Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Resubmissions
23/09/2023, 06:20
230923-g3294afc74 622/09/2023, 09:24
230922-ldawrshb83 1021/09/2023, 15:40
230921-s4gwbsha8z 419/09/2023, 16:03
230919-thpvgscc79 119/09/2023, 13:37
230919-qw5w3shc6s 1019/09/2023, 13:25
230919-qn8yrsbc63 1013/09/2023, 11:47
230913-nx8m9aeb62 412/09/2023, 19:11
230912-xv98qshf86 1012/09/2023, 19:03
230912-xqr7cshf46 1012/09/2023, 11:47
230912-nybd5sca41 1Analysis
-
max time kernel
363s -
max time network
362s -
platform
windows10-2004_x64 -
resource
win10v2004-20230831-en -
resource tags
arch:x64arch:x86image:win10v2004-20230831-enlocale:en-usos:windows10-2004-x64system -
submitted
12/09/2023, 19:03
Static task
static1
URLScan task
urlscan1
Malware Config
Extracted
njrat
Platinum
HacKed
127.0.0.1:6522
Client.exe
-
reg_key
Client.exe
-
splitter
|Ghost|
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1980726966-773384374-2129981223-1000\Control Panel\International\Geo\Nation NjRat Platinum Edition.exe -
Executes dropped EXE 4 IoCs
pid Process 3096 NjRat Platinum Edition.exe 1180 NjRat Platinum Edition.exe 2356 New Client.exe 2824 NjRat Platinum Edition.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks SCSI registry key(s) 3 TTPs 9 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 taskmgr.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString taskmgr.exe -
Enumerates system info in registry 2 TTPs 6 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe -
Modifies registry class 64 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-1980726966-773384374-2129981223-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4" NjRat Platinum Edition.exe Set value (data) \REGISTRY\USER\S-1-5-21-1980726966-773384374-2129981223-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000 NjRat Platinum Edition.exe Set value (int) \REGISTRY\USER\S-1-5-21-1980726966-773384374-2129981223-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0" NjRat Platinum Edition.exe Set value (int) \REGISTRY\USER\S-1-5-21-1980726966-773384374-2129981223-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1" NjRat Platinum Edition.exe Set value (data) \REGISTRY\USER\S-1-5-21-1980726966-773384374-2129981223-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\MRUListEx = 00000000ffffffff NjRat Platinum Edition.exe Key created \REGISTRY\USER\S-1-5-21-1980726966-773384374-2129981223-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0\0 NjRat Platinum Edition.exe Key created \REGISTRY\USER\S-1-5-21-1980726966-773384374-2129981223-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\Shell NjRat Platinum Edition.exe Key created \REGISTRY\USER\S-1-5-21-1980726966-773384374-2129981223-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags NjRat Platinum Edition.exe Set value (int) \REGISTRY\USER\S-1-5-21-1980726966-773384374-2129981223-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1" NjRat Platinum Edition.exe Set value (int) \REGISTRY\USER\S-1-5-21-1980726966-773384374-2129981223-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16" NjRat Platinum Edition.exe Set value (data) \REGISTRY\USER\S-1-5-21-1980726966-773384374-2129981223-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000 NjRat Platinum Edition.exe Set value (data) \REGISTRY\USER\S-1-5-21-1980726966-773384374-2129981223-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0\0\0\MRUListEx = ffffffff NjRat Platinum Edition.exe Set value (int) \REGISTRY\USER\S-1-5-21-1980726966-773384374-2129981223-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257" NjRat Platinum Edition.exe Set value (int) \REGISTRY\USER\S-1-5-21-1980726966-773384374-2129981223-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1" NjRat Platinum Edition.exe Set value (int) \REGISTRY\USER\S-1-5-21-1980726966-773384374-2129981223-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0" NjRat Platinum Edition.exe Set value (data) \REGISTRY\USER\S-1-5-21-1980726966-773384374-2129981223-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202020202 NjRat Platinum Edition.exe Key created \REGISTRY\USER\S-1-5-21-1980726966-773384374-2129981223-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0 NjRat Platinum Edition.exe Set value (data) \REGISTRY\USER\S-1-5-21-1980726966-773384374-2129981223-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0\MRUListEx = 00000000ffffffff NjRat Platinum Edition.exe Set value (data) \REGISTRY\USER\S-1-5-21-1980726966-773384374-2129981223-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000 NjRat Platinum Edition.exe Set value (int) \REGISTRY\USER\S-1-5-21-1980726966-773384374-2129981223-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0" NjRat Platinum Edition.exe Set value (int) \REGISTRY\USER\S-1-5-21-1980726966-773384374-2129981223-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1" NjRat Platinum Edition.exe Key created \REGISTRY\USER\S-1-5-21-1980726966-773384374-2129981223-1000_Classes\Local Settings NjRat Platinum Edition.exe Set value (data) \REGISTRY\USER\S-1-5-21-1980726966-773384374-2129981223-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0 = 78003100000000001f57b2961100557365727300640009000400efbe874f77482c57ea982e000000c70500000000010000000000000000003a00000000004a40a60055007300650072007300000040007300680065006c006c00330032002e0064006c006c002c002d0032003100380031003300000014000000 NjRat Platinum Edition.exe Set value (data) \REGISTRY\USER\S-1-5-21-1980726966-773384374-2129981223-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 020202020202 NjRat Platinum Edition.exe Key created \REGISTRY\USER\S-1-5-21-1980726966-773384374-2129981223-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU NjRat Platinum Edition.exe Set value (data) \REGISTRY\USER\S-1-5-21-1980726966-773384374-2129981223-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\MRUListEx = 00000000ffffffff NjRat Platinum Edition.exe Set value (data) \REGISTRY\USER\S-1-5-21-1980726966-773384374-2129981223-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0\0\0 = 8c00310000000000e9569d3d10004e4a5241542d7e312e37442d0000700009000400efbe1f578c9e1f578c9e2e00000065330200000007000000000000000000000000000000a216c8006e006a005200410054002d0030002e00370064002d0050006c006100740069006e0075006d002d00450064006900740069006f006e002d0052007500530000001c000000 NjRat Platinum Edition.exe Key created \REGISTRY\USER\S-1-5-21-1980726966-773384374-2129981223-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7} NjRat Platinum Edition.exe Key created \REGISTRY\USER\S-1-5-21-1980726966-773384374-2129981223-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell NjRat Platinum Edition.exe Set value (data) \REGISTRY\USER\S-1-5-21-1980726966-773384374-2129981223-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\2\MRUListEx = ffffffff NjRat Platinum Edition.exe Key created \REGISTRY\USER\S-1-5-21-1980726966-773384374-2129981223-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7} NjRat Platinum Edition.exe Set value (int) \REGISTRY\USER\S-1-5-21-1980726966-773384374-2129981223-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257" NjRat Platinum Edition.exe Set value (data) \REGISTRY\USER\S-1-5-21-1980726966-773384374-2129981223-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\MRUListEx = 000000000200000001000000ffffffff NjRat Platinum Edition.exe Set value (data) \REGISTRY\USER\S-1-5-21-1980726966-773384374-2129981223-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0\0 = 7e003100000000001f578c9e11004465736b746f7000680009000400efbe1f57b2961f578d9e2e00000087e101000000010000000000000000003e0000000000852d91004400650073006b0074006f007000000040007300680065006c006c00330032002e0064006c006c002c002d0032003100370036003900000016000000 NjRat Platinum Edition.exe Key created \REGISTRY\USER\S-1-5-21-1980726966-773384374-2129981223-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ NjRat Platinum Edition.exe Key created \REGISTRY\USER\S-1-5-21-1980726966-773384374-2129981223-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg NjRat Platinum Edition.exe Key created \REGISTRY\USER\S-1-5-21-1980726966-773384374-2129981223-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\Shell NjRat Platinum Edition.exe Key created \REGISTRY\USER\S-1-5-21-1980726966-773384374-2129981223-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7 NjRat Platinum Edition.exe Set value (data) \REGISTRY\USER\S-1-5-21-1980726966-773384374-2129981223-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000 NjRat Platinum Edition.exe Key created \REGISTRY\USER\S-1-5-21-1980726966-773384374-2129981223-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0\0\0 NjRat Platinum Edition.exe Key created \REGISTRY\USER\S-1-5-21-1980726966-773384374-2129981223-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6 NjRat Platinum Edition.exe Set value (data) \REGISTRY\USER\S-1-5-21-1980726966-773384374-2129981223-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\MRUListEx = 020000000000000001000000ffffffff NjRat Platinum Edition.exe Set value (str) \REGISTRY\USER\S-1-5-21-1980726966-773384374-2129981223-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}" NjRat Platinum Edition.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ NjRat Platinum Edition.exe Set value (str) \REGISTRY\USER\S-1-5-21-1980726966-773384374-2129981223-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}" NjRat Platinum Edition.exe Set value (data) \REGISTRY\USER\S-1-5-21-1980726966-773384374-2129981223-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02020202020202 NjRat Platinum Edition.exe Key created \REGISTRY\USER\S-1-5-21-1980726966-773384374-2129981223-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1 NjRat Platinum Edition.exe Key created \REGISTRY\USER\S-1-5-21-1980726966-773384374-2129981223-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0 NjRat Platinum Edition.exe Set value (data) \REGISTRY\USER\S-1-5-21-1980726966-773384374-2129981223-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\MRUListEx = 0000000001000000ffffffff NjRat Platinum Edition.exe Set value (data) \REGISTRY\USER\S-1-5-21-1980726966-773384374-2129981223-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\2 = 3a002e803accbfb42cdb4c42b0297fe99a87c641260001002600efbe1100000004fdca713cdcd9011add6aa644dcd9011add6aa644dcd90114000000 NjRat Platinum Edition.exe Set value (int) \REGISTRY\USER\S-1-5-21-1980726966-773384374-2129981223-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1" NjRat Platinum Edition.exe Set value (data) \REGISTRY\USER\S-1-5-21-1980726966-773384374-2129981223-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0 = 50003100000000001f57099e100041646d696e003c0009000400efbe1f57b2962c57ea982e0000007de1010000000100000000000000000000000000000058640700410064006d0069006e00000014000000 NjRat Platinum Edition.exe Set value (str) \REGISTRY\USER\S-1-5-21-1980726966-773384374-2129981223-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\Shell\SniffedFolderType = "Generic" NjRat Platinum Edition.exe Set value (str) \REGISTRY\USER\S-1-5-21-1980726966-773384374-2129981223-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\Shell\SniffedFolderType = "Generic" NjRat Platinum Edition.exe Key created \REGISTRY\USER\S-1-5-21-1980726966-773384374-2129981223-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg NjRat Platinum Edition.exe Set value (int) \REGISTRY\USER\S-1-5-21-1980726966-773384374-2129981223-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1" NjRat Platinum Edition.exe Key created \REGISTRY\USER\S-1-5-21-1980726966-773384374-2129981223-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\2 NjRat Platinum Edition.exe Set value (int) \REGISTRY\USER\S-1-5-21-1980726966-773384374-2129981223-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4" NjRat Platinum Edition.exe Set value (int) \REGISTRY\USER\S-1-5-21-1980726966-773384374-2129981223-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0" NjRat Platinum Edition.exe Key created \REGISTRY\USER\S-1-5-21-1980726966-773384374-2129981223-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0 NjRat Platinum Edition.exe Set value (data) \REGISTRY\USER\S-1-5-21-1980726966-773384374-2129981223-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0\0\MRUListEx = 00000000ffffffff NjRat Platinum Edition.exe Set value (int) \REGISTRY\USER\S-1-5-21-1980726966-773384374-2129981223-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0\0\0\NodeSlot = "6" NjRat Platinum Edition.exe Set value (data) \REGISTRY\USER\S-1-5-21-1980726966-773384374-2129981223-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 010000000200000000000000ffffffff NjRat Platinum Edition.exe Set value (int) \REGISTRY\USER\S-1-5-21-1980726966-773384374-2129981223-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16" NjRat Platinum Edition.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 376 msedge.exe 376 msedge.exe 2560 msedge.exe 2560 msedge.exe 4928 taskmgr.exe 4928 taskmgr.exe 4928 taskmgr.exe 4928 taskmgr.exe 4928 taskmgr.exe 4928 taskmgr.exe 4928 taskmgr.exe 4928 taskmgr.exe 4928 taskmgr.exe 4928 taskmgr.exe 4928 taskmgr.exe 4928 taskmgr.exe 4928 taskmgr.exe 4928 taskmgr.exe 4928 taskmgr.exe 4928 taskmgr.exe 4928 taskmgr.exe 4928 taskmgr.exe 4928 taskmgr.exe 4928 taskmgr.exe 4928 taskmgr.exe 4928 taskmgr.exe 4928 taskmgr.exe 4928 taskmgr.exe 4928 taskmgr.exe 4928 taskmgr.exe 4928 taskmgr.exe 4928 taskmgr.exe 4928 taskmgr.exe 3628 chrome.exe 3628 chrome.exe 1592 taskmgr.exe 1592 taskmgr.exe 1592 taskmgr.exe 1592 taskmgr.exe 1592 taskmgr.exe 1592 taskmgr.exe 1592 taskmgr.exe 1592 taskmgr.exe 1592 taskmgr.exe 1592 taskmgr.exe 1592 taskmgr.exe 1592 taskmgr.exe 1592 taskmgr.exe 1592 taskmgr.exe 1592 taskmgr.exe 1592 taskmgr.exe 1592 taskmgr.exe 760 chrome.exe 760 chrome.exe 3728 taskmgr.exe 3728 taskmgr.exe 3728 taskmgr.exe 3728 taskmgr.exe 3728 taskmgr.exe 3728 taskmgr.exe 3728 taskmgr.exe 3728 taskmgr.exe 3728 taskmgr.exe 3728 taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 2 IoCs
pid Process 1180 NjRat Platinum Edition.exe 3728 taskmgr.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs
pid Process 2560 msedge.exe 2560 msedge.exe 2560 msedge.exe 3628 chrome.exe 3628 chrome.exe 3628 chrome.exe 3628 chrome.exe 3628 chrome.exe 3628 chrome.exe 3628 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 4928 taskmgr.exe Token: SeSystemProfilePrivilege 4928 taskmgr.exe Token: SeCreateGlobalPrivilege 4928 taskmgr.exe Token: 33 4928 taskmgr.exe Token: SeIncBasePriorityPrivilege 4928 taskmgr.exe Token: SeShutdownPrivilege 3628 chrome.exe Token: SeCreatePagefilePrivilege 3628 chrome.exe Token: SeShutdownPrivilege 3628 chrome.exe Token: SeCreatePagefilePrivilege 3628 chrome.exe Token: SeShutdownPrivilege 3628 chrome.exe Token: SeCreatePagefilePrivilege 3628 chrome.exe Token: SeShutdownPrivilege 3628 chrome.exe Token: SeCreatePagefilePrivilege 3628 chrome.exe Token: SeShutdownPrivilege 3628 chrome.exe Token: SeCreatePagefilePrivilege 3628 chrome.exe Token: SeShutdownPrivilege 3628 chrome.exe Token: SeCreatePagefilePrivilege 3628 chrome.exe Token: SeShutdownPrivilege 3628 chrome.exe Token: SeCreatePagefilePrivilege 3628 chrome.exe Token: SeShutdownPrivilege 3628 chrome.exe Token: SeCreatePagefilePrivilege 3628 chrome.exe Token: SeShutdownPrivilege 3628 chrome.exe Token: SeCreatePagefilePrivilege 3628 chrome.exe Token: SeShutdownPrivilege 3628 chrome.exe Token: SeCreatePagefilePrivilege 3628 chrome.exe Token: SeShutdownPrivilege 3628 chrome.exe Token: SeCreatePagefilePrivilege 3628 chrome.exe Token: SeShutdownPrivilege 3628 chrome.exe Token: SeCreatePagefilePrivilege 3628 chrome.exe Token: SeShutdownPrivilege 3628 chrome.exe Token: SeCreatePagefilePrivilege 3628 chrome.exe Token: SeShutdownPrivilege 3628 chrome.exe Token: SeCreatePagefilePrivilege 3628 chrome.exe Token: SeShutdownPrivilege 3628 chrome.exe Token: SeCreatePagefilePrivilege 3628 chrome.exe Token: SeShutdownPrivilege 3628 chrome.exe Token: SeCreatePagefilePrivilege 3628 chrome.exe Token: SeShutdownPrivilege 3628 chrome.exe Token: SeCreatePagefilePrivilege 3628 chrome.exe Token: SeShutdownPrivilege 3628 chrome.exe Token: SeCreatePagefilePrivilege 3628 chrome.exe Token: SeShutdownPrivilege 3628 chrome.exe Token: SeCreatePagefilePrivilege 3628 chrome.exe Token: SeShutdownPrivilege 3628 chrome.exe Token: SeCreatePagefilePrivilege 3628 chrome.exe Token: SeShutdownPrivilege 3628 chrome.exe Token: SeCreatePagefilePrivilege 3628 chrome.exe Token: SeShutdownPrivilege 3628 chrome.exe Token: SeCreatePagefilePrivilege 3628 chrome.exe Token: SeShutdownPrivilege 3628 chrome.exe Token: SeCreatePagefilePrivilege 3628 chrome.exe Token: SeShutdownPrivilege 3628 chrome.exe Token: SeCreatePagefilePrivilege 3628 chrome.exe Token: SeShutdownPrivilege 3628 chrome.exe Token: SeCreatePagefilePrivilege 3628 chrome.exe Token: SeShutdownPrivilege 3628 chrome.exe Token: SeCreatePagefilePrivilege 3628 chrome.exe Token: SeShutdownPrivilege 3628 chrome.exe Token: SeCreatePagefilePrivilege 3628 chrome.exe Token: SeShutdownPrivilege 3628 chrome.exe Token: SeCreatePagefilePrivilege 3628 chrome.exe Token: SeShutdownPrivilege 3628 chrome.exe Token: SeCreatePagefilePrivilege 3628 chrome.exe Token: SeShutdownPrivilege 3628 chrome.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 2560 msedge.exe 2560 msedge.exe 2560 msedge.exe 2560 msedge.exe 2560 msedge.exe 2560 msedge.exe 2560 msedge.exe 2560 msedge.exe 2560 msedge.exe 2560 msedge.exe 2560 msedge.exe 2560 msedge.exe 2560 msedge.exe 2560 msedge.exe 2560 msedge.exe 2560 msedge.exe 2560 msedge.exe 2560 msedge.exe 2560 msedge.exe 2560 msedge.exe 2560 msedge.exe 2560 msedge.exe 2560 msedge.exe 2560 msedge.exe 2560 msedge.exe 2560 msedge.exe 4928 taskmgr.exe 4928 taskmgr.exe 4928 taskmgr.exe 4928 taskmgr.exe 4928 taskmgr.exe 4928 taskmgr.exe 4928 taskmgr.exe 4928 taskmgr.exe 4928 taskmgr.exe 4928 taskmgr.exe 4928 taskmgr.exe 4928 taskmgr.exe 4928 taskmgr.exe 4928 taskmgr.exe 4928 taskmgr.exe 4928 taskmgr.exe 4928 taskmgr.exe 4928 taskmgr.exe 4928 taskmgr.exe 4928 taskmgr.exe 4928 taskmgr.exe 4928 taskmgr.exe 4928 taskmgr.exe 4928 taskmgr.exe 4928 taskmgr.exe 4928 taskmgr.exe 4928 taskmgr.exe 4928 taskmgr.exe 4928 taskmgr.exe 4928 taskmgr.exe 4928 taskmgr.exe 4928 taskmgr.exe 4928 taskmgr.exe 4928 taskmgr.exe 4928 taskmgr.exe 4928 taskmgr.exe 4928 taskmgr.exe 4928 taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 2560 msedge.exe 2560 msedge.exe 2560 msedge.exe 2560 msedge.exe 2560 msedge.exe 2560 msedge.exe 2560 msedge.exe 2560 msedge.exe 2560 msedge.exe 2560 msedge.exe 2560 msedge.exe 2560 msedge.exe 2560 msedge.exe 2560 msedge.exe 2560 msedge.exe 2560 msedge.exe 2560 msedge.exe 2560 msedge.exe 2560 msedge.exe 2560 msedge.exe 2560 msedge.exe 2560 msedge.exe 2560 msedge.exe 2560 msedge.exe 4928 taskmgr.exe 4928 taskmgr.exe 4928 taskmgr.exe 4928 taskmgr.exe 4928 taskmgr.exe 4928 taskmgr.exe 4928 taskmgr.exe 4928 taskmgr.exe 4928 taskmgr.exe 4928 taskmgr.exe 4928 taskmgr.exe 4928 taskmgr.exe 4928 taskmgr.exe 4928 taskmgr.exe 4928 taskmgr.exe 4928 taskmgr.exe 4928 taskmgr.exe 4928 taskmgr.exe 4928 taskmgr.exe 4928 taskmgr.exe 4928 taskmgr.exe 4928 taskmgr.exe 4928 taskmgr.exe 4928 taskmgr.exe 4928 taskmgr.exe 4928 taskmgr.exe 4928 taskmgr.exe 4928 taskmgr.exe 4928 taskmgr.exe 4928 taskmgr.exe 4928 taskmgr.exe 4928 taskmgr.exe 4928 taskmgr.exe 4928 taskmgr.exe 4928 taskmgr.exe 4928 taskmgr.exe 4928 taskmgr.exe 4928 taskmgr.exe 4928 taskmgr.exe 4928 taskmgr.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1180 NjRat Platinum Edition.exe 1180 NjRat Platinum Edition.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2560 wrote to memory of 3812 2560 msedge.exe 88 PID 2560 wrote to memory of 3812 2560 msedge.exe 88 PID 2560 wrote to memory of 628 2560 msedge.exe 91 PID 2560 wrote to memory of 628 2560 msedge.exe 91 PID 2560 wrote to memory of 628 2560 msedge.exe 91 PID 2560 wrote to memory of 628 2560 msedge.exe 91 PID 2560 wrote to memory of 628 2560 msedge.exe 91 PID 2560 wrote to memory of 628 2560 msedge.exe 91 PID 2560 wrote to memory of 628 2560 msedge.exe 91 PID 2560 wrote to memory of 628 2560 msedge.exe 91 PID 2560 wrote to memory of 628 2560 msedge.exe 91 PID 2560 wrote to memory of 628 2560 msedge.exe 91 PID 2560 wrote to memory of 628 2560 msedge.exe 91 PID 2560 wrote to memory of 628 2560 msedge.exe 91 PID 2560 wrote to memory of 628 2560 msedge.exe 91 PID 2560 wrote to memory of 628 2560 msedge.exe 91 PID 2560 wrote to memory of 628 2560 msedge.exe 91 PID 2560 wrote to memory of 628 2560 msedge.exe 91 PID 2560 wrote to memory of 628 2560 msedge.exe 91 PID 2560 wrote to memory of 628 2560 msedge.exe 91 PID 2560 wrote to memory of 628 2560 msedge.exe 91 PID 2560 wrote to memory of 628 2560 msedge.exe 91 PID 2560 wrote to memory of 628 2560 msedge.exe 91 PID 2560 wrote to memory of 628 2560 msedge.exe 91 PID 2560 wrote to memory of 628 2560 msedge.exe 91 PID 2560 wrote to memory of 628 2560 msedge.exe 91 PID 2560 wrote to memory of 628 2560 msedge.exe 91 PID 2560 wrote to memory of 628 2560 msedge.exe 91 PID 2560 wrote to memory of 628 2560 msedge.exe 91 PID 2560 wrote to memory of 628 2560 msedge.exe 91 PID 2560 wrote to memory of 628 2560 msedge.exe 91 PID 2560 wrote to memory of 628 2560 msedge.exe 91 PID 2560 wrote to memory of 628 2560 msedge.exe 91 PID 2560 wrote to memory of 628 2560 msedge.exe 91 PID 2560 wrote to memory of 628 2560 msedge.exe 91 PID 2560 wrote to memory of 628 2560 msedge.exe 91 PID 2560 wrote to memory of 628 2560 msedge.exe 91 PID 2560 wrote to memory of 628 2560 msedge.exe 91 PID 2560 wrote to memory of 628 2560 msedge.exe 91 PID 2560 wrote to memory of 628 2560 msedge.exe 91 PID 2560 wrote to memory of 628 2560 msedge.exe 91 PID 2560 wrote to memory of 628 2560 msedge.exe 91 PID 2560 wrote to memory of 376 2560 msedge.exe 90 PID 2560 wrote to memory of 376 2560 msedge.exe 90 PID 2560 wrote to memory of 1560 2560 msedge.exe 92 PID 2560 wrote to memory of 1560 2560 msedge.exe 92 PID 2560 wrote to memory of 1560 2560 msedge.exe 92 PID 2560 wrote to memory of 1560 2560 msedge.exe 92 PID 2560 wrote to memory of 1560 2560 msedge.exe 92 PID 2560 wrote to memory of 1560 2560 msedge.exe 92 PID 2560 wrote to memory of 1560 2560 msedge.exe 92 PID 2560 wrote to memory of 1560 2560 msedge.exe 92 PID 2560 wrote to memory of 1560 2560 msedge.exe 92 PID 2560 wrote to memory of 1560 2560 msedge.exe 92 PID 2560 wrote to memory of 1560 2560 msedge.exe 92 PID 2560 wrote to memory of 1560 2560 msedge.exe 92 PID 2560 wrote to memory of 1560 2560 msedge.exe 92 PID 2560 wrote to memory of 1560 2560 msedge.exe 92 PID 2560 wrote to memory of 1560 2560 msedge.exe 92 PID 2560 wrote to memory of 1560 2560 msedge.exe 92 PID 2560 wrote to memory of 1560 2560 msedge.exe 92 PID 2560 wrote to memory of 1560 2560 msedge.exe 92 PID 2560 wrote to memory of 1560 2560 msedge.exe 92 PID 2560 wrote to memory of 1560 2560 msedge.exe 92
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://google.com1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2560 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ff8a41a46f8,0x7ff8a41a4708,0x7ff8a41a47182⤵PID:3812
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2216,17696801930883532875,557274888238507489,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2276 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:376
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2216,17696801930883532875,557274888238507489,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2224 /prefetch:22⤵PID:628
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2216,17696801930883532875,557274888238507489,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2924 /prefetch:82⤵PID:1560
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2216,17696801930883532875,557274888238507489,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3312 /prefetch:12⤵PID:3260
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2216,17696801930883532875,557274888238507489,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3304 /prefetch:12⤵PID:1264
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2216,17696801930883532875,557274888238507489,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2900 /prefetch:12⤵PID:2988
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3856
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2784
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4928
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
PID:3628 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0x11c,0x120,0x124,0xfc,0x128,0x7ff8a4049758,0x7ff8a4049768,0x7ff8a40497782⤵PID:4624
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1832 --field-trial-handle=1884,i,9096923219180315596,13172887173143456724,131072 /prefetch:22⤵PID:3200
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2176 --field-trial-handle=1884,i,9096923219180315596,13172887173143456724,131072 /prefetch:82⤵PID:4472
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2236 --field-trial-handle=1884,i,9096923219180315596,13172887173143456724,131072 /prefetch:82⤵PID:4756
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3260 --field-trial-handle=1884,i,9096923219180315596,13172887173143456724,131072 /prefetch:12⤵PID:4832
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3288 --field-trial-handle=1884,i,9096923219180315596,13172887173143456724,131072 /prefetch:12⤵PID:1940
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4532 --field-trial-handle=1884,i,9096923219180315596,13172887173143456724,131072 /prefetch:12⤵PID:2240
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4840 --field-trial-handle=1884,i,9096923219180315596,13172887173143456724,131072 /prefetch:82⤵PID:3892
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4980 --field-trial-handle=1884,i,9096923219180315596,13172887173143456724,131072 /prefetch:82⤵PID:112
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5044 --field-trial-handle=1884,i,9096923219180315596,13172887173143456724,131072 /prefetch:82⤵PID:2316
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5488 --field-trial-handle=1884,i,9096923219180315596,13172887173143456724,131072 /prefetch:82⤵PID:2156
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --mojo-platform-channel-handle=5624 --field-trial-handle=1884,i,9096923219180315596,13172887173143456724,131072 /prefetch:12⤵PID:2604
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --mojo-platform-channel-handle=3876 --field-trial-handle=1884,i,9096923219180315596,13172887173143456724,131072 /prefetch:12⤵PID:4864
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --mojo-platform-channel-handle=6124 --field-trial-handle=1884,i,9096923219180315596,13172887173143456724,131072 /prefetch:12⤵PID:4448
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --mojo-platform-channel-handle=2248 --field-trial-handle=1884,i,9096923219180315596,13172887173143456724,131072 /prefetch:12⤵PID:3948
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3520 --field-trial-handle=1884,i,9096923219180315596,13172887173143456724,131072 /prefetch:82⤵PID:4392
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5940 --field-trial-handle=1884,i,9096923219180315596,13172887173143456724,131072 /prefetch:82⤵PID:2680
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6100 --field-trial-handle=1884,i,9096923219180315596,13172887173143456724,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:760
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:1828
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:4916
-
C:\Program Files\7-Zip\7zG.exe"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Desktop\" -an -ai#7zMap6194:120:7zEvent285061⤵PID:4136
-
C:\Users\Admin\Desktop\njRAT-0.7d-Platinum-Edition-RuS\NjRat Platinum Edition.exe"C:\Users\Admin\Desktop\njRAT-0.7d-Platinum-Edition-RuS\NjRat Platinum Edition.exe"1⤵
- Executes dropped EXE
PID:3096
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x3dc 0x3d41⤵PID:4868
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
PID:1592
-
C:\Users\Admin\Desktop\njRAT-0.7d-Platinum-Edition-RuS\NjRat Platinum Edition.exe"C:\Users\Admin\Desktop\njRAT-0.7d-Platinum-Edition-RuS\NjRat Platinum Edition.exe"1⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1180 -
C:\Windows\Microsoft.NET\Framework\v2.0.50727\ilasm.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\ilasm.exe" /alignment=512 /QUIET "C:\Users\Admin\AppData\Local\Temp\stub.il" /output:"C:\Users\Admin\Desktop\New Client.exe"2⤵PID:4120
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
PID:3728
-
C:\Windows\system32\rundll32.exeC:\Windows\system32\rundll32.exe C:\Windows\system32\PcaSvc.dll,PcaPatchSdbTask1⤵PID:2216
-
C:\Users\Admin\Desktop\New Client.exe"C:\Users\Admin\Desktop\New Client.exe"1⤵
- Executes dropped EXE
PID:2356
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵PID:3248
-
C:\Windows\system32\werfault.exewerfault.exe /h /shared Global\4ead683a5f8c4cf7b0907ddc0857fdec /t 1352 /p 11801⤵PID:2384
-
C:\Users\Admin\Desktop\njRAT-0.7d-Platinum-Edition-RuS\NjRat Platinum Edition.exe"C:\Users\Admin\Desktop\njRAT-0.7d-Platinum-Edition-RuS\NjRat Platinum Edition.exe"1⤵
- Executes dropped EXE
PID:2824
-
C:\Windows\system32\werfault.exewerfault.exe /h /shared Global\ab17eb0fd27447d7b18c27ac574016cf /t 2904 /p 28241⤵PID:3632
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
64KB
MD5d2fb266b97caff2086bf0fa74eddb6b2
SHA12f0061ce9c51b5b4fbab76b37fc6a540be7f805d
SHA256b09f68b61d9ff5a7c7c8b10eee9447d4813ee0e866346e629e788cd4adecb66a
SHA512c3ba95a538c1d266beb83334af755c34ce642a4178ab0f2e5f7822fd6821d3b68862a8b58f167a9294e6d913b08c1054a69b5d7aec2efdb3cf9796ed84de21a8
-
Filesize
4B
MD5f49655f856acb8884cc0ace29216f511
SHA1cb0f1f87ec0455ec349aaa950c600475ac7b7b6b
SHA2567852fce59c67ddf1d6b8b997eaa1adfac004a9f3a91c37295de9223674011fba
SHA512599e93d25b174524495ed29653052b3590133096404873318f05fd68f4c9a5c9a3b30574551141fbb73d7329d6be342699a17f3ae84554bab784776dfda2d5f8
-
Filesize
4B
MD5f49655f856acb8884cc0ace29216f511
SHA1cb0f1f87ec0455ec349aaa950c600475ac7b7b6b
SHA2567852fce59c67ddf1d6b8b997eaa1adfac004a9f3a91c37295de9223674011fba
SHA512599e93d25b174524495ed29653052b3590133096404873318f05fd68f4c9a5c9a3b30574551141fbb73d7329d6be342699a17f3ae84554bab784776dfda2d5f8
-
Filesize
944B
MD56bd369f7c74a28194c991ed1404da30f
SHA10f8e3f8ab822c9374409fe399b6bfe5d68cbd643
SHA256878947d0ec814fe7c343cdebc05eebf00eb14f3023bdb3809a559e17f399fe5d
SHA5128fc5f073dc9fa1e1ae47c60a5f06e0a48709fd6a4302dffaa721858409e7bde64bc6856d3fb28891090516d1a7afc542579de287778b5755eafe75cc67d45d93
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
-
Filesize
298KB
MD52056424df06c59b02dd0129d8fb46591
SHA109c155e4ee514aa7cda24cd562e2866407a72ff6
SHA2567d0e70820bacf9f32391518b4fc96a1b949dbf7ce7e2497743f673ddcb1a735a
SHA5129d99a665b9eda0fee0c465164154c1ebc21dcb59e5155d0adff2515952fd36ebb1c7e4f593f449d082a0bac567fb7b2fc953e19ab30136b08dad5c43d2733393
-
Filesize
108KB
MD5810804025a5d73195159f941b65cf6c6
SHA1072fabd98fa156970a42f575e9e1eee8077ea2dc
SHA2562cb4b05f91fe206e787405fec49118a79bd114ae7096609592516221db1085a8
SHA51212f7e8eb198190f11195ac5d327c2c47504c2a971eae480de057f8aba7bb371698a66a621c11a73bb04ce9971cc8868c17d61abdcd401e25d10531d66dd6d4e8
-
Filesize
71KB
MD5035ef6eaf7accadce25b54de51a58b43
SHA16622e6858ee1349437d58c29fe821390c27cef41
SHA256c29fd8d1af7a65a8ee253f331922fe84445b275926596fcefd3d2fcc02bf842a
SHA512d6a21d79e3f10a9c4ad0b1d0294922a90a8485170e514129b71eb0c287925d6a80b8c4d5e246faaf86964ffe4841aee78a8fb7a3b6c5d4f6fb0a82a73dfb69ef
-
Filesize
40KB
MD5d574939016c1b0511053c934958d9a25
SHA11ebb35cd6af10fce71dcd4778c9bbcd9822ef999
SHA256ad0ad0fb63aff674e004faa8c826d6523a79532133fc07eb9a2ee5a1d367ec66
SHA51248758079cd42e05da63126f5119d15a4f79520095d062b67490b637df8fc12d567eaa2ec9c083d747093fbefedc651fbb3a2bc4f2fbbab9b5a09379626a40ceb
-
Filesize
3KB
MD5489d3171f2c6130e188796fc0282ddb1
SHA1713a0753aab6ba87516f7f19412c807027851683
SHA256ff1a6cfe3c5bc6173b83421c598c07e221476c03b9b5ed28b1fcad4808af82f9
SHA512050dfaec8bbffc558bc1ce902e5521f62d09c0d01aea31a30f0cad665a85160d8f288324a43404242620add1388b5c8c9d06d0b320cc7bd199a37b3ccff208d6
-
Filesize
3KB
MD5cbd4cb8a9ab46ec437258efda6a22ba9
SHA1d9c2693b318cfd2d01be3c873965f30bea3040e4
SHA2560932f9a452be0d6b2a503bad573343e6fc0ff72acd83a6714cfc0d85cbe7c29c
SHA51254f1c12cec349c69e1707f880b9c71614536189cb2b8b2b1c18191475e213ed7f9e9ae4d64a55f3fd153cdcf5feb46a18a6f55528bc364ae37c8e4abd5496a5b
-
Filesize
2KB
MD50872afb6b28f6c94b28ab05b4962873f
SHA159326986b39f5b8a425498c999751e8684b2dfcb
SHA2568373abc4f50ef0139ad73c748cf49149e59d2fce3d8a8cfb85387b142700a675
SHA512d7ad1c10bc827a36307cb7a188a6b211c816e103072859ff4a1129af600be181d42827442c2db59eb011c6455758e3f52e79d8d9044a16702058e5b470a6eb73
-
Filesize
1KB
MD53b14c3473ef603ecd44346ebf4f6d581
SHA16f4136eeab65037ffc38b348c59ec02cdff008e1
SHA256cbfba7c11937a6a6a41d6c5df8950dad777887c73b5a257ecf463ac06d5d7356
SHA5120b96f3e6915f9e892ebbb98ccc0370f9f83bfb782241839d1189645d3c8b0921295493f81f028616b0abbf72a8116a57f69edcd2584b758ef732246ad01a6e2e
-
Filesize
371B
MD59474d937e876d9ed7072e62d69045415
SHA17909328756b9a1a89dab2d6647b88a40bf790066
SHA256c5d381006d6fef09beab632629e91048ec9a2100061511e334f2cc5eb9334d85
SHA512e900f448aa94b1ded387000d5e358d8dfad129c628992925edeb9cbb70e71e1516476b17832bc3aee45cb0be2442a5a5e1d80956e85da915a924cb8835f4b9be
-
Filesize
1KB
MD56002e1a7fb3d0cb5843dbadee1ca0e77
SHA18bd4d4004122f9a239c41d9fade1eba897c82740
SHA256d87e74fb2d48c1f7203758b1a96c81e7f27b4daad14e401f5b8924b13cc1d898
SHA512e68860d209a103cd4e2a365c5514cf7ceb96aea0b418761b97659f1dd4b31a93be99f4fa09916be7f666dd039eeb96904ce328b4b3f48b20ce71fa5fbe6bcfbe
-
Filesize
1KB
MD5c86363ae687ce41e1bf67c175611c426
SHA166b52d6e75fe512e9ef4e07ac37b0d347c45af0d
SHA2564ce673ad5d3893a249d3697a2d20b93737cca71324228fb6d7e5eab25b7acf3f
SHA512946fb6c64f332b8f0b59877dd8ed1fc769eb9ed4ddfeb1d68eb21b8bbf5bd6f2b649be914176a0bd3f98ce22278296ffe428d450d961509107239fddf8a8dbbb
-
Filesize
1KB
MD578f026fa7d6c458ac7833af6fab3640e
SHA1cbfe7975313eff97f5c681cf97722812efadeeda
SHA2568fbdfe2218fe014d6a463633a2f5e6b5c40ffd646b83af1415955f4722b5fa13
SHA5124fcc875778b62799ffe07ed23610c1b74ff222f8c23e49e4b918751d2016d7090d86e30a6418354cbdebaba6416ab6734a66383960821b974aea80dd9449da4d
-
Filesize
1KB
MD5108bcc3183a7055837036f402ba8aa21
SHA1ef2ef04ed02b82c9522329958846b06f83e54057
SHA256976fe2c8922b36692022e55b8c87d87990f87b16e45f9eb3599a433e15a540b0
SHA51268730fd16f504e005b5a17b769123ca78eda4a097bbb42f28ef112c22b0f8c886c379e22c777078592610602523b434afc520062e8cf28c27e502c08da629a86
-
Filesize
1KB
MD5b6665e57ed4299e37a285264555d2c37
SHA1c5a6c800bfebcf6f4ca2756eb22fe9ca66279b84
SHA256e8fb7439be2b3b24f54a74b6482fb0747905ce4c3675f5e4969108f979856811
SHA5129b0f8b7ab542b9343d7e60918f0e1a66a29977dff61c07fed117adae5fbab4f3869b03978dc7ad548573b1794645e4fdfc400f2b0155634732fad7d63ca4134a
-
Filesize
1KB
MD52a96296147c3145ccb3fa71e0d99cd92
SHA1b2e24d37a1f690df6b89b161302dd24809384422
SHA256779df5a364e73b518e6817185df3d02e42f7c9607c09cbecdfbb5fcdf4e4cfeb
SHA512a61fdb4fc2ce172fb05a7ffa4d77f8602a007d28ef3c06a9d10c7673296fbd3d77cf0a6018a73b510015e3c2a7f11a56c8ccf7608c15e244a4fd3738b8da00c8
-
Filesize
1KB
MD5273396c30e453a3226a9250189f7b78e
SHA1acd14cd0dd9d4cd6fd438daceba2614ffab70a7f
SHA256e8d852e2ca37d614912d843efaaed54c3e610b0d68e315647d155969cdc2eed1
SHA512d81b9244152aa17c729450cb2cfaa630b63b42f9e5bddc29edde6d7bacab812c0883c22765d3bd019737919036a1533b9f2d39c1d41a8aeffc5d14ff1b464f89
-
Filesize
1KB
MD5c5311ab283fea323c5e31a1a3536114d
SHA150bdce95cf790d39b23ed91a151545a244af89db
SHA256aa6524481608573513493850c477717930597e3e493ffa738a360c0092df91c5
SHA512dc44d3b600f5f3f52500636cfcfb00829fef25314855dfa515157201b87c9ee2516ff686c3b308baea4e03a234c27cb935fc19faf3be1a17bd620195a2f63271
-
Filesize
6KB
MD5ea34a67cac077bf0a70cc9205cbe5612
SHA1689af33c19fedf1b6b5050dcc1a84dc7c1bce3e3
SHA256ee5eeb0d045719b04b6f40891dbf65d838e78f46cf3071e1e600ed58fd51e056
SHA5129b600fb17b424504ac2a4837b705c2fcae93f7ae96e52d5bb762abc100eb92577f5f1b6d8734eacf9e0e2bd44ccf8d9df075af8520564015d565d6e9e7ca5d1d
-
Filesize
6KB
MD5b8d5548eb1fb91027b4a6dcbe81250d2
SHA1a648b0a422cee5e9532f0ceb7e4980a793ce8a23
SHA256670a14796e66153693f5ccacdd97de33521a8d4192167d831093139dfb411b48
SHA5128b422bbc744ba077cac49c68f385b5adbad849ae477ec56f2d3e3b04fd05a16821224f490d30a3148473740b487a4adb7969abefd0d6d5b3c7d75a719fc6822d
-
Filesize
6KB
MD58d2c64b51bee00ba01f6d61e2ca3ab8d
SHA12911509c390671e6f4b561068baf256a215306e6
SHA2563ab9ffb4d1732cd1b7cd6cc922550571f90d83af434523dc62ae47f99d147f7c
SHA512a3ee473528734ec8719421ac3515c34102900a6ef1f64c71326f518cbbe6c48935f31d13438236e7fd69c95a594802703ef31cdd701f1381842dac7cd14e4a85
-
Filesize
6KB
MD5f4df0a30e08a9af75c87d91cf2effcec
SHA1754cdb737d943ba857b305e0769abaa2ab4b1e0f
SHA256592434f1d7f30d165fed01f5549426803a7c02c8dc8e8c909b858f8717e6fb05
SHA51289e11cd69f88f106ab2e0919c205026ded09b012c58d1667d5be4ede527ec90906be2f1a78ae45d6338bbef13b9a7404fcc8f0d5e95f9f8d037356ca2bd0db9d
-
Filesize
6KB
MD5fa123f0e9a7c97404a6a1d5549d9f366
SHA11219116a1ded548282d026de96296780bb3e0b42
SHA256b14c1e2f6912e8e43b51e486c2b91d5786b59fdb243abcd975b450a43805c496
SHA5123e1d195e78eca563f5105b8c9666d91e43e0fa1b8593661672744ae3659c38cd64de4dffc6976d55c0767363984fc07e1d7e13b916e9d707b24580a0a619b923
-
Filesize
6KB
MD58badbf97b9f918ff2d75cb257c56d3dc
SHA1e9fcde6815762e1943877810afe85784913e0ff6
SHA256d8f93148a0a553e9e18c1c5c5bc42566988821fcb1face3caca54f3309437abc
SHA512ea2c7e0c4f2f8d75e5d16e122cf809b71c73a201844bfe3af0c99bae18efec9eccffcc9d4e4ff8a1e4e9943bfd8d322f295f86c36c0e019b9bb56ff7ff619a6e
-
Filesize
5KB
MD5aa612c274fe15c2e83dbd28525f4f44c
SHA17967c4ed4fbcee6bc413ea319beed2ae988169f2
SHA2565cde7a5c18771af7379b875086293cc1f1b9e80cdd2a56227f7192056fa94c63
SHA512b481c2998f0841e8b38b23232ff7fd29732c2504ceb2bc5e77279744eeca83f4cdf855337f311b9f75e1b483d0b75e0b6c4fe2c9059dbac435928bc92bc0511f
-
Filesize
196KB
MD53d98155eebf762c8cf8119ca278450ed
SHA1c649e29541dc78918f397783944e96bb102cd7ea
SHA25675c80d60682a8a285a3165e19feb91ca5db15445c9224a74519603a37b8366a2
SHA512aac05e8995449f92d4ebc272a9582c23ef2f77951aeeb4f27e1da07a429e47fa2d6d12dadb2a0a306e92633d838dc6ab65266586faf13294ef74bd5722e077a6
-
Filesize
196KB
MD59cf33423fb73f4ba53579664235ba588
SHA1553b078bbfebed033ce345fd9a5fa4ad4f8a4c51
SHA256e9908bb55e768446acbc50efe1ab6fdfb07d67af7e4e56f6d32ae599bb8fdef7
SHA5124d1d2b2fd6bfd985dbd8ce87cd88b6f1e2430ba470633b1aed51239ca6601df4ce02421410d3fd1f12f49dacc83edbf26b25d93bbbac2dbcf950db0918d28470
-
Filesize
196KB
MD5b400409e91f8ae87ba2df96dd04f1d37
SHA1f0ebad2cfe5ad2d83d00bf32f265ce21afd88795
SHA256c585e68c597c7d02f1697b729d702d6b315b4c7d895cb2694f17ffedcf71537f
SHA5120d596b00b57686cca5bd48cc85acf203bebf4f9fb976569d9533df51c984428c9ac23e6fce84438aede60b18b951fba72afcc324f7f773d76c598760cbcdf4de
-
Filesize
196KB
MD588458d8ca93c36584dce803cec925dca
SHA1bf7b565f9b2ffdd2c04e02454f99dce25719cfe5
SHA256d23c21fd19a4829381a7cd149cd9dee73aee2f49ff491656e708e1e093f2f337
SHA5125cccfa7aa4fdae2cba64e50d88ad83a0f3807baa2397b046d1c09bf3ea938c2b6f829dc6b864db66fc0e971adc56d0b1dd45533705e28c50195836c949d42c40
-
Filesize
101KB
MD52258d1b55d0ba9902c1b7324f51683e8
SHA15284ab40621902e6bf4613ffe7d5ff835945a3be
SHA2565a25e94dcf52a6b0fd2ebfa07a969441af7c68a44336615a87a650c999bc9247
SHA5126fb940a068e6931fc77266f9f85cd5d64ea694d13a3f9285c056bcfa592d951b8de645bb44556a10f0cde8609f9b6d56fab0cf0d2c26ef775f06979a6d6d3cc2
-
Filesize
97KB
MD5a1b64598089d20ceb65315626281ac66
SHA1561e3b1890951a2cbdfd239c560f9f5362e8a817
SHA256c38ab02686bb4edd9e42dbbda30086f80e4f201aee64916acdd4dabc7176d1ab
SHA51262b6086957b8c6684aa0a2960a89b80f1485f421793012e81d8154fb4b3735836f22ceb56c501c5c63836baca77609dfd39d1f9a5eb9f3345ee37a050d01447b
-
Filesize
264KB
MD554979538c1f1819bdfa1f443df020ab8
SHA12326c5cf649689db8f64920bb5c1ff71ef507b2b
SHA256db3f71f9250a78e02e81fd6a32839b7aee0d34a68460660f4f60289165f4e736
SHA512f99cc4ff451449328dd3dba79ad3fc12febd8203d07be048f76ca4f4e0e7f3cd3709a336b6f84f8378fae70c9c8a7b9c1e47e165fde3bb0e701a80c8818921bd
-
Filesize
774B
MD51b2f0c7407b8bbbaaf86739abe069e81
SHA1372380724c49f74a66176054790917f31134ec63
SHA2563dd2fd61d338cf98cb575bd6efe579a67debb9e3b4535fd6c2dba57a120ffbfd
SHA512ea3343f655b6ab1181174db403590199049340f3bf2fb51e44f6be8949102d83952d1e7c69d92066573187e56199827abd3c90defab86b05072b0896ab458ae9
-
Filesize
152B
MD529e414757ec5f96753331ee050189d4e
SHA11e77a6b0e6d4a9236ff7bf4d70cd5bc3552716dd
SHA256ad7db569f6f5cd84623a76c82eb816e86b4cf01753f353a5746a4907fff326cf
SHA5124be7a1fdf2440637d9230c389d475af184e6f5599f0bb5547fce31f3a23a1c439746d433402243574a83f25ad9b8e4e1152578a37bdfce80a840baf7a2d68ea5
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize96B
MD5b3b3e42be72f896d2bc2977ea7e62225
SHA1437b32bdfffb77de4068ea6b90ba4f30bf45d017
SHA25697f26d9707a9c4aeb30e7a6d2ae8c86cf63dd6a80923d32539447d702bd06660
SHA51266721a913520a0ee92fc3606be075fabd575fc077b4ff3401c3b1bd70953df603f0d2f6a624cf8f352193a0f22908dbfa243dc30ea88c35284a36862e473805a
-
Filesize
1KB
MD56c85de844098fb22b8d5af2e53b523d0
SHA1a9efa130c32b6d7c5cd8f71674e79eed9d740c13
SHA2560e52d69ae5f43173c365c2f9b3c88baacd22e28e238112302581f213d614a02f
SHA512cd433cd2b449dafc9769985b6423d29b9e217beb6da2f03a5a908b8b961a09d955c3fbe32a04cfd14d8f1c458020a4a830b919e3190a0ad1613915af76d9947c
-
Filesize
6KB
MD5efa609a903cd37e55614304fdc73d91f
SHA1ae4bf3a0349d9a9066ad712e23e0f0e8f697bbdb
SHA25644f35a22771a4adb33be8f62cdaf2c8698da2b55550f0071c082d55ba1b59d67
SHA5121e85ebabcfea40a810bdca0165b2b3448c236260d5612b1009b0c34678849379353f1dafb1379526ed610a327595163e52a6ff01fa913a5c9b32b848a40beab6
-
Filesize
5KB
MD5636e5109f372d2d0066236b164a4181a
SHA1c3be2a6702c3f051208fc614229bb909be40faf7
SHA25606df14c3723b8526c975a0fd56b5da99459cdcf1ed192c6513e31745c9c19f80
SHA5126dcb72af108e3082cfb688552828bc702bdcd4e212bde8aacdd986dac2985ec651bce4bff03529c98d8387124fe593bad306b3292c2f1cfa6d1ae35ea2bf6a3b
-
Filesize
24KB
MD500ccde2abfa350da86ceaf6ed384e19b
SHA143bc0354c3799a7a287eb2d5c1a3227f849a7948
SHA25635fb77fb63d237b3e7f84ea0b261e576469bf69dd373d9d03b1bd17726255bf8
SHA51256ea8977b2c1eca7caae59945a636deafba0dc479783a16b763fe9e45d81d8fc44c497ef85ec2516c0e71fd2d28517c469d1484a61c79b45094004810126b240
-
Filesize
10KB
MD5a20ae47125741856f19a0b3f6d4fbf96
SHA1d14de12a04b6709f18163133449b58e5dc3ef50f
SHA256ef9524812c09abb0ebb2be74a34f1d14fd18d26d843930921f20c4f0fbded05f
SHA5125c309b75732b7d646927b18f6da26cb020ef440ab25e13cebe588ce1cf88264e9b65bbef1edd935050ad60066d877ecff16b42b07be978804762e341e574f880
-
Filesize
659KB
MD5c496991ec341aff8f47ad39d48920907
SHA1ca59aab30c76495f0c75c4396735b49d3cae23ef
SHA256119462fc087eaece7bbf1411d1b6abebfad76940f4b812c879540433602eec91
SHA51205bd4c184e9e8f45f7717287d4cd944c2a69673607550a7646f5e0ab3b4f3f649e4ee3a494d4b0b39ac5214c6e6ad7cefe59fffd05e2a657ffaf66014913bc7c
-
Filesize
64KB
MD53aec111f7928fa8f610aef30103bc1aa
SHA13e44d32f727d6623dbb398175dbec662d07e1d93
SHA25639f1ba5d18442642c4f749ec4cbea2295dc821170f1816860570dd2500848d8f
SHA512f371066a3aaa0323865f72cfe47b9b7669b68b218b3b33f05ddb0af583a31f574cf57c6395731e3a326b13a9cc7d90d6b6f5f1e8c161cd26ff7437f5039a8d6e
-
Filesize
64KB
MD53aec111f7928fa8f610aef30103bc1aa
SHA13e44d32f727d6623dbb398175dbec662d07e1d93
SHA25639f1ba5d18442642c4f749ec4cbea2295dc821170f1816860570dd2500848d8f
SHA512f371066a3aaa0323865f72cfe47b9b7669b68b218b3b33f05ddb0af583a31f574cf57c6395731e3a326b13a9cc7d90d6b6f5f1e8c161cd26ff7437f5039a8d6e
-
Filesize
7.0MB
MD5f4555fd1a0125ddf8ac8de8eec673e2b
SHA1178f12eb0fbf29bb7dd7ab8ab659eca5b2984774
SHA2564c2f94c77738275e7c4370557f19e402b48f8c82771cca538a5a95ca99f41e3a
SHA5123a43821884758df7b57861dc381d452cf03f15635aa936564d1dba24cda66b1f21042159672c6ba913e11ed209f21fb670d88c3df48d529bbd592e9e4a5d1a7e
-
Filesize
1.1MB
MD5a0a228c187329ad148f33c81ddb430bb
SHA1d70ec83d1b15b3156df73802dd1bec024b1b9346
SHA256b4bfd1ebc50f0eaab3d3f4c2152feae7aa8efad380b85064153a6bfd006c6210
SHA5120fe0a62c07f7ade0e6bfac8843c13c055369177935d801488a993bc4bcdb9da220ba1b37df2027dab8af7c15e5cf00b3e8f223b12165d8a1b0b9c30dc9939332
-
Filesize
7.9MB
MD59ea34bd96a5e4c536787107a532e1bf2
SHA166941b6165076379114b4216ff4f60d9623c407a
SHA256989114eac06b024e0fd631d7d7b6e5435f86ea349cdb59c9b7c4407d1527ae38
SHA512e80b6ccd07e4187331085a23fea83acc6fbee611e0af2b4f1c724f2ae5b50688692c8aa917852dca400c705d25b83b95c4201e70c12cf68b35a276ee3a23cabf
-
Filesize
7.9MB
MD59ea34bd96a5e4c536787107a532e1bf2
SHA166941b6165076379114b4216ff4f60d9623c407a
SHA256989114eac06b024e0fd631d7d7b6e5435f86ea349cdb59c9b7c4407d1527ae38
SHA512e80b6ccd07e4187331085a23fea83acc6fbee611e0af2b4f1c724f2ae5b50688692c8aa917852dca400c705d25b83b95c4201e70c12cf68b35a276ee3a23cabf
-
Filesize
7.9MB
MD59ea34bd96a5e4c536787107a532e1bf2
SHA166941b6165076379114b4216ff4f60d9623c407a
SHA256989114eac06b024e0fd631d7d7b6e5435f86ea349cdb59c9b7c4407d1527ae38
SHA512e80b6ccd07e4187331085a23fea83acc6fbee611e0af2b4f1c724f2ae5b50688692c8aa917852dca400c705d25b83b95c4201e70c12cf68b35a276ee3a23cabf
-
Filesize
7.9MB
MD59ea34bd96a5e4c536787107a532e1bf2
SHA166941b6165076379114b4216ff4f60d9623c407a
SHA256989114eac06b024e0fd631d7d7b6e5435f86ea349cdb59c9b7c4407d1527ae38
SHA512e80b6ccd07e4187331085a23fea83acc6fbee611e0af2b4f1c724f2ae5b50688692c8aa917852dca400c705d25b83b95c4201e70c12cf68b35a276ee3a23cabf
-
Filesize
1KB
MD5da15a1d8d770b57356ddd384342b3034
SHA1b03d6cb907c139492c7b914147a498b31ef839fd
SHA256c45c9d1d30f940289498be2af978d74178a5c24ceb7755c2648f6c7a89353813
SHA5123cf7dd0d14244c543e3442873ce7e495ade87ad906a42d53f3b38180ffc453bd74ae022b91306445d359475dbee4caa1514c4e913e823d174b8470b45fed7cfc
-
Filesize
680KB
MD511ca5b5feba113ccf66d6649b5b3cb40
SHA1503f3a2a449b195d6e71237fba623c3a7b5a08fa
SHA2569430fec62eb1bfecb35f4a9ceb2ddd5ce6294751cde85fd7169c8def811af49e
SHA5122183286132157f0122b1c8cbfbf0ccf49cf59ca033453d983fb4e25850203e1c03beff98bf99580b20c8049180d4afce339680ba70e1bd7c5a95f859afa70da3
-
Filesize
659KB
MD58a1ea88a0ce54fbe8a85aedc751e0edc
SHA12e3622edeaa569f4b38f740f593f4bd9f913c97a
SHA2564eaa0830f3a6b72e6380875b82c28fc48d22d3c14ab2adab87e2deafdbf19ea8
SHA512e01a5511b9e21610d3e2e325fbf15068432dda6dbc976ca7395ad9c3e2d8a91883be813db75339d51e0bd5ea7c23a9c37c9b7e7384399489b21d15d953397f64
-
Filesize
487B
MD54d18ac38a92d15a64e2b80447b025b7e
SHA15c34374c2dd5afa92e0489f1d6f86dde616aca6c
SHA256835a00d6e7c43db49ae7b3fa12559f23c2920b7530f4d3f960fd285b42b1efb5
SHA51272be79acd72366b495e0f625a50c9bdf01047bcf5f9ee1e3bdba10dab7bd721b0126f429a91d8c80c2434e8bc751defdf4c05bdc09d26a871df1bb2e22e923bf
-
Filesize
43KB
MD5d4b80052c7b4093e10ce1f40ce74f707
SHA12494a38f1c0d3a0aa9b31cf0650337cacc655697
SHA25659e2ac1b79840274bdfcef412a10058654e42f4285d732d1487e65e60ffbfb46
SHA5123813b81f741ae3adb07ae370e817597ed2803680841ccc7549babb727910c7bff4f8450670d0ca19a0d09e06f133a1aaefecf5b5620e1b0bdb6bcd409982c450
-
Filesize
63KB
MD5b0f1130c6da19dbdb8556f910f168420
SHA1e09ffdb725dc2ca0bc28a58a4615c0f3bcf08adb
SHA2568aeec9c0a673f2043bec795d8430c280392913ac275fbaa3380524ad2148eaf8
SHA5124d97ac1ec120120c22d2fa39c3bcdafbaf6796da4742154323860ede74a56fffadfd3734b2fcd37e60ea0334e951e3c2d7b05c52235db89bde3fa2a1424224fa
-
Filesize
85KB
MD59000a99ee61e1c87fb811a77df2e7b91
SHA161a026acdbeea3c8e68a55bce7c4803aa678adbb
SHA25647f7c69c4cc4c0feb6a6f1730d697ca95e24d5cedd490c31d8e30cd1fa3b3859
SHA512d45a1e2530143dab919b892b7e21657a2e6e62533046d75aa787da9ad012b73245aa033de5c169aed08a66fb117be1df1f87253cb4e49cf9b47b89e58d799c15
-
Filesize
49KB
MD5e9214452435d0e6f782b545ec0123331
SHA11705609d15c0c7cab4ebcb28f082cfcb8e1f80ac
SHA2567bae6ec2613874287c20ddcbdf75e7cca0ac65132485dfcfd632d0e5f97c1719
SHA51205cbe650b1ed26193128cba8d58fbe4c96ccb5931d877a6937e4a442f74412fd3cdda46b5cff4390a71133cba4c10c778377988c657eebfe5e631ae4f445ebce
-
Filesize
28KB
MD54643db3dbf75200efa97e80cfcf2da1d
SHA1cd65423fbeb54a82f1312ad96c848a261047ccba
SHA256bd5a390efa75b9a47077fa1e7558713842563ec5822eb7f1dbf35ad9020012dc
SHA512ccacfcf1e9325ee3dba0556cc527eae2b856531a7d963072181549e3e76395d42be27206f0312a5fa30d8d35df75a64382a399fb61c26cef703671fe21fb25e9
-
Filesize
39KB
MD5db87daf76c15f3808cec149f639aa64f
SHA1d67f84a44ddc25432ce179aeba9cff778af746ee
SHA256a3e4bee1b6944aa9266bd58de3f534a4c1896df621881a5252a0d355a6e67c70
SHA512ad7dc75254180ff7c988b7f394ad76b696384002457d558469d2c6401dd97cba54c532245bb555ab28d2beda3ab504736bb2b89040a21ba6598929392daab473
-
Filesize
12KB
MD5801a5d1e272399ca14ff7d6da60315ef
SHA1e546ef8f00d96404823a1ed242ed7b56167da2f7
SHA2568e816523110bb2ab5e7611c0322cc4aa2d6c8d2a899b3a03731965ed1644549b
SHA51232eeb2302cfe06e996f2d729d440fc2796d16e33fd9d793c5eaf379e8450d67e177d5c254721c6fd5636c92e55439054b982e0820a757ebd5e65584d3f0c739a
-
Filesize
7.0MB
MD5f4555fd1a0125ddf8ac8de8eec673e2b
SHA1178f12eb0fbf29bb7dd7ab8ab659eca5b2984774
SHA2564c2f94c77738275e7c4370557f19e402b48f8c82771cca538a5a95ca99f41e3a
SHA5123a43821884758df7b57861dc381d452cf03f15635aa936564d1dba24cda66b1f21042159672c6ba913e11ed209f21fb670d88c3df48d529bbd592e9e4a5d1a7e