154100x800000000000000013612Microsoft-Windows-Sysmon/Operationalar-win-dc.attackrange.local-2023-09-06 09:58:58.396{539407B1-4D62-64F8-7C06-000000000803}1668C:\Windows\SysWOW64\netsh.exe10.0.14393.0 (rs1_release.160715-1616)Network Command ShellMicrosoft® Windows® Operating SystemMicrosoft Corporationnetsh.exenetsh firewall delete allowedprogram "C:\Users\Administrator\server.exe"C:\Users\Administrator\Downloads\BuilderNjRat\njRAT v0.7\ATTACKRANGE\Administrator{539407B1-4166-64F8-AE19-060000000000}0x619ae2HighMD5=C3542EE1B9198274179B797C9B2A4633,SHA256=00B424FCE60E8C3ABB5BC05E2E1C4D86F14B07DB48D08660A5A7BB25FC9E3C23,IMPHASH=458D7E5D4617D66110F9AA49F8F7C3C3{539407B1-4A25-64F8-1B06-000000000803}3332C:\Users\Administrator\server.exe"C:\Users\Administrator\server.exe" ATTACKRANGE\Administrator 154100x800000000000000010843Microsoft-Windows-Sysmon/Operationalar-win-dc.attackrange.local-2023-09-06 09:45:16.040{539407B1-4A2C-64F8-1C06-000000000803}1852C:\Windows\SysWOW64\netsh.exe10.0.14393.0 (rs1_release.160715-1616)Network Command ShellMicrosoft® Windows® Operating SystemMicrosoft Corporationnetsh.exenetsh firewall add allowedprogram "C:\Users\Administrator\server.exe" "server.exe" ENABLEC:\Users\Administrator\Downloads\BuilderNjRat\njRAT v0.7\ATTACKRANGE\Administrator{539407B1-4166-64F8-AE19-060000000000}0x619ae2HighMD5=C3542EE1B9198274179B797C9B2A4633,SHA256=00B424FCE60E8C3ABB5BC05E2E1C4D86F14B07DB48D08660A5A7BB25FC9E3C23,IMPHASH=458D7E5D4617D66110F9AA49F8F7C3C3{539407B1-4A25-64F8-1B06-000000000803}3332C:\Users\Administrator\server.exe"C:\Users\Administrator\server.exe" ATTACKRANGE\Administrator 154100x80000000000000006541Microsoft-Windows-Sysmon/Operationalar-win-dc.attackrange.local-2023-09-06 09:08:34.556{539407B1-4192-64F8-DD00-000000000803}5360C:\Windows\System32\findstr.exe10.0.14393.0 (rs1_release.160715-1616)Find String (QGREP) UtilityMicrosoft® Windows® Operating SystemMicrosoft CorporationFINDSTR.EXEfindstr /v DELETEME C:\Windows\system32\ATTACKRANGE\Administrator{539407B1-4166-64F8-AE19-060000000000}0x619ae2HighMD5=15B171EC73E7B71F4EBB4247E716271E,SHA256=2956F7BC863498DFCC868CE7DF4C9C131A4A5C17B065658456AFEF7566ACE1EE,IMPHASH=D7962312082AAB17974D6817E09E5D7A{539407B1-4185-64F8-CD00-000000000803}5848C:\Windows\System32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\RunWallpaperSetupInit.cmd" "ATTACKRANGE\Administrator