njrat | hxxps://sites[.]google[.]com/view/exlaunch2/

Analysis

max time kernel
546s
max time network
784s
platform
windows11-21h2_x64
resource
win11-20241007-en
resource tags

arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
submitted
17-12-2024 13:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://sites.google.com/view/exlaunch2/

Score

10^/10

njrat hacked defense_evasion discovery evasion persistence phishing privilege_escalation trojan

Malware Config

Extracted

Family

njrat

Version

0.7d

Botnet

HacKed

hakim32.ddns.net:2000

127.0.0.1:5552

Mutex

85623461720a6d2cdfc5925563d264c4

Attributes

reg_key
85623461720a6d2cdfc5925563d264c4
splitter
|'|'|

Signatures

Njrat family
njrat
njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat
Downloads MZ/PE file

Modifies Windows Firewall 2 TTPs 1 IoCs

evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
1796	netsh.exe

A potential corporate email address has been identified in the URL: ExL@µnch3.zip
phishing
A potential corporate email address has been identified in the URL: ExL@µnch3.zipisavailablefordownload
phishing

Executes dropped EXE 5 IoCs

pid	Process
4452	winrar-x64-701.exe
900	winrar-x64-701.exe
1668	winrar-x64-701.exe
4644	Server.exe
4960	tmpF565.tmp.exe

Enumerates connected drives 3 TTPs 1 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\D:	Server.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
1	sites.google.com
5	sites.google.com

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\AppCompat\Programs\Amcache.hve.tmp	dw20.exe

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\winrar-x64-701.exe:Zone.Identifier	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3948	1452	WerFault.exe	130

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmpF565.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NjRat 0.7D Danger Edition.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dw20.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NjRat 0.7D Danger Edition.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ilasm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe

Checks processor information in registry 2 TTPs 7 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	dw20.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1	dw20.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	dw20.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	dw20.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	dw20.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	dw20.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	dw20.exe

Enumerates system info in registry 2 TTPs 5 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	dw20.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dw20.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-556537508-2730415644-482548075-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\0\0\MRUListEx = ffffffff	NjRat 0.7D Danger Edition.exe
Key created	\REGISTRY\USER\S-1-5-21-556537508-2730415644-482548075-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5	NjRat 0.7D Danger Edition.exe
Key created	\REGISTRY\USER\S-1-5-21-556537508-2730415644-482548075-1000_Classes\WOW6432Node\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	NjRat 0.7D Danger Edition.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-556537508-2730415644-482548075-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	NjRat 0.7D Danger Edition.exe
Key created	\REGISTRY\USER\S-1-5-21-556537508-2730415644-482548075-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg	NjRat 0.7D Danger Edition.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-556537508-2730415644-482548075-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	NjRat 0.7D Danger Edition.exe
Key created	\REGISTRY\USER\S-1-5-21-556537508-2730415644-482548075-1000_Classes\Local Settings	NjRat 0.7D Danger Edition.exe
Key created	\REGISTRY\USER\S-1-5-21-556537508-2730415644-482548075-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	NjRat 0.7D Danger Edition.exe
Key created	\REGISTRY\USER\S-1-5-21-556537508-2730415644-482548075-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	NjRat 0.7D Danger Edition.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-556537508-2730415644-482548075-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	NjRat 0.7D Danger Edition.exe
Key created	\REGISTRY\USER\S-1-5-21-556537508-2730415644-482548075-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	NjRat 0.7D Danger Edition.exe
Key created	\REGISTRY\USER\S-1-5-21-556537508-2730415644-482548075-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg	NjRat 0.7D Danger Edition.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-556537508-2730415644-482548075-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4"	NjRat 0.7D Danger Edition.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-556537508-2730415644-482548075-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4"	NjRat 0.7D Danger Edition.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-556537508-2730415644-482548075-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	NjRat 0.7D Danger Edition.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-556537508-2730415644-482548075-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	NjRat 0.7D Danger Edition.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-556537508-2730415644-482548075-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202020202020202	NjRat 0.7D Danger Edition.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-556537508-2730415644-482548075-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\Shell\SniffedFolderType = "Generic"	NjRat 0.7D Danger Edition.exe
Key created	\REGISTRY\USER\S-1-5-21-556537508-2730415644-482548075-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	NjRat 0.7D Danger Edition.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-556537508-2730415644-482548075-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\0\MRUListEx = 00000000ffffffff	NjRat 0.7D Danger Edition.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-556537508-2730415644-482548075-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	NjRat 0.7D Danger Edition.exe
Key created	\REGISTRY\USER\S-1-5-21-556537508-2730415644-482548075-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\2	NjRat 0.7D Danger Edition.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-556537508-2730415644-482548075-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16"	NjRat 0.7D Danger Edition.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	NjRat 0.7D Danger Edition.exe
Key created	\REGISTRY\USER\S-1-5-21-556537508-2730415644-482548075-1000_Classes\WOW6432Node\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	NjRat 0.7D Danger Edition.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-556537508-2730415644-482548075-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	NjRat 0.7D Danger Edition.exe
Key created	\REGISTRY\USER\S-1-5-21-556537508-2730415644-482548075-1000_Classes\Local Settings	NjRat 0.7D Danger Edition.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-556537508-2730415644-482548075-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\0\0 = 5a0031000000000091595b6c100053797374656d33320000420009000400efbec5522d6091595b6c2e0000008f360000000001000000000000000000000000000000c0221701530079007300740065006d0033003200000018000000	NjRat 0.7D Danger Edition.exe
Key created	\REGISTRY\USER\S-1-5-21-556537508-2730415644-482548075-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\0\0	NjRat 0.7D Danger Edition.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-556537508-2730415644-482548075-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202020202	NjRat 0.7D Danger Edition.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-556537508-2730415644-482548075-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257"	NjRat 0.7D Danger Edition.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-556537508-2730415644-482548075-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1"	NjRat 0.7D Danger Edition.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-556537508-2730415644-482548075-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	NjRat 0.7D Danger Edition.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-556537508-2730415644-482548075-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02020202	NjRat 0.7D Danger Edition.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-556537508-2730415644-482548075-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\MRUListEx = 0100000000000000ffffffff	NjRat 0.7D Danger Edition.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-556537508-2730415644-482548075-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\2\NodeSlot = "6"	NjRat 0.7D Danger Edition.exe
Key created	\REGISTRY\USER\S-1-5-21-556537508-2730415644-482548075-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6	NjRat 0.7D Danger Edition.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-556537508-2730415644-482548075-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	NjRat 0.7D Danger Edition.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-556537508-2730415644-482548075-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0100000000000000ffffffff	NjRat 0.7D Danger Edition.exe
Key created	\REGISTRY\USER\S-1-5-21-556537508-2730415644-482548075-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\Shell	NjRat 0.7D Danger Edition.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	NjRat 0.7D Danger Edition.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-556537508-2730415644-482548075-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257"	NjRat 0.7D Danger Edition.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-556537508-2730415644-482548075-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	NjRat 0.7D Danger Edition.exe
Key created	\REGISTRY\USER\S-1-5-21-556537508-2730415644-482548075-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1	NjRat 0.7D Danger Edition.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-556537508-2730415644-482548075-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\0 = 56003100000000004759e462100057696e646f777300400009000400efbec5522d6091595b6c2e000000a60500000000010000000000000000000000000000005a6dfb00570069006e0064006f0077007300000016000000	NjRat 0.7D Danger Edition.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-556537508-2730415644-482548075-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\Shell\SniffedFolderType = "Generic"	NjRat 0.7D Danger Edition.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-556537508-2730415644-482548075-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\MRUListEx = 020000000000000001000000ffffffff	NjRat 0.7D Danger Edition.exe
Key created	\REGISTRY\USER\S-1-5-21-556537508-2730415644-482548075-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\Shell	NjRat 0.7D Danger Edition.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-556537508-2730415644-482548075-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16"	NjRat 0.7D Danger Edition.exe
Key created	\REGISTRY\USER\S-1-5-21-556537508-2730415644-482548075-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-556537508-2730415644-482548075-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\0	NjRat 0.7D Danger Edition.exe
Key created	\REGISTRY\USER\S-1-5-21-556537508-2730415644-482548075-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	NjRat 0.7D Danger Edition.exe
Key created	\REGISTRY\USER\S-1-5-21-556537508-2730415644-482548075-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	NjRat 0.7D Danger Edition.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-556537508-2730415644-482548075-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	NjRat 0.7D Danger Edition.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-556537508-2730415644-482548075-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\0\0\NodeSlot = "5"	NjRat 0.7D Danger Edition.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-556537508-2730415644-482548075-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	NjRat 0.7D Danger Edition.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-556537508-2730415644-482548075-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	NjRat 0.7D Danger Edition.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-556537508-2730415644-482548075-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4"	NjRat 0.7D Danger Edition.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-556537508-2730415644-482548075-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	NjRat 0.7D Danger Edition.exe
Key created	\REGISTRY\USER\S-1-5-21-556537508-2730415644-482548075-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1	NjRat 0.7D Danger Edition.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-556537508-2730415644-482548075-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\MRUListEx = 00000000ffffffff	NjRat 0.7D Danger Edition.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-556537508-2730415644-482548075-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\2\MRUListEx = ffffffff	NjRat 0.7D Danger Edition.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-556537508-2730415644-482548075-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	NjRat 0.7D Danger Edition.exe
Key created	\REGISTRY\USER\S-1-5-21-556537508-2730415644-482548075-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\2	NjRat 0.7D Danger Edition.exe

NTFS ADS 5 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Temp\vu.exe\:Zone.Identifier:$DATA	NjRat 0.7D Danger Edition.exe
File opened for modification	C:\Users\Admin\Downloads\ExL@µnch3.zip:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 734794.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\winrar-x64-701.exe:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\NjRat.0.7D-main.zip:Zone.Identifier	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
396	msedge.exe
396	msedge.exe
3352	msedge.exe
3352	msedge.exe
4672	identity_helper.exe
4672	identity_helper.exe
2816	msedge.exe
2816	msedge.exe
4976	msedge.exe
4976	msedge.exe
408	msedge.exe
408	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
2496	msedge.exe
2496	msedge.exe
4644	Server.exe
4644	Server.exe
4644	Server.exe
4644	Server.exe
4644	Server.exe
4644	Server.exe
4644	Server.exe
4644	Server.exe
4644	Server.exe
4644	Server.exe
4644	Server.exe
4644	Server.exe
4644	Server.exe
4644	Server.exe
4644	Server.exe
4644	Server.exe
4644	Server.exe
4644	Server.exe
4644	Server.exe
4644	Server.exe
4644	Server.exe
4644	Server.exe
4644	Server.exe
4644	Server.exe
4644	Server.exe
4644	Server.exe
4644	Server.exe
4644	Server.exe
4644	Server.exe
4644	Server.exe
4644	Server.exe
4644	Server.exe
4644	Server.exe
4644	Server.exe
4644	Server.exe
4644	Server.exe
4644	Server.exe
4644	Server.exe
4644	Server.exe
4644	Server.exe
4644	Server.exe
4644	Server.exe
4644	Server.exe
4644	Server.exe
4644	Server.exe
4644	Server.exe

Suspicious behavior: GetForegroundWindowSpam 3 IoCs

pid	Process
1452	NjRat 0.7D Danger Edition.exe
4932	NjRat 0.7D Danger Edition.exe
4644	Server.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 29 IoCs

pid	Process
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe

Suspicious use of AdjustPrivilegeToken 40 IoCs

description	pid	Process
Token: SeRestorePrivilege	4808	dw20.exe
Token: SeBackupPrivilege	4808	dw20.exe
Token: SeBackupPrivilege	4808	dw20.exe
Token: SeBackupPrivilege	4808	dw20.exe
Token: SeBackupPrivilege	4808	dw20.exe
Token: 33	3056	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	3056	AUDIODG.EXE
Token: SeDebugPrivilege	4644	Server.exe
Token: 33	4644	Server.exe
Token: SeIncBasePriorityPrivilege	4644	Server.exe
Token: 33	4644	Server.exe
Token: SeIncBasePriorityPrivilege	4644	Server.exe
Token: 33	4644	Server.exe
Token: SeIncBasePriorityPrivilege	4644	Server.exe
Token: 33	4644	Server.exe
Token: SeIncBasePriorityPrivilege	4644	Server.exe
Token: 33	4644	Server.exe
Token: SeIncBasePriorityPrivilege	4644	Server.exe
Token: 33	4644	Server.exe
Token: SeIncBasePriorityPrivilege	4644	Server.exe
Token: 33	4644	Server.exe
Token: SeIncBasePriorityPrivilege	4644	Server.exe
Token: 33	4644	Server.exe
Token: SeIncBasePriorityPrivilege	4644	Server.exe
Token: 33	4644	Server.exe
Token: SeIncBasePriorityPrivilege	4644	Server.exe
Token: 33	4644	Server.exe
Token: SeIncBasePriorityPrivilege	4644	Server.exe
Token: 33	4644	Server.exe
Token: SeIncBasePriorityPrivilege	4644	Server.exe
Token: 33	4644	Server.exe
Token: SeIncBasePriorityPrivilege	4644	Server.exe
Token: 33	4644	Server.exe
Token: SeIncBasePriorityPrivilege	4644	Server.exe
Token: 33	4644	Server.exe
Token: SeIncBasePriorityPrivilege	4644	Server.exe
Token: 33	4644	Server.exe
Token: SeIncBasePriorityPrivilege	4644	Server.exe
Token: 33	4644	Server.exe
Token: SeIncBasePriorityPrivilege	4644	Server.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe

Suspicious use of SendNotifyMessage 17 IoCs

pid	Process
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
1452	NjRat 0.7D Danger Edition.exe
1452	NjRat 0.7D Danger Edition.exe
4932	NjRat 0.7D Danger Edition.exe
4932	NjRat 0.7D Danger Edition.exe
4932	NjRat 0.7D Danger Edition.exe

Suspicious use of SetWindowsHookEx 13 IoCs

pid	Process
4452	winrar-x64-701.exe
4452	winrar-x64-701.exe
4452	winrar-x64-701.exe
900	winrar-x64-701.exe
900	winrar-x64-701.exe
900	winrar-x64-701.exe
1668	winrar-x64-701.exe
1668	winrar-x64-701.exe
1668	winrar-x64-701.exe
1452	NjRat 0.7D Danger Edition.exe
1452	NjRat 0.7D Danger Edition.exe
4932	NjRat 0.7D Danger Edition.exe
4932	NjRat 0.7D Danger Edition.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3352 wrote to memory of 3124	3352	msedge.exe	77
PID 3352 wrote to memory of 3124	3352	msedge.exe	77
PID 3352 wrote to memory of 2928	3352	msedge.exe	78
PID 3352 wrote to memory of 2928	3352	msedge.exe	78
PID 3352 wrote to memory of 2928	3352	msedge.exe	78
PID 3352 wrote to memory of 2928	3352	msedge.exe	78
PID 3352 wrote to memory of 2928	3352	msedge.exe	78
PID 3352 wrote to memory of 2928	3352	msedge.exe	78
PID 3352 wrote to memory of 2928	3352	msedge.exe	78
PID 3352 wrote to memory of 2928	3352	msedge.exe	78
PID 3352 wrote to memory of 2928	3352	msedge.exe	78
PID 3352 wrote to memory of 2928	3352	msedge.exe	78
PID 3352 wrote to memory of 2928	3352	msedge.exe	78
PID 3352 wrote to memory of 2928	3352	msedge.exe	78
PID 3352 wrote to memory of 2928	3352	msedge.exe	78
PID 3352 wrote to memory of 2928	3352	msedge.exe	78
PID 3352 wrote to memory of 2928	3352	msedge.exe	78
PID 3352 wrote to memory of 2928	3352	msedge.exe	78
PID 3352 wrote to memory of 2928	3352	msedge.exe	78
PID 3352 wrote to memory of 2928	3352	msedge.exe	78
PID 3352 wrote to memory of 2928	3352	msedge.exe	78
PID 3352 wrote to memory of 2928	3352	msedge.exe	78
PID 3352 wrote to memory of 2928	3352	msedge.exe	78
PID 3352 wrote to memory of 2928	3352	msedge.exe	78
PID 3352 wrote to memory of 2928	3352	msedge.exe	78
PID 3352 wrote to memory of 2928	3352	msedge.exe	78
PID 3352 wrote to memory of 2928	3352	msedge.exe	78
PID 3352 wrote to memory of 2928	3352	msedge.exe	78
PID 3352 wrote to memory of 2928	3352	msedge.exe	78
PID 3352 wrote to memory of 2928	3352	msedge.exe	78
PID 3352 wrote to memory of 2928	3352	msedge.exe	78
PID 3352 wrote to memory of 2928	3352	msedge.exe	78
PID 3352 wrote to memory of 2928	3352	msedge.exe	78
PID 3352 wrote to memory of 2928	3352	msedge.exe	78
PID 3352 wrote to memory of 2928	3352	msedge.exe	78
PID 3352 wrote to memory of 2928	3352	msedge.exe	78
PID 3352 wrote to memory of 2928	3352	msedge.exe	78
PID 3352 wrote to memory of 2928	3352	msedge.exe	78
PID 3352 wrote to memory of 2928	3352	msedge.exe	78
PID 3352 wrote to memory of 2928	3352	msedge.exe	78
PID 3352 wrote to memory of 2928	3352	msedge.exe	78
PID 3352 wrote to memory of 2928	3352	msedge.exe	78
PID 3352 wrote to memory of 396	3352	msedge.exe	79
PID 3352 wrote to memory of 396	3352	msedge.exe	79
PID 3352 wrote to memory of 1244	3352	msedge.exe	80
PID 3352 wrote to memory of 1244	3352	msedge.exe	80
PID 3352 wrote to memory of 1244	3352	msedge.exe	80
PID 3352 wrote to memory of 1244	3352	msedge.exe	80
PID 3352 wrote to memory of 1244	3352	msedge.exe	80
PID 3352 wrote to memory of 1244	3352	msedge.exe	80
PID 3352 wrote to memory of 1244	3352	msedge.exe	80
PID 3352 wrote to memory of 1244	3352	msedge.exe	80
PID 3352 wrote to memory of 1244	3352	msedge.exe	80
PID 3352 wrote to memory of 1244	3352	msedge.exe	80
PID 3352 wrote to memory of 1244	3352	msedge.exe	80
PID 3352 wrote to memory of 1244	3352	msedge.exe	80
PID 3352 wrote to memory of 1244	3352	msedge.exe	80
PID 3352 wrote to memory of 1244	3352	msedge.exe	80
PID 3352 wrote to memory of 1244	3352	msedge.exe	80
PID 3352 wrote to memory of 1244	3352	msedge.exe	80
PID 3352 wrote to memory of 1244	3352	msedge.exe	80
PID 3352 wrote to memory of 1244	3352	msedge.exe	80
PID 3352 wrote to memory of 1244	3352	msedge.exe	80
PID 3352 wrote to memory of 1244	3352	msedge.exe	80

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://sites.google.com/view/exlaunch2/
1⤵
- Enumerates system info in registry
- Modifies registry class
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ff9f2cb3cb8,0x7ff9f2cb3cc8,0x7ff9f2cb3cd8
  2⤵
  PID:3124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1940,15211016354904442048,14163140074557375999,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1948 /prefetch:2
  2⤵
  PID:2928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1940,15211016354904442048,14163140074557375999,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2304 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1940,15211016354904442048,14163140074557375999,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2764 /prefetch:8
  2⤵
  PID:1244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,15211016354904442048,14163140074557375999,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3304 /prefetch:1
  2⤵
  PID:692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,15211016354904442048,14163140074557375999,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3336 /prefetch:1
  2⤵
  PID:4204
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1940,15211016354904442048,14163140074557375999,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5124 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,15211016354904442048,14163140074557375999,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5096 /prefetch:1
  2⤵
  PID:1676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,15211016354904442048,14163140074557375999,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5488 /prefetch:1
  2⤵
  PID:1236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1940,15211016354904442048,14163140074557375999,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3452 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,15211016354904442048,14163140074557375999,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5464 /prefetch:1
  2⤵
  PID:1124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,15211016354904442048,14163140074557375999,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5788 /prefetch:1
  2⤵
  PID:3900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,15211016354904442048,14163140074557375999,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3388 /prefetch:1
  2⤵
  PID:4200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1940,15211016354904442048,14163140074557375999,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3328 /prefetch:8
  2⤵
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:4976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,15211016354904442048,14163140074557375999,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6284 /prefetch:1
  2⤵
  PID:1560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,15211016354904442048,14163140074557375999,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6480 /prefetch:1
  2⤵
  PID:2704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,15211016354904442048,14163140074557375999,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5464 /prefetch:1
  2⤵
  PID:2232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,15211016354904442048,14163140074557375999,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6828 /prefetch:1
  2⤵
  PID:3276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,15211016354904442048,14163140074557375999,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6056 /prefetch:1
  2⤵
  PID:2208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,15211016354904442048,14163140074557375999,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6768 /prefetch:1
  2⤵
  PID:3532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,15211016354904442048,14163140074557375999,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6052 /prefetch:1
  2⤵
  PID:2496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,15211016354904442048,14163140074557375999,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6920 /prefetch:1
  2⤵
  PID:4024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,15211016354904442048,14163140074557375999,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6824 /prefetch:1
  2⤵
  PID:3040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,15211016354904442048,14163140074557375999,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3332 /prefetch:1
  2⤵
  PID:1004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,15211016354904442048,14163140074557375999,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7080 /prefetch:1
  2⤵
  PID:4876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,15211016354904442048,14163140074557375999,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5788 /prefetch:1
  2⤵
  PID:708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,15211016354904442048,14163140074557375999,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3572 /prefetch:1
  2⤵
  PID:4936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,15211016354904442048,14163140074557375999,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1148 /prefetch:1
  2⤵
  PID:836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1940,15211016354904442048,14163140074557375999,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6300 /prefetch:8
  2⤵
  PID:3580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,15211016354904442048,14163140074557375999,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6044 /prefetch:1
  2⤵
  PID:4764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1940,15211016354904442048,14163140074557375999,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7236 /prefetch:8
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:408
- C:\Users\Admin\Downloads\winrar-x64-701.exe
  "C:\Users\Admin\Downloads\winrar-x64-701.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:4452
- C:\Users\Admin\Downloads\winrar-x64-701.exe
  "C:\Users\Admin\Downloads\winrar-x64-701.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1940,15211016354904442048,14163140074557375999,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=6740 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,15211016354904442048,14163140074557375999,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6552 /prefetch:1
  2⤵
  PID:4176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,15211016354904442048,14163140074557375999,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5124 /prefetch:1
  2⤵
  PID:4300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,15211016354904442048,14163140074557375999,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3552 /prefetch:1
  2⤵
  PID:2736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,15211016354904442048,14163140074557375999,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5356 /prefetch:1
  2⤵
  PID:4784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,15211016354904442048,14163140074557375999,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4996 /prefetch:1
  2⤵
  PID:696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,15211016354904442048,14163140074557375999,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3540 /prefetch:1
  2⤵
  PID:4408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,15211016354904442048,14163140074557375999,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5872 /prefetch:1
  2⤵
  PID:5024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1940,15211016354904442048,14163140074557375999,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6728 /prefetch:8
  2⤵
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:2496

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4824

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:540

C:\Windows\system32\werfault.exe
werfault.exe /h /shared Global\973bd82cead94facaef78edd1e972d89 /t 4048 /p 4452
1⤵
PID:2352

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3380

C:\Users\Admin\Downloads\winrar-x64-701.exe
"C:\Users\Admin\Downloads\winrar-x64-701.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1668

C:\Users\Admin\AppData\Local\Temp\Temp1_NjRat.0.7D-main.zip\NjRat.0.7D-main\NjRat 0.7D Danger Edition\NjRat 0.7D Danger Edition.exe
"C:\Users\Admin\AppData\Local\Temp\Temp1_NjRat.0.7D-main.zip\NjRat.0.7D-main\NjRat 0.7D Danger Edition\NjRat 0.7D Danger Edition.exe"
1⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:1452
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
  dw20.exe -x -s 2332
  2⤵
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Checks processor information in registry
  - Enumerates system info in registry
  - Suspicious use of AdjustPrivilegeToken
  PID:4808
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1452 -s 2252
  2⤵
  - Program crash
  PID:3948

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 1452 -ip 1452
1⤵
PID:4760

C:\Users\Admin\Desktop\NjRat 0.7D Danger Edition\NjRat 0.7D Danger Edition.exe
"C:\Users\Admin\Desktop\NjRat 0.7D Danger Edition\NjRat 0.7D Danger Edition.exe"
1⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
- NTFS ADS
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:4932
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\ilasm.exe
  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\ilasm.exe" /alignment=512 /QUIET "C:\Users\Admin\AppData\Local\Temp\stub.il" /output:"C:\Users\Admin\Desktop\Server.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4412

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004BC 0x00000000000004D4
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3056

C:\Users\Admin\Desktop\Server.exe
"C:\Users\Admin\Desktop\Server.exe"
1⤵
- Executes dropped EXE
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:4644
- C:\Windows\SysWOW64\netsh.exe
  netsh firewall add allowedprogram "C:\Users\Admin\Desktop\Server.exe" "Server.exe" ENABLE
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:1796
- C:\Users\Admin\AppData\Local\Temp\tmpF565.tmp.exe
  "C:\Users\Admin\AppData\Local\Temp\tmpF565.tmp.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4960
- C:\Users\Admin\AppData\Local\Temp\tmp926E.tmp.exe
  "C:\Users\Admin\AppData\Local\Temp\tmp926E.tmp.exe"
  2⤵
  PID:4124
- C:\Users\Admin\AppData\Local\Temp\tmpFCEB.tmp.exe
  "C:\Users\Admin\AppData\Local\Temp\tmpFCEB.tmp.exe"
  2⤵
  PID:5776
- C:\Users\Admin\AppData\Local\Temp\tmp66A3.tmp.exe
  "C:\Users\Admin\AppData\Local\Temp\tmp66A3.tmp.exe"
  2⤵
  PID:5944

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {c82192ee-6cb5-4bc0-9ef0-fb818773790a} -Embedding
1⤵
PID:1256

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:1792

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc
1⤵
PID:2148

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
554d6d27186fa7d6762d95dde7a17584

SHA1
93ea7b20b8fae384cf0be0d65e4295097112fdca

SHA256
2fa6145571e1f1ece9850a1ac94661213d3e0d82f1cef7ac1286ff6b2c2017cb

SHA512
57d9008ccabc315bd0e829b19fe91e24bab6ef20bcfab651b937b0f38eec840b58d0aed092a3bbedd2d6a95d5c150372a1e51087572de55672172adc1fc468a7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a28bb0d36049e72d00393056dce10a26

SHA1
c753387b64cc15c0efc80084da393acdb4fc01d0

SHA256
684d797e28b7fd86af84bfb217d190e4f5e03d92092d988a6091b2c7bbbd67c1

SHA512
20940fee33aa2194c36a3db92d4fd314ce7eacc2aa745abec62aa031c2a53ba4ff89f2568626e7bd2536090175f8d045c3bb52c5faa5ecc8da8410ab5fc519f7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\32215236-d9c0-443e-b2cc-7bca09b95726.tmp

Filesize
1KB

MD5
d6e90a4534aa0abfbc4d440e96f0a305

SHA1
fb810c7b35d5e72937a81249c8d2c2392c9d7314

SHA256
7f70000ab6a7fa341610cf479f6297216213c3b2af3ea497576affa8ec283909

SHA512
ab1830f584a0608ce71a35e16d870638b8174f4ea619c93285718182ba0bab7ceb4b36d410362a60c1105bab0c69a24d6e517459c1f69fab2dcbd4518e2d449e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00002e

Filesize
62KB

MD5
c813a1b87f1651d642cdcad5fca7a7d8

SHA1
0e6628997674a7dfbeb321b59a6e829d0c2f4478

SHA256
df670e09f278fea1d0684afdcd0392a83d7041585ba5996f7b527974d7d98ec3

SHA512
af0d024ba1faafbd6f950c67977ed126827180a47cea9758ee51a95d13436f753eb5a7aa12a9090048a70328f6e779634c612aebde89b06740ffd770751e1c5b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00002f

Filesize
67KB

MD5
69df804d05f8b29a88278b7d582dd279

SHA1
d9560905612cf656d5dd0e741172fb4cd9c60688

SHA256
b885987a52236f56ce7a5ca18b18533e64f62ab64eb14050ede93c93b5bd5608

SHA512
0ef49eeeeb463da832f7d5b11f6418baa65963de62c00e71d847183e0035be03e63c097103d30329582fe806d246e3c0e3ecab8b2498799abbb21d8b7febdc0e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000030

Filesize
19KB

MD5
1bd4ae71ef8e69ad4b5ffd8dc7d2dcb5

SHA1
6dd8803e59949c985d6a9df2f26c833041a5178c

SHA256
af18b3681e8e2a1e8dc34c2aa60530dc8d8a9258c4d562cbe20c898d5de98725

SHA512
b3ff083b669aca75549396250e05344ba2f1c021468589f2bd6f1b977b7f11df00f958bbbd22f07708b5d30d0260f39d8de57e75382b3ab8e78a2c41ef428863

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000031

Filesize
63KB

MD5
226541550a51911c375216f718493f65

SHA1
f6e608468401f9384cabdef45ca19e2afacc84bd

SHA256
caecff4179910ce0ff470f9fa9eb4349e8fb717fa1432cf19987450a4e1ef4a5

SHA512
2947b309f15e0e321beb9506861883fde8391c6f6140178c7e6ee7750d6418266360c335477cae0b067a6a6d86935ec5f7acdfdacc9edffa8b04ec71be210516

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00003e

Filesize
18KB

MD5
5874476248aa64a7474180838abbfacb

SHA1
82bce12fcef16b46aa29747f1f4f5b3675ea920a

SHA256
69633ea1317c6e008ec045c365f8ac1bd633db8454c1d90eea7b77368e3462a0

SHA512
7847bc55ebe9dbc4a77f634d4f2f0ad508bf2e81ba175beb071b927d0361efb6cffed65479211c719b9f6bc29b91ed8d98164ed9ac393ac31162227aa50eaf8e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
a3d0936b65f89210d083b32bc2eeb739

SHA1
d6ab7464fcab0a2cff23cb43bc6cfd5acaef3be8

SHA256
cff194665e4616e610fc62680625eb2ec57f784971cba104313ef672310805f2

SHA512
6e602c83ac628db354297475bc3b41bff17fd8ac3ca3d863667368cf229192da06ba1c5edddd8182be0ce4be8563b1a570ac544f4393e119e147ba5db4c8934f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
4KB

MD5
1b728b9e70be311dad405394572ae1a1

SHA1
a6d57a3882c4afefcb906df4c40ee72ac5d27cfa

SHA256
b14f33bac6945b9904d2db08a14cfd087feeb368d9503d6fb2d5631c219854b0

SHA512
efc8beb7c52f38c67fdb00d93ea22a5f6c258bddf99064457529baa62a946c043810a005a0ed14ed5c872430a5749c67ea70888c78abe8410031bfb8a1663a28

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
66706901a9a62492d1c6c765d7684b1c

SHA1
2bdcf1cc29ceb18df01c4d53cabdbecc3bfb9a7b

SHA256
c18634887780560344cb3ba54a49a1c9b94d194efe7a48c31a9e2138df41782a

SHA512
12cfdd5dd4ee911c0075bd7334da48b40bbc06a48279c0c921432476f3a3a66d7338157fccea0fd461926eae9ad30038d0f0c543a1f3a2d9b49d015f049f035c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
4KB

MD5
ef71fbc9a7a9cb03d3f1a69cd69be169

SHA1
9d6e1dbfdb6ef7f7a3984f4cb36ee887e7736095

SHA256
9f134188acf4061db4f69b424ab36a3857f6be89e395d387197ef65707ee1b25

SHA512
140ad11083fa50cbce377dba2bda262bdeac2423931a455467df33736467fb1a943524db2c0bd4a067eb84a24dfd4f059ab65fc823e7a74b92ca7a852ea2e3af

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
052cd4cc6964e7c9ed0d41593754417c

SHA1
219082a61da17711574bc48b0997004c0a3330cc

SHA256
f1202cbc3e9e4b0baf13b10bad70acb26a944d05709183d2db496492de74fb6c

SHA512
e4edc4a68f636ddaee187f7c41a0c8212e28206df738cd85053d069298daa2be65d55c4c97b5f007317978a92f3ac668df3dd7e918c4a4280ab9d87058f31141

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
4KB

MD5
c74a1ff0f56e303a2a1dcd3172da93c6

SHA1
e74d536a9c96044b922feffa508ccbc35e05f56c

SHA256
e869544b0773a223fcb24353a8663a10f8ec1c50e8228b2b9c4cb3dfd4d46318

SHA512
171112df994a34917fed3bba1176a97cf79661c154495c8a2bdddf074b5f9d5d2eb22dfd6973dc5daf3641b0d3258c682d4f3253a5fd25f21d25bc016b05a272

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
4KB

MD5
379205c06f6b2b0535accfbbf904670f

SHA1
d9d5eaac56523d58534926cd70510f5e8b263890

SHA256
1b4b8fa451179b37c7d163843313e69b57ae8680287e5e63086c2fa4d776f318

SHA512
8e1691b48111d2a321c87b7ffaa98f6d3f4188f5779806b5e9fabedb23a4c07c368071f6c20b57a3fd134a1ce6d9e1670806e8c8726df5969a4d70562d3870e8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
803a463b45060f554a2b7084622cf6a6

SHA1
49e2b83496016e11867322f6c26f6dea48ad14b6

SHA256
cf1a94c756fdf5c569d635b38f0039853a65cd654cf5914d2e31463a0a2f735c

SHA512
1c15f2d0544cd64e234173497c796e11656106305736ab8b393126b77de86b5aafb461b4387dd8693a20a69af6c5386d13be2658f2cde0cae63367836bc21d21

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
4KB

MD5
219157173aafae6fd758facfb8ca99cb

SHA1
473bba10baf73d271c290a377ee1ce120664507e

SHA256
b729e82440212b0d17bc9a2c5f1e2435664590455bb11209196797b883a65932

SHA512
caacae6c0afd4d2a18813aa3fa760730892c40e90bca488f3dba961bc0f79e42522c208a867b6e4563838f85116e7aecd8756572725b6b603531df533e41c621

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
f42828433d7fc86e97a00e99e2e0ce8e

SHA1
e81babcf3fdae95924b426cc5bb380549d6407d8

SHA256
60eae439df3f327f6ea25f3a617801bcf2ee3d339282c9f722c87d190c301212

SHA512
1549b274e6e85de96bd2f357d4f9a583cfe27faf3eae056f08cbb1498d79decda42354f0fc7551b6a9b9dcf6433f2fcf7eaf1ed0ef5c8854b9705aa57b61fc6f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
19094dcf876dd791752b549d5ea4863b

SHA1
76334a306f01c900218aec13a5b83222ddf95222

SHA256
473534070603f8075f153a66f2f3a9b7ae6b103255248efbe19cdfb48162b433

SHA512
f7eeebd0d60a21a1573e0afbd0a5548fb795378a0ef915483ddbfda8e88f7d55fcecb0f503c348b7edcf37f62bf1b36886cdcb0c49cdc4356363c0ece4f86e28

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
203f3c5b1e35f5d47265549ee947cb1f

SHA1
02861d82848dd7230b1626d08b17486746660a0b

SHA256
630e93e0e5565420479b0c2b523ec78c5657ff552f11db0aeca7a94ae4e50938

SHA512
3d7f7844bfd6912e3a215df28ff91b10346e71d3a526f2bef2ccd4420b33dd587d2f2fef53ec30b9207c9b33514854cf1859f325bb234dd609dfa06790ee13cc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
c33ef63783d099d30168a7f8a88e80a9

SHA1
b8e50fc47ed1bd64efb8934571259930d89f1410

SHA256
1b064852b136f7a93202ad3e983b26284ab34af0e32278ed156d0dba068be1a9

SHA512
ada324ab143ebbab988fa314ddc3dc65b0232b1fd3c5780bdf4de9fcc920e6dd86317bbc6d49deed3a98a01a32ade4f58132d4a350d0e1a1df2cf46a02bd3c8f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
bb4c51af5cd1d5299a5c87786a264c45

SHA1
4342ad8bbd438b2ad72aaad39e345b03a035eb48

SHA256
6f313ce0611faeb7c869afcfbdbe79783a68103d981c17369751b166461bdf66

SHA512
1442771dae21d954a8ebef93c71bd601f555e5ae00ebaff72ba2630974b150b655bfd813ca82eef632284deb3cd76daa45e633242aacf8618a3354a309990d0e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
c9086194f32024a5639c04fd1854856e

SHA1
471017ae81830a421a94adf6dadabee0dcf899de

SHA256
1df6912e297e9a6cac419b1beece31f2bc7f4f522483e2e43400a3b1803270f4

SHA512
a772cea3900f178d5161b1806f58974b82e2bd748ade11b23b3234078cf43f8739034bfe7bd8e3d67cba407a567afeb536f72bbf0551f8912710637294b199e8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
04881761c5622c3826f3e4981e79fa4b

SHA1
69adf07451523ffdf38de038b0c025437ffe5518

SHA256
e6068383ef6759271c820970b9303f353db567eb2f36d1db7d76479bee25352b

SHA512
c26564d228ee75618ac2f2dfe5a5f6def2248ea0f9c21f2fc989e8a7d48fb1ae7f24ac8bfde47d86e41ae6a34c340f11fa136b6ffe89cef372f83a9bb697c6b5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
7c444e09eddd5b4c3583f235fdd2a49a

SHA1
d14fe255b665027bee3423c2fcf1895cdaa3cd99

SHA256
c1812f65529d81a7adfb0cf99608eefd989d41a2fdfff6bec597c940c0aa025e

SHA512
9916a4328a5c2db025af2f289362ff237d45ab4815bb90386ac0e54c8d8f118b916198cffc8b895ac2d2c71453b9940271884890a65dd6825e7725dc56e4728b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
72B

MD5
d19d5fef1f75dea2638508a1b89ef40a

SHA1
e33bbb05ee5549603ef7d41d7f6754b30924ec2a

SHA256
70b80b9c4ecebfd04c0e6bf4e020029a0958f243518c9894d0272f08c73b0289

SHA512
80a9ce5889d203a28285e924f4fb11d02a04b70210ca6f0c5e9084d49a6cf414197dc564846d2eb52fe66be4d74b648360b919e2f5cc112cbd779a7ffd548045

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe583042.TMP

Filesize
48B

MD5
b157495144c50c71dcf1bf98a3b749bd

SHA1
49ccc83241e343705324d2e8f26631ab9f3ee9d3

SHA256
ae73604b59f4429f86311827da99612181e4d977ec2b70663fe739c016ae01ad

SHA512
77fb8cdc35c781dec0cbf3cfe96263b5d252048fbd00c2b1a47740cda919688fd7b051e8668d8c7221a8d27b723f29cc76441df42691b7d78cd055ba680451e6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
f96c7e41ee5513331c24c847cde6f5c6

SHA1
435ace36c8bf7e7eee1e55b84d98e3bf62f24004

SHA256
cf3f6fc60d5e787ad74b8859636a36752cb637a3d73b30addff5a812f21e2b98

SHA512
90aadb032d564a9a8ba9413206fcfa8d14987af04428a242a010b81d1b816c5d827cab37b343bf038dcdc33d8c204cad6c54e33e6ecc9c6c440d16e3153f6e91

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
eb865c1d98b705e4de91d733b44930e0

SHA1
ec6c892d8b0169575fa0bab88117cba6a0804ff0

SHA256
a81c541b610f8381161a2762ebf1dcaef73293966ce0187746dec4f7bf98eb1e

SHA512
5d87a4c1b225d2b9521003b609303f34c2bcd72d63c093b6e5a0c2f3f63c9889c7c0129cf9cc88fafb0b66e999803f1c8af46ec6754107ee0647b698998b287a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
3c38a85808f18f173e1b14b7dd1d7318

SHA1
a423cc3dbe171ce69eeda2957d9e308ec5469e96

SHA256
670cdd44faed6cbcf7812a8477a09bfee94d23a20938305219139f722afbf6be

SHA512
ffdc24a691853070b3cab34eaed88d8db863fd9cd7dc9a8c88ae7914c6f62030a2dd43e4df1d71882d8daea253df809e68f7754a185ced22516d71113a864590

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
f594fd7395e127ee2fc270c4483f8edb

SHA1
b3603fdb6647a08ebc9bd49b4b6fd7ab6c6052d5

SHA256
f3339e2f1858f3adc86f077aa38e330f0fe1d4c4423a650ce857c0a1dd4285c8

SHA512
d1319dea01a655a95ead7e69eb88591a6d00aa63d32f25ed57495e5a22d295c063e86c2a961ab7860191c752372554a1e250fb9f18c9934cf77620ae100f55b2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
c55c63c3644d7b76ab0004bb7cf95b38

SHA1
e63b6931237311d3835b3ce90562f45d3b6fb257

SHA256
82ea222bdc32c791e46deccb2b4d26104121f7f6242f69ef56201605542c1e17

SHA512
1eb46730f7be02e9e60b1690a99180e8c95cdb15af24f871a88004ea50e449f30415f452c216794cf526a890a61371841cbfd06b4bd79c859a1083e702aa939c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
5972450bc859e610133849e97cd1df0f

SHA1
3f25c328f06542691cb4f6194d5ac6774ac1db5f

SHA256
94e134d4d9bd1cab99078f57d0c405e51bfa9c0491567a25ed0a4d13a5d7ca3b

SHA512
0a2fa6f2a1e1fa66ddb5f70237517000e99a626616cf042dcf2e5c64bf8d64599fb7b105283d1c3e567e058740829f6906f6cf3ba578076c59220895942c26ed

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
11d6574966d58ab97d89018f0bb53ef6

SHA1
ba4f71a2a5b8e40bce70268b9906044c883acc0f

SHA256
9b745e2b6fec35cdf6bb6fa3673edc4fa4710c2d33562b64be716f48253b57bc

SHA512
7e0923a71c54f163fa63d9a9ae5e76c657c4ce4f3d6a72d72e5c08d8c4adefe0211013257464dd1343b961c07645885cb7e7b3cc3deb2ed0d0a73b9e42de4628

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
7c3f75b7925d8bfb97322ab3b92872eb

SHA1
176a7f44c83ef7af5edeaf4f0b7a9ce2a61a79af

SHA256
9a903430fbfc750127aeb1cfec893e62377758f60d7cfc8e401f4b3369a0ee70

SHA512
08b47f4ac9b4999a1e7fec2b41f923e725f93c98b52a58b5420925c78c6a647ba720e87d09224bd98e4f3da8ff4bbd0673852e0870315fa4da9d8277c394114c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5801ff.TMP

Filesize
371B

MD5
c2f0f25bda82ddcfa28ab8530cff4a42

SHA1
0b512a4a21cfa4b5829abc2b4b5b95b60d1cef56

SHA256
fc67bff2e0d48b6d0fd35841298b0b141beeb28a049deace08f97ea91a023f85

SHA512
2fcfacbfe9ae84d355157170863a41755df23ffb5c0101f77b16738da23f33e4b44f2c4b66139ffc9472e87f4b54f487b0cef4a04e59ead9b3f4993e24c57dd3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
0d99944dbe61f19b8d2d79bb11f6e890

SHA1
40c392b9c55438bf260da95c8f946948833edd22

SHA256
6fabd2a88a36543bff53bf9b4112e572996056a6578c792f50f2e10b521ca4ab

SHA512
46b805d49114880c450ca0c66424e79dd99cea063953db349b49a4ba979968c0c67fbe848416675b25ccbae79c2ebcf6292f9c4af0dbf6254c3288f10ef18619

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
6b37116777895550a5c76b6beb367ae5

SHA1
50ceea5cb984064ef3024dab2ed02cef52836d12

SHA256
f3a34528ab6bd54bd5375183c3ac261f903e8b5038c0d56207fdce5572e461e4

SHA512
ee2337286b8a42c62a5a98b9d4940133f512da89ce9149eff122fc65a9b1f80b48940d612ba3dd6fd1489b138e3df89d610a6029ec7a58112e3fb26c3133ce54

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
f4495ca1b0c825028e83b63dbe16c647

SHA1
c07e4299efa76027b720a8e18c1bd793109a7311

SHA256
a990e71257d99c74ec815d5e066cccde85b0a086e2038561c1fd00cd3e194440

SHA512
f6973fb8875a9d3600aa34c042e9ebcf14c4da9c310f27c99cbe8f380cdb57ebfb9c5f9fd233838b8d9ee5d44b71eb75845cdafcb625056e88307d5d3daa2f17

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
9044fea143f6a4268a6017fdd25820dd

SHA1
b89a9d18955c59f6957eb06bbfd9092a8a0c664a

SHA256
239b7f31542378691a2dc9144089d503285f21a049d6d4c7e85738f4c734ab2f

SHA512
5bba52a1e822c92cfb6e6246fb8e1d50c29148dd3a937d7e3b9d82decb15ee418e877ab7caa011ad08ba9cf29b758f1e5515eddd7858cbf115b10f030bca8033

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
554b949b762fc02e47e33d16c71d2ea8

SHA1
baa128083f4ee65995b3e5f551fc203a5b66e008

SHA256
a572d3896348111cf63bcea5e40441a6947b43e7f6c1bcfe2cd640c40f35e6f3

SHA512
bd0dc50415c048c5108970078fcb4d8d9d314fd56b8196193fbe3b6dd7bf964fa3ffa6491ff83b25c112b08b62e152772f2886a8ac4782cee32000563cdbf372

Download Submit
C:\Users\Admin\AppData\Local\Temp\stub.il

Filesize
1.2MB

MD5
f7d6bf852cf7f74cd87dc239329756cb

SHA1
d6122914c36638c97c89bf751df5c5bf1c36aacb

SHA256
6a290b40a173b26d471e2adc4212f25fa0a3224f303890cb70d98db2bf07e2c0

SHA512
b3db677d9db1ae0a18b0f4d7bc108c54c011761b99f3f418bf5136478e73ccab8ebd43ac34ffb99f6bf4d5fffe4f045c7244c019bede2351b00555171c89c057

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp66A3.tmp.exe

Filesize
61KB

MD5
f4407493019fe05f34b074539519ebc4

SHA1
b3f5ff69ff4fee493440c133f033a0d05a6edd43

SHA256
a5c1bdc7b8c0e456edac031568c8acca0524eeec7e91977d63c41c0a82c608c5

SHA512
24668bd17617e038544ed5cc92385cba01ec1b70725930457a5deb6f4ef1a079e3af8d7f592dad851fb1685387daaf47cc02a6c406042dc7ec1f406d2ab3bfc4

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp926E.tmp.exe

Filesize
29KB

MD5
685c1eade930e2b40f02f98328fca44d

SHA1
e42f950e1dbed069d7c337c9ff09f55fb90afdf6

SHA256
ec85087f6830b71f106871c59dc8ffa0de91cc3d8ce8c269b7264359d9b4e80b

SHA512
aceb433536f6f8f684219c2d62b64604175d1eb8fb0c3d0aba819c81b6793f2f96b2c8b13d7311f7513234d8d9e62dbb61750156d9ee8d8fdfdb7b5ec69262fd

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpF565.tmp.exe

Filesize
28KB

MD5
6c2210ba180f0e1b9d831c3c6c14c8b4

SHA1
00bebdf704f4cabf254583c6ad87c6e72872b61a

SHA256
501c36ac282029ccf7950a4957d4c10ea72fe18f0ad8d6daeabfe628fa4070a7

SHA512
26a63ad05199cf45acd7519fbc63945097b4c4a89bb2cdfa4f87ba004e1ce106220b0b99419e656de26d164265b3868a9ce541c71b05d4e4db1a9a1343130e9b

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
10KB

MD5
c7fb30cc0964859cb77a07f564380656

SHA1
a4d271fd8a4962c0a520e64689a018e4ce417a0d

SHA256
107bb81e9891dd9c386c325f3150581cc4f4833d09394e3b359c0414477321a2

SHA512
06158560e4f1d9f9e41fa4a861efabce0fdb5b5020abfe01d371a5a6764babba38ee4f2b0ef02460040b16a5a1b0ff5b56b1c2a879ebf4d00cb405c48579a2bb

Download Submit
C:\Users\Admin\Desktop\Server.exe

Filesize
93KB

MD5
febd4cc8f519b14698c299c2ce54b395

SHA1
d83e57e6ed54777ebc6ccdd6d859ac137182928b

SHA256
3f73cccf357c61968b7b0615ca07bc3fbc9d4b115cbd7a5c3267dfcf43ac2884

SHA512
3cb7deda7b79fe26fb9093f649362b0ca70153a839417cc2408990c193a3efe3ef3606eba962e779dc91a3f403321f315087213a0a05a3bffe843dc4d32ab80f

Download Submit
C:\Users\Admin\Downloads\ExL@µnch3.zip

Filesize
8.2MB

MD5
52a3a8dbcba4fa274ebf66bed42c0029

SHA1
17fc15fef29ccf3f5c3fef9ee34d793710fec6fb

SHA256
141d706ed9ce9ccc7bbd03eb631635b6d19543038682b8798215d9438a950b69

SHA512
2d69a7367315e52a96b65a6b3431bc22783c92e09308cc00d550ec2f670e88b0d1b5282e528b0e026ba7e3ec2a9a5a04b47944c60f03ac484e57c80ee2282b98

Download Submit
C:\Users\Admin\Downloads\ExL@µnch3.zip:Zone.Identifier

Filesize
26B

MD5
fbccf14d504b7b2dbcb5a5bda75bd93b

SHA1
d59fc84cdd5217c6cf74785703655f78da6b582b

SHA256
eacd09517ce90d34ba562171d15ac40d302f0e691b439f91be1b6406e25f5913

SHA512
aa1d2b1ea3c9de3ccadb319d4e3e3276a2f27dd1a5244fe72de2b6f94083dddc762480482c5c2e53f803cd9e3973ddefc68966f974e124307b5043e654443b98

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 734794.crdownload

Filesize
3.8MB

MD5
46c17c999744470b689331f41eab7df1

SHA1
b8a63127df6a87d333061c622220d6d70ed80f7c

SHA256
c5b5def1c8882b702b6b25cbd94461c737bc151366d2d9eba5006c04886bfc9a

SHA512
4b02a3e85b699f62df1b4fe752c4dee08cfabc9b8bb316bc39b854bd5187fc602943a95788ec680c7d3dc2c26ad882e69c0740294bd6cb3b32cdcd165a9441b6

Download Submit
memory/4124-1221-0x00000000001B0000-0x00000000001BE000-memory.dmp

Filesize
56KB

Download
memory/4960-1203-0x00000000052E0000-0x0000000005336000-memory.dmp

Filesize
344KB

Download
memory/4960-1202-0x0000000004FE0000-0x0000000004FEA000-memory.dmp

Filesize
40KB

Download
memory/4960-1201-0x0000000005140000-0x00000000051D2000-memory.dmp

Filesize
584KB

Download
memory/4960-1200-0x0000000005650000-0x0000000005BF6000-memory.dmp

Filesize
5.6MB

Download
memory/4960-1199-0x0000000005000000-0x000000000509C000-memory.dmp

Filesize
624KB

Download
memory/4960-1198-0x0000000000540000-0x000000000054E000-memory.dmp

Filesize
56KB

Download
memory/5944-1254-0x000000001BE20000-0x000000001BEC6000-memory.dmp

Filesize
664KB

Download
memory/5944-1255-0x000000001C3A0000-0x000000001C86E000-memory.dmp

Filesize
4.8MB

Download
memory/5944-1256-0x000000001C910000-0x000000001C9AC000-memory.dmp

Filesize
624KB

Download
memory/5944-1258-0x000000001CB10000-0x000000001CB5C000-memory.dmp

Filesize
304KB

Download
memory/5944-1257-0x0000000001630000-0x0000000001638000-memory.dmp

Filesize
32KB

Download