njrat | d96bb6e66aef5a2901a0bfb80df3382d79cdcf60c9916badf27b456244bc6929

Analysis

max time kernel
299s
max time network
305s
platform
windows11-21h2_x64
resource
win11-20250313-en
resource tags

arch:x64arch:x86image:win11-20250313-enlocale:en-usos:windows11-21h2-x64system
submitted
30/03/2025, 16:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

NjRat.0.7D-main/njRAT Lime Edition/NjRat Lime Edition 0.8.0.exe
Size

9.5MB
MD5

482c73ca6c64073d877cf9c510b872ca
SHA1

0bf34784d312b98d38c107429e48489180484ebf
SHA256

1c617cfb5d8a252e015f9937af47d84f5557d7ebe25f2b2acfeb03671bf08ed9
SHA512

ca1a60df6e96b55071b6d48475bcddea430f84ded41705a796db6f3bc405a0aa41607fa4852d3e2f3e72c1bdd5f37b22e99134e6f3aec8a4b809b417dca2ee96
SSDEEP

49152:PlkGKaDShlBAGHoi/K333dGEoMLez0fgPdLl8HC5IaKSihCwc0YMOBf7BfKjGO+V:PlkwH1i/KZy0fgPVwy70GUOrRMDoMu2

Score

10^/10

njrat lime discovery trojan

Malware Config

Extracted

Family

njrat

Version

0.7.3

Botnet

Lime

127.0.0.1:6522

Mutex

Client.exe

Attributes

reg_key
Client.exe
splitter
11

Signatures

Njrat family
njrat
njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat

Executes dropped EXE 2 IoCs

pid	Process
2356	reactor.exe
5004	New Client.exe

Loads dropped DLL 2 IoCs

pid	Process
2356	reactor.exe
2356	reactor.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NjRat Lime Edition 0.8.0.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ilasm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	csc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cvtres.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	New Client.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reactor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dw20.exe

Checks processor information in registry 2 TTPs 43 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	dw20.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	dw20.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	dw20.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1	dw20.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	dw20.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	dw20.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	dw20.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	dw20.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dw20.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1136229799-3442283115-138161576-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg	NjRat Lime Edition 0.8.0.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1136229799-3442283115-138161576-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 19002f433a5c000000000000000000000000000000000000000000	NjRat Lime Edition 0.8.0.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1136229799-3442283115-138161576-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 0100000000000000ffffffff	NjRat Lime Edition 0.8.0.exe
Key created	\REGISTRY\USER\S-1-5-21-1136229799-3442283115-138161576-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg	NjRat Lime Edition 0.8.0.exe
Key created	\REGISTRY\USER\S-1-5-21-1136229799-3442283115-138161576-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\fx.sb.cdmaead3483b5e3a557227b77554c4d4739fd53e90f	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1136229799-3442283115-138161576-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	NjRat Lime Edition 0.8.0.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1136229799-3442283115-138161576-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\MRUListEx = ffffffff	NjRat Lime Edition 0.8.0.exe
Key created	\REGISTRY\USER\S-1-5-21-1136229799-3442283115-138161576-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2	NjRat Lime Edition 0.8.0.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1136229799-3442283115-138161576-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	NjRat Lime Edition 0.8.0.exe
Key created	\REGISTRY\USER\S-1-5-21-1136229799-3442283115-138161576-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1136229799-3442283115-138161576-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 020202	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1136229799-3442283115-138161576-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\2\NodeSlot = "3"	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1136229799-3442283115-138161576-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0e000000ffffffff	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1136229799-3442283115-138161576-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f50e04fd020ea3a6910a2d808002b30309d0000	NjRat Lime Edition 0.8.0.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1136229799-3442283115-138161576-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0 = 56003100000000006d5a1b8c12004170704461746100400009000400efbe6d5a1b8c7e5ac5812e0000003b570200000001000000000000000000000000000000e682dd004100700070004400610074006100000016000000	NjRat Lime Edition 0.8.0.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1136229799-3442283115-138161576-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\MRUListEx = 00000000ffffffff	NjRat Lime Edition 0.8.0.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1136229799-3442283115-138161576-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	NjRat Lime Edition 0.8.0.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1136229799-3442283115-138161576-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202	NjRat Lime Edition 0.8.0.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1136229799-3442283115-138161576-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	NjRat Lime Edition 0.8.0.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1136229799-3442283115-138161576-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\KnownFolderDerivedFolderType = "{885A186E-A440-4ADA-812B-DB871B942259}"	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1136229799-3442283115-138161576-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	NjRat Lime Edition 0.8.0.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1136229799-3442283115-138161576-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\SniffedFolderType = "Downloads"	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1136229799-3442283115-138161576-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\IconSize = "16"	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-1136229799-3442283115-138161576-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	NjRat Lime Edition 0.8.0.exe
Key created	\REGISTRY\USER\S-1-5-21-1136229799-3442283115-138161576-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	NjRat Lime Edition 0.8.0.exe
Key created	\REGISTRY\USER\S-1-5-21-1136229799-3442283115-138161576-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1	NjRat Lime Edition 0.8.0.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1136229799-3442283115-138161576-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1136229799-3442283115-138161576-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1"	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1136229799-3442283115-138161576-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByKey:PID = "14"	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-1136229799-3442283115-138161576-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-1136229799-3442283115-138161576-1000_Classes\Local Settings	NjRat Lime Edition 0.8.0.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1136229799-3442283115-138161576-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\MRUListEx = 00000000ffffffff	NjRat Lime Edition 0.8.0.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1136229799-3442283115-138161576-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	NjRat Lime Edition 0.8.0.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1136229799-3442283115-138161576-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\SniffedFolderType = "Generic"	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1136229799-3442283115-138161576-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1136229799-3442283115-138161576-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\Mode = "4"	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1136229799-3442283115-138161576-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupView = "4294967295"	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1136229799-3442283115-138161576-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\MRUListEx = 00000000ffffffff	NjRat Lime Edition 0.8.0.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1136229799-3442283115-138161576-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1 = 3a002e803accbfb42cdb4c42b0297fe99a87c641260001002600efbe11000000c1b2c3f23d94db014021e5bd4594db014021e5bd4594db0114000000	NjRat Lime Edition 0.8.0.exe
Key created	\REGISTRY\USER\S-1-5-21-1136229799-3442283115-138161576-1000_Classes\Local Settings	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1136229799-3442283115-138161576-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16"	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-1136229799-3442283115-138161576-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-1136229799-3442283115-138161576-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-790078335-998561069-2208156648-988539944-4021756109-3505228477-4058360096\Children	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1136229799-3442283115-138161576-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\MRUListEx = 00000000ffffffff	NjRat Lime Edition 0.8.0.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1136229799-3442283115-138161576-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0\0\0\NodeSlot = "1"	NjRat Lime Edition 0.8.0.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1136229799-3442283115-138161576-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	NjRat Lime Edition 0.8.0.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1136229799-3442283115-138161576-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 010000000200000000000000ffffffff	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1136229799-3442283115-138161576-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff	NjRat Lime Edition 0.8.0.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1136229799-3442283115-138161576-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	NjRat Lime Edition 0.8.0.exe
Key created	\REGISTRY\USER\S-1-5-21-1136229799-3442283115-138161576-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	NjRat Lime Edition 0.8.0.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1136229799-3442283115-138161576-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-1136229799-3442283115-138161576-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1136229799-3442283115-138161576-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	NjRat Lime Edition 0.8.0.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1136229799-3442283115-138161576-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	NjRat Lime Edition 0.8.0.exe
Key created	\REGISTRY\USER\S-1-5-21-1136229799-3442283115-138161576-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0	NjRat Lime Edition 0.8.0.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1136229799-3442283115-138161576-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	NjRat Lime Edition 0.8.0.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1136229799-3442283115-138161576-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1136229799-3442283115-138161576-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-1136229799-3442283115-138161576-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-1136229799-3442283115-138161576-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0\0	NjRat Lime Edition 0.8.0.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1136229799-3442283115-138161576-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16"	NjRat Lime Edition 0.8.0.exe
Key created	\REGISTRY\USER\S-1-5-21-1136229799-3442283115-138161576-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell	NjRat Lime Edition 0.8.0.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1136229799-3442283115-138161576-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	NjRat Lime Edition 0.8.0.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1136229799-3442283115-138161576-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\2\MRUListEx = ffffffff	firefox.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2860	schtasks.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
4388	NjRat Lime Edition 0.8.0.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
4388	NjRat Lime Edition 0.8.0.exe
2732	firefox.exe

Suspicious use of AdjustPrivilegeToken 35 IoCs

description	pid	Process
Token: 33	3820	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	3820	AUDIODG.EXE
Token: SeDebugPrivilege	4388	NjRat Lime Edition 0.8.0.exe
Token: SeDebugPrivilege	980	firefox.exe
Token: SeDebugPrivilege	980	firefox.exe
Token: SeDebugPrivilege	2732	firefox.exe
Token: SeDebugPrivilege	2732	firefox.exe
Token: SeDebugPrivilege	2732	firefox.exe
Token: SeDebugPrivilege	2732	firefox.exe
Token: SeDebugPrivilege	2732	firefox.exe
Token: SeDebugPrivilege	2732	firefox.exe
Token: SeDebugPrivilege	2732	firefox.exe
Token: SeDebugPrivilege	2732	firefox.exe
Token: SeDebugPrivilege	2732	firefox.exe
Token: SeDebugPrivilege	2732	firefox.exe
Token: SeDebugPrivilege	2732	firefox.exe
Token: SeDebugPrivilege	2732	firefox.exe
Token: SeDebugPrivilege	2732	firefox.exe
Token: SeDebugPrivilege	2732	firefox.exe
Token: SeDebugPrivilege	2732	firefox.exe
Token: SeDebugPrivilege	2732	firefox.exe
Token: SeDebugPrivilege	2732	firefox.exe
Token: SeDebugPrivilege	2732	firefox.exe
Token: SeDebugPrivilege	2732	firefox.exe
Token: SeDebugPrivilege	2732	firefox.exe
Token: SeDebugPrivilege	2732	firefox.exe
Token: SeDebugPrivilege	2732	firefox.exe
Token: SeDebugPrivilege	2732	firefox.exe
Token: SeDebugPrivilege	980	firefox.exe
Token: SeDebugPrivilege	980	firefox.exe
Token: SeDebugPrivilege	980	firefox.exe
Token: SeRestorePrivilege	5576	dw20.exe
Token: SeBackupPrivilege	5576	dw20.exe
Token: SeBackupPrivilege	5576	dw20.exe
Token: SeBackupPrivilege	5576	dw20.exe

Suspicious use of FindShellTrayWindow 48 IoCs

pid	Process
4388	NjRat Lime Edition 0.8.0.exe
4388	NjRat Lime Edition 0.8.0.exe
4388	NjRat Lime Edition 0.8.0.exe
980	firefox.exe
980	firefox.exe
980	firefox.exe
980	firefox.exe
980	firefox.exe
980	firefox.exe
980	firefox.exe
980	firefox.exe
980	firefox.exe
980	firefox.exe
980	firefox.exe
980	firefox.exe
980	firefox.exe
980	firefox.exe
980	firefox.exe
980	firefox.exe
980	firefox.exe
980	firefox.exe
4388	NjRat Lime Edition 0.8.0.exe
4388	NjRat Lime Edition 0.8.0.exe
4388	NjRat Lime Edition 0.8.0.exe
980	firefox.exe
980	firefox.exe
980	firefox.exe
980	firefox.exe
980	firefox.exe
980	firefox.exe
980	firefox.exe
980	firefox.exe
980	firefox.exe
980	firefox.exe
980	firefox.exe
980	firefox.exe
980	firefox.exe
980	firefox.exe
980	firefox.exe
980	firefox.exe
980	firefox.exe
980	firefox.exe
980	firefox.exe
980	firefox.exe
980	firefox.exe
980	firefox.exe
980	firefox.exe
980	firefox.exe

Suspicious use of SendNotifyMessage 6 IoCs

pid	Process
4388	NjRat Lime Edition 0.8.0.exe
4388	NjRat Lime Edition 0.8.0.exe
4388	NjRat Lime Edition 0.8.0.exe
4388	NjRat Lime Edition 0.8.0.exe
4388	NjRat Lime Edition 0.8.0.exe
4388	NjRat Lime Edition 0.8.0.exe

Suspicious use of SetWindowsHookEx 33 IoCs

pid	Process
4388	NjRat Lime Edition 0.8.0.exe
980	firefox.exe
2732	firefox.exe
980	firefox.exe
980	firefox.exe
980	firefox.exe
980	firefox.exe
980	firefox.exe
980	firefox.exe
980	firefox.exe
980	firefox.exe
980	firefox.exe
980	firefox.exe
980	firefox.exe
980	firefox.exe
980	firefox.exe
980	firefox.exe
980	firefox.exe
980	firefox.exe
980	firefox.exe
980	firefox.exe
980	firefox.exe
980	firefox.exe
980	firefox.exe
980	firefox.exe
980	firefox.exe
980	firefox.exe
980	firefox.exe
980	firefox.exe
980	firefox.exe
980	firefox.exe
980	firefox.exe
980	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4388 wrote to memory of 1764	4388	NjRat Lime Edition 0.8.0.exe	82
PID 4388 wrote to memory of 1764	4388	NjRat Lime Edition 0.8.0.exe	82
PID 4388 wrote to memory of 1764	4388	NjRat Lime Edition 0.8.0.exe	82
PID 4388 wrote to memory of 2356	4388	NjRat Lime Edition 0.8.0.exe	84
PID 4388 wrote to memory of 2356	4388	NjRat Lime Edition 0.8.0.exe	84
PID 4388 wrote to memory of 2356	4388	NjRat Lime Edition 0.8.0.exe	84
PID 2356 wrote to memory of 4708	2356	reactor.exe	88
PID 2356 wrote to memory of 4708	2356	reactor.exe	88
PID 2356 wrote to memory of 4708	2356	reactor.exe	88
PID 4708 wrote to memory of 2244	4708	csc.exe	89
PID 4708 wrote to memory of 2244	4708	csc.exe	89
PID 4708 wrote to memory of 2244	4708	csc.exe	89
PID 3504 wrote to memory of 980	3504	firefox.exe	93
PID 3504 wrote to memory of 980	3504	firefox.exe	93
PID 3504 wrote to memory of 980	3504	firefox.exe	93
PID 3504 wrote to memory of 980	3504	firefox.exe	93
PID 3504 wrote to memory of 980	3504	firefox.exe	93
PID 3504 wrote to memory of 980	3504	firefox.exe	93
PID 3504 wrote to memory of 980	3504	firefox.exe	93
PID 3504 wrote to memory of 980	3504	firefox.exe	93
PID 3504 wrote to memory of 980	3504	firefox.exe	93
PID 3504 wrote to memory of 980	3504	firefox.exe	93
PID 3504 wrote to memory of 980	3504	firefox.exe	93
PID 980 wrote to memory of 4684	980	firefox.exe	94
PID 980 wrote to memory of 4684	980	firefox.exe	94
PID 980 wrote to memory of 4684	980	firefox.exe	94
PID 980 wrote to memory of 4684	980	firefox.exe	94
PID 980 wrote to memory of 4684	980	firefox.exe	94
PID 980 wrote to memory of 4684	980	firefox.exe	94
PID 980 wrote to memory of 4684	980	firefox.exe	94
PID 980 wrote to memory of 4684	980	firefox.exe	94
PID 980 wrote to memory of 4684	980	firefox.exe	94
PID 980 wrote to memory of 4684	980	firefox.exe	94
PID 980 wrote to memory of 4684	980	firefox.exe	94
PID 980 wrote to memory of 4684	980	firefox.exe	94
PID 980 wrote to memory of 4684	980	firefox.exe	94
PID 980 wrote to memory of 4684	980	firefox.exe	94
PID 980 wrote to memory of 4684	980	firefox.exe	94
PID 980 wrote to memory of 4684	980	firefox.exe	94
PID 980 wrote to memory of 4684	980	firefox.exe	94
PID 980 wrote to memory of 4684	980	firefox.exe	94
PID 980 wrote to memory of 4684	980	firefox.exe	94
PID 980 wrote to memory of 4684	980	firefox.exe	94
PID 980 wrote to memory of 4684	980	firefox.exe	94
PID 980 wrote to memory of 4684	980	firefox.exe	94
PID 980 wrote to memory of 4684	980	firefox.exe	94
PID 980 wrote to memory of 4684	980	firefox.exe	94
PID 980 wrote to memory of 4684	980	firefox.exe	94
PID 980 wrote to memory of 4684	980	firefox.exe	94
PID 980 wrote to memory of 4684	980	firefox.exe	94
PID 980 wrote to memory of 4684	980	firefox.exe	94
PID 980 wrote to memory of 4684	980	firefox.exe	94
PID 980 wrote to memory of 4684	980	firefox.exe	94
PID 980 wrote to memory of 4684	980	firefox.exe	94
PID 980 wrote to memory of 4684	980	firefox.exe	94
PID 980 wrote to memory of 4684	980	firefox.exe	94
PID 980 wrote to memory of 4684	980	firefox.exe	94
PID 980 wrote to memory of 4684	980	firefox.exe	94
PID 980 wrote to memory of 4684	980	firefox.exe	94
PID 980 wrote to memory of 4684	980	firefox.exe	94
PID 980 wrote to memory of 4684	980	firefox.exe	94
PID 980 wrote to memory of 4684	980	firefox.exe	94
PID 980 wrote to memory of 4684	980	firefox.exe	94
PID 980 wrote to memory of 4684	980	firefox.exe	94

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\NjRat.0.7D-main\njRAT Lime Edition\NjRat Lime Edition 0.8.0.exe
"C:\Users\Admin\AppData\Local\Temp\NjRat.0.7D-main\njRAT Lime Edition\NjRat Lime Edition 0.8.0.exe"
1⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4388
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\ilasm.exe
  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\ilasm.exe" /alignment=512 /QUIET "C:\Users\Admin\AppData\Local\Temp\stub.il" /output:"C:\Users\Admin\Desktop\New Client.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1764
- C:\Users\Admin\AppData\Local\Temp\NjRat.0.7D-main\njRAT Lime Edition\plugin\reactor.exe
  "C:\Users\Admin\AppData\Local\Temp\NjRat.0.7D-main\njRAT Lime Edition\plugin\reactor.exe" -file "C:\Users\Admin\Desktop\New Client.exe" -admin 0 -shownagscreen 0 -showloadingscreen 0 -targetfile "C:\Users\Admin\Desktop\New Client.exe" -antitamp 1 -compression 0 -control_flow_obfuscation 0 -nativeexe 0 -necrobit 1 -necrobit_comp 1 -prejit 0 -incremental_obfuscation 0 -obfuscate_public_types 0 -resourceencryption 0 -stringencryption 1 -antistrong 0
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2356
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\sutxnfn1\sutxnfn1.cmdline"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4708
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESBA0F.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC85C5F1FA9DDE4230872D6317BB841BAC.TMP"
      4⤵
      System Location Discovery: System Language Discovery
      PID:2244

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004C0 0x00000000000004B8
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3820

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3504
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:980
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1952 -prefsLen 27097 -prefMapHandle 1956 -prefMapSize 270279 -ipcHandle 2028 -initialChannelId {0c3d0196-2db9-4cf3-8b71-f2d8b34ece57} -parentPid 980 -crashReporter "\\.\pipe\gecko-crash-server-pipe.980" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
    3⤵
    PID:4684
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2400 -prefsLen 27133 -prefMapHandle 2404 -prefMapSize 270279 -ipcHandle 2408 -initialChannelId {9c061f94-10a0-4e55-8388-ba0c5ddfaae5} -parentPid 980 -crashReporter "\\.\pipe\gecko-crash-server-pipe.980" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
    3⤵
    PID:3856
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3784 -prefsLen 27323 -prefMapHandle 3788 -prefMapSize 270279 -jsInitHandle 3792 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3800 -initialChannelId {ab06cdb7-0b68-4953-8611-7fe8ada5c1ad} -parentPid 980 -crashReporter "\\.\pipe\gecko-crash-server-pipe.980" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
    3⤵
    - Checks processor information in registry
    PID:4760
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3976 -prefsLen 27323 -prefMapHandle 3980 -prefMapSize 270279 -ipcHandle 4056 -initialChannelId {432a6b70-c450-493d-8a10-79ca05fab472} -parentPid 980 -crashReporter "\\.\pipe\gecko-crash-server-pipe.980" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
    3⤵
    PID:652
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4692 -prefsLen 34822 -prefMapHandle 4696 -prefMapSize 270279 -jsInitHandle 4700 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4664 -initialChannelId {1c536f9b-ac73-4e80-ade0-1dc298768076} -parentPid 980 -crashReporter "\\.\pipe\gecko-crash-server-pipe.980" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
    3⤵
    - Checks processor information in registry
    PID:4584
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 5040 -prefsLen 34822 -prefMapHandle 5048 -prefMapSize 270279 -ipcHandle 5076 -initialChannelId {8dc127aa-d91d-41fd-ae82-fdea036bf463} -parentPid 980 -crashReporter "\\.\pipe\gecko-crash-server-pipe.980" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
    3⤵
    - Checks processor information in registry
    PID:1708
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5656 -prefsLen 32952 -prefMapHandle 5660 -prefMapSize 270279 -jsInitHandle 5664 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5224 -initialChannelId {67dad4fc-afa1-4a3e-ba46-b2c8d973b82c} -parentPid 980 -crashReporter "\\.\pipe\gecko-crash-server-pipe.980" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
    3⤵
    - Checks processor information in registry
    PID:5604
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5064 -prefsLen 32952 -prefMapHandle 5032 -prefMapSize 270279 -jsInitHandle 5696 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5704 -initialChannelId {1000856b-8a7f-4ce3-b1f7-824bc44e7459} -parentPid 980 -crashReporter "\\.\pipe\gecko-crash-server-pipe.980" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
    3⤵
    - Checks processor information in registry
    PID:5616
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5876 -prefsLen 32952 -prefMapHandle 5880 -prefMapSize 270279 -jsInitHandle 5884 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5892 -initialChannelId {d0e0d123-635d-4faa-8cca-920400f8484d} -parentPid 980 -crashReporter "\\.\pipe\gecko-crash-server-pipe.980" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
    3⤵
    - Checks processor information in registry
    PID:5628
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6324 -prefsLen 33071 -prefMapHandle 6328 -prefMapSize 270279 -jsInitHandle 6332 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6340 -initialChannelId {7f1e951f-174a-43b0-97a7-06c1cfe7131c} -parentPid 980 -crashReporter "\\.\pipe\gecko-crash-server-pipe.980" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 tab
    3⤵
    - Checks processor information in registry
    PID:484
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2832 -prefsLen 36543 -prefMapHandle 4664 -prefMapSize 270279 -jsInitHandle 5644 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3148 -initialChannelId {ad2bc487-887d-4cab-a6f3-37bee9335aee} -parentPid 980 -crashReporter "\\.\pipe\gecko-crash-server-pipe.980" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 11 tab
    3⤵
    - Checks processor information in registry
    PID:6044
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 4 -prefsHandle 6700 -prefsLen 39630 -prefMapHandle 6696 -prefMapSize 270279 -ipcHandle 6340 -initialChannelId {d688310a-0e9e-4258-9b8e-02a8647a1209} -parentPid 980 -crashReporter "\\.\pipe\gecko-crash-server-pipe.980" -appDir "C:\Program Files\Mozilla Firefox\browser" - 12 utility
    3⤵
    - Checks processor information in registry
    - Modifies registry class
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    PID:2732
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6776 -prefsLen 36543 -prefMapHandle 6784 -prefMapSize 270279 -jsInitHandle 6476 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6788 -initialChannelId {ef6e34bd-6ec2-4466-a97e-e241ab679c0a} -parentPid 980 -crashReporter "\\.\pipe\gecko-crash-server-pipe.980" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 13 tab
    3⤵
    - Checks processor information in registry
    PID:696
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6948 -prefsLen 36543 -prefMapHandle 6944 -prefMapSize 270279 -jsInitHandle 6940 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6992 -initialChannelId {c9babfce-9fe0-4640-bc75-efda2f4a5fc4} -parentPid 980 -crashReporter "\\.\pipe\gecko-crash-server-pipe.980" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 14 tab
    3⤵
    - Checks processor information in registry
    PID:1812
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2824 -prefsLen 36543 -prefMapHandle 7352 -prefMapSize 270279 -jsInitHandle 7356 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 7364 -initialChannelId {1ab57109-9a38-41ae-92ab-7008364383d7} -parentPid 980 -crashReporter "\\.\pipe\gecko-crash-server-pipe.980" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 15 tab
    3⤵
    - Checks processor information in registry
    PID:1440
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 7472 -prefsLen 36543 -prefMapHandle 7476 -prefMapSize 270279 -jsInitHandle 7480 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 7488 -initialChannelId {e96709fb-ab99-42af-b033-7bdac6170b69} -parentPid 980 -crashReporter "\\.\pipe\gecko-crash-server-pipe.980" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 16 tab
    3⤵
    - Checks processor information in registry
    PID:5412
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 1 -prefsHandle 2844 -prefsLen 39680 -prefMapHandle 7336 -prefMapSize 270279 -ipcHandle 6120 -initialChannelId {22a7ebb6-67d9-4fcd-ae53-395d289f4887} -parentPid 980 -crashReporter "\\.\pipe\gecko-crash-server-pipe.980" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 17 utility
    3⤵
    - Checks processor information in registry
    PID:4060
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 2 -prefsHandle 6672 -prefsLen 39680 -prefMapHandle 3240 -prefMapSize 270279 -ipcHandle 6492 -initialChannelId {ef5dfc64-4804-46c7-8b04-92bc59059a09} -parentPid 980 -crashReporter "\\.\pipe\gecko-crash-server-pipe.980" -appDir "C:\Program Files\Mozilla Firefox\browser" - 18 utility
    3⤵
    - Checks processor information in registry
    PID:5352

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc
1⤵
PID:1184

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DisplayEnhancementService
1⤵
PID:3952

C:\Users\Admin\Desktop\New Client.exe
"C:\Users\Admin\Desktop\New Client.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5004
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /Delete /tn NYAN /F
  2⤵
  - System Location Discovery: System Language Discovery
  PID:6040
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /create /tn NYAN /tr "C:\Users\Admin\Desktop\New Client.exe" /sc minute /mo 1
  2⤵
  - System Location Discovery: System Language Discovery
  - Scheduled Task/Job: Scheduled Task
  PID:2860
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
  dw20.exe -x -s 900
  2⤵
  - System Location Discovery: System Language Discovery
  - Checks processor information in registry
  - Enumerates system info in registry
  - Suspicious use of AdjustPrivilegeToken
  PID:5576

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\027putap.default-release\cache2\doomed\2351

Filesize
54KB

MD5
14c361717be6cb79e6394903b67691ab

SHA1
64a3c63ee58823b17b5cfd97f819186fd2d4483c

SHA256
e0a020a4372f66b22ac914746bdf99934889f98422d4ef2923e56d71888486c4

SHA512
f169684df2fabc033324adec359ac0dfc7769955a683699b910aaf48136a47ccd9140f81a58cbd6ea1a9361161195f48a202f70af6b6f878a3b2e03486cfe080

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\027putap.default-release\cache2\entries\04C4559D9993B061D714A666D7D6F9A36374286F

Filesize
225KB

MD5
1f3e7d5b242281a125ba80e481dcddf5

SHA1
21a389bb6123cdb8de4c366063ca5a3294a0454b

SHA256
b19619da1b853e4ca9988488ffb3eb23511f487fd3503265b37fdbccb2d2c62a

SHA512
71beceedcab7d1c5b4dd8836d6c33d890c18609558e0d08f47504e1e75b6e84684c4242ca3ee8e45643f05057f69da5cd93f105146d0ed15d7c8a404b8d66e15

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\027putap.default-release\cache2\entries\A585344A45AF937E3AB7D706291A9A3ED8D581D9

Filesize
13KB

MD5
ba0beeefc03187263c58e7f3a7b32101

SHA1
21772fcf15f6a4597832eedcdaaff9f26db75207

SHA256
29ec04b8f803edde402b0e9e34776e21b7a1e535b190cb20840be661a9d3e8d7

SHA512
0be246146105270bc7194d0644e7ee66f8ac1a5a38ab0a536f19d6c3aa9c0b00a9ec31373e02590a08b4e428b10ddc25bbd6cc629413080f1fcca4f9fa4bffc3

Download Submit
C:\Users\Admin\AppData\Local\Temp\NjRat.0.7D-main\njRAT Lime Edition\plugin\reactor.exe

Filesize
5.8MB

MD5
7429e30caa2a8b41d926ffef1a05b347

SHA1
32abbd56225cd7379bb1cca8f6749d43916efe2b

SHA256
1efc5368bcd9704d7df85e2e143936d6ee4509ac31a7ca6d3eb4cf3b18c5ef27

SHA512
55243a97d9a7fcd43d531bb61615e734c8bfea242f6e28d67ce09cee586d032d83709a3b8c4ecf9b567252a53d1dad1853aca669316aa2ae62422386156b77c1

Download Submit
C:\Users\Admin\AppData\Local\Temp\RESBA0F.tmp

Filesize
1KB

MD5
967a6e0d5964df6796a21a62aa3796e4

SHA1
88e58e8e4b42040b40160ff9fd39c61cf2106021

SHA256
d2bd74c44fac8e5ac529a52dbc0835eadce277a1f0430472e0823829ead4eede

SHA512
849cfb7120a9b22119910662e5260e3dd2dbd54c802010f598b60a67c1c4cdcf3decd07a7a2e4b40ffd56ee643da594fcad44407bba30ce93b69426956d124ff

Download Submit
C:\Users\Admin\AppData\Local\Temp\stub.il

Filesize
770KB

MD5
69992e206058440ddfd4ea4e64252deb

SHA1
821b3a1472ca5ecd309d35a16b82cc1a63791e91

SHA256
531a6c1d11d95c69ea5cfeab0ffde5687ffe1730d701f43306915eabf7c398f9

SHA512
88a97b376e84ae47297fe8c6c55d0827a32641bb91c7f6c24aad50ead209e0de85dd7b9e9c153141118d123aae9ebf0e33ca4606a8fee41b230e5451d4844364

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpB9A2.tmp

Filesize
3KB

MD5
44844a0221a2b746ae1fee9f5ae48833

SHA1
f2063f56865741078e0bfc3183e949cc2050b9e6

SHA256
8670c6814895e2ac8493488f61a8db3a590f7cf85246a1da69088c749b3254d5

SHA512
66941e98658eb28e6b6954efa832672aba4957292f28f9cb6304c627460a2cdcef09beedeae612218d1dcd4e75114392ae7246eda78559514cecac6450bece94

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon

Filesize
11KB

MD5
25e8156b7f7ca8dad999ee2b93a32b71

SHA1
db587e9e9559b433cee57435cb97a83963659430

SHA256
ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986

SHA512
1211b2fa997ba13ff926aec58b6b35a81d7fe108b0caa8f4d6369d0a37f8481373b78a4b201651243adde9e2b2699ce929482a46226ff6299b0a0e40fe2ddc56

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon

Filesize
14.0MB

MD5
bcceccab13375513a6e8ab48e7b63496

SHA1
63d8a68cf562424d3fc3be1297d83f8247e24142

SHA256
a6af95a209b2e652ed6766804b9b8ad6b6a68f2c610b8f14713cd40df0d62bf9

SHA512
d94483deaae98bf9212699f1ab0bd913f6151a63e65ebc1ea644ab98d5e3ebd74ecaa08f70aca31e11a5d2c64d1504b723817af35bbe9d7b05c758dd6945d484

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon

Filesize
502KB

MD5
e690f995973164fe425f76589b1be2d9

SHA1
e947c4dad203aab37a003194dddc7980c74fa712

SHA256
87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171

SHA512
77991110c1d195616e936d27151d02e4d957be6c20a4f3b3511567868b5ddffc6abbfdc668d17672f5d681f12b20237c7905f9b0daaa6d71dcdac4b38f2448b2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\027putap.default-release\AlternateServices.bin

Filesize
7KB

MD5
04624deeb5ac89b71dd5727a786c00cc

SHA1
2b115081b8f0dc338273e030eaecbabeed1a3b8d

SHA256
47c283e0cdc8dbe50b26d40628aabb734fa8622d628a8c20e9a8d0f8d9d9ecb3

SHA512
89381c52a06fee714e96d68675403dc18af2807ac876977977bb719ad79b46ed9c717d36618766f46e25e0b715283ab9db35bce42324a5dd0d18ca2684e4c828

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\027putap.default-release\AlternateServices.bin

Filesize
11KB

MD5
5b7a3f996408bc4d68ec2e2e07af04f0

SHA1
41d3b8260b23e6f0dacf958c9e1ee5aed593d928

SHA256
c49e00e4c8d769af10d7d9ff440f32ad6f49170407ae6664c269d3fad44200d7

SHA512
ea5706aaa5d39de416cac86ca9ae7346e4d7e897ed5a842986367a2f52d0915a928829367a9e672f15f474e6da686b4cb899a467d0b88cf65d58ce4249e94d6d

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\027putap.default-release\SiteSecurityServiceState.bin

Filesize
5KB

MD5
686d3dd689718b68244f416ab7c55080

SHA1
4f528a427b6dc171c9c16b7d2399bd798379e49a

SHA256
2a419cc4396f8f08faa2e2023f74104fb8d0a86a106bd2124794bd2a2bcd856d

SHA512
55eb1d55fe1eb05aa3c697083a8e4dc76f39665bb0d4061bb9a14a01e51d813b632c081dbdb2fc6c9076d35adf148c8c97ec37ba1c26780c75ae5d2605a4d7dc

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\027putap.default-release\datareporting\glean\db\data.safe.tmp

Filesize
6KB

MD5
15718861b903b215a5356f55208c96f6

SHA1
d23a2b0c4ae38a4a1a4c6d571450287e02a30838

SHA256
8f477066181da5c6ac1ac587447b60f0e407e92de619d093c22569af5fc3a45c

SHA512
62c0700c440df3b901573da54fc069daeddc30dac3354e3e4ecae6876a83d058af70e89e265c0ad70bc8a9ce523f95f5c72fa4dc1a474970479429cfcde76506

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\027putap.default-release\datareporting\glean\db\data.safe.tmp

Filesize
7KB

MD5
ded4743c94bf9041ac31b576f02905f1

SHA1
92b13a383aabab5da71a69e82ff81f2963853913

SHA256
a676ea9dfdb427b6f8f1cb86701f9126f9d64933eaffd43543bad06c61d74c9b

SHA512
95d879bc9f61c6bc8d3c331b984a9aaf22a1e9bffe62f4e38c72dc628b3cbb4e92222b4445d0baad9bfbad7d2e816a979c11631d6b7f1f5cdb71d00b5c73b677

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\027putap.default-release\datareporting\glean\events\events

Filesize
1KB

MD5
24bea816bc73aa417c161ffad35801c5

SHA1
c92755ee3ea9f135b3873ad6de6ead3b937d1621

SHA256
83a8c83cace8e8d3d1f1df1c97e46f41ea9115db65218d5f2a62a435c46a9d02

SHA512
a5d2d9e8dc8512e4a9fc587465f79bfac62e916467b301509309a27a50075828c8cde07cc234a1698ecd7c4400fb022c76dcf679484677eac0fbab96e7a1ac32

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\027putap.default-release\datareporting\glean\events\events

Filesize
4KB

MD5
b4c028297bb68d3c72aa2545e9b0df94

SHA1
830e223bce6eae325ca274c1e0a7234637133478

SHA256
6d47b92e98e02cd66d39014b1d3c24838c042f4444208b628c00b410bbb2d647

SHA512
796e3fe92518435b1fcda849d926a9f73a9e0ae300d7606c22ef9a59f466af07684647f52b42ba1520bb885c345d122c0ac1cf98dbf2988a2e4e3cf57e28a0f8

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\027putap.default-release\datareporting\glean\pending_pings\19e1629c-4ffe-4b2b-9b1d-ff50e5e08a2b

Filesize
886B

MD5
1fc3573c1e980ca4f703efa5fe287598

SHA1
d7d795970be325fcc9d046e3bdb98a5176e64817

SHA256
366b9932f32dbf6609aa996ef77b0c50b94cc00ddbbe7b0b56b589886abe366a

SHA512
6a36a7a867204f2986bab09e89943cefab833e61aba62195df6abbc013312618215d370717b91746803e1851c19dfe4b2fee0969fe7a1e5cad71b5a433048b59

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\027putap.default-release\datareporting\glean\pending_pings\4a30cf45-2792-484d-a88a-58f6a1928a0f

Filesize
235B

MD5
368a2587e26cddffd67a2230191162e6

SHA1
2a4c9ec08a667864fc0ac81c6251527be6f2f1d6

SHA256
cf4b88ce3b19e06e60c144444047ab977c7a74585460a70e1b2a89b1e5e98961

SHA512
74ebc5ec734835c4ff284df1624ca2a6522ab282249cfc8765a11203746811bce7f90549ba3eb7315a4819ab1192fb3c1e4a92d5b4689b8e7286f1d535515a0f

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\027putap.default-release\datareporting\glean\pending_pings\8b8e910c-9183-448b-8d21-449649851e53

Filesize
16KB

MD5
bc0fb35905ed9dea58f672760b4c98cc

SHA1
5a7631202485fdef1e081d70e944471c05cff5be

SHA256
b223e6d0590d471f25ad61fca25ea7f1405ab95724ee432324aeaf956a7f25be

SHA512
4d6375ad6840f7b6a81897eacb59dce5d524b79c890de52cc70a2eb663664df9c9b557e703f282de3b6d1abec6f6dda3395b98d897255e4210fc24b505677b37

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\027putap.default-release\datareporting\glean\pending_pings\c0f3c578-2522-412a-8989-f07fa218e4fb

Filesize
883B

MD5
6a73cdc7fc964e8f2a7a1f5a1c8e6e08

SHA1
da77a0f10cac93ccbaa6bbca16435970ac560054

SHA256
5121bc1a6d18af24a39eeb2c77b5ea9f751cc012074990de8324e7132f4faa62

SHA512
ccdd45887f7ef1ec1e55dc7547c5c7e52932790537cb26bbe5b664bf3f4fb6c20a5f6112d7481b00c0f73482166e0d9de4160a302b05303076e56bc8676dc537

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\027putap.default-release\datareporting\glean\pending_pings\c918d070-6af8-4b7d-8a09-be675f7cb347

Filesize
235B

MD5
07d87d87c877819065cf487e7b493d15

SHA1
6ebfb4d9980144cecd61c5e505d135d28a591c11

SHA256
33561e77d41ecc16a3a8be35b504bfbfa8fbcbe3b97c7d0c44073d07f8564f63

SHA512
73493b044313012b0e998995d40865e22bcb3e0249934c173224a0f4ad3256a5d737a47a998ec1d3f48225f135247132ca1fdfe8b346b67f273353a6db6c616d

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\027putap.default-release\datareporting\glean\pending_pings\dc023eab-9354-4a8d-b297-cabf8e7ac949

Filesize
2KB

MD5
d63d35eee4d598770520e60d02ab545a

SHA1
a1c9b78bdefd0eaa4df86ff72e90ec6bb488864c

SHA256
6ecd4ae57f5d374313b667e838a872d1127be70a7691ce17480bc216b0d3b20c

SHA512
44ae98f0cb1114b6f2704ab28ae6f92982856d451c1005eac221ac3d3d6443e40110f45db7f91b2c7b7c01287443b0c137e6d86fe9c813d5971fae34de505597

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\027putap.default-release\extensions.json

Filesize
16KB

MD5
ece9d6fba705c362bc296a6dd9bd8cd2

SHA1
bced4bb6bc2d803d3c147926ec47e52d3e3ad4a2

SHA256
3245e39d474134b0d3938d0bdce72829945e994d3e27862c8cb26c4141d62f53

SHA512
e2213fee187bdf2d99114e3acbb4d4a3987dcf4ece8ac6b2746e8be4de0b63a545da33462d5be4665e440a5238301df8fced11e159b16ac5e9af5df714c9dc81

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\027putap.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll

Filesize
1.1MB

MD5
626073e8dcf656ac4130e3283c51cbba

SHA1
7e3197e5792e34a67bfef9727ce1dd7dc151284c

SHA256
37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651

SHA512
eebdeef5e47aeadfeebdbab8625f4ec91e15c4c4e4db4be91ea41be4a3da1e1afeed305f6470e5d6b2a31c41cbfb5548b35a15fccd7896d3fde7cdf402d7a339

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\027putap.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info

Filesize
116B

MD5
ae29912407dfadf0d683982d4fb57293

SHA1
0542053f5a6ce07dc206f69230109be4a5e25775

SHA256
fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6

SHA512
6f9083152c02f93a900cb69b1ce879e0c0d69453f1046280ca549a0301ae7925facdda6329f7ccb61726addee78ba2fffc5ba3491a185f139f3155716caf0a8d

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\027putap.default-release\gmp-widevinecdm\4.10.2891.0\manifest.json

Filesize
1001B

MD5
32aeacedce82bafbcba8d1ade9e88d5a

SHA1
a9b4858d2ae0b6595705634fd024f7e076426a24

SHA256
4ed3c6389f6f7cd94db5cd0f870c34a296fc0de3b1e707fccf01645b455790ce

SHA512
67dfe5632188714ec87f3c79dbe217a0ae4dfb784f3fac63affd20fef8b8ef1978c28b3bf7955f3daaf3004ac5316b1ffa964683b0676841bab4274c325c6e2b

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\027putap.default-release\gmp-widevinecdm\4.10.2891.0\widevinecdm.dll

Filesize
18.5MB

MD5
1b32d1ec35a7ead1671efc0782b7edf0

SHA1
8e3274b9f2938ff2252ed74779dd6322c601a0c8

SHA256
3ed0dec36754402707c2ae4fbfa887fe3089945f6f7c1a8a3e6c1e64ad1c2648

SHA512
ab452caa2a529b5bf3874c291f1ffb2a30d9ea43dae5df6a6995dde4bc3506648c749317f0d8e94c31214e62f18f855d933b6d0b6b44634b01e058d3c5fcb499

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\027putap.default-release\prefs-1.js

Filesize
11KB

MD5
a00d52801979d3321ae72637a663c19a

SHA1
43b42ff973a297145f55cc3971b285c592bc5e4d

SHA256
e7ba3d32e5299abc013aa7f43bc9c1258e06432b27beff0eb209567810857d39

SHA512
596e358629dc2bc9b4915ff251b4e021ed2c0884fff778d7342f166072fe59f07b8c6ee39ac6c22681599b432b22086fb8da4b57f8359313990d3b736845517a

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\027putap.default-release\prefs-1.js

Filesize
8KB

MD5
ab6836fab58d0a7eb0e32c9ede2d707d

SHA1
447774fda8e8994a95b11ef0f92cff5669bdaa6f

SHA256
3f5f6211a3de955c94f3d0647ca8c21e101ad91748808dd616ef563b785694da

SHA512
e2e4d13d17d6ec0bb51a64738672070c31b0c5fb201b5fe1a545623e0eb33d65fe852fc7f6a62af24e0b8a5dfc0f2443f42901c2846e7e6b634233e9694a6a4d

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\027putap.default-release\prefs.js

Filesize
6KB

MD5
ce490edec7079e7a39d362fbf9c8a5e7

SHA1
01cc954a86eb6b9005d376ed5c8f44558d89562d

SHA256
ac3d8693eb9845797ab685d7042c20d4c449ed870ace0e66c2c2019eb4909947

SHA512
46b24786402016bbfdec4701bf50e8155e95f12f2bfb569206e18201320bce92d03c75ddbe827872ca704f7244bd74cde4c63239dabf4ca210e45f68b4201bcd

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\027putap.default-release\prefs.js

Filesize
6KB

MD5
f3c7895c6d6e85e50945cf91ae33008d

SHA1
74bd9b7f3cafdedf40b34472c5f3a84cb195723c

SHA256
e199eb4c6073c31a8bc93693d6f941432e19ef5f92624394463ef388618a0e22

SHA512
375ffc0a82835b58b5eff696e7f88fdbf2c7abcf62dcfed6d6ae90462730a87904e727cbb40a88d343afb5f37217080d9417f3a7bb5f35acd9b87f8c8c19a529

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\027putap.default-release\sessionstore-backups\recovery.baklz4

Filesize
9KB

MD5
e4ea740971af83cf9019d44084db8eb5

SHA1
e74564e59f6c9b2137ebf6bf652c269bc4c19eb1

SHA256
054ffcd8663d2bb99fc2925763cb1cd2447673e4680500c2eeb798734dd57abc

SHA512
4a6c08f423120c5e602188f1f28afdfd6eb2fb6fda3889a711f0f55a6a40c660443c216f15404866c70696d120ef798df783c0b8f5f619cd328ba4d8f7070eb0

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\027putap.default-release\sessionstore-backups\recovery.baklz4

Filesize
10KB

MD5
46dd89692e725886fe7fb6c728ec3c0a

SHA1
dbe098d59803f6baa1c2d0d0e08c8f9ac3c7e204

SHA256
58e6db0299e6fd68e8bd3a9abaf5a3c53232ffa3bf929d1c0bcc1f3774130f4f

SHA512
cc70e4795e4b907af796223bcbf88cd8347738492f5d3c129b4b0f1441327c3a6e69160add57c171986a813423362cb1bc1daba2c8fedc0d4543087736b4d546

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\027putap.default-release\sessionstore-backups\recovery.baklz4

Filesize
4KB

MD5
3abb62bdc9c81ebca02138eea9d522c7

SHA1
bdf839706af397c3516bfb2f4dc2fa36a4e1d34c

SHA256
b1b3a537db7abfffa4c21028780c8414ffc915d6906b5fe77eeea2bd721e4f3e

SHA512
8625d2b9d494690b5db23708deecbdd123ff4ed9f5e770475630c0b5b2337beaa4312ac4c1be5b3a5294d20d394800929409171b099d9f7882a98aa39b478624

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\027putap.default-release\sessionstore-backups\recovery.baklz4

Filesize
1KB

MD5
85ee5c28eada4382063b878a2c486f17

SHA1
58048d7f98d289bb1b5ac0c63a969fa1e7c56bce

SHA256
bd4a50bfb6842a8e6ecc40b44652da5a0eba3ecc0e0fd5f20c7a43ec4c053aad

SHA512
944829bf699bcbd2a94b488655ea5f03afff969a700194ecb50827638f02527aef0f9b3217dfe9de821da19e148f7a2d56a0f213c5a0bc98439e5fa0b67b05d4

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\027putap.default-release\sessionstore-backups\recovery.baklz4

Filesize
9KB

MD5
820fdb2e558a0f9a9949b709cbe7a98e

SHA1
95c24fa535ad06a45afdd125c102e3242c92b223

SHA256
3b3b51a8bc7931758ad0cfc2468b05a424f1f1003623350cdf094bc70bb0aea2

SHA512
669f0d9e093f5a9fde063f8483d5d94ebcc008a8b0cb5db879b7e20844b75d2adea0d0e954cbec206b9123b79018670469e38a6907ed9a9e2369a3be58999b22

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\027putap.default-release\sessionstore-backups\recovery.baklz4

Filesize
9KB

MD5
916d0f40e98984dc842f9adea3eaaf49

SHA1
91c9b7f4d4f352bb5686ac0025327d1f189497de

SHA256
20823400273b9bcd3108f17cde669133cf2b1c11a26b7646496bfd3b6b079bd5

SHA512
daa8a0cf633cd80fc9d222f6db49d9487fbd232bafe2e1d5782673cf2ec4899b067ff84c6553a2202a11a421cfa7531248c2ff8d6ea10923c784b7294536e54e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\027putap.default-release\sessionstore-backups\recovery.baklz4

Filesize
10KB

MD5
9914fdf6cdd4721b6dcb8c71909de5d4

SHA1
3922372935eff91043aacef78836df7cf8de7c0c

SHA256
b87aa62d41ddf9e8e8496d394004b7a4c9301f352bedf0d8d8858de4941c6b72

SHA512
b521f58f3290666d50e84d3db0ea849896954e456a79a0f845ef972cb88ab7d637f5d62629c82bbe1249360328a5737a2b8239fe7e1dfcd3b41809962054b07e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\027putap.default-release\sessionstore-backups\recovery.baklz4

Filesize
10KB

MD5
8ff0e87d6475207de2fd2b290a5eed40

SHA1
8c9a648ac10cf3618f41e35bc6096d97135840dd

SHA256
3a084cc8ee0794e696465d62dd47af1b8741a6d6d37fddad38db71ca9f95c50b

SHA512
a63a92e96625955e37a6921790eb95faeef91676177dfd45b450908e3a8a5182ee909fc17a6c8ea00373c1cfaa9ec692f32122e6b4d7e8b1b5fb06ad852f87f4

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\027putap.default-release\storage\default\https+++www.roblox.com\idb\3140325527hBbDa.sqlite

Filesize
48KB

MD5
2c14995e04412a3fb20501b94dbccab0

SHA1
404b4978373119d3ecd0463aec1c683e839c46ba

SHA256
7e5b80ffeb0cc9ac64e1e1ec6e33fba90332d82e3afb267f6daf5ba34cbb8610

SHA512
2fc02d47cda5137a2c86cd059da509b58587a9452fc77926ae3fc4f4bd13d3ea6a7ea9f3f3aa3a70004f84505e8265d5feeb4dc0aff347237225163569331937

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\027putap.default-release\storage\default\https+++www.virustotal.com\cache\morgue\252\{a5f76cf1-77a1-4431-884c-02326ef84cfc}.final

Filesize
61KB

MD5
50f4d342ab5b277c089b377a1cdcad6b

SHA1
ddd9faa67e2e4b9015de7ae33ace8ac0c71aecc7

SHA256
e78fe8dceace816632cae6baadd35e8219159734b1d15a57c845530a9b88afed

SHA512
56c98effa07691b74706256495da978928cda54e01df8e2d9fe5cff1bd0f0aa26acae5aa55eda12842e5422a3287b44ec5ef655c8e1be748d6befd86579eb1af

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\027putap.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite

Filesize
3.5MB

MD5
cd69a1d81cf717e541f10f3a2579317d

SHA1
d9b34b8256b89ca8e0a953bbe46794639a5f1c10

SHA256
0c6647b20d06715c8bea809d4472f8cdafd35865fb1dac368fc35d25f922f978

SHA512
9b10c9558f668454f3c5ad9e63310dc0b60276a90885e3f7db4831df260e1880166655934b1e621c522a940da5fa5f5be7433e94cdf43ad58c5ad970d2f3aa9e

Download Submit
C:\Users\Admin\Desktop\New Client.exe

Filesize
163KB

MD5
8dbe9b6264693ee418bc0cd137802369

SHA1
b01b4cf9047e1eefd8ff350e545ac87bfd097f35

SHA256
14ac892414e6382f33d8da8ea71c8c84c9930df1febc5b1a7c2153b3a1a67d68

SHA512
8b9e3a75896a57c5a4cce2a86a4d0dfd0816ac2227f514fbe053fb1be6cb0a26b7ab48ac14e697671f048afdb240e3cc95ec1ac5183ef5902892993713f75387

Download Submit
C:\Users\Admin\Desktop\New Client.exe

Filesize
73KB

MD5
bc0bef0a1ce112cc20d51f4cba18c490

SHA1
7c479a73b14619e5d53cf3b6137d0121a573cd77

SHA256
fc98fa77fe6e946327e12059fe3d5258f12b178ed82cc0bd06107b8a5086f420

SHA512
274d34bb2246f78e11c98f1e3754f9654685170a6e0b00f2f370d954af02836268255d5fef50dba419318bbcfa231d1ecf2a2d308a004c275f146f7b7c8c0c8b

Download Submit
C:\Users\Admin\Desktop\New Client.exe.hash

Filesize
16B

MD5
3763572a0d0dd27df9f21e3c3bcf8752

SHA1
0257706fc9f590969dec1402fd1a65b5a678e6fc

SHA256
ddb4b673088cf0e933830ff6c738be9b71472b973f2e236ba436698ad39c7f51

SHA512
dfa37419726c9d6b452967490d72aeb26fb0b4c675413f9b5f3d418e3c5073144c7b7485f036043d313ef4b516cf0374bb360a38e5c063715befa0977ba40407

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\CSC85C5F1FA9DDE4230872D6317BB841BAC.TMP

Filesize
644B

MD5
1057e8bc7416c67cfab7e93390e8f1cc

SHA1
290a2282fd38ced13f0192b1a7a0c931c8817c81

SHA256
3a7755107ac74e14f10162f081d82ecc90baa27cc2ac301d6cf320e63c13158e

SHA512
98199a2de3f899bb66bbf2663f44ea4b541040779478a7e912c03dcc02f13c5f60df0e8fd14eb68fd719db4d0392f1b6282d8f7ab64af6d50e540501d51a5c90

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\sutxnfn1\sutxnfn1.0.cs

Filesize
976B

MD5
3942ef3d57acd7e889f62cb7eeee6799

SHA1
22ca5e404b6a1117222977e65dc2f7f6149464d6

SHA256
0207e89b316cfd9276a6d79497ef0660134343582f3a21e910f02a662207398c

SHA512
f00b7d8aa9769908c35edf25318e31818edf886b24d0ede453bcc0214cec7ea0e5f12911b705bb74afcd17d00261b5b4c1533f8d24d95e9e4da4e36c6e29a717

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\sutxnfn1\sutxnfn1.cmdline

Filesize
157B

MD5
0827041fa58bbb81eb651c14e8645e83

SHA1
12ad3584a7dfd0da8880ef7bbe97e1a70cb19e5a

SHA256
b43513889ac817d9887d2734ad5790a7d46ae07bfdd36d0028ed3fd855e0ac95

SHA512
260f195a0a6fffd0038f9e405523d5648e612053cc10ff021663a2f79fcd2bca60fb10227eec5928e2edeb81a4d2ee0996aed44d30718eea8e464ff3e22eee5a

Download Submit
memory/1764-22-0x00000000750D0000-0x0000000075681000-memory.dmp

Filesize
5.7MB

Download
memory/1764-26-0x00000000750D0000-0x0000000075681000-memory.dmp

Filesize
5.7MB

Download
memory/2356-39-0x00000000053B0000-0x0000000005416000-memory.dmp

Filesize
408KB

Download
memory/2356-36-0x0000000000260000-0x0000000000832000-memory.dmp

Filesize
5.8MB

Download
memory/2356-40-0x0000000006540000-0x000000000654A000-memory.dmp

Filesize
40KB

Download
memory/2356-56-0x0000000007500000-0x0000000007508000-memory.dmp

Filesize
32KB

Download
memory/2356-38-0x0000000005310000-0x00000000053A2000-memory.dmp

Filesize
584KB

Download
memory/2356-37-0x00000000057C0000-0x0000000005D66000-memory.dmp

Filesize
5.6MB

Download
memory/4388-3-0x00000000750D0000-0x0000000075681000-memory.dmp

Filesize
5.7MB

Download
memory/4388-7-0x00000000750D0000-0x0000000075681000-memory.dmp

Filesize
5.7MB

Download
memory/4388-13-0x00000000750D0000-0x0000000075681000-memory.dmp

Filesize
5.7MB

Download
memory/4388-6-0x00000000750D0000-0x0000000075681000-memory.dmp

Filesize
5.7MB

Download
memory/4388-14-0x00000000750D0000-0x0000000075681000-memory.dmp

Filesize
5.7MB

Download
memory/4388-4-0x00000000750D0000-0x0000000075681000-memory.dmp

Filesize
5.7MB

Download
memory/4388-9-0x00000000750D0000-0x0000000075681000-memory.dmp

Filesize
5.7MB

Download
memory/4388-0-0x00000000750D1000-0x00000000750D2000-memory.dmp

Filesize
4KB

Download
memory/4388-5-0x00000000750D0000-0x0000000075681000-memory.dmp

Filesize
5.7MB

Download
memory/4388-15-0x00000000750D0000-0x0000000075681000-memory.dmp

Filesize
5.7MB

Download
memory/4388-2-0x00000000750D0000-0x0000000075681000-memory.dmp

Filesize
5.7MB

Download
memory/4388-1-0x00000000750D0000-0x0000000075681000-memory.dmp

Filesize
5.7MB

Download
memory/4388-8-0x00000000750D0000-0x0000000075681000-memory.dmp

Filesize
5.7MB

Download
memory/4388-10-0x00000000750D0000-0x0000000075681000-memory.dmp

Filesize
5.7MB

Download