - C:\Windows\system32\sc.exe
      sc stop WdiSystemHost
      4⤵
      Launches sc.exe
      PID:688
  - - C:\Windows\system32\sc.exe
      sc config WdiSystemHost start= disabled
      4⤵
      Launches sc.exe
      PID:2248
  - - C:\Windows\system32\sc.exe
      sc stop InstallService
      4⤵
      PID:4360
  - - C:\Windows\system32\sc.exe
      sc config InstallService Start= disabled
      4⤵
      Launches sc.exe
      PID:5272
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\3y17bRb9681eL7Z8Ak86wcf7b.exe" -Force
  2⤵
  PID:2940
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\3y17bRb9681eL7Z8Ak86wcf7b.exe" -Force
  2⤵
  PID:2700
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Windows\Resources\Themes\2bc88ei9J91bLK7Vsa5cad7dbgCa\svchost.exe" -Force
  2⤵
  PID:5852
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\3y17bRb9681eL7Z8Ak86wcf7b.exe" -Force
  2⤵
  PID:3508
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Windows\Resources\Themes\2bc88ei9J91bLK7Vsa5cad7dbgCa\svchost.exe" -Force
  2⤵
  PID:6084
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c timeout 1
  2⤵
  PID:2136

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

3y17bRb9681eL7Z8Ak86wcf7b.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\3y17bRb9681eL7Z8Ak86wcf7b.exe.log
Size 706B
SHA256 418398bab7542ba692fe00d88d6de06c65f73b9376567c5190a007f7a211c91f
MD5 7119a280abc0c4b5f21a0932887a54ac
SHA1 aa369248ea6d293fe56a5ed669e29cd897911f84
SHA512 b11111d017e86445be9c41d2ca4a6e147cf2d8ae31663bb0772e2eaaf3a7a906285ab78a708d9122a29f8aa2519e80b12e050ad4538867e2b5d3edb0fe21039f
MD5 SHA1 SHA512

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
Size 2KB
SHA256 6f8fd1b8d9788ad54eaeee329232187e24b7b43393a01aeba2d6e9675231fb69
MD5 3d086a433708053f9bf9523e1d87a4e8
SHA1 b3ab5d4f282a4c8fe8c3005b8a557ed5a0e37f28
SHA512 931ae42b4c68a4507ff2342332b08eb407050d47cf4176137ea022d0f6e513c689e998445a04c6d18d4877391705c586bfce0234632b898d41aaed0957996dfd
MD5 SHA1 SHA512

Submit Download