dcrat | hxxps://github[.]com/AJMartel/MeGa-RAT-Pack

Analysis

max time kernel
743s
max time network
745s
platform
windows10-ltsc 2021_x64
resource
win10ltsc2021-20241023-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20241023-enlocale:en-usos:windows10-ltsc 2021-x64system
submitted
24-11-2024 22:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://github.com/AJMartel/MeGa-RAT-Pack

Score

10^/10

dcrat xmrig credential_access defense_evasion discovery evasion infostealer miner persistence privilege_escalation rat spyware stealer

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Dcrat family
dcrat
Xmrig family
xmrig
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 55 IoCs

miner

resource	yara_rule
behavioral1/memory/1832-469-0x0000000000400000-0x0000000000DCB000-memory.dmp	xmrig
behavioral1/memory/1832-470-0x0000000000400000-0x0000000000DCB000-memory.dmp	xmrig
behavioral1/memory/1832-471-0x0000000000400000-0x0000000000DCB000-memory.dmp	xmrig
behavioral1/memory/1832-472-0x0000000000400000-0x0000000000DCB000-memory.dmp	xmrig
behavioral1/memory/1832-473-0x0000000000400000-0x0000000000DCB000-memory.dmp	xmrig
behavioral1/memory/1832-475-0x0000000000400000-0x0000000000DCB000-memory.dmp	xmrig
behavioral1/memory/1832-506-0x0000000000400000-0x0000000000DCB000-memory.dmp	xmrig
behavioral1/memory/1832-531-0x0000000000400000-0x0000000000DCB000-memory.dmp	xmrig
behavioral1/memory/1832-544-0x0000000000400000-0x0000000000DCB000-memory.dmp	xmrig
behavioral1/memory/1832-547-0x0000000000400000-0x0000000000DCB000-memory.dmp	xmrig
behavioral1/memory/1832-549-0x0000000000400000-0x0000000000DCB000-memory.dmp	xmrig
behavioral1/memory/1832-551-0x0000000000400000-0x0000000000DCB000-memory.dmp	xmrig
behavioral1/memory/1832-561-0x0000000000400000-0x0000000000DCB000-memory.dmp	xmrig
behavioral1/memory/1832-731-0x0000000000400000-0x0000000000DCB000-memory.dmp	xmrig
behavioral1/memory/1832-780-0x0000000000400000-0x0000000000DCB000-memory.dmp	xmrig
behavioral1/memory/1832-817-0x0000000000400000-0x0000000000DCB000-memory.dmp	xmrig
behavioral1/memory/1832-820-0x0000000000400000-0x0000000000DCB000-memory.dmp	xmrig
behavioral1/memory/1832-849-0x0000000000400000-0x0000000000DCB000-memory.dmp	xmrig
behavioral1/memory/1832-850-0x0000000000400000-0x0000000000DCB000-memory.dmp	xmrig
behavioral1/memory/1832-852-0x0000000000400000-0x0000000000DCB000-memory.dmp	xmrig
behavioral1/memory/1832-856-0x0000000000400000-0x0000000000DCB000-memory.dmp	xmrig
behavioral1/memory/1832-859-0x0000000000400000-0x0000000000DCB000-memory.dmp	xmrig
behavioral1/memory/1832-860-0x0000000000400000-0x0000000000DCB000-memory.dmp	xmrig
behavioral1/memory/1832-864-0x0000000000400000-0x0000000000DCB000-memory.dmp	xmrig
behavioral1/memory/1832-865-0x0000000000400000-0x0000000000DCB000-memory.dmp	xmrig
behavioral1/memory/1832-869-0x0000000000400000-0x0000000000DCB000-memory.dmp	xmrig
behavioral1/memory/1832-873-0x0000000000400000-0x0000000000DCB000-memory.dmp	xmrig
behavioral1/memory/1832-874-0x0000000000400000-0x0000000000DCB000-memory.dmp	xmrig
behavioral1/memory/1832-875-0x0000000000400000-0x0000000000DCB000-memory.dmp	xmrig
behavioral1/memory/1832-876-0x0000000000400000-0x0000000000DCB000-memory.dmp	xmrig
behavioral1/memory/1832-877-0x0000000000400000-0x0000000000DCB000-memory.dmp	xmrig
behavioral1/memory/1832-885-0x0000000000400000-0x0000000000DCB000-memory.dmp	xmrig
behavioral1/memory/1832-983-0x0000000000400000-0x0000000000DCB000-memory.dmp	xmrig
behavioral1/memory/1832-1112-0x0000000000400000-0x0000000000DCB000-memory.dmp	xmrig
behavioral1/memory/1832-1163-0x0000000000400000-0x0000000000DCB000-memory.dmp	xmrig
behavioral1/memory/1832-1235-0x0000000000400000-0x0000000000DCB000-memory.dmp	xmrig
behavioral1/memory/1832-1269-0x0000000000400000-0x0000000000DCB000-memory.dmp	xmrig
behavioral1/memory/1832-1279-0x0000000000400000-0x0000000000DCB000-memory.dmp	xmrig
behavioral1/memory/1832-1287-0x0000000000400000-0x0000000000DCB000-memory.dmp	xmrig
behavioral1/memory/1832-1410-0x0000000000400000-0x0000000000DCB000-memory.dmp	xmrig
behavioral1/memory/1832-1470-0x0000000000400000-0x0000000000DCB000-memory.dmp	xmrig
behavioral1/memory/1832-1499-0x0000000000400000-0x0000000000DCB000-memory.dmp	xmrig
behavioral1/memory/1832-1563-0x0000000000400000-0x0000000000DCB000-memory.dmp	xmrig
behavioral1/memory/1832-1564-0x0000000000400000-0x0000000000DCB000-memory.dmp	xmrig
behavioral1/memory/1832-1565-0x0000000000400000-0x0000000000DCB000-memory.dmp	xmrig
behavioral1/memory/1832-1566-0x0000000000400000-0x0000000000DCB000-memory.dmp	xmrig
behavioral1/memory/1832-1567-0x0000000000400000-0x0000000000DCB000-memory.dmp	xmrig
behavioral1/memory/1832-1568-0x0000000000400000-0x0000000000DCB000-memory.dmp	xmrig
behavioral1/memory/1832-1569-0x0000000000400000-0x0000000000DCB000-memory.dmp	xmrig
behavioral1/memory/1832-1570-0x0000000000400000-0x0000000000DCB000-memory.dmp	xmrig
behavioral1/memory/1832-1571-0x0000000000400000-0x0000000000DCB000-memory.dmp	xmrig
behavioral1/memory/1832-1572-0x0000000000400000-0x0000000000DCB000-memory.dmp	xmrig
behavioral1/memory/1832-1573-0x0000000000400000-0x0000000000DCB000-memory.dmp	xmrig
behavioral1/memory/1832-1574-0x0000000000400000-0x0000000000DCB000-memory.dmp	xmrig
behavioral1/memory/1832-1575-0x0000000000400000-0x0000000000DCB000-memory.dmp	xmrig

Modifies Windows Firewall 2 TTPs 3 IoCs

evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
4388	netsh.exe
684	netsh.exe
5676	netsh.exe

Checks computer location settings 2 TTPs 5 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-87863914-780023816-688321450-1000\Control Panel\International\Geo\Nation	Virus Rat v8.0 Betax.exe
Key value queried	\REGISTRY\USER\S-1-5-21-87863914-780023816-688321450-1000\Control Panel\International\Geo\Nation	LimeRATx.exe
Key value queried	\REGISTRY\USER\S-1-5-21-87863914-780023816-688321450-1000\Control Panel\International\Geo\Nation	LeGend Rat v1.9x.exe
Key value queried	\REGISTRY\USER\S-1-5-21-87863914-780023816-688321450-1000\Control Panel\International\Geo\Nation	Kronus RATx.exe
Key value queried	\REGISTRY\USER\S-1-5-21-87863914-780023816-688321450-1000\Control Panel\International\Geo\Nation	njRAT v0.11Gx.exe

Executes dropped EXE 16 IoCs

pid	Process
4788	njRAT v0.11Gx.exe
1832	TiWorker.exe
4592	njRAT v0.11G.exe
5600	Server.exe
5712	Virus Rat v8.0 Betax.exe
3808	Virus Rat v8.0 Beta.exe
5240	l.exe
5772	l.exe
3416	2.exe
5472	LimeRATx.exe
1496	LimeRAT.exe
5816	LeGend Rat v1.9x.exe
6016	LeGend Rat v1.9.exe
5564	Kronus RATx.exe
1276	Kronus RAT.exe
2136	HidraForce v4.0.exe

Loads dropped DLL 4 IoCs

pid	Process
6016	LeGend Rat v1.9.exe
6016	LeGend Rat v1.9.exe
6016	LeGend Rat v1.9.exe
6016	LeGend Rat v1.9.exe

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-87863914-780023816-688321450-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\a283d5eda9cd874157adf0af127afd04 = "\"C:\\Users\\Admin\\Desktop\\Server.exe\" .."	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\a283d5eda9cd874157adf0af127afd04 = "\"C:\\Users\\Admin\\Desktop\\Server.exe\" .."	Server.exe

Indicator Removal: Clear Persistence 1 TTPs 1 IoCs

Clear artifacts associated with previously established persistence like scheduletasks on a host.

defense_evasion

Clear Persistence

T1070.009

pid	Process
4340	cmd.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 4 IoCs

Web Service

T1102

flow	ioc
69	raw.githubusercontent.com
70	raw.githubusercontent.com
89	pastebin.com
91	pastebin.com

AutoIT Executable 3 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral1/files/0x002800000004523c-436.dat	autoit_exe
behavioral1/files/0x002b00000004522f-839.dat	autoit_exe
behavioral1/files/0x002a000000045276-1255.dat	autoit_exe

Drops file in System32 directory 6 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\config.json	njRAT v0.11Gx.exe
File opened for modification	C:\Windows\SysWOW64\config.json	njRAT v0.11Gx.exe
File created	C:\Windows\SysWOW64\MicrosoftWindows.xml	njRAT v0.11Gx.exe
File opened for modification	C:\Windows\SysWOW64\MicrosoftWindows.xml	njRAT v0.11Gx.exe
File created	C:\Windows\SysWOW64\TiWorker.exe	njRAT v0.11Gx.exe
File opened for modification	C:\Windows\SysWOW64\TiWorker.exe	njRAT v0.11Gx.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\a3dc1a45-a111-4c57-a41c-bb79c7af6cf3.tmp	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\20241124220910.pma	setup.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 9 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	l.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	l.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	LeGend Rat v1.9.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	HidraForce v4.0.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Gathers network information 2 TTPs 1 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
1600	ipconfig.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-87863914-780023816-688321450-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	Virus Rat v8.0 Beta.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-87863914-780023816-688321450-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4"	njRAT v0.11G.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-87863914-780023816-688321450-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	njRAT v0.11G.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-87863914-780023816-688321450-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4"	Virus Rat v8.0 Beta.exe
Key created	\REGISTRY\USER\S-1-5-21-87863914-780023816-688321450-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1	njRAT v0.11G.exe
Key created	\REGISTRY\USER\S-1-5-21-87863914-780023816-688321450-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg	njRAT v0.11G.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-87863914-780023816-688321450-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4"	njRAT v0.11G.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-87863914-780023816-688321450-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1"	njRAT v0.11G.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-87863914-780023816-688321450-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\8\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\IconSize = "16"	Virus Rat v8.0 Beta.exe
Key created	\REGISTRY\USER\S-1-5-21-87863914-780023816-688321450-1000_Classes\Local Settings	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-87863914-780023816-688321450-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 010000000200000000000000ffffffff	njRAT v0.11G.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-87863914-780023816-688321450-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1 = 14002e803accbfb42cdb4c42b0297fe99a87c6410000	njRAT v0.11G.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-87863914-780023816-688321450-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\8\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	Virus Rat v8.0 Beta.exe
Key created	\REGISTRY\USER\S-1-5-21-87863914-780023816-688321450-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	Virus Rat v8.0 Beta.exe
Key created	\REGISTRY\USER\S-1-5-21-87863914-780023816-688321450-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg	njRAT v0.11G.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-87863914-780023816-688321450-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202020202	njRAT v0.11G.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-87863914-780023816-688321450-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\3\NodeSlot = "8"	Virus Rat v8.0 Beta.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-87863914-780023816-688321450-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\8\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByKey:PID = "0"	Virus Rat v8.0 Beta.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-87863914-780023816-688321450-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	njRAT v0.11G.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-87863914-780023816-688321450-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	njRAT v0.11G.exe
Key created	\REGISTRY\USER\S-1-5-21-87863914-780023816-688321450-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1	Virus Rat v8.0 Beta.exe
Key created	\REGISTRY\USER\S-1-5-21-87863914-780023816-688321450-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	njRAT v0.11G.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-87863914-780023816-688321450-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	njRAT v0.11G.exe
Key created	\REGISTRY\USER\S-1-5-21-87863914-780023816-688321450-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\Shell	njRAT v0.11G.exe
Key created	\REGISTRY\USER\S-1-5-21-87863914-780023816-688321450-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	njRAT v0.11G.exe
Key created	\REGISTRY\USER\S-1-5-21-87863914-780023816-688321450-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	Virus Rat v8.0 Beta.exe
Key created	\REGISTRY\USER\S-1-5-21-87863914-780023816-688321450-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	njRAT v0.11G.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-87863914-780023816-688321450-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\MRUListEx = 00000000ffffffff	njRAT v0.11G.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	njRAT v0.11G.exe
Key created	\REGISTRY\USER\S-1-5-21-87863914-780023816-688321450-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\8\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}	Virus Rat v8.0 Beta.exe
Key created	\REGISTRY\USER\S-1-5-21-87863914-780023816-688321450-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\8\ComDlg	Virus Rat v8.0 Beta.exe
Key created	\REGISTRY\USER\S-1-5-21-87863914-780023816-688321450-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	Virus Rat v8.0 Beta.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-87863914-780023816-688321450-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\8\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	Virus Rat v8.0 Beta.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-87863914-780023816-688321450-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	Virus Rat v8.0 Beta.exe
Key created	\REGISTRY\USER\S-1-5-21-87863914-780023816-688321450-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\Shell	Virus Rat v8.0 Beta.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-87863914-780023816-688321450-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16"	Virus Rat v8.0 Beta.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-87863914-780023816-688321450-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	Virus Rat v8.0 Beta.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-87863914-780023816-688321450-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	njRAT v0.11G.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-87863914-780023816-688321450-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	njRAT v0.11G.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-87863914-780023816-688321450-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\MRUListEx = 01000000030000000000000002000000ffffffff	Virus Rat v8.0 Beta.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-87863914-780023816-688321450-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\NodeSlot = "5"	njRAT v0.11G.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-87863914-780023816-688321450-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16"	njRAT v0.11G.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-87863914-780023816-688321450-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02020202020202	Virus Rat v8.0 Beta.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-87863914-780023816-688321450-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 020202	njRAT v0.11G.exe
Key created	\REGISTRY\USER\S-1-5-21-87863914-780023816-688321450-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell	njRAT v0.11G.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-87863914-780023816-688321450-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	njRAT v0.11G.exe
Key created	\REGISTRY\USER\S-1-5-21-87863914-780023816-688321450-1000_Classes\Local Settings	Virus Rat v8.0 Beta.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-87863914-780023816-688321450-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\0 = 6600310000000000785940b110004e4a524154567e312e31314700004a0009000400efbe9b4d8e6b785940b12e000000820b0400000004000000000000000000000000000000a1ff08006e006a005200410054002000760030002e0031003100470000001c000000	njRAT v0.11G.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-87863914-780023816-688321450-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257"	njRAT v0.11G.exe
Key created	\REGISTRY\USER\S-1-5-21-87863914-780023816-688321450-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5	njRAT v0.11G.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-87863914-780023816-688321450-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\8\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\Mode = "4"	Virus Rat v8.0 Beta.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-87863914-780023816-688321450-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\8\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\FFlags = "1"	Virus Rat v8.0 Beta.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-87863914-780023816-688321450-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\Shell\SniffedFolderType = "Generic"	Virus Rat v8.0 Beta.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-87863914-780023816-688321450-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\Shell\SniffedFolderType = "Generic"	njRAT v0.11G.exe
Key created	\REGISTRY\USER\S-1-5-21-87863914-780023816-688321450-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\3	Virus Rat v8.0 Beta.exe
Key created	\REGISTRY\USER\S-1-5-21-87863914-780023816-688321450-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\8\Shell	Virus Rat v8.0 Beta.exe
Key created	\REGISTRY\USER\S-1-5-21-87863914-780023816-688321450-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	njRAT v0.11G.exe
Key created	\REGISTRY\USER\S-1-5-21-87863914-780023816-688321450-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4	njRAT v0.11G.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-87863914-780023816-688321450-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	njRAT v0.11G.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-87863914-780023816-688321450-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	njRAT v0.11G.exe
Key created	\REGISTRY\USER\S-1-5-21-87863914-780023816-688321450-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\8	Virus Rat v8.0 Beta.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-87863914-780023816-688321450-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\8\Shell\SniffedFolderType = "Documents"	Virus Rat v8.0 Beta.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-87863914-780023816-688321450-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\8\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\LogicalViewMode = "1"	Virus Rat v8.0 Beta.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-87863914-780023816-688321450-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257"	Virus Rat v8.0 Beta.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
448	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4056	msedge.exe
4056	msedge.exe
4476	msedge.exe
4476	msedge.exe
3796	identity_helper.exe
3796	identity_helper.exe
3992	msedge.exe
3992	msedge.exe
4788	njRAT v0.11Gx.exe
4788	njRAT v0.11Gx.exe
4788	njRAT v0.11Gx.exe
4788	njRAT v0.11Gx.exe
4788	njRAT v0.11Gx.exe
4788	njRAT v0.11Gx.exe
4788	njRAT v0.11Gx.exe
4788	njRAT v0.11Gx.exe
6084	msedge.exe
6084	msedge.exe
6084	msedge.exe
6084	msedge.exe
5204	msedge.exe
5204	msedge.exe
1740	msedge.exe
1740	msedge.exe
5712	Virus Rat v8.0 Betax.exe
5712	Virus Rat v8.0 Betax.exe
5712	Virus Rat v8.0 Betax.exe
5712	Virus Rat v8.0 Betax.exe
5712	Virus Rat v8.0 Betax.exe
5712	Virus Rat v8.0 Betax.exe
5712	Virus Rat v8.0 Betax.exe
5712	Virus Rat v8.0 Betax.exe
5600	Server.exe
5600	Server.exe
5600	Server.exe
5600	Server.exe
5600	Server.exe
5600	Server.exe
5600	Server.exe
5600	Server.exe
5600	Server.exe
5600	Server.exe
5600	Server.exe
5600	Server.exe
5600	Server.exe
5600	Server.exe
5600	Server.exe
5600	Server.exe
5600	Server.exe
5600	Server.exe
5600	Server.exe
5600	Server.exe
5600	Server.exe
5600	Server.exe
5600	Server.exe
5600	Server.exe
5600	Server.exe
5600	Server.exe
5600	Server.exe
5600	Server.exe
5600	Server.exe
5600	Server.exe
5600	Server.exe
5600	Server.exe

Suspicious behavior: GetForegroundWindowSpam 4 IoCs

pid	Process
3808	Virus Rat v8.0 Beta.exe
5600	Server.exe
1276	Kronus RAT.exe
5240	l.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 27 IoCs

pid	Process
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeRestorePrivilege	3976	7zG.exe
Token: 35	3976	7zG.exe
Token: SeSecurityPrivilege	3976	7zG.exe
Token: SeSecurityPrivilege	3976	7zG.exe
Token: SeLockMemoryPrivilege	1832	TiWorker.exe
Token: 33	640	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	640	AUDIODG.EXE
Token: SeDebugPrivilege	4592	njRAT v0.11G.exe
Token: SeDebugPrivilege	5600	Server.exe
Token: 33	5600	Server.exe
Token: SeIncBasePriorityPrivilege	5600	Server.exe
Token: 33	5600	Server.exe
Token: SeIncBasePriorityPrivilege	5600	Server.exe
Token: 33	5600	Server.exe
Token: SeIncBasePriorityPrivilege	5600	Server.exe
Token: 33	5600	Server.exe
Token: SeIncBasePriorityPrivilege	5600	Server.exe
Token: 33	5600	Server.exe
Token: SeIncBasePriorityPrivilege	5600	Server.exe
Token: 33	5600	Server.exe
Token: SeIncBasePriorityPrivilege	5600	Server.exe
Token: 33	5600	Server.exe
Token: SeIncBasePriorityPrivilege	5600	Server.exe
Token: 33	5600	Server.exe
Token: SeIncBasePriorityPrivilege	5600	Server.exe
Token: 33	5600	Server.exe
Token: SeIncBasePriorityPrivilege	5600	Server.exe
Token: 33	5600	Server.exe
Token: SeIncBasePriorityPrivilege	5600	Server.exe
Token: 33	5600	Server.exe
Token: SeIncBasePriorityPrivilege	5600	Server.exe
Token: 33	5600	Server.exe
Token: SeIncBasePriorityPrivilege	5600	Server.exe
Token: 33	5600	Server.exe
Token: SeIncBasePriorityPrivilege	5600	Server.exe
Token: 33	5600	Server.exe
Token: SeIncBasePriorityPrivilege	5600	Server.exe
Token: 33	5600	Server.exe
Token: SeIncBasePriorityPrivilege	5600	Server.exe
Token: SeRestorePrivilege	548	7zG.exe
Token: 35	548	7zG.exe
Token: SeSecurityPrivilege	548	7zG.exe
Token: SeSecurityPrivilege	548	7zG.exe
Token: 33	5600	Server.exe
Token: SeIncBasePriorityPrivilege	5600	Server.exe
Token: 33	5600	Server.exe
Token: SeIncBasePriorityPrivilege	5600	Server.exe
Token: 33	5600	Server.exe
Token: SeIncBasePriorityPrivilege	5600	Server.exe
Token: 33	5600	Server.exe
Token: SeIncBasePriorityPrivilege	5600	Server.exe
Token: 33	5600	Server.exe
Token: SeIncBasePriorityPrivilege	5600	Server.exe
Token: 33	5600	Server.exe
Token: SeIncBasePriorityPrivilege	5600	Server.exe
Token: 33	5600	Server.exe
Token: SeIncBasePriorityPrivilege	5600	Server.exe
Token: 33	5600	Server.exe
Token: SeIncBasePriorityPrivilege	5600	Server.exe
Token: 33	5600	Server.exe
Token: SeIncBasePriorityPrivilege	5600	Server.exe
Token: 33	5600	Server.exe
Token: SeIncBasePriorityPrivilege	5600	Server.exe
Token: 33	5600	Server.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
3976	7zG.exe
4592	njRAT v0.11G.exe
4592	njRAT v0.11G.exe
4592	njRAT v0.11G.exe
4592	njRAT v0.11G.exe
4592	njRAT v0.11G.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4592	njRAT v0.11G.exe
4592	njRAT v0.11G.exe
4592	njRAT v0.11G.exe
4592	njRAT v0.11G.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
3808	Virus Rat v8.0 Beta.exe
3808	Virus Rat v8.0 Beta.exe
3808	Virus Rat v8.0 Beta.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe

Suspicious use of SetWindowsHookEx 13 IoCs

pid	Process
4788	njRAT v0.11Gx.exe
4592	njRAT v0.11G.exe
5712	Virus Rat v8.0 Betax.exe
3808	Virus Rat v8.0 Beta.exe
3808	Virus Rat v8.0 Beta.exe
5240	l.exe
3808	Virus Rat v8.0 Beta.exe
5472	LimeRATx.exe
5816	LeGend Rat v1.9x.exe
6016	LeGend Rat v1.9.exe
6016	LeGend Rat v1.9.exe
5564	Kronus RATx.exe
3500	HidraForce v4.0x.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4476 wrote to memory of 2340	4476	msedge.exe	80
PID 4476 wrote to memory of 2340	4476	msedge.exe	80
PID 4476 wrote to memory of 216	4476	msedge.exe	81
PID 4476 wrote to memory of 216	4476	msedge.exe	81
PID 4476 wrote to memory of 216	4476	msedge.exe	81
PID 4476 wrote to memory of 216	4476	msedge.exe	81
PID 4476 wrote to memory of 216	4476	msedge.exe	81
PID 4476 wrote to memory of 216	4476	msedge.exe	81
PID 4476 wrote to memory of 216	4476	msedge.exe	81
PID 4476 wrote to memory of 216	4476	msedge.exe	81
PID 4476 wrote to memory of 216	4476	msedge.exe	81
PID 4476 wrote to memory of 216	4476	msedge.exe	81
PID 4476 wrote to memory of 216	4476	msedge.exe	81
PID 4476 wrote to memory of 216	4476	msedge.exe	81
PID 4476 wrote to memory of 216	4476	msedge.exe	81
PID 4476 wrote to memory of 216	4476	msedge.exe	81
PID 4476 wrote to memory of 216	4476	msedge.exe	81
PID 4476 wrote to memory of 216	4476	msedge.exe	81
PID 4476 wrote to memory of 216	4476	msedge.exe	81
PID 4476 wrote to memory of 216	4476	msedge.exe	81
PID 4476 wrote to memory of 216	4476	msedge.exe	81
PID 4476 wrote to memory of 216	4476	msedge.exe	81
PID 4476 wrote to memory of 216	4476	msedge.exe	81
PID 4476 wrote to memory of 216	4476	msedge.exe	81
PID 4476 wrote to memory of 216	4476	msedge.exe	81
PID 4476 wrote to memory of 216	4476	msedge.exe	81
PID 4476 wrote to memory of 216	4476	msedge.exe	81
PID 4476 wrote to memory of 216	4476	msedge.exe	81
PID 4476 wrote to memory of 216	4476	msedge.exe	81
PID 4476 wrote to memory of 216	4476	msedge.exe	81
PID 4476 wrote to memory of 216	4476	msedge.exe	81
PID 4476 wrote to memory of 216	4476	msedge.exe	81
PID 4476 wrote to memory of 216	4476	msedge.exe	81
PID 4476 wrote to memory of 216	4476	msedge.exe	81
PID 4476 wrote to memory of 216	4476	msedge.exe	81
PID 4476 wrote to memory of 216	4476	msedge.exe	81
PID 4476 wrote to memory of 216	4476	msedge.exe	81
PID 4476 wrote to memory of 216	4476	msedge.exe	81
PID 4476 wrote to memory of 216	4476	msedge.exe	81
PID 4476 wrote to memory of 216	4476	msedge.exe	81
PID 4476 wrote to memory of 216	4476	msedge.exe	81
PID 4476 wrote to memory of 216	4476	msedge.exe	81
PID 4476 wrote to memory of 4056	4476	msedge.exe	82
PID 4476 wrote to memory of 4056	4476	msedge.exe	82
PID 4476 wrote to memory of 1124	4476	msedge.exe	83
PID 4476 wrote to memory of 1124	4476	msedge.exe	83
PID 4476 wrote to memory of 1124	4476	msedge.exe	83
PID 4476 wrote to memory of 1124	4476	msedge.exe	83
PID 4476 wrote to memory of 1124	4476	msedge.exe	83
PID 4476 wrote to memory of 1124	4476	msedge.exe	83
PID 4476 wrote to memory of 1124	4476	msedge.exe	83
PID 4476 wrote to memory of 1124	4476	msedge.exe	83
PID 4476 wrote to memory of 1124	4476	msedge.exe	83
PID 4476 wrote to memory of 1124	4476	msedge.exe	83
PID 4476 wrote to memory of 1124	4476	msedge.exe	83
PID 4476 wrote to memory of 1124	4476	msedge.exe	83
PID 4476 wrote to memory of 1124	4476	msedge.exe	83
PID 4476 wrote to memory of 1124	4476	msedge.exe	83
PID 4476 wrote to memory of 1124	4476	msedge.exe	83
PID 4476 wrote to memory of 1124	4476	msedge.exe	83
PID 4476 wrote to memory of 1124	4476	msedge.exe	83
PID 4476 wrote to memory of 1124	4476	msedge.exe	83
PID 4476 wrote to memory of 1124	4476	msedge.exe	83
PID 4476 wrote to memory of 1124	4476	msedge.exe	83

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://github.com/AJMartel/MeGa-RAT-Pack
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x124,0x128,0x12c,0x100,0x130,0x7ffe9c7346f8,0x7ffe9c734708,0x7ffe9c734718
  2⤵
  PID:2340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2140,800591641684552216,10565991234023758539,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2168 /prefetch:2
  2⤵
  PID:216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2140,800591641684552216,10565991234023758539,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2308 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2140,800591641684552216,10565991234023758539,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2744 /prefetch:8
  2⤵
  PID:1124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,800591641684552216,10565991234023758539,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3396 /prefetch:1
  2⤵
  PID:4024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,800591641684552216,10565991234023758539,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3404 /prefetch:1
  2⤵
  PID:3076
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2140,800591641684552216,10565991234023758539,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5616 /prefetch:8
  2⤵
  PID:1320
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings
  2⤵
  - Drops file in Program Files directory
  PID:2460
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x248,0x24c,0x250,0x224,0x254,0x7ff7113a5460,0x7ff7113a5470,0x7ff7113a5480
    3⤵
    PID:3816
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2140,800591641684552216,10565991234023758539,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5616 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,800591641684552216,10565991234023758539,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5652 /prefetch:1
  2⤵
  PID:4812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,800591641684552216,10565991234023758539,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5676 /prefetch:1
  2⤵
  PID:1980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,800591641684552216,10565991234023758539,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3444 /prefetch:1
  2⤵
  PID:3652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,800591641684552216,10565991234023758539,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5956 /prefetch:1
  2⤵
  PID:2400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2140,800591641684552216,10565991234023758539,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=3448 /prefetch:8
  2⤵
  PID:2796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,800591641684552216,10565991234023758539,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6236 /prefetch:1
  2⤵
  PID:984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2140,800591641684552216,10565991234023758539,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6436 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2140,800591641684552216,10565991234023758539,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.4355 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5200 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:6084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,800591641684552216,10565991234023758539,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5752 /prefetch:1
  2⤵
  PID:4372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,800591641684552216,10565991234023758539,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5804 /prefetch:1
  2⤵
  PID:5192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2140,800591641684552216,10565991234023758539,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6844 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,800591641684552216,10565991234023758539,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5816 /prefetch:1
  2⤵
  PID:6120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,800591641684552216,10565991234023758539,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3472 /prefetch:1
  2⤵
  PID:6112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2140,800591641684552216,10565991234023758539,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6800 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,800591641684552216,10565991234023758539,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5948 /prefetch:1
  2⤵
  PID:3636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,800591641684552216,10565991234023758539,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5920 /prefetch:1
  2⤵
  PID:2428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,800591641684552216,10565991234023758539,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2668 /prefetch:1
  2⤵
  PID:2160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2140,800591641684552216,10565991234023758539,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6984 /prefetch:8
  2⤵
  PID:3292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,800591641684552216,10565991234023758539,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5912 /prefetch:1
  2⤵
  PID:1208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,800591641684552216,10565991234023758539,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4884 /prefetch:1
  2⤵
  PID:5972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,800591641684552216,10565991234023758539,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3500 /prefetch:1
  2⤵
  PID:380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2140,800591641684552216,10565991234023758539,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6268 /prefetch:8
  2⤵
  PID:4520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,800591641684552216,10565991234023758539,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5824 /prefetch:1
  2⤵
  PID:5468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,800591641684552216,10565991234023758539,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1708 /prefetch:1
  2⤵
  PID:5792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,800591641684552216,10565991234023758539,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2680 /prefetch:1
  2⤵
  PID:2488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,800591641684552216,10565991234023758539,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5272 /prefetch:1
  2⤵
  PID:5372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2140,800591641684552216,10565991234023758539,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6248 /prefetch:8
  2⤵
  PID:2080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,800591641684552216,10565991234023758539,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5440 /prefetch:1
  2⤵
  PID:2480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,800591641684552216,10565991234023758539,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7164 /prefetch:1
  2⤵
  PID:1864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,800591641684552216,10565991234023758539,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=47 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6696 /prefetch:1
  2⤵
  PID:1956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2140,800591641684552216,10565991234023758539,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4440 /prefetch:8
  2⤵
  PID:5248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2140,800591641684552216,10565991234023758539,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3768 /prefetch:8
  2⤵
  PID:1104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2140,800591641684552216,10565991234023758539,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5380 /prefetch:8
  2⤵
  PID:2296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2140,800591641684552216,10565991234023758539,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6836 /prefetch:8
  2⤵
  PID:1460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2140,800591641684552216,10565991234023758539,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6892 /prefetch:8
  2⤵
  PID:4536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2140,800591641684552216,10565991234023758539,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5072 /prefetch:8
  2⤵
  PID:6056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2140,800591641684552216,10565991234023758539,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=932 /prefetch:8
  2⤵
  PID:1800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2140,800591641684552216,10565991234023758539,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6284 /prefetch:8
  2⤵
  PID:3708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2140,800591641684552216,10565991234023758539,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3092 /prefetch:8
  2⤵
  PID:2176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,800591641684552216,10565991234023758539,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=58 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6472 /prefetch:1
  2⤵
  PID:2200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2140,800591641684552216,10565991234023758539,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6960 /prefetch:8
  2⤵
  PID:4500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,800591641684552216,10565991234023758539,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=61 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1764 /prefetch:1
  2⤵
  PID:5072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,800591641684552216,10565991234023758539,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=63 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5896 /prefetch:1
  2⤵
  PID:1384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2140,800591641684552216,10565991234023758539,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7060 /prefetch:8
  2⤵
  PID:3904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2140,800591641684552216,10565991234023758539,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6264 /prefetch:8
  2⤵
  PID:3392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2140,800591641684552216,10565991234023758539,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4972 /prefetch:8
  2⤵
  PID:2132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2140,800591641684552216,10565991234023758539,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6244 /prefetch:8
  2⤵
  PID:4260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2140,800591641684552216,10565991234023758539,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6884 /prefetch:8
  2⤵
  PID:1496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2140,800591641684552216,10565991234023758539,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5792 /prefetch:8
  2⤵
  PID:3580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2140,800591641684552216,10565991234023758539,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4868 /prefetch:8
  2⤵
  PID:5224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2140,800591641684552216,10565991234023758539,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6136 /prefetch:8
  2⤵
  PID:4592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2140,800591641684552216,10565991234023758539,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1676 /prefetch:8
  2⤵
  PID:2640

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3484

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1828

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:880

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Desktop\" -an -ai#7zMap23776:82:7zEvent15523
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:3976

C:\Users\Admin\Desktop\njRAT v0.11G\njRAT v0.11Gx.exe
"C:\Users\Admin\Desktop\njRAT v0.11G\njRAT v0.11Gx.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4788
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /End /TN "Microsoft\Windows\MUI\WindowsUpdate" & schtasks /End /TN "WindowsUpdate" & exit
  2⤵
  PID:5048
- - C:\Windows\system32\schtasks.exe
    schtasks /End /TN "Microsoft\Windows\MUI\WindowsUpdate"
    3⤵
    PID:2700
- - C:\Windows\system32\schtasks.exe
    schtasks /End /TN "WindowsUpdate"
    3⤵
    PID:4560
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /Delete /TN "WindowsUpdate" /F & exit
  2⤵
  - Indicator Removal: Clear Persistence
  PID:4340
- - C:\Windows\system32\schtasks.exe
    schtasks /Delete /TN "WindowsUpdate" /F
    3⤵
    PID:1868
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh advfirewall firewall add rule name="System" dir=out action=allow program="%windir%\SysWOW64\TiWorker.exe" enable=yes & exit
  2⤵
  PID:3500
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="System" dir=out action=allow program="C:\Windows\SysWOW64\TiWorker.exe" enable=yes
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    PID:4388
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh advfirewall firewall add rule name="System" dir=in action=allow program="%windir%\SysWOW64\TiWorker.exe" enable=yes & exit
  2⤵
  PID:1380
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="System" dir=in action=allow program="C:\Windows\SysWOW64\TiWorker.exe" enable=yes
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    PID:684
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /Create /XML "%windir%\SysWOW64\MicrosoftWindows.xml" /TN "Microsoft\Windows\MUI\WindowsUpdate" /F & exit
  2⤵
  PID:4592
- - C:\Windows\system32\schtasks.exe
    schtasks /Create /XML "C:\Windows\SysWOW64\MicrosoftWindows.xml" /TN "Microsoft\Windows\MUI\WindowsUpdate" /F
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:448
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /Change /TN "Microsoft\Windows\MUI\WindowsUpdate" /TR "%windir%\SysWOW64\TiWorker.exe" & schtasks /Run /TN "Microsoft\Windows\MUI\WindowsUpdate" & exit
  2⤵
  PID:4340
- - C:\Windows\system32\schtasks.exe
    schtasks /Change /TN "Microsoft\Windows\MUI\WindowsUpdate" /TR "C:\Windows\SysWOW64\TiWorker.exe"
    3⤵
    PID:4776
- - C:\Windows\system32\schtasks.exe
    schtasks /Run /TN "Microsoft\Windows\MUI\WindowsUpdate"
    3⤵
    PID:2140
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c certutil –addstore –f root MicrosoftWindows.crt & exit
  2⤵
  PID:2588
- - C:\Windows\system32\certutil.exe
    certutil –addstore –f root MicrosoftWindows.crt
    3⤵
    PID:2744
- C:\Users\Admin\Desktop\njRAT v0.11G\njRAT v0.11G.exe
  "C:\Users\Admin\Desktop\njRAT v0.11G\njRAT v0.11G.exe"
  2⤵
  - Executes dropped EXE
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:4592

C:\Windows\SysWOW64\TiWorker.exe
"C:\Windows\SysWOW64\TiWorker.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1832
- C:\Windows\System32\Conhost.exe
  \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
  2⤵
  PID:684

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x4cc 0x2fc
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:640

C:\Users\Admin\Desktop\Server.exe
"C:\Users\Admin\Desktop\Server.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:5600
- C:\Windows\SysWOW64\netsh.exe
  netsh firewall add allowedprogram "C:\Users\Admin\Desktop\Server.exe" "Server.exe" ENABLE
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:5676

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Desktop\" -an -ai#7zMap20134:96:7zEvent23552
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:548

C:\Users\Admin\Desktop\Virus Rat v8.0 Beta\Virus Rat v8.0 Betax.exe
"C:\Users\Admin\Desktop\Virus Rat v8.0 Beta\Virus Rat v8.0 Betax.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:5712
- C:\Users\Admin\Desktop\Virus Rat v8.0 Beta\Virus Rat v8.0 Beta.exe
  "C:\Users\Admin\Desktop\Virus Rat v8.0 Beta\Virus Rat v8.0 Beta.exe"
  2⤵
  - Executes dropped EXE
  - Modifies registry class
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:3808

C:\Users\Admin\Desktop\l.exe
"C:\Users\Admin\Desktop\l.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:5240

C:\Users\Admin\Desktop\l.exe
"C:\Users\Admin\Desktop\l.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5772

C:\Users\Admin\Desktop\2.exe
"C:\Users\Admin\Desktop\2.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3416

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Desktop\" -an -ai#7zMap22035:92:7zEvent23944
1⤵
PID:5592

C:\Users\Admin\Desktop\LimeRAT v0.1.8.5C\LimeRATx.exe
"C:\Users\Admin\Desktop\LimeRAT v0.1.8.5C\LimeRATx.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:5472
- C:\Users\Admin\Desktop\LimeRAT v0.1.8.5C\LimeRAT.exe
  "C:\Users\Admin\Desktop\LimeRAT v0.1.8.5C\LimeRAT.exe"
  2⤵
  - Executes dropped EXE
  PID:1496
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\Desktop\LimeRAT v0.1.8.5C\MISC\Support\Guidance.html
    3⤵
    PID:6092
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x144,0x148,0x14c,0x120,0x150,0x7ffe9c7346f8,0x7ffe9c734708,0x7ffe9c734718
      4⤵
      PID:2800

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Desktop\" -an -ai#7zMap24320:88:7zEvent27279
1⤵
PID:5284

C:\Users\Admin\Desktop\LeGend Rat v1.9\LeGend Rat v1.9x.exe
"C:\Users\Admin\Desktop\LeGend Rat v1.9\LeGend Rat v1.9x.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:5816
- C:\Users\Admin\Desktop\LeGend Rat v1.9\LeGend Rat v1.9.exe
  "C:\Users\Admin\Desktop\LeGend Rat v1.9\LeGend Rat v1.9.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:6016

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x4cc 0x2fc
1⤵
PID:5156

C:\Windows\SysWOW64\werfault.exe
werfault.exe /h /shared Global\7b06adf0831b427bbf9647b5e1342d29 /t 5832 /p 6016
1⤵
PID:5660

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Desktop\" -an -ai#7zMap25218:78:7zEvent12755
1⤵
PID:3148

C:\Users\Admin\Desktop\Kronus RAT\Kronus RATx.exe
"C:\Users\Admin\Desktop\Kronus RAT\Kronus RATx.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:5564
- C:\Users\Admin\Desktop\Kronus RAT\Kronus RAT.exe
  "C:\Users\Admin\Desktop\Kronus RAT\Kronus RAT.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: GetForegroundWindowSpam
  PID:1276

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe"
1⤵
PID:4760
- C:\Windows\system32\ipconfig.exe
  ipconfig
  2⤵
  - Gathers network information
  PID:1600

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Desktop\" -an -ai#7zMap8502:98:7zEvent23250
1⤵
PID:5300

C:\Users\Admin\Desktop\Hidra Force v4.0 (9)\Hidra Force v4.0\HidraForce v4.0x.exe
"C:\Users\Admin\Desktop\Hidra Force v4.0 (9)\Hidra Force v4.0\HidraForce v4.0x.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:3500
- C:\Users\Admin\Desktop\Hidra Force v4.0 (9)\Hidra Force v4.0\HidraForce v4.0.exe
  "C:\Users\Admin\Desktop\Hidra Force v4.0 (9)\Hidra Force v4.0\HidraForce v4.0.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2136

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Indicator Removal

T1070

Clear Persistence

T1070.009

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
6dda6e078b56bc17505e368f3e845302

SHA1
45fbd981fbbd4f961bf72f0ac76308fc18306cba

SHA256
591bf3493eb620a3851c0cd65bff79758a09c61e9a22ea113fa0480404a38b15

SHA512
9e460013fd043cee9bdbcdaf96ac2f7e21a08e88ddb754dddbd8378ee2288d50271e66b42092d84a12e726469465185be11a6fafab6ed4236a244524bd60f502

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f6126b3cef466f7479c4f176528a9348

SHA1
87855913d0bfe2c4559dd3acb243d05c6d7e4908

SHA256
588138bf57e937e1dec203a5073c3edb1e921c066779e893342e79e3d160e0b4

SHA512
ef622b26c8cee1f767def355b2d7bffb2b28e7a653c09b7e2d33f6468a453fff39fd120cacbffd79ce35722592af0f3fb7d5054e2dca06310e44dc460533f3d8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000002

Filesize
38KB

MD5
4a6a239f02877981ae8696fbebde3fc9

SHA1
5f87619e1207d7983c8dfceaac80352d25a336cf

SHA256
ac546e02b937ee9ac6f6dd99081db747db7af6a4febf09cbe49e91452d9257b8

SHA512
783cf2ae4ba57031c7f4c18bdac428a1074bb64f6eb8cef126ad33f46c08767deeac51917bef0f1595295b9f8a708cb297b7cf63fc3f7db0aa4ac217ce10f7cf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000003

Filesize
20KB

MD5
b701fd5ce841ce90ff569c641bf0cbfd

SHA1
923ef9dff528ad65b6f135828aa39340be591a9c

SHA256
26ac894bd46903e9b8d08bf85cf4c7795e88f7c9dd85717b7560e16acc007fe3

SHA512
67d8cbd5ca9334aa5c784bb73b2057d28e2a3687341cd62358b5c5211ba833e10909dada2069b49b0ef328c1a40d8e02b58d27385e3d944eacde240a4bcf2fde

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000004

Filesize
37KB

MD5
d34875fe1c47517f4081a1e2c5bc91f9

SHA1
204fed3cda5eea26388e139dd1600682e7665cf6

SHA256
aff6fc26fb0c69a279bdf9b32b4d2560cd47039470cca8248534daf8d0876186

SHA512
aa164260951708910e1cc3d83c17f2d176427dcbe53e1e13cb539d65317a1750bd1e482850049e9c126aa5e70fbdd72db13d50367b90c8b8b37f01a264ecb148

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000006

Filesize
16KB

MD5
da4fb15960b623d2d1e45e712eab4e9e

SHA1
4daa448effcf03190d1a8b38b4cd377d8a1bf0b8

SHA256
04a50722e2d7f3138fb002ddfd8dab1b0bf44803960fae3dd1f336118d8940db

SHA512
05a0acdcee52bc0708da2ee4a1da468e07ae8ed525e0d4552f36fa9bd3f465d5f982e2d58f07cecfe78b0834003754f1d0adacdfac70b3b1bc2a85973e4f1ab0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000007

Filesize
38KB

MD5
f6c1297fae3fc10f55d4959d9dc771ce

SHA1
2df076464b94b7b06d771f3ef68e7a1403ec3d82

SHA256
9aa5a405e664c215a315b794668de2faf252ee0bc0694596d82a1c0e91564ae3

SHA512
d0d3e4a6fda2f9abb60d05befceaec9f1dec9d5dd4a31df5eeb94f0c1c545cfdbf70b862d0340a460e6d0cc62b8df16d3ea839683fa534c67030e70a181659db

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000008

Filesize
53KB

MD5
cfff8fc00d16fc868cf319409948c243

SHA1
b7e2e2a6656c77a19d9819a7d782a981d9e16d44

SHA256
51266cbe2741a46507d1bb758669d6de3c2246f650829774f7433bc734688a5a

SHA512
9d127abfdf3850998fd0d2fb6bd106b5a40506398eb9c5474933ff5309cdc18c07052592281dbe1f15ea9d6cb245d08ff09873b374777d71bbbc6e0594bde39b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000009

Filesize
24KB

MD5
4b3e8a18f156298bce6eda1280ff618d

SHA1
c929ff9c0cb0715dc5ab9fa66a469cb18106ed0e

SHA256
eb8429f5918f8dfb14c7f8b32620f3516303c812869e9e8d1059e759a1550b49

SHA512
e51a54976d11fe25486d35ba92f99b8de28222a7dca8c272dfc43d8f0bc1d34b6259797fd5a7aad9c1553c0881772875ba90e7d99f6175d16ffdd00586fe8ba3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000a

Filesize
88KB

MD5
76d82c7d8c864c474936304e74ce3f4c

SHA1
8447bf273d15b973b48937326a90c60baa2903bf

SHA256
3329378951655530764aaa1f820b0db86aa0f00834fd7f51a48ad752610d60c8

SHA512
a0fc55af7f35ad5f8ac24cea6b9688698909a2e1345460d35e7133142a918d9925fc260e08d0015ec6fa7721fbeae90a4457caa97d6ce01b4ff46109f4cd5a46

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000b

Filesize
18KB

MD5
2e23d6e099f830cf0b14356b3c3443ce

SHA1
027db4ff48118566db039d6b5f574a8ac73002bc

SHA256
7238196a5bf79e1b83cacb9ed4a82bf40b32cd789c30ef790e4eac0bbf438885

SHA512
165b1de091bfe0dd9deff0f8a3968268113d95edc9fd7a8081b525e0910f4442cfb3b4f5ac58ecfa41991d9dcabe5aa8b69f7f1c77e202cd17dd774931662717

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000c

Filesize
59KB

MD5
5bead0d2b2685032fc3f12b5a4f72a21

SHA1
118ba82f13acc96cc2b28a1192947b81fbe88c2a

SHA256
b74d05151579f9564a39b1287d81d6574c90ecebfdff9106480e29bf816fb610

SHA512
653583a04218e9cacfd813458e28bf8b784cde06a74672948a5b864216ead351a00f8d62ef6e06ea8e85e43048df27d8b6b0c8432d5842c8f3ee7bbbfae325fc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000d

Filesize
101KB

MD5
9a861a6a772b86aaa2cc92e55adf3912

SHA1
85156e7eaf0d3bff66bd6119093610e8d9e8e5d2

SHA256
6e7cc83f3b23d5f48bafdd934321de60485eb8d9ced04c6299e07dc6bcbc0d1b

SHA512
b0a051e2e703227a55674fe235a97643ab1478af2384a5a974605cdd0e4ed79916d65e2adf61d19f59779da920699e74ac72cce05ec078f22f9b6678c5022a26

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000f

Filesize
19KB

MD5
1e53408e78feddaa3dea2f0014d5dead

SHA1
3dbd20f4511465b8b18e4681ea24f9e0140307cf

SHA256
deb39cbf92259253ae2c5627f31489104612379e8d781a7b2bce775682c2d833

SHA512
601a7dd43d4e43ad479b4241d02652c5523b2bd900118bb2cfd579bfa451e96a6328723c61146ebc113e79c03bf718464504d43502836250fd6b3752e13d6467

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000011

Filesize
19KB

MD5
923ab2519b04aea8cba5847f455b1f36

SHA1
62c1484e3932dd60bee7aa0b745c677bda617524

SHA256
f7e6eedbd48abc94e3a45b163d4a383109ea030c44d79087f696cfb0ab6c0564

SHA512
90a7f94d71372ebaa918513252b0df68a760c63f471609fa45d8b5b7ce48ffa9d36302f0dd0fab0564567c913a33a1e078687e687ca01fb6e6b26b47c0ff8575

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000012

Filesize
65KB

MD5
9ed7332eafdace9fa537d85edd315ec7

SHA1
94f0bed557290420e9d672c9a6382f25d5950d13

SHA256
c0d22a1d8cfca056cbc9961b1fb30aa1b7500a597b009e5f8effe8fe62f9a392

SHA512
87d6a8fcc27ccd9000a013e753e5046e2b4bfb09789ef410df522b0d9edc9b1eb399f4170d93c382bcca9428acfd48f5d113ad7d8645d5818b8769688e1f1519

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\06ee5c702acf5b4d_0

Filesize
1KB

MD5
cde8abb799dd69cf61c5245cbacca37e

SHA1
3a1da7d0da647746993379cbe35604ee1877b5d9

SHA256
06f3ec062d0d3bd24af12ad8bce092d05f6d327162dea8948216b6bc3155c9c4

SHA512
29b196ebc7b51d9b702f2885ef32d0f819cabce6a28ed9d56cd00a62812bd9a14f7734cedf270e64a0ed42819f6e644075f7034a94cd7ecd9651cb44694a00e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\0c2ca087b0d95fc8_0

Filesize
7KB

MD5
f31a162b73ace0cd8c1b84a53016225e

SHA1
992c79ee9fd74f93f0ced5a6799b915e407ca944

SHA256
23e14e97dfcc1f2a2e4383ddfe85fc5b2ad0aacf96e303fc4080fed2b954d3f1

SHA512
90bd79b03d8e837beb8f68c386c44d1482f1c17e102b601e6016e1c167e6a555036523bc0855e8294f10548ef32b6c845ce2648699eb399b6abe59ae2affcdf6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\1032ec4e6fe12574_0

Filesize
2KB

MD5
03e19705139b1859e245f2bfa281b847

SHA1
7051a952d277f739c123b6b917078110eb434c48

SHA256
31cff09bbe282f29a5c98a496ff503279f25704634570a38c27775178de899e5

SHA512
d2bf675b21f645ebd06029e10d96383d7adde72109fd128a523868e07a44f1cd7b22da6659117949f9f91fa7d2a074eb966354df5fdcc6d6c8a33c52f42e640b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\104824d6ecdb971a_0

Filesize
4KB

MD5
5f859d5062528648872cbd5b28d9d5f9

SHA1
aa9d1e8a8639a939d795cb8dfdd50686e714c441

SHA256
cbae8ac52630a7141b3d3dfa747bd79346663d8c0aca10209bf6ee381d0c025c

SHA512
0f1507772f61d8ac96e7e9125e6e04f0cf8714e233ec34061aa813e3c6eb006882a3e737712206802ac7bd791bdbb03c931cd06e28403a6d089fc5837b1c14b8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\186ac216b8a002bb_0

Filesize
1KB

MD5
805f865c9ddee9d156e27a8aa7a0019b

SHA1
30211f0a3bef30ad466ec7598a543cf1e7c0c90e

SHA256
b3ddc965cff225ce5e60126f2b0e61a3bb1883a71a3d564b2327501f1431719c

SHA512
b484cac4ba16148f7743e5abf1b50bfd50633cd676e169b98c6d705cd27d1b854efcbf5873b3a0b7334c062c534f61c3a1f80e6bf7389b60556e0808337d4750

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\1b6753ef78015a7c_0

Filesize
2KB

MD5
735715f06921b7feb8b9911e0d243d03

SHA1
4e1efa19138e6ed436402c16702b538ba560aeb3

SHA256
b8c3bd2868c7a367821cbbcbc9ceba2e97723f6d7cb2374dc2dd2dc27f014fd9

SHA512
1eba960e85758f87116fd8d7ca4dc427ddcdb1c14977915b49944d83ddcd24050f521b2344ba81e3f47e9d3855c953e2ad08cb40b04a249dc501f866f465c749

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\1c1b6c13b94c6b24_0

Filesize
5KB

MD5
9b418983ed8fa81f0fd1840c1ec8a957

SHA1
74ee7e2fba66565d4ecc61cefa4a6975f699d879

SHA256
fd593c507840581f344e28129fac1fe9dc3074c4aa671871ecd72432936147af

SHA512
ab1489d1fcaef7f71474bc90ab6f394a042b5119c9bdc036e48fa2ad4e4a951f6e2162cb53fabedbe36b7153e08fe9396b796a300a7912af6ae61e990f1fc3ec

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\2005abd1c10ed4cf_0

Filesize
1KB

MD5
6f2d7bd8a63c67e2072075178ec898fc

SHA1
c216b0e673056615be4ae012b610791bb82f9f97

SHA256
4c032e1676c96184b529a1227e9d276e8e299fd374352f7b31cc14e490a4c733

SHA512
2e74587219f787ccd74699390eb358d5fe37758884d8cc66b4ca7fa9143ea60bb6f5b5ce0189ce0d4fd2a72ea46bd167fd4b7358614d11e73fef2e3e0b3de7cd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\21adacea2b7bd078_0

Filesize
75KB

MD5
c15cda10a5403694424eecb2d8cb295a

SHA1
b4bf32069abd86ac31eab3bfb1f63c81658523fd

SHA256
0a709b41a62f659bb455fbc197ecb9e60b894ef5d033080d16389daee0b9bfbd

SHA512
6c3663000a6674c72e17493efe76d799bbab7858e1fa5bf5f8c04cc0e50416ff787050671cdb43df16c7b4e464e9c4f21b2d92ba38da7fd5c799b9450b97122a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\22510e6f41637f30_0

Filesize
1KB

MD5
854a94e1a83a2c9c45841cd88dd72b07

SHA1
ac68266a26b99382872ef62a9dd48b897d172719

SHA256
694508ef67cf8e2c0cdda2dc240ce5afd97a43a05fdde33dd191fc61521560e3

SHA512
fb4945c2240609c8b55e5c969803860b244b4b9993f6d73d31c529ef824a90cb05891827561cb42397256a37362aee2a77e94c6c5fd5e7e99977c4cc6ff3f428

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\27af1c8d2db74e2f_0

Filesize
1KB

MD5
eb1247b21e6872baf1a65347910b784e

SHA1
7ec62032e68458a224109f2a4d8d7fcc2c5cfeb7

SHA256
097806649390aa3d1f09dd3b43000d2d326c97477b240a3daa1c80022433fc3f

SHA512
601db7b75515a4961c6537fe77ae88d3e87a0963e178c174807cd73148025bf4d54045b36bd4e675ed7e2e1064963c242bc73defafe0a5f49df3c522483b4491

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\2971f80f10bd8d9b_0

Filesize
1KB

MD5
3297cc219547809a038a9818c20dfe7b

SHA1
e5676ff39e25ee450c32906f162012145e722493

SHA256
2c240900eaeac64250741d8d17fd8ff6038d7b5c1290dbfdd61dbba6e74416ec

SHA512
74dd4358eb3618ff3df100747634241bb580d56fcf4bc0dbec21294474b7f9a81ce3da475173c5809a9118cd28d479175ea07c4ffd51863e25a9d0281d21908c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\30a58d4cf6a6cbd9_0

Filesize
1KB

MD5
79a59c80eaaa99cf290e105313476ace

SHA1
2986af405ec20dfecb309e99897d77e171ddf1ae

SHA256
3a74d2b6120d9c490c45988b4e4c4f421327e274227f7daf7a58281a3df4897a

SHA512
e6db019fcd1ea09de0e0361b4adf39096e9960f81a674c3ed267ea277e621aa0f995749a0477ba27f5e24412892687835434ee18fb73183bc16e2b4c611ece87

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\31d3611f0e13cd20_0

Filesize
1KB

MD5
765cdae027751a83df89b49db8962540

SHA1
8fe5a8ea3edca0770bbeb5d32c1beb783d336149

SHA256
ba36f50fe48fa7b219f5ae7b07a197548de307dcc03b4b5e0729f9c456565e1c

SHA512
b8b25bb99b34fb82212c47cb9c11822e1ce8d5553f7bc4ebdbd041b9194d52411bc9a36da35aaf5fb8f4c1889d00db648b603de3631229da92846036b7b4e580

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\368e6d8695dab822_0

Filesize
1KB

MD5
24acdcf260fa5b47648313e961059535

SHA1
d2c1320a1e0e4f823c4f3f160fe0b15b03127d4f

SHA256
880668962e995963be5f217290651c4c3ab22603333913eb5d09471655e2b872

SHA512
22ab9fa22d4fcb5b0bdfebd4ce5265b566b75205ce4cc8c3dea8c8382bdf95b4c3f17988e8de6e8e2760798ff8b38fc771db8ffb7f751dc70f0fd730bd3bfc0e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\3c2fdbb61f728b10_0

Filesize
25KB

MD5
85f0fc06d5a7068e48886860b4cc3fde

SHA1
138a4b3ccc1cea7ea4fbc0f9892154a52512599d

SHA256
41079496b74dc5f21d9209cf50c03debda09b26c1586d9105ba6cb0b083cf202

SHA512
98022ceae7f27a8760bbc036742241e94b03b5d6ec9c5b66aecaaa722085d824e0a27766e8da34d366f8faed959f3955e17d5a3823ec139f5f91f2adf74f9e21

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\3ee4296198224a06_0

Filesize
1KB

MD5
22e0bf22868ec6d5bdde0b976b61276b

SHA1
9451e7065d764577ceea5b54e6f42c615eeebf49

SHA256
b04bd9f9768514a501135220f513cdda3a74d57eaa5dfe0821c9a32d9e8a1bef

SHA512
17e7470ba085b6c376031b03790d977824f29dbda513d2b584cb1bc6d58442a0df570e2bba6f8a95dc05814d0e2ba414fbf18f59ec480fbeb50c4a47a45f4861

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\5424cc6c5f90b9f5_0

Filesize
19KB

MD5
564b52251333560c51fa5b76e1482a66

SHA1
2bc6f30668b68584b36ce74ec7ec86a8ccdcdcb5

SHA256
c0013eac05b49ba115fa93dc2d7757a8b5f3d01adfaecdeddc5c338f5d9c82d5

SHA512
9e32ea592388726f02a3bb6a9adcf4ccdd71c2fc830c2658a878ea7406244e930fa9c0efddf8070eb50492c6d6c09565b15a40b15ba7e54bb5b073ff4bf6f6f6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\552e9cab9e32a74c_0

Filesize
1KB

MD5
beabd3235f55b1f9148526e6e57361b7

SHA1
04f53c72897c459b4baf07bf2b4d0ce4106c5d90

SHA256
596d5ad819f060cb48bb595340c0fd44a91b153d73d5139f4faca02a3a9afc8e

SHA512
42d8291fffe099680578611aec78e1bbd77f6b642608f51da4e0c82b35aa0df46afb42c0f3c7c3fe01c6ecd6497d1c72ce26eb2418ae499d0c1d5ccbd0cb1a5e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\59a2d57a8f4ae140_0

Filesize
1KB

MD5
d54f52d5d57f2fd0a0e012cff57fb804

SHA1
5b5ddfc352f0fe6b831461a12bf52c5ede4fb629

SHA256
c07e84fc3dac0bc91deb9f7813b06124978234621f2bd750c5eca8953d0eac07

SHA512
2b265efe4b6a76c825ded92e85ba6d84c7391d9294db5de63573b66f3580fc2616b9b765520ed96ae45da66044fa74e8ceec9d3db78f8e5a725a229e0dfbdca8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\5b115e1bea96c5ee_0

Filesize
7KB

MD5
ce8ed526603fb5242c0d065b7fe37aec

SHA1
cb18926a4923174a534235b575987ea4ca5ba284

SHA256
cb0122478484ca29c08c41c387c91cc53009002c1663392e5cd42df2d1963e49

SHA512
d596ef66cdc952859c332819503b7f7b1d800314615375e8e76ca48929f9b8c0bbfbf1b8b1c676e445b7e6324f5b54de69e11603f7f71fbe36f266634fa38b6b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\60d8fe482d318ee3_0

Filesize
151KB

MD5
9abb256fee4d7998ddb20ee698e56871

SHA1
b0463723452e67182942c8f75c3692a22ce7b07e

SHA256
af26988b9c7fec697a3cc474daa5faffb6c8c2912a07ab73b519e2964f26e723

SHA512
71d0fe4e62bd7112ec5f655500bc6e88649263959dd0e1e70ba6a094a442bb7957234c68a6443e374eae64652356cc74d98dea15bbd4241966406d44d8bb41b7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\63fe5347d1e9c95c_0

Filesize
1KB

MD5
5608795be2b420e2db5bee69072845d2

SHA1
fda709bedf0ba5d171f0a00386962a54d0425823

SHA256
ceff92e8555a22f67ba854f97d804b57d049618b49fc0d5f1c512a3aaa21d198

SHA512
914993fbf1a71aa36429b9068a78e4ec1c665593c21c0a8d2cd7f8afb99d13d97b1efd5e8cdeea5c331b7fcbcabffe45ea5e90ea6b6ebac9ae5dc554cf9e6dcf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\65029c17e720c1c5_0

Filesize
1022B

MD5
6b1e1cb8a86ad1c5ecf1471d16856e38

SHA1
a76e98cfee472a176aa5c33b004eb8d2157c2ee7

SHA256
5e4bfe2da40bf790b0057b65d020b8a1dfbfef248d760730868cfe7c50f9b6a8

SHA512
971b3cdc82ab532788d836fe1a5786d673bf28598919226528d4394e0b52c2099bccb487017dbdff8f501e69c29b1e2e892ba3e54c0011d58b0edf61b557674a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\6dac06d87b633d78_0

Filesize
1KB

MD5
b9d1dfe6718df508d9107c9137236994

SHA1
a2e5b43c5a440c15c394ac6456b16f3baff585f3

SHA256
61e6a649c62f5157c5c16e9893321c2693ef9d9a386d706739e85a40aff18487

SHA512
9a2627c88210e3bc741874728be4845c4a1dba6d230294ecd25b388c3e7c1fdd4780b8a1f044fcce7ae86dcadbd8e49b8aceeba55454fd3493d6b5634e59c789

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\6f2bf4015bef8176_0

Filesize
1KB

MD5
d1cf0e8eeaefd6dcaa4d7da1c929c52c

SHA1
817ce92679331a223000a6b75f60eaf9d1a7a42a

SHA256
5fa838b5dfea8a3b54a975c1d2c433e83ef5bffbafa041e81186c8ced7b019fa

SHA512
41a2e235ef8799cafd68d5a820e55f748f7a148163eefcac1fbb10895cf76b72d4011f3d5447194658a6bb01caa4c75161fd28c1d5ff0820b6489ff89001beda

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\6f5d2dce1828194d_0

Filesize
2KB

MD5
2e4c7f883e474699693e1ba673befd99

SHA1
292ca047dd3d823572ce7f71e861b5b961a2df7c

SHA256
b295189cf34fe0f1a70adcd5e8adbf4e2ad2f805a034d72d5eb70694c07be852

SHA512
355f8b48a9c5c81f916828ddea2326386cde5b42158c0719332311f33d1a53875707d85dfd61ca63d60fb02928d13e0d9778f1bebea266ebde697472d92af9cc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\70310703cf50647e_0

Filesize
1KB

MD5
dda4d0bc5576c1c2388736c8dcb22ec9

SHA1
cf64fedb44f35deab6fa11d5adb76152ebef545b

SHA256
9ee233af0afaaa4145fea15d173a6d89403c50b926becc76800e42e82e15f22d

SHA512
f33f1a7a6c4867794e3f4bdcd0d164b498977062f6be9e26e8135a92169bc098275c4ff35f42cff1b394ef5610ea2567fbf3a9f992ae69e7227bc738355d3a01

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\72079ac2309c9dbe_0

Filesize
1KB

MD5
50e54779c24b02d73bcad06d1bac26bd

SHA1
b2ae6572934ae1c90b22058cc06f392e9637da88

SHA256
8bf5f963a711667a2e471ebdcf0b2a5eef9686caa7253674335d72ab3384651f

SHA512
12bb92f8dabe3b44b60c43dd9ca0f4d5c7e5ab297e045a88a0813a3eac1b88ededde4984785504ba060594ab813da08b5a079b547ba7df1ab537783df25dd231

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\74c4a22c9167daea_0

Filesize
1KB

MD5
26152c23cd4ae2ad0e0fbd9032d3fadd

SHA1
80ecbf0238440c9661c50eb2344e7c7db76d1413

SHA256
de308b93e3d1984e05858a181e0c04d8afe5ed355ec67ebc913ed0e7f1897431

SHA512
99251f282751f6007020d392bd7f69ea3385de45d2bcc1a3143789d2a61172b895ba3fe533aadb60f5a99f538abb02c7f6bd9bceaf27dfe7e35ed74a60d431ab

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\770cac0733aef6fb_0

Filesize
2KB

MD5
95f6615548a3e6aa5ce978ed76e7b512

SHA1
47dfe822996fba7fa06f62814218a5b5664ee2fc

SHA256
f6eef0fc9dccf6bf840613e2e27c8d122b58cd8d2ac7846528b358dae3f33c1e

SHA512
4ad310eb4a13a78fe3eaf22f4b9c195c954e81bd77e847b88fb3e2c2d90d694b78e0d22fda728b1a9f25f03434d3acc4d07a01c66aa1210746a7fd610752efa6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\784f44036ef2601a_0

Filesize
8KB

MD5
50ef9bcd4dd642cb09f2d19a86224038

SHA1
986e7415559b373d1f2afe13861ca4dac0bd0049

SHA256
6e26f7f347c9a1459a1af9e110e1b13196ff6f5fb49e40b6c47fcbb3d0a18488

SHA512
0a1c4227df0ebe9a1bc0cadd1bc29313fba5dfe40aaeedf1ed33b6d49d0c3c6564536609e379d86b7641fbc54e0f190c1bbc3ff3c47ff635566857906ac03c29

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\7da78d17f9ef47ce_0

Filesize
366B

MD5
5deaa83d3e802d23de6465f87af81be5

SHA1
9a11576f5910593a1116026cba919ab8b56603bf

SHA256
cd341d551eb134f3a0e524d00fd57ab63bb95e517e1808c45654b4e3b73a21f7

SHA512
c6f727b3c4da9812e85f6ace896e4026dce83d7d6ef61e1b604c82bcc960fdea0931ebda3c626b05561e69794d81749c362eef9cf1b013e36161216bed56c781

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\7fe85d7249e8dc55_0

Filesize
1KB

MD5
7b4433a9954675111111add8899996c6

SHA1
1b2818c002e8f7eb67128900ea5c38d615b168ab

SHA256
0d514d69e7c2e30ce8aaa65fcd724479f740f32278f41b8893723d8da764ed46

SHA512
1922a5887925482aa1736d8b06371f473c24a67adb0317d6ef2347b12903e951483d7693918ff4270d5815956e3ecab2194652f864dcbba44ddafdba88d9bfc5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\8246f48763f78d45_0

Filesize
2KB

MD5
cf74bc77cf839c6871fce6942851ad28

SHA1
1ae43f47f4a87016bc3fc4ba8c06f9599f6991b5

SHA256
1e22cf69d525d0fec7d27a190d25502ba61cb13887eccdffe2f9d1617dfd0056

SHA512
2a2179c4261715670e24380451b5c4890e96af1be71ac8bd06ccf328a90a0ff23a7bee50f24b52d94774a9670d017691e952c65633c27fc7c6a7a5f4d873ed92

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\83d923e02fb02d0e_0

Filesize
2KB

MD5
a33ffa5324230b2de6342e6375511875

SHA1
53eedf612978b2d9f4fcd047500e8725ee1b539e

SHA256
a1ecf84a528522f800a187d6084fe67faeff2a6e3f711a8440b04786b4b54f6a

SHA512
91029216b5092ea95e2ab1bfbcb307205b224d33f6a850d4380655043dcc8daccc7677ed3dd170c5b72e6ae8247d15cbe78513809ea04ccb8d1908faa13a7b64

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\8eaeda4dc7af93fb_0

Filesize
1KB

MD5
b57e0217fa709cecde77007a9a52eacf

SHA1
41b6bec80ff3b12304bc9822bc50c768ba897c79

SHA256
78fd5baa526bb181243677d3d5425a14dde996f58849687e8737f24dc503cc13

SHA512
a73e6c5e0ea2cfbf9a4a9823c461de11c0c898302eb6b2699d688a7b0c4f1e0dd089d011941f1fd67c0fa679736b1d7f49f5f1551db6771c1693417dae3aa507

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\9118bfbb0b598596_0

Filesize
3KB

MD5
9fa4ba8f838b25e58e4aaf2b92d79294

SHA1
c3d55dd47fff21bb6c9d3ad424f82c547b9d2fa8

SHA256
4ddf98ab50f1c2ed3cbe3565691e96ceb6ba689f605eae1d425f18ceae3c945a

SHA512
fb4a65417bd6199607d2d820add1fef89eaf199f4a631641b33fd22c3efe5a6dcdd96b3cd730c51b9fabb3d7fc7cd6d4dc2f74f0255b603e1f609786e5cbc66c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\91928e60c6c05d69_0

Filesize
104KB

MD5
6a914cc7e55bb03bf2977707a8159d08

SHA1
8689ad5ca62f1348a0d22b5fbeac97eeee643171

SHA256
0408faf87b1cf8ec85bcc32141396b9be16a6d07eb6c5dec331b13d689f9f81f

SHA512
0f5340241025f85477e5342450e6bdc6dd9d077e247add4356082fc79206ec0f56f76e1622dfb3a337b9f9ac7a5aa40b03551fa88fcd84465d28ef57aeffb982

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\9398d8b9db4e54f1_0

Filesize
16KB

MD5
cdc2c8df0f7f2d57d76b5c3e32651322

SHA1
a4494ddfe7a4d4652024216346f6cb555ebd1ba0

SHA256
afab433ee344c524b1ced50ff9a9e72b5b3e5e3e75d29db32eace002ffe2f941

SHA512
e327d09cda59ae82e6e798dc236d79e1aa34dbca6106a09ff07c65b5aaa3fe5f4642363326ab15b44048af1790437a25ad6ed2e01b88ebd08a7be09acf53d2ec

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\950822ca8a0f3b0d_0

Filesize
2KB

MD5
05ad28957dcc7e378a2b17ada697a114

SHA1
7b7376b7dbd7cebd29d6275b6c9b73dbfee9dbee

SHA256
2889d552c48005ada98f5e9a74d8748abc957f735f515d73b1b584ba8516a26f

SHA512
253c9d21eec862b840c25deb3f162795f2cb52bcacf1f3b9e500445132330ba814720e53165f8475db058e2336b8481d5f61e5ba597b526c79d98aad52737098

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\951674a2601a33d9_0

Filesize
1KB

MD5
b426203e2d9e6978bc47655e3a29b241

SHA1
ca49759f9e3be9e5958a4f9c263884e3ca3ca5e1

SHA256
66ed4064df762814add562267fe53cd4e4930b8d5fad110a1c13da4ac3dce02a

SHA512
fcdf8b9073f73d9da6b0fc81a6f1b39b3c86b6826e4de98912639fa52822b79c3e2ed0bfba57c32c6ff72880c281ad99d6cff328a1ff43a444394fd224081313

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\a02df7c313f59d27_0

Filesize
2KB

MD5
c9406ae73dc093e65fb658542d45505f

SHA1
ace6e7efe57411e3fe1f3e4bed03007b50b1001e

SHA256
82aac9640e407b8c3e85c4e315b75fe2af0b2a28fa2176b2dcb216452ee7cd07

SHA512
6805c081f972d3f2a35b3a1ff5f111a268f7e87b967543e3691d8b71a515e9713cdee079fd641f372f61b64f5a9fbe850b0dbcf7b14ce2b073e6bc8a01c96541

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\a529e8fb64b4a3f0_0

Filesize
2KB

MD5
0f36218cbd363b8d9ff089356c0ba304

SHA1
77f3a7414b536104d6a617fa2fd6fc98ce6602ca

SHA256
587b1d709ca96902b86b574bb92b38b91d131a0562f245be9f6af07e1862f891

SHA512
d6240767dda3f3ee8bce84333799911447f297c16acdf796f285bf263bb02bc5f7e4201f8dc82cb699cdadd915e76cee22512abe4479e5409cc6f64361e702bf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\a77060d9035c605d_0

Filesize
1KB

MD5
f664a83d44bed3e4dcd50985ba951561

SHA1
71216e1295fd863a910bef6cca8d787cc35b365f

SHA256
4a05cbbac4207cc613ea78549608b8eb8d2d870a1d1c0a54d71ddf63422e58d7

SHA512
5293ed2e57720e0ec993bb406de4fed31ddceac851c71d4c3f4f5d2dac17178b5106d9d1d22e1e31711ae0fda6e8139f6648a3fcfcac6979843f3a347a7f5297

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\a9656f9ed8a92417_0

Filesize
269B

MD5
08415a1e69441069ae1fda3b11d156a1

SHA1
203c989f499ee64076c75a1c8d1712ff718024fa

SHA256
efc73ed34004d45d7c28935c2cb0e43ea3765680704bb6566dd7224aebb8318c

SHA512
8360cd04ef3acef04dadae28b7f989a890b917d46a88e9aa35a7cdde0d7c6b380e9fc42ea6c1fcd97567e7bff1d28608e5b3328e9bb946918db0a165009544ef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\aa22ed8fc94af805_0

Filesize
11KB

MD5
212bc3e4efc1601acf04dbd76019934b

SHA1
06e0b71a6f1bdbecb1f3f9fbc9906f91db034681

SHA256
e74f8899c0c448db27e20ba4564e7c720bb1c6fc21834736434de7a7472625a1

SHA512
40b3d9582240fd55b6f7ae431c43653f0f50311c20aad33319722523b902aed5b9a98fdabb11088a4332345ba96062ac843553417ccbd3c6f8ddc7480a5cb8a4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\ab4927b351fa58f3_0

Filesize
1KB

MD5
a37da697d98c11655e493723d0d455df

SHA1
b5f125fa2bb3c365a31dac1d1bd2ca5220c63142

SHA256
dc192c4e5d81afefbcc77a823799f73e50ecb871819f00e9e369c7b8097184fa

SHA512
e05b3c112825b8fd6bd3ff9f7b6077fefd7b2e44994b160ac9f9545a24a5411b2bce03438cc55524fc246144ebe035b099b6e45cd131d96a93e9cd542447921f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\ad3da63b93fca116_0

Filesize
1KB

MD5
57353194d5e75719dd29b45d0de3b772

SHA1
fece41a2bc1bab9418e76247c0548469f0437d24

SHA256
cb414b0f23387991bd12fc9e48156eadca31a531315c0c0d1e516cdc50685834

SHA512
8a072c763332b766c50719ba85c965d51580965bbed29894cc2fd39ff8fb316c36b524ca31aaa8bb7342426524c734c9500d6bc2bbbece273fa255fa2cb30663

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\ae7108eb825b27b9_0

Filesize
11KB

MD5
58fd9f2d67101e27917e2de213adfc9c

SHA1
e8bcb7a0ce1a3ac18958bc742b3e5592bdc0e847

SHA256
cb526f95934a9b52e7577f7816cd00706cb8333b851010167ff45b35dba5b8e5

SHA512
9e8cfd164c1f3934360be80a40181b852bee53f45619ecc3470b22603bc2d07f633bd86dd4de7c52d63fbe0dceaab3f65fa3921f4a10eaebc637b1ec966809e6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\b4ba527aedd17fdf_0

Filesize
1KB

MD5
f8282f8915061c4c290bfbdbc3b1d499

SHA1
96e27a0ebbed7c17567c90aebf77b4188edd6eae

SHA256
ce6992f3847703411f30bc81a2e6c8e75396d4be275cc2100cf9d28f4b1d1a4c

SHA512
e07d3401ccf8b8f32f32ac951a8952ac278f255bcc740cb963c9a7026adc331271255a08e1c2ea076765c719c621146e0b41848e7788ebf12b24332b00528717

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\ba872977e7eafed0_0

Filesize
1KB

MD5
0678e0d130ebad79752489898210b434

SHA1
9e689bec6903cf577248a06d450010660a198f97

SHA256
4933a9115c1c2a719b82fe543173ca21781d953c40940be8dd722ca9edc1146a

SHA512
de3f1221e3d1deb2fb0d5ac43140bba7b2864a79751d28cbc0d512b2dbb8a713448b947ee3f7cade4a742787e9fb1f998c00c0e5623e4e75186953cfd646c9bd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\bc58f788f5f057c6_0

Filesize
2KB

MD5
a35c9473081fb18f54ce7bfa05564d9d

SHA1
dc86d9f27d20695c8cba5e9db6461928aa4ce86c

SHA256
b5d9a31b309289c8e2c09760519ce05c5197b19156e7c1c6ad5b08db674e3f90

SHA512
143be9db93fb2848d9910a0ca7ff5e0fc4e1a7693e62fd9335a616d3f408a99591d2ec027443c2d09b15f255f917a665f90d5c25852118c157a20f3c9ae18734

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\c09016419eda93ac_0

Filesize
1KB

MD5
3c31669982fa093d11aedd7f1db91346

SHA1
376a22d6daeece3181709286817ad58a3e5c04e9

SHA256
1423bfe6ebc8f9ad9f00fbd8ad42eec29b99adef6c30cbf36fbb1ea216cc6c11

SHA512
86a62f203bae26d9ede0e082afabeec5c4542e369078b214745928645fcf2547881658453382fcc4726cbd0b1143b67dc597bc5f363ef1e60aee2b6c5e71f4ab

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\c4f2da4e4b4dba36_0

Filesize
34KB

MD5
4b967169875880f5101f08ff1cf2a76a

SHA1
5d4024444a0fe2304eda010d573cbee121ec165f

SHA256
4c85ca9971d991c835c27c37fe6a1e3e8e7472a9b1dc6823163ca3102401fd95

SHA512
4435f5f039873cf6078361861097fa9e39f30a11df7fcbb824a46607a6c76fe0d59156ae13cad500936a00b80f6feeac1221e6d48881f15e97ebcba3a632967f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\c846ec194d8fe574_0

Filesize
1KB

MD5
3918493ebf616ee298a4ef4cc789a239

SHA1
dc05505b2c8285d8cf52031e43fbd79085e6d2d9

SHA256
355334addd41ce811a630e325c0a1879f35710a494e02b8f6c7ea009bc3404f7

SHA512
21070a8f198f14e02421a0d02734951ca7afb551ed7e58da603987c15144fb4ec8fbe640cec02416353467cb32a1135f5bd218b80aa9c2661a6e174ff115105c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\ced11c0ee670f7ef_0

Filesize
275B

MD5
b5829a3744205bb6ff4e6645309d42d4

SHA1
ab1bceac88a16cd8d89f29f2041ba76547f931e7

SHA256
c528728161094583a0a9a98864228522afe351ee845a7bd88eace348f5f5dc02

SHA512
db12d90bbc53a37754129bcf4af9aa5f82397ceceb367378ba5da4785eb76ac372715192e27e7a8ef2ef7c494307af4b913c62bcf9548a437847698819a011e5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\d13dcd90e0ecee81_0

Filesize
1KB

MD5
8a85013db6546c040615e944a190bde4

SHA1
5df1da484c7e70a9bd1b252951a0335fb4635629

SHA256
e9979668ad396934f9244591cffe0614644ededc816d08de38ef2d06cba99a6f

SHA512
1696164d9cbd9fa13b12d0593545a831e2cde58298177aa37b77e6273452b4c1f5296bcba6e8bc0e6ac618386afe9bb17fdde80cb024c0520993ce1b652bf594

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\d3a150248d3d35f4_0

Filesize
52KB

MD5
2d6d77ea55f7a9622a1d76002352154d

SHA1
6e9eabe58a5b59acebecbc7633bccf006e759190

SHA256
8108487765c11849f387f3371820102f97860e53ba37e53eeb3bde58f26d6c9d

SHA512
1a095fae2c2797606192cb2c8b695a55f6e9f5355846f460e89b519924acc21c84fb7e38bb6af33878ebb48413ee80e729a7c101186f21dfe77877459aa14ebb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\d5667bf87cc6b1b8_0

Filesize
1KB

MD5
394803736aaf460cf9789d2d99f5aecd

SHA1
b421084a420227563fcec340a77d474dd91faee3

SHA256
11b8ecbd3669e7fcd416cb19f231caf5b9e749de72ecb1f0c290e92b0bc1a68c

SHA512
53a74d506e05e76af1cc5a2ee46c0b3642bc8670454dba95f0f136f956d5ac9e0ff5b00ca617850b2246c6031187e43f25d39a8ae6f578818eb0666b63243c82

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\d6ee81079c1cbac4_0

Filesize
2KB

MD5
d467beba62ab3ad3519d89592a1df014

SHA1
895d5571169440202e59f5a1cace830929cbe519

SHA256
29d255a4fe0d70be7969b61576cc53b7afbd0179943a6de33fc5cb6eefe69154

SHA512
ead4526ee9a0b9d93a118da756ffdd2a64ba9b838a7269e89cae2a54d3d41bab3d8a0ba957b497759b15d197b67e928858ee79d9aa93e2c258987035046d91fa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\dd0e5236e7e32c30_0

Filesize
4KB

MD5
a8cdd4325537230bf0c1a0e3f9efec05

SHA1
33147a434dfabb32a1fa89eb51dcc0b3905d4046

SHA256
f475e398a25162695ac2384263df94dd5e5741a7649ac585c3697ff3961266e7

SHA512
6acb13d0d78a979eea376cb9c19dba9fb2375d70591f84c3ea57c514daf1869aea6a0c9f5e51f3dd694ca6852e49a4130851989a98ba3e5652fa3c6861bc1b33

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\de67f181cad528bc_0

Filesize
6KB

MD5
79c754ac8318152e1670c13ece4bb6e8

SHA1
d1d44e2101d2da66a1db8136e43c11bea5a058aa

SHA256
67498983e8dda112e240ec449868a365729aaf67c6301e3d4380889419697f47

SHA512
fcae197347a6a0e5d407e5a01e148a308642cb06fe95f20ab551cdfacefa40a8fc0abdd9d081283f6d601b8e71827c3a56694baf30c997afed76b4babe18a5c4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\df9da550ea6d3003_0

Filesize
1KB

MD5
d5676473dcf15f6ce411cd42cfa73574

SHA1
2db26a0fab454266a59c20d1c12b0e8a98297174

SHA256
bc1c2af607d3c748f9de655a92da045889eb9a884ccf4474235d07a88a9a5fe9

SHA512
a9509386fd227c814d4a6630bb6545b5a666604fa1df4555488f7a43597ec44601d65639f40a0cdf1816e238e7060bea0aa61c3cb73f8ad46d02e1a1b207d176

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\e0b14e0f803304f7_0

Filesize
2KB

MD5
d45a5a98def09dfc67a17c387bf8c506

SHA1
e2efd2f6f4da063af5d25abb4fe859562588d358

SHA256
0b3d7ff23d73ba3e59e054fc1b79efe5a1059df1447ed8a888a7b1a59be06253

SHA512
3b838ca8b37bc7709d4823103327906f32776d616558d717d2c1d437cc656bbc219392cbc9d8b169d766870f8b1310e0bc48424a0edcab1c2b23f88251489a1d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\e9365e295e2d0d36_0

Filesize
1KB

MD5
a8b0289a1294e44167af5dc2c46a0ca8

SHA1
5162910703905acfa95b051f435be20ae20ccfc3

SHA256
e1656ad4a441ad648d68206425cd6d915f00dcb7e17609af50601a6dc83ffd4f

SHA512
6c3166e03d019eac4c7b87c6b8c370d817e26c9c5fc0f1379948143d6d0d63acb16986fbd91f5b9f7b4941fc26df21e33c78b29e0435ff0ef55288f04734031d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\eb4b2d9cb24cbf51_0

Filesize
2KB

MD5
6782bc5c5beeab4d1b12040b851a9c22

SHA1
11e5e500468580654a2419f90335f615e4001c34

SHA256
074d247e7db1c0da732bd39cbf3e67dc73b7c805d5450369a3fa53e0ad8ad63e

SHA512
d4fec21f57c64409c3cf1d87096d4d4efb89126bd6ed8fc2b56d787d684ec8f0c357290173ba0d1d3ebc73e86e4b6beadf128a797b97578902ec3ee578aa4d1a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\f299668f7f337ff0_0

Filesize
1KB

MD5
fd16fb37e19d6de9792e1c35719cd2c7

SHA1
e89fd77cd348306abe79984101db1c1587405a35

SHA256
1bd19bc9001382959a6c93967b57070b20795536a633ab86a8d7372daffc6ad7

SHA512
e10ff100ab1aa3cc45e3190eefa2595e8c2445f2eb0d156244175729aea2a3e39a3e61081e38bcf0a7ed583d30bddda81e721f9890f135b85a39404d90b0f713

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\f5c5b9cbc406ca3f_0

Filesize
850B

MD5
be123bcb06c249ebd50edd876c5b300f

SHA1
750b618c8680b07a27176425c2629c24d8876833

SHA256
e6082996b62c91a78f25d92f572dd7fc0b84ac1496e78dff99a6e45790940ee1

SHA512
0024fbf083e9bc3b754b931a5fd9bf4ccf2ac0df2473bbd509e7d14b432876ece3dccb47b3907fe8d6dc2b935d1ca5b5d8e4708fbb01ef9b8c5286bcd6207892

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\f72f2db5654ae915_0

Filesize
4KB

MD5
449ac0867883add2c4b892987fc65304

SHA1
528827807594a2955b7fa8a8f94d2bedac217fa0

SHA256
b4b99009cc8a94bac194ed5ee7ff821e6b856097b4a0d9013c561c7b598d1b3a

SHA512
8e3e6237875053b5f1c7992eca7f5d462381e4c1b606f6a85560ca978cc414baf849749bf6d76d978786179fb748d134bd3d05d0a70a0e5bf2e9237a4e1e7a36

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\f7db7a663f3d811f_0

Filesize
2KB

MD5
3da94a77d855306bdc60c984fb4c41fc

SHA1
8a01830e42564ef7b506e3f4be6485d4735e8a66

SHA256
586cffb3e9b35987decbe4fbaf1483334bbfd6f3a7d2c04ada6491e4442ed092

SHA512
9dfed1335346f1e78353bb9ed2461fa2c10fc4b7ed1555b2958f8006a77e15e7990990dbc56e771bce926b3adb7ccfd54feec690be46c7658b9d14365bdbae5e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\fb77cdbeca77f865_0

Filesize
3KB

MD5
c9a4f7ed2ecdabe9cd711a70fa2667cb

SHA1
cb98f18c1676dad4c50c190b2286d8471eb81741

SHA256
d326c485ad6b40556371f2628b4baa5ff2b6a5e2de88017d97d1c77b3eb30e3d

SHA512
db7fe853b1f8f64eb91e37ba7446298dc71b6c1c782eef1433f3a75da83e13cc2ff1ad730b3cc08a32d3ae3e79aa5dca4821cc6548e38c8e78ef8513f1e1dcfc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\fff42046e7a12364_0

Filesize
1KB

MD5
3ae40a563e334ce67676819a87dfdadd

SHA1
e4e2fd76392553b3c83b0f96fe1a340e6cd1a252

SHA256
c21c9ceeeea76410af2e3d3a3ada870c41be4191306cc35cdf877ae0333b511b

SHA512
0150486d43b72aa5e8c6071a3aae32b54b080088a597c1b53279b0fcf3eb97eda5a259d78d1fb641154897c628ffdb5727ac6c5455cf30b98cf6853ebbf6ab2e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
ba559ebea249b2fb978d8630f01907ca

SHA1
f0ae66f0469f35e0780b5ccefbddc801459d887e

SHA256
2c83bc6a278f05a19102fe47652e184c8fdc429ab84aae4f13e7bf09e6d7a093

SHA512
e6876c7388d202a3b24526db5fecb04014c48133583105af6afb7ad3c2eec8b151156bf633aa2fbdc33c0764ea50cd731d9618d76f75cb06546d8911d0e84484

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
48B

MD5
ff133c818d06c0f07a6e3cbc08bd1f4d

SHA1
e922b6cb3e5f530d46b9973e7db91d2149181402

SHA256
0d173f0bdb42680fdc4818ca19ca172562f764faec6960d52e86a4f041db11bb

SHA512
19f6e3b0175ff16499fb2dde4c7eb353393c411efeed02c6c29266a6ff36944578c0bff1bef06006e2e7a6c6c2685dbb0cf567ea47de55c0af81d97cc2dd7082

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
4af25da44c9f1905b9a311866a77a7ce

SHA1
cb798e85eb99eaf0e6ebd258647a4c2b2ee2e8e1

SHA256
49a4f5d12a725643187ae8ee3c51970a1a4981850794b66c0aa2341a5f6d6d38

SHA512
bd4aa690caf5f22b62109c2e63c3581a720350e0138e5d7928a9c2d28cf6d4fdc4d0cb7bfeb28184f64603322a221764e4ecd3cf7d663923666a2b99a4dcae1d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
35b16518ee0e34447f513db250a1a3bf

SHA1
84aefe7c2c9b171cf532a38ee110a06e41f30684

SHA256
f4958a0d427627847ddf23f9e813470befd91021d0ebe383c0c42aee55c41b85

SHA512
7e5e4a0bac298097f2c63278c7ecefba008e56a9e8876ee798268d1680ccad83b41d8ba10fd218c8617346252319aa47f9a4c7fa2b056cafb5e9be37c71003af

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
a9df56582c084aba0a26e2950e1b9f3d

SHA1
b017fd65b15beebcac04e0c5c0364c4c8edcf6d1

SHA256
ef780f27a8d0b5f0b8f9286fea15deac7aac9ef575660b82c2ce175b98f5f3cb

SHA512
1183d2eee05e7605a3f448f91fe55413fafd25189c8e024303a0c19aef7805a482558716ff9b01f90cb7b1c7e00c3f0f6b1dbc08e4a5bb07f36c7bc4d508cf14

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
f020d83485f3cc5f146ccb16f8d2340a

SHA1
8e2664fd1cebb92805288c798a6bd4cabbc3f73c

SHA256
a3f7430bb5b0d0618e1f40d7ac6e0b2c111382f3399443f14c646194b6ccc078

SHA512
1f2d054d6ba12c393c5716741ebb1ebd624efeb5d96c3969beeed69c8ea858d8f88a7503e35e53a0c793b8e7ad50d7093eb61853757a6cdee79cae286ded0475

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
4af633472f38317ad3c1fba17595aa4d

SHA1
ed6b96dcb488f1b674e389b638af319e1ad05485

SHA256
3f3ac25dec463f11d48b21c037238db11af7f2da039333f50102cef714966110

SHA512
ee057b77853c2ee926f72636df77da63f0b232874a2ddce048f4961dc0c4825aa099563c1520fa82a3f986e7a5b8b90bb1645b101fe38875b5a1719c11e4bd6d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico

Filesize
70KB

MD5
e5e3377341056643b0494b6842c0b544

SHA1
d53fd8e256ec9d5cef8ef5387872e544a2df9108

SHA256
e23040951e464b53b84b11c3466bbd4707a009018819f9ad2a79d1b0b309bc25

SHA512
83f09e48d009a5cf83fa9aa8f28187f7f4202c84e2d0d6e5806c468f4a24b2478b73077381d2a21c89aa64884df3c56e8dc94eb4ad2d6a8085ac2feb1e26c2ef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
579B

MD5
46fa4f5f7344089589d117bd7599b3a9

SHA1
b6cc1fe19e527d4a372c97e4d195ed94eee40030

SHA256
223280d95a13f1af6af06459bbf230874500c212a2e16f63914eff3f22e8b57a

SHA512
6b680aedde7e806802652aab9ab31cb21438bc8756b063955e6f03bbbdf1273f7d47c40ec1a19fe27537afeb8d6cc219a246d31f7c6822b481649fe296e2a45c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State~RFe58aca6.TMP

Filesize
59B

MD5
2800881c775077e1c4b6e06bf4676de4

SHA1
2873631068c8b3b9495638c865915be822442c8b

SHA256
226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974

SHA512
e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
1ddd0a6f545556d7cd1293dacbde914d

SHA1
a843e86a8f0f8a80ce4d12a285530589c3f2019f

SHA256
7553dbc90e7863c3445039e6ba9426f21bea61b831b463ceb8bdb9eac8d4bcdd

SHA512
f9385686d0907d945ce277e5bf9026d917e5d1eba16e9e23cfa5dae1358d6c707ba6dc813a40307a79853e7460d7fe73507f6162b00108697d509e711d9c3428

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
9c84cca2a900bcd1de6f863e768e9c34

SHA1
8ad5d3be0234cd1bd89dd3ffccead5f88bd6f477

SHA256
248f7fde8f45414e55dadcfc63b1a83deff706ae52c18f683d655811d04587b0

SHA512
90ece5e7c559d15696540042d3ca751e66831686401513674bc2b1dc81d5826980624d4ccd8c7af445e642b1a89d88c88e70db236e8239694fba6e1dce605a0c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
ce3af8459508b51841f40d27638c6db9

SHA1
35c6dedfc75bceb5632298c69fd0eed86cea39fb

SHA256
032fdf014ed80d91204a65597ecd066da1498b38db233911211ad4a78c7b2678

SHA512
b41892beb7bfa814386420b44409343174478bf0fa1b1d619e216eaa111591df8b696b7c0775dc01daae80be0f6a0324e1c6c1c93bd1861b5c47aca1cecd4008

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
0849d53b4a68e4924b9174148ccedf04

SHA1
dc2c1fdd942047566c7df60a34d6bd76530375a9

SHA256
9dcf9a2fecb33aa04ec0a909c4be859a838db605f784365478c7b1dc67434533

SHA512
3dde2ccda951cdaa0b317d2b58a2e9ed2a53cc4adbc55aef3dbc34dcdc73509f6ecec7d686b2859802f25318efee297b1075aee8dcf9d72c8a110cf45ba7ed1f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
ab35ec3bb8ae020745891a2190920422

SHA1
1f33863026feaf1782ffa3cce97b6690b2aa8abc

SHA256
17758c7cf15d1490534a934bb0fa0b0cebbe1b08ffd34b2c3476cdb80af67413

SHA512
dbc2aea2bd3c5bca96d983fd762deecdbadab560bb36c80c50251fa3617da3ef7d09aa4168a5fde99b192f7e61e1525e8876dcc422c4eeb97a805019d87d1556

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
fd31237949cfbde11ee493880c6f487c

SHA1
9ea119ef0c0cb9ff792e1e2be6a18af5c69de385

SHA256
ab5622edb28f3da429c0034c248adad56adb9591be05a4b2fc12931b126b763c

SHA512
bbdf42f8d5c6b865987bbb297734cb4a54e560af1c489506bc157127e151d91b12d2cc19096e8d2ad5acc5e02c8484b41a84b6bcb9f1f21c976351b9c53656c3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
a2276687578c525ecb69ebb7585af129

SHA1
0bc829e89b207473f058aff5fb722a693c6e2c3c

SHA256
a3c97e7d83513bb8556e1cd008f212b188390e6a03ad2f8f4c0e8bdf13dcb067

SHA512
d69b9bf3f32e43f24098c28e64bc0bd1ed97df8a1de7899a71d137d02266e1c9068f8153a6c99afcd35d72097b0a813868a4a579634c97c6824380ac0010c525

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
d9058a2efa8ec7649fae55c434ed91fb

SHA1
8e880ac5fd78aee74fbb1220e478d3e298fc8232

SHA256
8688b1e406022cd6a328a037e827f863d62ce168128dc8150baa6ad2f143dd6a

SHA512
1dbe14f75f80fd58e8ce92b5ffc01c9aba80e8412fec2e068a596b69e7f01fbd9a78fcdf8acf301363ce8543be223b943b090692e315370742a7c68bb0e02324

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
00dacdd194b83121c058d9b351ea6c14

SHA1
64b3678e425e662020efd84845319f1bd96eef38

SHA256
5e9994ff9160c2e15579112ee9dc3d338f46f460b6c8fa49655bdfa4e777ed11

SHA512
80276f6d67ecfd54280b0313bb80d2e8bc832d4e6e8afe6c33814db79be7d7d348b0d2288d229f199a923e68c7c15b79c363d0e3e25933b4feb02328cd238f43

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
f5cfb130cb5e05c86ba3e55ef3c18eec

SHA1
1bd29f01b45dd0324d80357d347d171dac630388

SHA256
1d7d8b863885df6836ab8ccac5fdc88c843d54b87cb6e6b5e01b405d70a122f1

SHA512
868bc147467b672d30c463e13657c154ef828bacbcf1eb33034a0e99b6b3ad9c9ec65ea35ce10f13a8ba955217d4d363e50a1c864d4eaa189c476df67756b5d9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
cbf7292a48bdb68ca7bcdec56d02aac0

SHA1
9e45305bd2caa5724cdce652a99e78d2db8da41b

SHA256
972f9a956e4da74a5732401d0fbe477f7e6ca281d00e188bb6d9fe253b04cbb1

SHA512
841b0953236a792454ceced614dd4e02ca758b6e8fe9354d56dcdefa9d4302a89de743b87afd4dbf758c98b141519ccfffce84f3b977124c6b37e895cd86fddd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
fc08ab45ba070409a652c8d0adad7f9d

SHA1
1239fa51e671abe2af65190528fc468bbddc7ca5

SHA256
71a60ee0d0e2ffff71adead8b692cf0837f426a3a5340cf2956b7e01fb67d11a

SHA512
d462628cf227104e50344c0c1d72f643a1945f622735a304386cc6b1d5f20a2efa4ff668006dcfca89f0d8fe5fccb673db55371aec7fc624695335305d1fb388

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
725025b18aca16c9e269e67ba1604068

SHA1
4d515bfae00ef72e621c8ca7965286fe87748541

SHA256
5b23a891d446a88a357568ad7c2ecf07892676bb70bcc28ecb62e4a6546a7fda

SHA512
962a488e456e0bddad6e84009fcae1e5584eebdde7acd856a12334bd5f1ea423ff1ef1ab0c9de2752ff7e023c9030a421c0ad15fee0d758c72411dfd365e2f48

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
c71bcba5cc46bed12bd5b3a7c2998ae8

SHA1
6bf9f7e459caf75e1020ba54811e7d66ed344125

SHA256
06d16a475caaf455660f54017beee122e90d936d1181dc6f6a4c39f7aaa1602c

SHA512
3efcec06cc682900b45daddead954ccfac678b7e9de10a6926f551f60b298a4d7038747cbe925887ecab6bfdb49319caefe4b5eb77f7e79afa8e93e4b55db6bd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
3da81c57872ce5065a74109cc101c160

SHA1
bce91e8b2d1ec155de09cda2cb28f23380e423b9

SHA256
ae9b0ad8c0e2ff8470841714bc29a2438b877a448a68f896d45074fddaf546ec

SHA512
49296b9dfa628f7b604869a00d41d04952d952c766caac3c1857cc31e626ef17c23222e77dc830d1a4666538789f1606b21c446b43493566c9d2700b6d2f28f4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
6dae7e3eaa5ef94eaa5a0cb931ad139d

SHA1
cb76a8d5e261a345cddd62c9ad1910dd24e9089e

SHA256
dcf554fba64c6d0f00c1dbbf0c17094e5cae009772dee90b4f4db70126a9480a

SHA512
7a423f54aa4ec43ae1e8ad3e1340bccf19ef10d7d673f55d256303732924e14dba8f8c53fd8dbeff8b18d74efd76feda94845c6cae6186bbfddc8c50471df487

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
3ee936cba90af02e83d6a8695c2bf8c2

SHA1
7dfc53cfcff012c4dc92dd2d6d91a9ae708c46c3

SHA256
dc2a91168004cb66813a0750a7e3033afba55d83fd68787fc373765fbb5d56ae

SHA512
2299fcb471c1cc1b125a662a675fea243f9216adc231cfb9cc18402a58df87e8a3c0731cc29840c5f307810f247ae61b809aa73be12832e09c842d2b130d37ad

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
f4e5fc3bdf7db3f37100bf24ab1ab0a4

SHA1
c8d680678229f1e6a11e782f8b04d2fc0f15dbba

SHA256
90aa49be2bcb41766c5fec59e4788c08d6dad0a2375f1f817d26f474fcbd95ca

SHA512
0badde69b3dd2003b2c6909baa7f9085e09044c3ecfda2eed9a3b074cf441cac98136635a91771c4e82b0927fcbf68e6dee795c613c0e09a29f3958fb9c44428

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
90cc75707c7f427e9bbc8e0553500b46

SHA1
9034bdd7e7259406811ec8b5b7ce77317b6a2b7e

SHA256
f5d76f8630779de1fe82f8802d6d144861e3487171e4b32e3f8fffd2a57725fb

SHA512
7ad692bce11aee08bf65bb7c578b89a4a3024211ee1deaf671c925d65cc016943f2caad3d57b365e16d1764c78c36cae35c3c45cef0928dd611a565b0313e511

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
0d8c8c98295f59eade1d8c5b0527a5c2

SHA1
038269c6a2c432c6ecb5b236d08804502e29cde0

SHA256
9148e2a2ba2a3b765c088dc8a1bdcc9b07b129e5e48729a61ebc321cb7b8b721

SHA512
885a734a97a6f8c4a8fb5f0efa9fe55742f0685210472ed376466e67f928e82ddf91ba1211389d9c55dd1e03dc064aa7a81d1fca3cf429fbaf8f60db8b1348c6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
61e1a0d2322ae683e85edbd1149fd264

SHA1
6188669ffdcc84ec7c2986eaed39528710b1ff98

SHA256
78d6ce1ee3715d3f0b63003087e67f597802e9dd4f8c5a9de3e9a5268831cb8f

SHA512
c0cdde2d3b9db5a9b4aacd4f7b4546f86d46c7ac9f100153fa54f95f02937b1c86ccccb035722e7bc0212ab4c9e7be169ffbcdd9422c9dceb3e82c3fcfb3b439

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
8eb44b3f770c1986c69f9e3d4295e26c

SHA1
c06040176310c1dedceaea6e42c54c859a25802a

SHA256
b78358e1b15c0998b28d5bf7b02cd4511d6223a4d6bffbf677f5eea38eb1c93c

SHA512
a68acd7f3d6220eb30753309b6c9574bfb1873dffef62a3c5b68497f4de11fdf9d2d1c6bbed1171a2ba29a3a0bea3cd5f91e18d891763a4a09e83b17d14e8bc5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
188f9b51896cfefef2dca88c64eaa9d0

SHA1
be3a4b2b9724b31ad14a7a7526d787f53ea09616

SHA256
7f9bad0f0ae868f487ca4bc26621db6cb73203dfc96dedcbe0eb70a98c2aec96

SHA512
81a06572873724ec46842e8482e236ef9729f91d4f8e6b447b7603288db97cefe3737c84d1f9105a148cac82a0d10aad7b9e568a6632b42c09815e6d838addfb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
f320a4592fae231046a65ab103cca6df

SHA1
54ac4c6be42a919280480b38cb03500862d4293b

SHA256
b4133485a206451c187cc29cc95e73f86ecfd1becd7a0a650189946e89e9ded9

SHA512
1c5421f9d024f36b95d040e95fcee0bee9416d15134a8b1a2930fe2224e89e9a6f172d962b533b8eb60b7548cb744fb58b0f761ebd5caf92eec2e603e8dec5c1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
39d0fd2d63487cb88bafe8bd3b56f792

SHA1
9b24c9977bf0c4e964ca3f836bd6b02b792a1adc

SHA256
946ae51ba76707c0843b4bec78379719d43e5f2c6401bf3f460bec7eeb3c8356

SHA512
e4d6835e0a5365125dc682cf0485c4423802193c439a0a405dcbf192af2b74aae22e26524740ee7e2f2a58ecf0a2f30a51fee4edc728c5d51a99c3361c495e84

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
50dc99eddf898be1f61ea3dad9321f85

SHA1
44f4d3f8dfdb8a98a1a1b82b8b44f08c4616d053

SHA256
6364b653e0302f08452b45b58390f249e6372e9aa97dcefba8fea721df7536bc

SHA512
9a5435ed90eedb9270573a1f4bd29daea515762acee153e347db2364975b52d45fe26dc7c5a71916ed9810538f7b721ef049fff8d7e24502f007d175876e454f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
0064f93d43e3423b716580952a486d92

SHA1
199f9909421e00db09a2e87e87177cde78a81c4d

SHA256
9d63b14ae23d68befc47348bc7e12907e2e0f1aa3055156c6f0a70015ad9dd60

SHA512
4d7a1fa29c15c874972669a89e85a29117a2df446a4573b2c858e2d6aca2f2735beabe12b7e48504c6e4cf6424c8e73facd4d02ff84c887ab1e8f6578a17cd90

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
2d0e7b0ba79ef65a67527bd4357dc863

SHA1
d50e729f2f8f72c824007123057843e98899414d

SHA256
605db005824a49a24b198a10886c73fef093d3d9e62b043d9712be1f138ea911

SHA512
aa72efe22f8ae448b5b1ee4ca4248f72785e868446e3ec5700f731d8f41f1b7fd3d5b306f73ceab3d1e0548c43a4b2a3826b6d13808d8c94ad0314c49d709236

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
172943db035e7a9bebdc95770741a5e7

SHA1
9aa50947003d94df5b07e10ec98cf200601fbb35

SHA256
283c025031714d1dd94ff6d427e4805d8ece432b4bbb78a5aa4bf91e6852e96d

SHA512
de0a56aab74f17d21261b6abc5c7fd858f810b13e66bfbf046462b4c7cb3ae1f1c5f82c425376a27546871d7bd8c88fc364f908a5e636f1b0715ab762cf0b75f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
6d23ec8d813e0a71a996116c71b97b78

SHA1
0269928ec17ea7335e1400f21e6b32d93b1ecbfb

SHA256
83d92b9318d706094d88f0c94df2cc5e0e470c148d458b80c584e1e6714190f0

SHA512
b3f21c5dac4e34ef0887574a6f7a568faad76fef7d5a1abd966bd93e305a83713944ae27d3a579b49bf31b8297d24d7210b9c230addc176cc6c1920b44e69253

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
af745ef8a10a56194f38b868386391a5

SHA1
d513ebaac940e7ca3c1a8859b06d1cd8befb9afe

SHA256
5646145d64d6c0ddd4c7e191d4df1e6e4326b076b03a0293b86bfaf758ed7fb8

SHA512
8b5ace6ec4314cf1a9d1ceac44faca011c7b02593cf2f794a8dcc6f4dd10dcae7248e5c7d07d3c1241b188fe9d2b6ed2840e18379ed7b326f0ef2e15ff5a25a4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
b54677930d96079641a9282076f1dacd

SHA1
41bf542e8d66bd11248562ffa1f010cc1dac69a2

SHA256
70a0aa34b9187951f3480f3dc9b3be1d529046f874f1d045a6ff0d241397994c

SHA512
5ed637b2a7ed795ceae1033e59b530875c01a53c37ef9ee5d22e68b014e7696642fe67f35320fe1113eeb6e9b7b793d867a4f98de6d3510e216d14e592a5b80e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe580f1e.TMP

Filesize
874B

MD5
c1319dc6c547e6d06be0723ecf68ade4

SHA1
c60b3e7d5be9815cbcd30dc5a6771e769bdfebe0

SHA256
60d8b79e9f10c6b31712d884e44a8c66d878ebeb90bb7c593ffb0ab97a0a42e5

SHA512
04b478045daa180bebace1dbd388560d4f4b9b03f15b42ac1f01386857880ef34b8972382b6c6050c5431f587b22d86242f7aa7b8758d2847fd85ae71f6683f7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\blob_storage\c15a8a30-1d70-400c-9f40-94706a96d9ad\24

Filesize
4.5MB

MD5
b2a73b578b37207d45847839e1a07cca

SHA1
87e5e64a10cde2eb767f6de9b7c2be01d12893a9

SHA256
295e3b677fef7c7c58b8161b6d103b0f415e092e435fd1a9f46091eaaa3da016

SHA512
c4647f839cbc23fdb8313e54a568f30c6473e3be1f010eaa2f5d9cdff988ef0d8774aef5dc85d76d67bf79a161d7cc89bf280d011d6d4a4bb929af8338fb2cfe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\blob_storage\c15a8a30-1d70-400c-9f40-94706a96d9ad\3

Filesize
2.4MB

MD5
c481efd673a16709f5a0b74142dd284f

SHA1
45fbda3d1ceac813e6c5f153081f712abd1ffd39

SHA256
59fbefda02a63fc7417afb7c2e443ac81bf3655c39eeb75538497d2993cfefa4

SHA512
f0b7d58b98d376c7e163735f1160f8a5c7b0697130595093f5e1762e17a8845b9d493ab391f875a3f13a59611fd88a78d15462f4073037e57358dfa589cc12ac

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
8KB

MD5
32b91f2eeaf2b33d15b2e5c8635f4106

SHA1
a790703bd7d3f72a511d860942efc43755219f2a

SHA256
6c82122febbefede8884c874d9b3cf8c036509cdc40726ed8359146630db621e

SHA512
36fd7fb2fbc3abb54729f5313d94d050a04556af8ce58a3dc09edca2fa693ab9ea9ad111e618bea477588fb3c57592468513a15c0cb9ba943fc8f5284f443940

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
d111cd694278320752c1e163f67f0b2e

SHA1
cf1eebe43d071bfe676597ff82d005138ddd1f91

SHA256
e3250f15fa0d26e0beb0acd0cdbb2427e630901500d83711b90b07845f5e6815

SHA512
8ac56a1080a6f00542541cd6cdfd70c9b6568ca4f1bcd28964d43082d0c48950c32e1ed0e6d9e9700d85408642faf06b45ae77a72355ba0d08b23d16c50de87f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
a9a6e1088b7fb216b0e489a9a8102f30

SHA1
0597ed57c59bd85f4befd43ae165725de7a19f4a

SHA256
217663fcd2b605d0e28f964d93e7a7db6a5f465a39c2af05ab8172d468b5d9d6

SHA512
4af1e636536aa96cda2a7a2271352606ea65956dd72a9ae20c4cd040cfe4a8cebf687624a0df6622b95f1ffd87fc66b4edd4cb0f06971a15b40ffc36890e6848

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
1dfd39d670472851ccd3fd8ae9e9541c

SHA1
0b39dcad674ae2f592f96f96af8fa1e55465148a

SHA256
b93e28e2bc64ecb016fd8cf053c7d2e755299e2f774c19b1f05c01021b40d9b7

SHA512
b0b5b640f885501759efe2c70a06d8b93e0132fd7e6a53da1074653cb13c6ed9c369d27563a8d63925d266ad598f542831fba7fb99e8c6b944aacce500ae41e6

Download Submit
C:\Users\Admin\AppData\Local\Temp\Stub.exe

Filesize
184KB

MD5
05febebd1390c2b46629cec7647b20af

SHA1
dca194d5c79c8a552761cbc5ec8025f192c45d21

SHA256
54ddbf803299d65815109ddd5caafbb62aca474e2fc8ca33f2bc0e8925e45337

SHA512
dcb5ea711e60fda39a7896b0c45ad2c334e11073da4dd786dabfa3515296782ab1542128dc8faacb8087d38b1ef963a233d38c9d2d1886376fd133f45bcb8f6c

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
3KB

MD5
91787bcd4d661547bb1ae03e3912ccb4

SHA1
30919a7a621d65d3f3e3dafc25ed204f4fd682ca

SHA256
8249964f1346ca2dc6e430deb58bb033f5fbf1347077d143f7db72cb29026244

SHA512
46ec2fccba5780c3d6628dcf07efbe7c2ceb6c82ae42dc5259c20c23f6557988fb471f0b99d54a2a0252ad87fe10b92b4f7b3eaabde8486bee31f3fc5350d3a8

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
3KB

MD5
9a2a6f54aec93ac5cd05efffda3497f4

SHA1
74af8efa838a7f361eaced2bb67ba6f9155acba0

SHA256
0e7fb5f59bcc1cd841ed98785fe2a015b790b13c6f53440655ff1cf9017da3b0

SHA512
84327729c95e5b0ea9ebea6279141d209937988b9a1b31152ce02e2179b35a691701066650947ac5d7fd1e6f3eaba4082bc67d9d325ca6239188bca752a87f8a

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
10KB

MD5
c920181a4767b0d0616b22ed854933bd

SHA1
5d755973729cec796c83b291f77367643817095f

SHA256
1211acbddd06843bcd423a4f421d510d5bcf4e91fae791e12e1b3ae229c253a7

SHA512
de4f2708982e66ab0b5320bde0485d5239604baaa7828443d59f0f088538c48a69c90e9e3b030912c9ef07bc43b3324492370401b32bcd773be7963117b88ce0

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
10KB

MD5
33b6e87e45aabecc72d6b1d912ace7da

SHA1
6db974bfd3382c7b5dfafef8c0250fe0c18202fd

SHA256
5cc1c1d2f0008dc1590851c88449d046cc2a3f0e255030307d5af02ab81b16b4

SHA512
279cbaa5aac4c7a1960de7975edea755d2ad77d270ad68117ae8cc5fb1149de37c30fa5e264a7d71e0b36695e95a872a34af809382078b8954fd7096747f8ebe

Download Submit
C:\Users\Admin\Desktop\2.exe

Filesize
184KB

MD5
db90ba10b2952279fe5b06233a54c46d

SHA1
7c1ce61ed28d3bc8f3ad064b8e9ecdfa65154df1

SHA256
468834a619c83d2daa4d467530e35165af46ed1edeb0c0e04a138e0e59435339

SHA512
e526ed21673eeedf07e748f2d1390a2b5202fc6c833d3db55e0b884f2180e0042440417d1f3462fc50ab51f1f33784c6cb17a6ed4063e7d18017884dfd4d9d0c

Download Submit
C:\Users\Admin\Desktop\Kronus RAT\Flag\re.png

Filesize
545B

MD5
c1cf1874c3305e5663547a48f6ad2d8c

SHA1
0f67f12d76a0543772a3259a3b38935381349e01

SHA256
79a39793efbf8217efbbc840e1b2041fe995363a5f12f0c01dd4d1462e5eb842

SHA512
c00e202e083f703e39cafbb86f3e3f6b330359906e3a6c7a6a78364d6adeb489f8b8ab1b2d6a1b8d9ef1a17702cfc8fc17219cf1aae3e5a7c18833f028037843

Download Submit
C:\Users\Admin\Desktop\Kronus RAT\Flag\sj.png

Filesize
512B

MD5
559ce5baaee373db8da150a5066c1062

SHA1
ee80e5f63c986d04f46bff10f639113c88107ced

SHA256
f8dc302371c809ebda3e9183c606264601f8dd851d2b1878fd25f0f6abe2988c

SHA512
c0ca7595cdd2dcef0385ccb1c0d15bb74accaea63b9531233bddf14c1791ffc9712dff660292706cfa269a975d29d7a189885cd09046ac6d8ed39a57ec9557ca

Download Submit
C:\Users\Admin\Desktop\Kronus RAT\Flag\zw.png

Filesize
574B

MD5
e7ae0b7e3c49a5a775a9d6854912e21a

SHA1
d9cb015d1a7c121fc2f120013b7fb6ac5b49bf8b

SHA256
b546d55dd33c7049ef9bbfe4b665c785489b3470a04e6a2db4fda1fea403dc62

SHA512
bbf766e8e5f11c01778276e6dde4b56e9ffabc9d436b48bc81d89a9e50452ab9478452b6a7c75b2da4e9ab085e1944c38a6c4cca813be5ad0d100d87f7116f8f

Download Submit
C:\Users\Admin\Desktop\LeGend Rat v1.9\Text\Mpress.txt

Filesize
5B

MD5
f8320b26d30ab433c5a54546d21f414c

SHA1
97cdbdc7feff827efb082a6b6dd2727237cd49fd

SHA256
60a33e6cf5151f2d52eddae9685cfa270426aa89d8dbc7dfb854606f1d1a40fe

SHA512
af1aace54ec0ab736f8a6a262cc319740beb89d04efe071d451522e2cdb210bf0c81ae676ebc45781935cc18a3b939a6645b2ebe0a484e2594d672d81460b3dd

Download Submit
C:\Users\Admin\Desktop\LimeRAT v0.1.8.5C\LimeRAT.exe

Filesize
7.0MB

MD5
ffbb60a749e56f5082fe5062ea3f96ac

SHA1
21dc812e7222ddfe9cc378e427d87510ed9a54b8

SHA256
0e07e5cd74c50413b2c41fe12fdce42151b89f3824aebd310874b25de3a7d12f

SHA512
14a9528ca95b15a774bacae90ecb2915a796fdd9dc374664b038944da072317c274fdf37197f99a0012d9d1b0a6b5505cd83ec0a2e6058ee1e5562d0005cc74c

Download Submit
C:\Users\Admin\Desktop\LimeRAT v0.1.8.5C\LimeRATx.exe

Filesize
7.5MB

MD5
1bf8c72781edfc8b8844da21bc303d5e

SHA1
cdaae5914bbecd84f6f74f558639a7f9e0a1fdb1

SHA256
8c5f3d8af3d617ceb71e78bb8b18aa072f1241ba78d24058fd49aef6baef55d4

SHA512
faa6b67345b509fbfb42064e1c66e6cb1697994e6a69f88b579a19deb6df90e63ea78c4bbe840ed5d905c0440b3ec10aac8e8732a3948b02c6c5e4a6868f10b5

Download Submit
C:\Users\Admin\Desktop\Server.exe

Filesize
32KB

MD5
5482165587f5b849cd3d9cbc8d0a49c4

SHA1
db59c0e4a6c9b02856072625f34ce1e96a56ba69

SHA256
64d07f34c9aaadde5ac8bf904fdef43164a6eb963843c85df4fd0ae11afefa20

SHA512
7e7e5feabff4cabfbddd8ffd4532c6c5a9549b34d8644dfee9baaa1e9b3d481035766098daf79887354ab6c0c99c2316404469b646f7c24f96462321b08d7a00

Download Submit
C:\Users\Admin\Desktop\Virus Rat v8.0 Beta\Virus Rat v8.0 Beta.exe

Filesize
1.5MB

MD5
d09dde7627a40e1188c1f8583fc04f6f

SHA1
dee130741865f7ad97f4d9a349a538fe53746226

SHA256
b2c89ea8b521f8982b315e7e077aedb5f0f1a1cfdc6d5439b990a731d66c005c

SHA512
ffdb26d14447875bbdf67d95b6343da9e56ae1795846a05e49f563cd5e2141ea7d1a741c70df15cd7da30dc90ff620fe3cc2347f98d0a08b7722544866e73c6d

Download Submit
C:\Users\Admin\Desktop\Virus Rat v8.0 Beta\Virus Rat v8.0 Betax.exe

Filesize
4.9MB

MD5
4f75408c85ed77dc57751920d75855d2

SHA1
6d47dc82098fd5d0a6db4634b83683947ddeca73

SHA256
e6d4d0ca5dec1bc593866697730b3673f4ec12759c9ec72b09bcedf4e91fd72a

SHA512
0c3c31a2ac84ae85ab7fa6398622b2f685f9c3febb0f5fed703d4ee492ba8a8c1ce9c47fb1654e92d4a4c5cf99336a8db6491fb73c02a2939b557bf576d26f84

Download Submit
C:\Users\Admin\Desktop\l.exe

Filesize
184KB

MD5
4a7e408ebfeec9a47e0439c930763303

SHA1
8a959cb24e4f0a19bd595e3ec31f00baaf36dff0

SHA256
27ef9a650d846d564ffc1cb4ea6a9d3d9a16e59b27406a947e844e82d46c0cc2

SHA512
188388ea7dd5cb89227f035a9875ac8514e0ff28328dabbe9558ba56558d16a08b8f76955e9cca3b3982270a31bcede65910752d9b79297445b8a335ca952974

Download Submit
C:\Users\Admin\Desktop\njRAT v0.11G\Alert.wav

Filesize
643KB

MD5
562fb3b4b1b1eafd2cf107f2e92e0670

SHA1
cebf2a65c99e1b2c13d7212bf111bdf0fe5c13ce

SHA256
5ff592b183b2c990448f1dcd842a29cfe17a3eaa9956e0135c945c578676344a

SHA512
807cd580a04c84fb671c1dfa0fc2b90bbf2428e4727d7fa3956011623cae5c7e093acf55d5f0ad325116b729c96e845f06f3fc3007e8048238aacdea7f21386a

Download Submit
C:\Users\Admin\Desktop\njRAT v0.11G\Estub.exe

Filesize
23KB

MD5
a269c8915fe8754a7ae451b879415477

SHA1
2e49e94bcebbdafd3879fa10ceadf0f058f65da9

SHA256
142e61b92c40934e121c6204ad4a9cd2893cb3566e982a15d6df55454fe782af

SHA512
b23e60a51f20c76f43451ec870efb046abc9e3e0980014771188c041c41b8c6e719feae3f90d45b38d0042262f76564ab5b91739cc1a35b942292fc8947248ee

Download Submit
C:\Users\Admin\Desktop\njRAT v0.11G\GeoIP.dat

Filesize
1.2MB

MD5
797b96cc417d0cde72e5c25d0898e95e

SHA1
8c63d0cc8a3a09c1fe50c856b8e5170a63d62f13

SHA256
8a0675001b5bc63d8389fc7ed80b4a7b0f9538c744350f00162533519e106426

SHA512
9bb0c40c83551000577f8cf0b8a7c344bc105328a2c564df70fabec978ad267fa42e248c11fb78166855b0816d2ef3ec2c12fe52f8cc0b83e366e46301340882

Download Submit
C:\Users\Admin\Desktop\njRAT v0.11G\Mono.Cecil.dll

Filesize
305KB

MD5
851ec9d84343fbd089520d420348a902

SHA1
f8e2a80130058e4db3cf569cf4297d07d05c93e0

SHA256
cdadc26c09f869e21053ee1a0acf3b2d11df8edd599fe9c377bd4d3ce1c9cda9

SHA512
5e1d1b953fda4a905749eff8c4133a164748ba08c4854348539d335cf53c873eae7c653807a2701bf307693a049ae6c523bd1497a8e659bdea0a71085a58a5f1

Download Submit
C:\Users\Admin\Desktop\njRAT v0.11G\WinMM.Net.dll

Filesize
43KB

MD5
d4b80052c7b4093e10ce1f40ce74f707

SHA1
2494a38f1c0d3a0aa9b31cf0650337cacc655697

SHA256
59e2ac1b79840274bdfcef412a10058654e42f4285d732d1487e65e60ffbfb46

SHA512
3813b81f741ae3adb07ae370e817597ed2803680841ccc7549babb727910c7bff4f8450670d0ca19a0d09e06f133a1aaefecf5b5620e1b0bdb6bcd409982c450

Download Submit
C:\Users\Admin\Desktop\njRAT v0.11G\njRAT v0.11G.exe

Filesize
971KB

MD5
e835e5efd3e3f9b5bf42486029450264

SHA1
28f409676b8c949e5691289e17312ea867afb01c

SHA256
112113a092929c5abc34a05a2d4c42f736a23ea7ef66c23b5e005586db1e2fe2

SHA512
59006d66d4d475df46be583b48320f65e6f461843a94e1a809a1a610d0acacc4aa309e49867e1aff1158afbd01416b67254ea1d52c39314de54bfc4481466f84

Download Submit
C:\Users\Admin\Desktop\njRAT v0.11G\njRAT v0.11Gx.exe

Filesize
4.9MB

MD5
ffb4062b8c94ba74ea6778098a0b0147

SHA1
07f96525c1f1ed94715a42488453f9c1cee7eff1

SHA256
9edd1622b9cf1b2340f4a6605e26ebd0f996f97074c418bd15a4a9d457713898

SHA512
2a2af0144f1a396cf864b972cf2208f834d710129a8660e7e80f2baa96aa101db910f84f2d4677289e8c14d405da98d4cb6b2c2dc2a5c584b4547b53b8426d83

Download Submit
C:\Users\Admin\Desktop\njRAT v0.11G\plugin\cam.dll

Filesize
63KB

MD5
a73edb60b80a2dfa86735d821bea7b19

SHA1
f39a54d7bc25425578a2b800033e4508714a73ed

SHA256
7a4977b024d048b71bcc8f1cc65fb06e4353821323f852dc6740b79b9ab75c98

SHA512
283e9206d0b56c1f8b0741375ccd0a184410cf89f5f42dfe91e7438c5fd0ac7fa4afbb84b8b7ea448b3093397552fd3731b9be74c67b846d946da486dcf0df68

Download Submit
C:\Users\Admin\Desktop\njRAT v0.11G\plugin\ch.dll

Filesize
12KB

MD5
e747fa3339c1f138b6bfce707b541d03

SHA1
b95c54fbd6eb20ba4b4e69736b574baa2699ab8e

SHA256
6e31148cc1b3235b71731c3944a7b06f861e104e978708d12c695ec09b5b3760

SHA512
b970c3e8bf6a2e3ae920bc8bd014edb86ca92c85a2bccff732c7e5eb2f81ffbd902a34a0a68bd51545954b5f4d6dd1bb84b5c005868c0659717eba2892a67355

Download Submit
C:\Users\Admin\Desktop\njRAT v0.11G\plugin\inf.dll

Filesize
19KB

MD5
cef141d894400bc2e0096d1ed0c8f95b

SHA1
1bcef29980686dc4cf8ff13f251f1ead7ba6e2d2

SHA256
9648ffd2eb53744c5f78dc8442a8bcbbe9831db1e198be370a62cbf9f51cd896

SHA512
794e7cc5a899407414bb3bbe2f2aadbfcacdeda2eb0381249b8dd5ed342534910b85b1450f509f1d6b36109efdc82eb3ef1eba36b76ce123b1034192d871d2d7

Download Submit
C:\Users\Admin\Desktop\njRAT v0.11G\plugin\mic.dll

Filesize
50KB

MD5
d4c5ddc00f27162fc0947830e0e762b7

SHA1
7769be616d752e95d80e167f2ef4cc6b8c3c21fe

SHA256
b6fb6b66821e70a27a4750b0cd0393e4ee2603a47feac48d6a3d66d1c1cb56d5

SHA512
9555f800213f2f4a857b4558aa4d030edf41485b8366812d5a6b9adcc77fc21584e30d2dd9ce515846f3a809c85038958cb8174bf362cf6fed97ca99a826e379

Download Submit
C:\Users\Admin\Desktop\njRAT v0.11G\plugin\plg.dll

Filesize
40KB

MD5
80f3036110c00a57b09bba7343c16696

SHA1
aab69aa9dd1ae6c8ad38aca89720053c918d5560

SHA256
fc96e837e9902d3941210eeee94d79f9d268f9715fb966945bdb20cb93c9e497

SHA512
5e5140ec8a8b23d06ce3349e7c4b107c6a73fbe3fa55a05fa8178b3c3b76df6c417d3334a03824ac24c58208b03b46f94fa48f68cf313d93e214d40087b076e8

Download Submit
C:\Users\Admin\Desktop\njRAT v0.11G\plugin\pt.dll

Filesize
17KB

MD5
257382aaec1c75f7c0c8492149d615b4

SHA1
c420e365c2eb239a6bb8226b2d8355399e54116a

SHA256
52a6a0dae135328169ea619714a291729a2ef78356ce3601c1fc5d4311d14f3b

SHA512
4b7acbb275696d7dea4e66968e497e0c138d38e374c235e1964dfe18f287d31658694d9326e1e074ad4f2678e5bcebd4f4ad5b042781de60dfe8e12901c57d21

Download Submit
C:\Users\Admin\Desktop\njRAT v0.11G\plugin\pw.dll

Filesize
39KB

MD5
db87daf76c15f3808cec149f639aa64f

SHA1
d67f84a44ddc25432ce179aeba9cff778af746ee

SHA256
a3e4bee1b6944aa9266bd58de3f534a4c1896df621881a5252a0d355a6e67c70

SHA512
ad7dc75254180ff7c988b7f394ad76b696384002457d558469d2c6401dd97cba54c532245bb555ab28d2beda3ab504736bb2b89040a21ba6598929392daab473

Download Submit
C:\Users\Admin\Desktop\njRAT v0.11G\plugin\sc2.dll

Filesize
12KB

MD5
19967e886edcd2f22f8d4a58c8ea3773

SHA1
bf6e0e908eaad659fdd32572e9d73c5476ca26ec

SHA256
3e5141c75b7746c0eb2b332082a165deacb943cef26bd84668e6b79b47bdfd93

SHA512
d471df3f0d69909e8ef9f947da62c77c3ff1eb97ac1dd53a74ad09fb4d74ec26c3c22facc18ec04f26df3b85b0c70863119f5baa090b110ab25383fcdb4e9d6e

Download Submit
C:\Users\Admin\Desktop\njRAT v0.11G\stub.exe

Filesize
32KB

MD5
9eb959abe7d4fc63256ebbd216756222

SHA1
36cc04cd807251e08ca285f2070878165a42c94e

SHA256
a1c419116396cb01b6dadedbff3b140aa16e49d08c3e09f5da89a057982a5300

SHA512
d88c6e8b100893af21557fe0002aebd1209b0f5c18b8959b11fa689ebf14f214c38cb9faec0b8d3a63a6ef7dafff17befd88ec098fc90ab8109fbd7a6ee1fa17

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 372331.crdownload

Filesize
7.4MB

MD5
3875a5b0a469aa8d63e0a63e27c62a4f

SHA1
210ab7e0f8b69472ad26a45a9bae11f31c7f1c89

SHA256
164d890947f638747e8c1f48aa4846486d569f9097e0fcf98e1055fcf70e9f47

SHA512
0a88aef6675d80d9d757815be5fe52540189cbbb81b065ca50f7422e375f7ce29bd084ea7756b0f4c92856a2343bd6fe15384cdee2e63b36e814170677e24b95

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 407806.crdownload

Filesize
9.5MB

MD5
21bab7798f00f1c800d84ad098a58516

SHA1
1dd00479bcd600161946bc16c173d01745265114

SHA256
34e0167d94c66d58a48c9d11a1e6391975fd9dbf8af230fa4a691255df8419a5

SHA512
87848d4981896d7ac8fa13941af242fbd85e9bf92d91a346a8498f4b5d6f49d7412cb86984b21b05358ca79f9df44182ec4a22866fde16fa5f5e6fe35b7a51ba

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 679559.crdownload

Filesize
4.3MB

MD5
23d22636149f96029a95819232c81d39

SHA1
e917f7bba7e32d00eab7eec22df46f1a7ea4feac

SHA256
10d06a7e626dd304a5fbc219bce0001ad735cfe62674806dd7a237a16e20a962

SHA512
87b405db6a08451517716300f5d6f35e474c27868a5b0a7e3caac25367b072500de158eb42e33b31f814bcd4d269d801df0f6be56ea5de79b4a40649b8b2726e

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 783319.crdownload

Filesize
17.7MB

MD5
8c00eef493bda17ee854792c0ef768ea

SHA1
3252e53be05ca6ea93b2185830c13861c3e6b20e

SHA256
9e47fac7f18ffea8b34fa667b2dcd548f8d106c6d2a4c43a6fdf52a7990f0a3d

SHA512
17d4ce4b0f569c1f1ef21556117d1e496a2cb1c273e396bb9cf413158fd13636cbdcf6e76ac38f220ffee221596b1e251bcf7892eaaa0657ab9b31a7006cd18b

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 843436.crdownload

Filesize
8.2MB

MD5
cdf7a799fa0660275e4dd4d69bd87ede

SHA1
bb89141a3d5f8eedc4c7994a538fbb8309b87a3a

SHA256
d459bc6bc0ed596aebc5b54f51398d40bab2fed84aed89d52410719419c3db41

SHA512
50b76fb2dc282d381f4fa399c64fccfa8817a9244eaa0fb5a3b96a4a89443d5d7d6ee9b3856bf29d0547349a394c8f4f5d65c981c7a2b5b8ccdde1e0f267a00b

Download Submit
C:\Users\Admin\Downloads\njRAT v0.11G.zip

Filesize
6.0MB

MD5
32bf79b1446f3d8e61a7f56ba38ca4d7

SHA1
449aa1ca8abdf9e4dc063fcd5724595358bcb066

SHA256
f2cb1cbd4038819d76067507910caebca8a37d3f18098eee803755aab82902f0

SHA512
39a78b0b8016a1d28a865cc6b2f1c241a8415b7063a2377bc1a41151e2c845cae737392a22600210fa18cf92e5f9a077ad8486ef7c074ecbd3184f8722310c13

Download Submit
C:\Windows\SysWOW64\MicrosoftWindows.xml

Filesize
4KB

MD5
b1cbfcc7b7a5716a30b77f5dc5bb6135

SHA1
5c397ffd7a845b2fdf9e82ff73698784a91a2fb9

SHA256
96f2ff4ddcadf6421071daa6cdda2ce866fb7b10d12cc1b20bd07cb131210430

SHA512
d08516e7610e5a08d1c5c2d1cc5a22b1cd2d6b7c890f895caee0cf65577a1315d575d91a8f7f78ffc7bd0dd77b23ece46fadf58ba44257a115330a54a3ebfcf7

Download Submit
C:\Windows\SysWOW64\TiWorker.exe

Filesize
3.2MB

MD5
ecede3c32ce83ff76ae584c938512c5a

SHA1
090b15025e131cc03098f6f0d8fa5366bc5fa1f0

SHA256
366f1e9f9c99aa81034bada3cc344f2fb5a74246e1d5851441244df1ecc9ae6d

SHA512
61ca6075c8a2086d42b58698484afc0005645507474831cacafc10126f47c8f0cda10c1c215557f9391865b55b16ae881a593d7547cbad560b54369684b23d1d

Download Submit
C:\Windows\SysWOW64\config.json

Filesize
1011B

MD5
3da156f2d3307118a8e2c569be30bc87

SHA1
335678ca235af3736677bd8039e25a6c1ee5efca

SHA256
f86ab68eaddd22fbe679ea5ab9cc54775e74081beffd758b30776ba103f396eb

SHA512
59748e02cc4b7f280471b411d6ca3c9986f4c12f84b039bae25269634fc825cde417fe46246f58538668c19cca91e698e31d9f32df69aad89e68423f86bb00c0

Download Submit
memory/1496-1265-0x00000000028D0000-0x00000000028FC000-memory.dmp

Filesize
176KB

Download
memory/1496-1264-0x00000000000B0000-0x00000000007C2000-memory.dmp

Filesize
7.1MB

Download
memory/1496-1266-0x000000001B730000-0x000000001B7DA000-memory.dmp

Filesize
680KB

Download
memory/1832-549-0x0000000000400000-0x0000000000DCB000-memory.dmp

Filesize
9.8MB

Download
memory/1832-1564-0x0000000000400000-0x0000000000DCB000-memory.dmp

Filesize
9.8MB

Download
memory/1832-865-0x0000000000400000-0x0000000000DCB000-memory.dmp

Filesize
9.8MB

Download
memory/1832-864-0x0000000000400000-0x0000000000DCB000-memory.dmp

Filesize
9.8MB

Download
memory/1832-860-0x0000000000400000-0x0000000000DCB000-memory.dmp

Filesize
9.8MB

Download
memory/1832-859-0x0000000000400000-0x0000000000DCB000-memory.dmp

Filesize
9.8MB

Download
memory/1832-873-0x0000000000400000-0x0000000000DCB000-memory.dmp

Filesize
9.8MB

Download
memory/1832-856-0x0000000000400000-0x0000000000DCB000-memory.dmp

Filesize
9.8MB

Download
memory/1832-852-0x0000000000400000-0x0000000000DCB000-memory.dmp

Filesize
9.8MB

Download
memory/1832-850-0x0000000000400000-0x0000000000DCB000-memory.dmp

Filesize
9.8MB

Download
memory/1832-849-0x0000000000400000-0x0000000000DCB000-memory.dmp

Filesize
9.8MB

Download
memory/1832-874-0x0000000000400000-0x0000000000DCB000-memory.dmp

Filesize
9.8MB

Download
memory/1832-875-0x0000000000400000-0x0000000000DCB000-memory.dmp

Filesize
9.8MB

Download
memory/1832-820-0x0000000000400000-0x0000000000DCB000-memory.dmp

Filesize
9.8MB

Download
memory/1832-817-0x0000000000400000-0x0000000000DCB000-memory.dmp

Filesize
9.8MB

Download
memory/1832-780-0x0000000000400000-0x0000000000DCB000-memory.dmp

Filesize
9.8MB

Download
memory/1832-1575-0x0000000000400000-0x0000000000DCB000-memory.dmp

Filesize
9.8MB

Download
memory/1832-731-0x0000000000400000-0x0000000000DCB000-memory.dmp

Filesize
9.8MB

Download
memory/1832-561-0x0000000000400000-0x0000000000DCB000-memory.dmp

Filesize
9.8MB

Download
memory/1832-1287-0x0000000000400000-0x0000000000DCB000-memory.dmp

Filesize
9.8MB

Download
memory/1832-551-0x0000000000400000-0x0000000000DCB000-memory.dmp

Filesize
9.8MB

Download
memory/1832-1574-0x0000000000400000-0x0000000000DCB000-memory.dmp

Filesize
9.8MB

Download
memory/1832-547-0x0000000000400000-0x0000000000DCB000-memory.dmp

Filesize
9.8MB

Download
memory/1832-1573-0x0000000000400000-0x0000000000DCB000-memory.dmp

Filesize
9.8MB

Download
memory/1832-544-0x0000000000400000-0x0000000000DCB000-memory.dmp

Filesize
9.8MB

Download
memory/1832-1572-0x0000000000400000-0x0000000000DCB000-memory.dmp

Filesize
9.8MB

Download
memory/1832-531-0x0000000000400000-0x0000000000DCB000-memory.dmp

Filesize
9.8MB

Download
memory/1832-1571-0x0000000000400000-0x0000000000DCB000-memory.dmp

Filesize
9.8MB

Download
memory/1832-1570-0x0000000000400000-0x0000000000DCB000-memory.dmp

Filesize
9.8MB

Download
memory/1832-1279-0x0000000000400000-0x0000000000DCB000-memory.dmp

Filesize
9.8MB

Download
memory/1832-1569-0x0000000000400000-0x0000000000DCB000-memory.dmp

Filesize
9.8MB

Download
memory/1832-1269-0x0000000000400000-0x0000000000DCB000-memory.dmp

Filesize
9.8MB

Download
memory/1832-506-0x0000000000400000-0x0000000000DCB000-memory.dmp

Filesize
9.8MB

Download
memory/1832-1568-0x0000000000400000-0x0000000000DCB000-memory.dmp

Filesize
9.8MB

Download
memory/1832-1567-0x0000000000400000-0x0000000000DCB000-memory.dmp

Filesize
9.8MB

Download
memory/1832-1566-0x0000000000400000-0x0000000000DCB000-memory.dmp

Filesize
9.8MB

Download
memory/1832-1565-0x0000000000400000-0x0000000000DCB000-memory.dmp

Filesize
9.8MB

Download
memory/1832-869-0x0000000000400000-0x0000000000DCB000-memory.dmp

Filesize
9.8MB

Download
memory/1832-1563-0x0000000000400000-0x0000000000DCB000-memory.dmp

Filesize
9.8MB

Download
memory/1832-876-0x0000000000400000-0x0000000000DCB000-memory.dmp

Filesize
9.8MB

Download
memory/1832-1499-0x0000000000400000-0x0000000000DCB000-memory.dmp

Filesize
9.8MB

Download
memory/1832-1235-0x0000000000400000-0x0000000000DCB000-memory.dmp

Filesize
9.8MB

Download
memory/1832-877-0x0000000000400000-0x0000000000DCB000-memory.dmp

Filesize
9.8MB

Download
memory/1832-885-0x0000000000400000-0x0000000000DCB000-memory.dmp

Filesize
9.8MB

Download
memory/1832-1410-0x0000000000400000-0x0000000000DCB000-memory.dmp

Filesize
9.8MB

Download
memory/1832-1163-0x0000000000400000-0x0000000000DCB000-memory.dmp

Filesize
9.8MB

Download
memory/1832-463-0x0000000000400000-0x0000000000DCB000-memory.dmp

Filesize
9.8MB

Download
memory/1832-464-0x0000000000400000-0x0000000000DCB000-memory.dmp

Filesize
9.8MB

Download
memory/1832-469-0x0000000000400000-0x0000000000DCB000-memory.dmp

Filesize
9.8MB

Download
memory/1832-470-0x0000000000400000-0x0000000000DCB000-memory.dmp

Filesize
9.8MB

Download
memory/1832-983-0x0000000000400000-0x0000000000DCB000-memory.dmp

Filesize
9.8MB

Download
memory/1832-475-0x0000000000400000-0x0000000000DCB000-memory.dmp

Filesize
9.8MB

Download
memory/1832-1470-0x0000000000400000-0x0000000000DCB000-memory.dmp

Filesize
9.8MB

Download
memory/1832-473-0x0000000000400000-0x0000000000DCB000-memory.dmp

Filesize
9.8MB

Download
memory/1832-471-0x0000000000400000-0x0000000000DCB000-memory.dmp

Filesize
9.8MB

Download
memory/1832-1112-0x0000000000400000-0x0000000000DCB000-memory.dmp

Filesize
9.8MB

Download
memory/1832-472-0x0000000000400000-0x0000000000DCB000-memory.dmp

Filesize
9.8MB

Download
memory/2136-2694-0x0000000000AC0000-0x0000000000E26000-memory.dmp

Filesize
3.4MB

Download
memory/2136-2700-0x0000000004C90000-0x0000000004CE6000-memory.dmp

Filesize
344KB

Download
memory/2136-2699-0x0000000002BB0000-0x0000000002BBA000-memory.dmp

Filesize
40KB

Download
memory/2136-2698-0x000000000B3B0000-0x000000000B44C000-memory.dmp

Filesize
624KB

Download
memory/2136-2697-0x000000000B270000-0x000000000B302000-memory.dmp

Filesize
584KB

Download
memory/2136-2696-0x000000000B780000-0x000000000BD26000-memory.dmp

Filesize
5.6MB

Download
memory/2136-2695-0x0000000007870000-0x0000000007C78000-memory.dmp

Filesize
4.0MB

Download
memory/2744-474-0x0000019CE24C0000-0x0000019CE24EA000-memory.dmp

Filesize
168KB

Download
memory/4592-488-0x0000000000DA0000-0x0000000000DA8000-memory.dmp

Filesize
32KB

Download
memory/4592-509-0x0000000021B80000-0x0000000021BD2000-memory.dmp

Filesize
328KB

Download
memory/4592-555-0x000000001DCB0000-0x000000001DCC6000-memory.dmp

Filesize
88KB

Download
memory/4592-507-0x000000001DCB0000-0x000000001DCC6000-memory.dmp

Filesize
88KB

Download
memory/4592-493-0x000000001DEA0000-0x000000001DEB2000-memory.dmp

Filesize
72KB

Download
memory/4592-490-0x000000001E330000-0x000000001E4AE000-memory.dmp

Filesize
1.5MB

Download
memory/4592-489-0x000000001BFD0000-0x000000001C01C000-memory.dmp

Filesize
304KB

Download
memory/4592-487-0x000000001BD70000-0x000000001BE0C000-memory.dmp

Filesize
624KB

Download
memory/4592-486-0x000000001B7A0000-0x000000001BC6E000-memory.dmp

Filesize
4.8MB

Download
memory/4592-485-0x000000001B1C0000-0x000000001B266000-memory.dmp

Filesize
664KB

Download