c1105c7581c23cf3142e5fc81c06ede2d58f477f7562bf86d1300f17e68a1458

Analysis

user interaction
yes
max time kernel
26s
max time network
151s
platform
windows11-21h2_x64
resource
win11-20260911-en
resource tags

arch:x64arch:x86image:win11-20260911-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
17/10/2026, 13:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
decomBuild_Slayed.exe
Size 1.7MB
Sample261017-qjdl3atzay
SHA256 c1105c7581c23cf3142e5fc81c06ede2d58f477f7562bf86d1300f17e68a1458
MD5 5675afb5a96f73ba44143bf0d7eb1f48
SHA1 d2a5c460cefe31fb069298ef30b3b608a9751b4f
SHA512 457cc310044159e30d186a53176acf9cd155d8ac8265a5ac019f30114a278e3da34b4a1ca5a08f925390c5d2c05bb03f9522fb09e0e5be93b773dc9bbbd12fa8
SSDEEP 24576:Xktz2I9NXzgGjTybBltfLJ9ZLJ4GCBr8nvRj6U0IgDBcj+oKac5:XktzbXsb1JnjAcv9gDBw+oKa
TLSH
T1A9858D8233C28D62D57F67339B22924029E8EF115B93C71ED86F47B73E53BA4A4651C2
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery execution persistence privilege_escalation

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 64 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
6096	powershell.exe
3644	powershell.exe
3580	powershell.exe
5756	powershell.exe
4688	powershell.exe
1252	powershell.exe
2088	powershell.exe
2728	powershell.exe
2416	powershell.exe
4216	powershell.exe
8	powershell.exe
5328	powershell.exe
4400	powershell.exe
2256	powershell.exe
5532	powershell.exe
1452	powershell.exe
2056	powershell.exe
1260	powershell.exe
4732	powershell.exe
5812	powershell.exe
568	powershell.exe
6068	powershell.exe
5560	powershell.exe
1588	powershell.exe
4964	powershell.exe
3880	powershell.exe
2264	powershell.exe
5160	powershell.exe
1532	powershell.exe
5456	powershell.exe
3696	powershell.exe
5436	powershell.exe
1832	powershell.exe
5340	powershell.exe
3720	powershell.exe
1596	powershell.exe
1324	powershell.exe
2256	powershell.exe
4420	powershell.exe
4272	powershell.exe
2516	powershell.exe
2068	powershell.exe
1528	powershell.exe
4612	powershell.exe
3488	powershell.exe
1504	powershell.exe
1328	powershell.exe
2508	powershell.exe
3288	powershell.exe
6000	powershell.exe
5572	powershell.exe
1100	powershell.exe
6088	powershell.exe
5660	powershell.exe
4816	powershell.exe
752	powershell.exe
540	powershell.exe
3932	powershell.exe
3496	powershell.exe
4664	powershell.exe
2388	powershell.exe
5808	powershell.exe
4520	powershell.exe
5912	powershell.exe

.NET Reactor proctector 2 IoCs

Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.

resource	yara_rule
behavioral2/files/0x001800000002b78e-39.dat	net_reactor
behavioral2/files/0x003b00000000067d-1619.dat	net_reactor

Creates a file in the Startup directory 1 TTPs 2 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\msedgewebview3.exe.lnk	decomBuild_Slayed.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\msedgewebview3.exe.lnk	msedgewebview3.exe

Executes dropped EXE 2 IoCs

pid	Process
5484	msedgewebview3.exe
2408	msedgewebview3.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2293636880-3790684622-1477845016-1000\Software\Microsoft\Windows\CurrentVersion\Run\msedgewebview3.exe = "\"C:\\Users\\Admin\\AppData\\Local\\EdgeWebView\\msedgewebview3.exe\""	msedgewebview3.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2293636880-3790684622-1477845016-1000\Software\Microsoft\Windows\CurrentVersion\Run\msedgewebview3.exe = "\"C:\\Users\\Admin\\AppData\\Local\\EdgeWebView\\msedgewebview3.exe\""	decomBuild_Slayed.exe

Contacts third-party web service commonly abused for C2 1 TTPs 5 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
1	discord.com
19	discord.com
36	discord.com
47	discord.com
56	discord.com

Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
defense_evasion

File Deletion
T1070.004

Looks up external IP address via web service 1 TTPs 32 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
11	api.ipify.org
1	api.ipify.org
3	ip-api.com
4	ip-api.com
8	ip-api.com
29	api.ipify.org
30	ip-api.com
40	api.ipify.org
44	ipinfo.io
49	api.ipify.org
2	api.ipify.org
5	api.ipify.org
6	ip-api.com
22	ip-api.com
51	ip-api.com
52	ip-api.com
7	ip-api.com
9	ipinfo.io
15	ip-api.com
31	ip-api.com
32	ip-api.com
33	ipinfo.io
50	ip-api.com
53	ipinfo.io
14	ip-api.com
41	ip-api.com
1	ip-api.com
13	ip-api.com
16	ipinfo.io
43	ip-api.com
1	ipinfo.io
42	ip-api.com

Hide Artifacts: Ignore Process Interrupts 1 TTPs 3 IoCs

Command interpreters often include specific commands/flags that ignore errors and other hangups.

defense_evasion

Ignore Process Interrupts

T1564.011

pid	Process
2924	powershell.exe
4916	powershell.exe
4664	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4576	cmd.exe
3284	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 6 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	msedgewebview3.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	msedgewebview3.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	msedgewebview3.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	decomBuild_Slayed.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	decomBuild_Slayed.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	msedgewebview3.exe

Delays execution with timeout.exe 2 IoCs

defense_evasion

pid	Process
4572	timeout.exe
4516	timeout.exe

Modifies registry key 1 TTPs 1 IoCs

Modify Registry

T1112

pid	Process
4024	reg.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 5 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5876	schtasks.exe
3928	schtasks.exe
3904	schtasks.exe
3948	schtasks.exe
2276	schtasks.exe

Suspicious behavior: AddClipboardFormatListener 2 IoCs

pid	Process
2408	msedgewebview3.exe
2408	msedgewebview3.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4164	decomBuild_Slayed.exe
5756	powershell.exe
5756	powershell.exe
4520	powershell.exe
4520	powershell.exe
5484	msedgewebview3.exe
6096	powershell.exe
6096	powershell.exe
5484	msedgewebview3.exe
5484	msedgewebview3.exe
5484	msedgewebview3.exe
5484	msedgewebview3.exe
5160	powershell.exe
5160	powershell.exe
2828	powershell.exe
2828	powershell.exe
5484	msedgewebview3.exe
5484	msedgewebview3.exe
5484	msedgewebview3.exe
5484	msedgewebview3.exe
2952	powershell.exe
2408	msedgewebview3.exe
2952	powershell.exe
3644	powershell.exe
3644	powershell.exe
2408	msedgewebview3.exe
2408	msedgewebview3.exe
2408	msedgewebview3.exe
2408	msedgewebview3.exe
3244	powershell.exe
3244	powershell.exe
4612	powershell.exe
4612	powershell.exe
6068	powershell.exe
6068	powershell.exe
2408	msedgewebview3.exe
2408	msedgewebview3.exe
2408	msedgewebview3.exe
2408	msedgewebview3.exe
2584	powershell.exe
2584	powershell.exe
3448	powershell.exe
3448	powershell.exe
2408	msedgewebview3.exe
2408	msedgewebview3.exe
2408	msedgewebview3.exe
2408	msedgewebview3.exe
1532	powershell.exe
1532	powershell.exe
2408	msedgewebview3.exe
2408	msedgewebview3.exe
2408	msedgewebview3.exe
2408	msedgewebview3.exe
4400	powershell.exe
4400	powershell.exe
752	powershell.exe
752	powershell.exe
3488	powershell.exe
3488	powershell.exe
2388	powershell.exe
2388	powershell.exe
5912	powershell.exe
5912	powershell.exe
4948	powershell.exe

Suspicious use of AdjustPrivilegeToken 29 IoCs

description	pid	Process
Token: SeDebugPrivilege	4164	decomBuild_Slayed.exe
Token: SeDebugPrivilege	5756	powershell.exe
Token: SeDebugPrivilege	4520	powershell.exe
Token: SeDebugPrivilege	5484	msedgewebview3.exe
Token: SeDebugPrivilege	6096	powershell.exe
Token: SeDebugPrivilege	5160	powershell.exe
Token: SeDebugPrivilege	2828	powershell.exe
Token: SeDebugPrivilege	2952	powershell.exe
Token: SeDebugPrivilege	2408	msedgewebview3.exe
Token: SeDebugPrivilege	3644	powershell.exe
Token: SeDebugPrivilege	3244	powershell.exe
Token: SeDebugPrivilege	4612	powershell.exe
Token: SeDebugPrivilege	6068	powershell.exe
Token: SeDebugPrivilege	2584	powershell.exe
Token: SeDebugPrivilege	3448	powershell.exe
Token: SeDebugPrivilege	1532	powershell.exe
Token: SeDebugPrivilege	4400	powershell.exe
Token: SeDebugPrivilege	752	powershell.exe
Token: SeDebugPrivilege	3488	powershell.exe
Token: SeDebugPrivilege	2388	powershell.exe
Token: SeDebugPrivilege	5912	powershell.exe
Token: SeDebugPrivilege	4948	powershell.exe
Token: SeDebugPrivilege	4964	powershell.exe
Token: SeDebugPrivilege	5572	powershell.exe
Token: SeDebugPrivilege	2256	powershell.exe
Token: SeDebugPrivilege	3880	powershell.exe
Token: SeDebugPrivilege	2204	powershell.exe
Token: SeDebugPrivilege	5048	powershell.exe
Token: SeDebugPrivilege	5456	powershell.exe

Suspicious use of WriteProcessMemory 43 IoCs

description	pid	Process	procid_target
PID 4164 wrote to memory of 704	4164	decomBuild_Slayed.exe	82
PID 4164 wrote to memory of 4212	4164	decomBuild_Slayed.exe	85
PID 4164 wrote to memory of 5756	4164	decomBuild_Slayed.exe	87
PID 4164 wrote to memory of 900	4164	decomBuild_Slayed.exe	89
PID 4164 wrote to memory of 5876	4164	decomBuild_Slayed.exe	91
PID 4164 wrote to memory of 3880	4164	decomBuild_Slayed.exe	93
PID 4164 wrote to memory of 3928	4164	decomBuild_Slayed.exe	95
PID 4164 wrote to memory of 4380	4164	decomBuild_Slayed.exe	98
PID 4164 wrote to memory of 4520	4164	decomBuild_Slayed.exe	100
PID 5484 wrote to memory of 5668	5484	msedgewebview3.exe	103
PID 5484 wrote to memory of 2332	5484	msedgewebview3.exe	105
PID 5484 wrote to memory of 6096	5484	msedgewebview3.exe	107
PID 4164 wrote to memory of 5160	4164	decomBuild_Slayed.exe	109
PID 4164 wrote to memory of 3904	4164	decomBuild_Slayed.exe	111
PID 4164 wrote to memory of 2076	4164	decomBuild_Slayed.exe	113
PID 5484 wrote to memory of 2828	5484	msedgewebview3.exe	115
PID 4164 wrote to memory of 2952	4164	decomBuild_Slayed.exe	117
PID 4164 wrote to memory of 2408	4164	decomBuild_Slayed.exe	119
PID 2408 wrote to memory of 1524	2408	msedgewebview3.exe	120
PID 2408 wrote to memory of 3188	2408	msedgewebview3.exe	122
PID 2408 wrote to memory of 3644	2408	msedgewebview3.exe	124
PID 4164 wrote to memory of 3244	4164	decomBuild_Slayed.exe	126
PID 4164 wrote to memory of 4576	4164	decomBuild_Slayed.exe	128
PID 4576 wrote to memory of 4572	4576	cmd.exe	130
PID 2408 wrote to memory of 4612	2408	msedgewebview3.exe	131
PID 4164 wrote to memory of 6068	4164	decomBuild_Slayed.exe	214
PID 2408 wrote to memory of 2584	2408	msedgewebview3.exe	135
PID 4164 wrote to memory of 4300	4164	decomBuild_Slayed.exe	137
PID 2408 wrote to memory of 3448	2408	msedgewebview3.exe	139
PID 2408 wrote to memory of 1532	2408	msedgewebview3.exe	141
PID 2408 wrote to memory of 4400	2408	msedgewebview3.exe	143
PID 2408 wrote to memory of 752	2408	msedgewebview3.exe	145
PID 2408 wrote to memory of 3488	2408	msedgewebview3.exe	147
PID 2408 wrote to memory of 2388	2408	msedgewebview3.exe	149
PID 2408 wrote to memory of 5912	2408	msedgewebview3.exe	151
PID 2408 wrote to memory of 4948	2408	msedgewebview3.exe	153
PID 2408 wrote to memory of 4964	2408	msedgewebview3.exe	155
PID 2408 wrote to memory of 5572	2408	msedgewebview3.exe	333
PID 2408 wrote to memory of 2256	2408	msedgewebview3.exe	277
PID 2408 wrote to memory of 3880	2408	msedgewebview3.exe	331
PID 2408 wrote to memory of 2204	2408	msedgewebview3.exe	332
PID 2408 wrote to memory of 5048	2408	msedgewebview3.exe	165
PID 2408 wrote to memory of 5456	2408	msedgewebview3.exe	167

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\decomBuild_Slayed.exe
"C:\Users\Admin\AppData\Local\Temp\decomBuild_Slayed.exe"
1⤵
- Creates a file in the Startup directory
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4164
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks.exe" /query /fo CSV /nh
  2⤵
  PID:704
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks.exe" /delete /tn "msedgewebview3.exe_Fallback" /f
  2⤵
  PID:4212
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "(Get-MpPreference).ExclusionPath -contains 'C:\Users\Admin\AppData\Local\Temp\decomBuild_Slayed.exe'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5756
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks.exe" /query /fo CSV /nh
  2⤵
  PID:900
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks.exe" /create /tn "msedgewebview3" /tr "\"C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe\"" /sc minute /mo 1 /rl HIGHEST /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:5876
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks.exe" /query /fo CSV /nh
  2⤵
  PID:3880
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks.exe" /create /tn "msedgewebview3" /tr "\"C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe\"" /sc minute /mo 1 /rl HIGHEST /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:3928
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks.exe" /query /fo CSV /nh
  2⤵
  PID:4380
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\Temp\decomBuild_Slayed.exe\" -Force"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4520
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\Temp\decomBuild_Slayed.exe\" -Force"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5160
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks.exe" /create /tn "msedgewebview3" /tr "\"C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe\"" /sc minute /mo 1 /rl HIGHEST /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:3904
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks.exe" /query /fo CSV /nh
  2⤵
  PID:2076
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\Temp\decomBuild_Slayed.exe\" -Force"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2952
- C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe
  "C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe"
  2⤵
  - Creates a file in the Startup directory
  - Executes dropped EXE
  - Adds Run key to start application
  - Reads the TCP/IP host and domain name from the registry
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2408
- - C:\Windows\SYSTEM32\schtasks.exe
    "schtasks.exe" /query /fo CSV /nh
    3⤵
    PID:1524
- - C:\Windows\SYSTEM32\schtasks.exe
    "schtasks.exe" /delete /tn "msedgewebview3.exe_Fallback" /f
    3⤵
    PID:3188
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "(Get-MpPreference).ExclusionPath -contains 'C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe'"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3644
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe\" -Force"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4612
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe\" -Force"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2584
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe\" -Force"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3448
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe\" -Force"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1532
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe\" -Force"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4400
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe\" -Force"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:752
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe\" -Force"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3488
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe\" -Force"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2388
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe\" -Force"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5912
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe\" -Force"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4948
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe\" -Force"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious use of AdjustPrivilegeToken
    PID:4964
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe\" -Force"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:5572
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe\" -Force"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious use of AdjustPrivilegeToken
    PID:2256
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe\" -Force"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:3880
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe\" -Force"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2204
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe\" -Force"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:5048
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe\" -Force"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious use of AdjustPrivilegeToken
    PID:5456
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe\" -Force"
    3⤵
    PID:772
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe\" -Force"
    3⤵
    PID:1120
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe\" -Force"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:3720
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe\" -Force"
    3⤵
    PID:4988
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe\" -Force"
    3⤵
    PID:4312
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe\" -Force"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:4272
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe\" -Force"
    3⤵
    PID:5268
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe\" -Force"
    3⤵
    PID:2120
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe\" -Force"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:5532
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe\" -Force"
    3⤵
    PID:2548
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe\" -Force"
    3⤵
    PID:2084
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe\" -Force"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:2056
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe\" -Force"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:540
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe\" -Force"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:1596
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe\" -Force"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:2088
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe\" -Force"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:3696
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe\" -Force"
    3⤵
    PID:4548
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe\" -Force"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:1452
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe\" -Force"
    3⤵
    PID:5232
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe\" -Force"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:568
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe\" -Force"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:6068
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe\" -Force"
    3⤵
    PID:5976
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe\" -Force"
    3⤵
    PID:4160
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe\" -Force"
    3⤵
    PID:4336
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\Temp\decomBuild_Slayed.exe\" -Force"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3244
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Kc5r1SNg.bat""
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4576
- - C:\Windows\system32\timeout.exe
    timeout /t 2 /nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:4572
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\Temp\decomBuild_Slayed.exe\" -Force"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:6068
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /q "C:\Users\Admin\AppData\Local\Temp\decomBuild_Slayed.exe"
  2⤵
  PID:4300

C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe
"C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe"
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5484
- C:\Windows\system32\schtasks.exe
  "schtasks.exe" /query /fo CSV /nh
  2⤵
  PID:5668
- C:\Windows\system32\schtasks.exe
  "schtasks.exe" /delete /tn "msedgewebview3.exe_Fallback" /f
  2⤵
  PID:2332
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "(Get-MpPreference).ExclusionPath -contains 'C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:6096
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe\" -Force"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2828

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc
1⤵
PID:4304

C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe
C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe
1⤵
PID:2984
- C:\Windows\system32\schtasks.exe
  "schtasks.exe" /query /fo CSV /nh
  2⤵
  PID:3748
- C:\Windows\system32\schtasks.exe
  "schtasks.exe" /delete /tn "msedgewebview3.exe_Fallback" /f
  2⤵
  PID:2676
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "(Get-MpPreference).ExclusionPath -contains 'C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:3580
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe\" -Force"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:4688
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe\" -Force"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:2516
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe\" -Force"
  2⤵
  PID:4416
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe\" -Force"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:1328
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe\" -Force"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:2068
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe\" -Force"
  2⤵
  PID:1428
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe\" -Force"
  2⤵
  PID:3408
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe\" -Force"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:4816
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe\" -Force"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:4664
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe\" -Force"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:5436
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe\" -Force"
  2⤵
  PID:4000
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe\" -Force"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:3932
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe\" -Force"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:1260
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe\" -Force"
  2⤵
  PID:1804
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe\" -Force"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:1324
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe\" -Force"
  2⤵
  PID:5740
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe\" -Force"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:2508
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe\" -Force"
  2⤵
  PID:4492
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe\" -Force"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:1832
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe\" -Force"
  2⤵
  PID:5032
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe\" -Force"
  2⤵
  PID:6060
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe\" -Force"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:4732
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe\" -Force"
  2⤵
  PID:3876
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe\" -Force"
  2⤵
  PID:5420
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe\" -Force"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:2256
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe\" -Force"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:6000
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe\" -Force"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:3496
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe\" -Force"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:1100
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe\" -Force"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:6088
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe\" -Force"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:2728
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe\" -Force"
  2⤵
  PID:5936
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe\" -Force"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:4420
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe\" -Force"
  2⤵
  PID:4892
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe\" -Force"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:2416
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe\" -Force"
  2⤵
  PID:5424
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe\" -Force"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:5328
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe\" -Force"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:3288
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe\" -Force"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:5340
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe\" -Force"
  2⤵
  PID:5192
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe\" -Force"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:5560
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe\" -Force"
  2⤵
  PID:5440
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe\" -Force"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:5808
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe\" -Force"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:4216
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe\" -Force"
  2⤵
  PID:5020
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe\" -Force"
  2⤵
  PID:2796
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe\" -Force"
  2⤵
  PID:128
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe\" -Force"
  2⤵
  PID:2192
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe\" -Force"
  2⤵
  PID:5656
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe\" -Force"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:1588
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe\" -Force"
  2⤵
  PID:2988
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe\" -Force"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:1504
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe\" -Force"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:3880
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:2204
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe\" -Force"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:5572
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe\" -Force"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:2264
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe\" -Force"
  2⤵
  PID:5460
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe\" -Force"
  2⤵
  PID:1400
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe\" -Force"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:1252
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe\" -Force"
  2⤵
  PID:6096
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe\" -Force"
  2⤵
  PID:1136
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe\" -Force"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:5660
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe\" -Force"
  2⤵
  PID:4824
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe\" -Force"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:8
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe\" -Force"
  2⤵
  PID:3484
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe\" -Force"
  2⤵
  PID:3944
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe\" -Force"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:1528
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe\" -Force"
  2⤵
  PID:1724
- C:\Users\Admin\AppData\Local\Temp\Tf02PgVu.exe
  "C:\Users\Admin\AppData\Local\Temp\Tf02PgVu.exe"
  2⤵
  PID:3280
- - C:\Windows\system32\schtasks.exe
    "schtasks.exe" /query /tn "msedgewebview3" /fo CSV /nh
    3⤵
    PID:484
- - C:\Windows\system32\schtasks.exe
    "schtasks.exe" /delete /tn "msedgewebview3" /f
    3⤵
    PID:4480
- - C:\Windows\system32\schtasks.exe
    "schtasks.exe" /query /tn "msedgewebview3" /fo CSV /nh
    3⤵
    PID:3604
- - C:\Windows\system32\schtasks.exe
    "schtasks.exe" /delete /tn "msedgewebview3.exe_Fallback" /f
    3⤵
    PID:5836
- - C:\Windows\system32\schtasks.exe
    "schtasks.exe" /query /tn "msedgewebview3" /fo CSV /nh
    3⤵
    PID:1952
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "if (Get-Command Get-MpPreference -ErrorAction SilentlyContinue) { exit 0 } else { exit 1 }"
    3⤵
    - Hide Artifacts: Ignore Process Interrupts
    PID:2924
- - C:\Windows\system32\schtasks.exe
    "schtasks.exe" /query /tn "msedgewebview3" /fo CSV /nh
    3⤵
    PID:3124
- - C:\Windows\system32\schtasks.exe
    "schtasks.exe" /query /tn "msedgewebview3" /fo CSV /nh
    3⤵
    PID:1284
- - C:\Windows\system32\schtasks.exe
    "schtasks.exe" /create /tn "msedgewebview3" /tr "\"C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe\"" /sc minute /mo 1 /rl HIGHEST /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3948
- - C:\Windows\system32\schtasks.exe
    "schtasks.exe" /query /tn "msedgewebview3" /fo CSV /nh
    3⤵
    PID:884
- - C:\Windows\system32\schtasks.exe
    "schtasks.exe" /query /tn "msedgewebview3_logon" /fo CSV /nh
    3⤵
    PID:1348
- - C:\Windows\system32\schtasks.exe
    "schtasks.exe" /create /tn "msedgewebview3_logon" /tr "\"C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe\"" /sc onlogon /rl HIGHEST /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2276
- - C:\Windows\system32\schtasks.exe
    "schtasks.exe" /delete /tn "msedgewebview3.exe_Fallback" /f
    3⤵
    PID:5088
- - C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe
    "C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe"
    3⤵
    PID:3996
  - - C:\Windows\system32\schtasks.exe
      "schtasks.exe" /query /tn "msedgewebview3" /fo CSV /nh
      4⤵
      PID:5024
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "if (Get-Command Get-MpPreference -ErrorAction SilentlyContinue) { exit 0 } else { exit 1 }"
      4⤵
      Hide Artifacts: Ignore Process Interrupts
      PID:4916
  - - C:\Windows\system32\schtasks.exe
      "schtasks.exe" /query /tn "msedgewebview3" /fo CSV /nh
      4⤵
      PID:4380
  - - C:\Windows\system32\schtasks.exe
      "schtasks.exe" /query /tn "msedgewebview3_logon" /fo CSV /nh
      4⤵
      PID:5320
  - - C:\Users\Admin\AppData\Local\Temp\b8RrPI3B.exe
      "C:\Users\Admin\AppData\Local\Temp\b8RrPI3B.exe" --selfupdate
      4⤵
      PID:5672
    - - C:\Windows\system32\schtasks.exe
        
        "schtasks.exe" /query /tn "msedgewebview3" /fo CSV /nh
        5⤵
        
        PID:5776
    - - C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe
        
        "C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe"
        5⤵
        
        PID:5616
      - C:\Windows\system32\schtasks.exe
        
        "schtasks.exe" /query /tn "msedgewebview3" /fo CSV /nh
        6⤵
        
        PID:5284
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "if (Get-Command Get-MpPreference -ErrorAction SilentlyContinue) { exit 0 } else { exit 1 }"
        6⤵
        Hide Artifacts: Ignore Process Interrupts
        
        PID:4664
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\fQlcg5gj.bat""
    3⤵
    - Executes a command shell one-liner
    PID:3284
  - - C:\Windows\system32\timeout.exe
      timeout /t 2 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:4516
  - - C:\Windows\system32\reg.exe
      reg add HKLM\SYSTEM\CurrentControlSet\Control\Session Manager /v PendingFileRenameOperations /t REG_MULTI_SZ /d "\??\C:\Users\Admin\AppData\Local\Temp\Tf02PgVu.exe\0" /f
      4⤵
      Modifies registry key
      PID:4024
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c del /f /q "C:\Users\Admin\AppData\Local\Temp\Tf02PgVu.exe"
    3⤵
    PID:5640
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe\" -Force"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:5812

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Hide Artifacts

T1564

Ignore Process Interrupts

T1564.011

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

msedgewebview3.exe

Path C:\Users\Admin\AppData\Local\EdgeWebView\msedgewebview3.exe
Size 1.7MB
SHA256 c1105c7581c23cf3142e5fc81c06ede2d58f477f7562bf86d1300f17e68a1458
MD5 5675afb5a96f73ba44143bf0d7eb1f48
SHA1 d2a5c460cefe31fb069298ef30b3b608a9751b4f
SHA512 457cc310044159e30d186a53176acf9cd155d8ac8265a5ac019f30114a278e3da34b4a1ca5a08f925390c5d2c05bb03f9522fb09e0e5be93b773dc9bbbd12fa8
SSDEEP 24576:Xktz2I9NXzgGjTybBltfLJ9ZLJ4GCBr8nvRj6U0IgDBcj+oKac5:XktzbXsb1JnjAcv9gDBw+oKa
TLSH
T1A9858D8233C28D62D57F67339B22924029E8EF115B93C71ED86F47B73E53BA4A4651C2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 4KB
SHA256 e27390d57580e3dfba07bec3d8e430203bbc91e90f6937079b3fd52abc721bd4
MD5 dbbd2d4458d7e8094846420da595dfc3
SHA1 267cb47b904f14a519d2bd73abfdb30e1a06e1a6
SHA512 480e7ca865b811f79f35fcfe7a9ac0280b48d1f9459873d18f000db55c72d53345cf3a10075c1ac407439545f699ce2a7bef38b00b4e19439edf384b00045531
SSDEEP 96:iq4uYqGEo9xx+incqKXq3qotzYNYr7aqCiNLm7RIz+cBPzQh0nRAy6FcxZcosQSm:iq4uYqGEUdncqKXq3qotzYuWq2Iz+wx
TLSH
T11D91EE323375E0D5C8263F07192C19C463AF439AEA54AF48B258620EED2714BDF122F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download