crimsonrat | hxxps://github[.]com/Da2dalus/The-MALWARE-Repo

Analysis

max time kernel
224s
max time network
240s
platform
windows11-21h2_x64
resource
win11-20250313-en
resource tags

arch:x64arch:x86image:win11-20250313-enlocale:en-usos:windows11-21h2-x64system
submitted
08/04/2025, 16:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://github.com/Da2dalus/The-MALWARE-Repo

Score

10^/10

crimsonrat modiloader warzonerat credential_access defense_evasion discovery infostealer persistence privilege_escalation rat rezer0 spyware stealer trojan

Malware Config

Extracted

Family

warzonerat

168.61.222.215:5400

Extracted

Family

crimsonrat

185.136.161.124

Extracted

Family

modiloader

https://drive.google.com/u/0/uc?id=1TcSctGVBajYMA7CFDc158wpvqkpxmkhJ&export=download

Signatures

CrimsonRAT main payload 1 IoCs

resource	yara_rule
behavioral1/files/0x001a00000002b235-1351.dat	family_crimsonrat

CrimsonRat
Crimson RAT is a malware linked to a Pakistani-linked threat actor.
rat crimsonrat
Crimsonrat family
crimsonrat
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader
Modiloader family
modiloader

UAC bypass 3 TTPs 2 IoCs

defense_evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe

WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
rat infostealer warzonerat
Warzonerat family
warzonerat

ModiLoader First Stage 1 IoCs

resource	yara_rule
behavioral1/files/0x001a00000002b1a3-1081.dat	modiloader_stage1

ReZer0 packer 1 IoCs

Detects ReZer0, a packer with multiple versions used in various campaigns.

rezer0

resource	yara_rule
behavioral1/memory/1380-1250-0x0000000005EB0000-0x0000000005ED8000-memory.dmp	rezer0

Warzone RAT payload 2 IoCs

rat

resource	yara_rule
behavioral1/memory/5876-1257-0x0000000000400000-0x0000000000553000-memory.dmp	warzonerat
behavioral1/memory/5876-1259-0x0000000000400000-0x0000000000553000-memory.dmp	warzonerat

Downloads MZ/PE file 10 IoCs

flow	pid	Process
52	1888	firefox.exe
52	1888	firefox.exe
52	1888	firefox.exe
52	1888	firefox.exe
52	1888	firefox.exe
52	1888	firefox.exe
52	1888	firefox.exe
52	1888	firefox.exe
52	1888	firefox.exe
52	1888	firefox.exe

Modifies Windows Firewall 2 TTPs 1 IoCs

defense_evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
7092	netsh.exe

Executes dropped EXE 17 IoCs

pid	Process
564	VanToM-Rat.bat
1380	WarzoneRAT.exe
2200	Server.exe
6036	WinNuke.98.exe
1372	SpySheriff.exe
5608	AdwereCleaner.exe
4008	6AdwCleaner.exe
4564	6AdwCleaner.exe
4900	Remcos.exe
2008	Userdata.exe
6000	Userdata.exe
5288	Userdata.exe
4640	CrimsonRAT.exe
2540	dlrarhsiva.exe
6004	NJRat.exe
5272	NetWire.exe
5608	NetWire.exe

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 5 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2081498128-3109241912-2948996266-1000\Software\Microsoft\Windows\CurrentVersion\Run\Server = "C:\\Users\\Admin\\Desktop\\VanToM-Rat.bat"	VanToM-Rat.bat
Set value (str)	\REGISTRY\USER\S-1-5-21-2081498128-3109241912-2948996266-1000\Software\Microsoft\Windows\CurrentVersion\Run\Server = "C:\\Users\\Admin\\AppData\\Roaming\\VanToM Folder\\Server.exe"	Server.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2081498128-3109241912-2948996266-1000\Software\Microsoft\Windows\CurrentVersion\Run\AdwCleaner = "\"C:\\Users\\Admin\\AppData\\Local\\6AdwCleaner.exe\" -auto"	6AdwCleaner.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2081498128-3109241912-2948996266-1000\Software\Microsoft\Windows\CurrentVersion\Run\remcos = "\"C:\\Windows\\SysWOW64\\Userdata\\Userdata.exe\""	Remcos.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2081498128-3109241912-2948996266-1000\Software\Microsoft\Windows\CurrentVersion\Run\remcos = "\"C:\\Windows\\SysWOW64\\Userdata\\Userdata.exe\""	Userdata.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 8 IoCs

Web Service

T1102

flow	ioc
119	drive.google.com
5	raw.githubusercontent.com
7	raw.githubusercontent.com
11	raw.githubusercontent.com
45	raw.githubusercontent.com
46	raw.githubusercontent.com
52	raw.githubusercontent.com
118	drive.google.com

Drops file in System32 directory 6 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Userdata\Userdata.exe	Remcos.exe
File opened for modification	C:\Windows\SysWOW64\Userdata\Userdata.exe	Remcos.exe
File created	C:\Windows\SysWOW64\Userdata\Userdata.exe:Zone.Identifier:$DATA	Remcos.exe
File opened for modification	C:\Windows\SysWOW64\Userdata	Remcos.exe
File opened for modification	C:\Windows\SysWOW64\remcos\logs.dat	Userdata.exe
File created	C:\Windows\SysWOW64\remcos\logs.dat	Userdata.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1380 set thread context of 5876	1380	WarzoneRAT.exe	109

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 9 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File created	C:\Users\Admin\Downloads\SpySheriff.exe:Zone.Identifier	firefox.exe
File created	C:\Users\Admin\Downloads\NetWire.exe:Zone.Identifier	firefox.exe
File created	C:\Users\Admin\Downloads\NJRat.exe:Zone.Identifier	firefox.exe
File created	C:\Users\Admin\Downloads\AdwereCleaner.exe:Zone.Identifier	firefox.exe
File created	C:\Users\Admin\Downloads\WinNuke.98.exe:Zone.Identifier	firefox.exe
File created	C:\Users\Admin\Downloads\WarzoneRAT.exe:Zone.Identifier	firefox.exe
File created	C:\Users\Admin\Downloads\Remcos.exe:Zone.Identifier	firefox.exe
File created	C:\Users\Admin\Downloads\CrimsonRAT.exe:Zone.Identifier	firefox.exe
File created	C:\Users\Admin\Downloads\NetWire(1).exe:Zone.Identifier	firefox.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe

System Location Discovery: System Language Discovery 1 TTPs 18 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SpySheriff.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NetWire.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NetWire.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSBuild.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WarzoneRAT.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WinNuke.98.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AdwereCleaner.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Remcos.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Userdata.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NJRat.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
1128	PING.EXE

NSIS installer 2 IoCs

installer

resource	yara_rule
behavioral1/files/0x001a00000002b0c1-545.dat	nsis_installer_1
behavioral1/files/0x001a00000002b0c1-545.dat	nsis_installer_2

Checks processor information in registry 2 TTPs 18 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe

Modifies registry key 1 TTPs 2 IoCs

Modify Registry

T1112

pid	Process
1504	reg.exe
3248	reg.exe

NTFS ADS 13 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\VanToM Folder\Server.exe\:Zone.Identifier:$DATA	VanToM-Rat.bat
File created	C:\Users\Admin\AppData\Roaming\jFvfxe.exe\:Zone.Identifier:$DATA	WarzoneRAT.exe
File created	C:\Users\Admin\Downloads\AdwereCleaner.exe:Zone.Identifier	firefox.exe
File created	C:\Users\Admin\Downloads\SpySheriff.exe:Zone.Identifier	firefox.exe
File created	C:\Users\Admin\Downloads\Walker.com:Zone.Identifier	firefox.exe
File created	C:\Users\Admin\Downloads\WinNuke.98.exe:Zone.Identifier	firefox.exe
File created	C:\Users\Admin\Downloads\VanToM-Rat.bat:Zone.Identifier	firefox.exe
File created	C:\Users\Admin\Downloads\Remcos.exe:Zone.Identifier	firefox.exe
File created	C:\Users\Admin\Downloads\NetWire.exe:Zone.Identifier	firefox.exe
File created	C:\Users\Admin\Downloads\CrimsonRAT.exe:Zone.Identifier	firefox.exe
File created	C:\Users\Admin\Downloads\WarzoneRAT.exe:Zone.Identifier	firefox.exe
File created	C:\Users\Admin\Downloads\NJRat.exe:Zone.Identifier	firefox.exe
File created	C:\Users\Admin\Downloads\NetWire(1).exe:Zone.Identifier	firefox.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
1128	PING.EXE

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5104	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1380	WarzoneRAT.exe
1380	WarzoneRAT.exe
1380	WarzoneRAT.exe
1380	WarzoneRAT.exe
1380	WarzoneRAT.exe
1380	WarzoneRAT.exe
6004	NJRat.exe
6004	NJRat.exe
6004	NJRat.exe
6004	NJRat.exe
6004	NJRat.exe
6004	NJRat.exe
6004	NJRat.exe
6004	NJRat.exe
6004	NJRat.exe
6004	NJRat.exe
6004	NJRat.exe
6004	NJRat.exe
6004	NJRat.exe
6004	NJRat.exe
6004	NJRat.exe
6004	NJRat.exe
6004	NJRat.exe
6004	NJRat.exe
6004	NJRat.exe
6004	NJRat.exe
6004	NJRat.exe
6004	NJRat.exe
6004	NJRat.exe
6004	NJRat.exe
6004	NJRat.exe
6004	NJRat.exe
6004	NJRat.exe
6004	NJRat.exe
6004	NJRat.exe
6004	NJRat.exe
6004	NJRat.exe
6004	NJRat.exe
6004	NJRat.exe
6004	NJRat.exe
6004	NJRat.exe
6004	NJRat.exe
6004	NJRat.exe
6004	NJRat.exe
6004	NJRat.exe
6004	NJRat.exe
6004	NJRat.exe
6004	NJRat.exe
6004	NJRat.exe
6004	NJRat.exe
6004	NJRat.exe
6004	NJRat.exe
6004	NJRat.exe
6004	NJRat.exe
6004	NJRat.exe
6004	NJRat.exe
6004	NJRat.exe
6004	NJRat.exe
6004	NJRat.exe
6004	NJRat.exe
6004	NJRat.exe
6004	NJRat.exe
6004	NJRat.exe
6004	NJRat.exe

Suspicious use of AdjustPrivilegeToken 9 IoCs

description	pid	Process
Token: SeDebugPrivilege	1888	firefox.exe
Token: SeDebugPrivilege	1888	firefox.exe
Token: SeDebugPrivilege	1888	firefox.exe
Token: SeDebugPrivilege	1888	firefox.exe
Token: SeDebugPrivilege	1888	firefox.exe
Token: SeDebugPrivilege	1380	WarzoneRAT.exe
Token: SeDebugPrivilege	4008	6AdwCleaner.exe
Token: SeDebugPrivilege	4564	6AdwCleaner.exe
Token: SeDebugPrivilege	6004	NJRat.exe

Suspicious use of FindShellTrayWindow 22 IoCs

pid	Process
1888	firefox.exe
1888	firefox.exe
1888	firefox.exe
1888	firefox.exe
1888	firefox.exe
1888	firefox.exe
1888	firefox.exe
1888	firefox.exe
1888	firefox.exe
1888	firefox.exe
1888	firefox.exe
1888	firefox.exe
1888	firefox.exe
1888	firefox.exe
1888	firefox.exe
1888	firefox.exe
1888	firefox.exe
1888	firefox.exe
1888	firefox.exe
1888	firefox.exe
564	VanToM-Rat.bat
2200	Server.exe

Suspicious use of SetWindowsHookEx 38 IoCs

pid	Process
1888	firefox.exe
1888	firefox.exe
1888	firefox.exe
1888	firefox.exe
1888	firefox.exe
1888	firefox.exe
1888	firefox.exe
1888	firefox.exe
1888	firefox.exe
1888	firefox.exe
1888	firefox.exe
1888	firefox.exe
1888	firefox.exe
1888	firefox.exe
1888	firefox.exe
1888	firefox.exe
1888	firefox.exe
1888	firefox.exe
1888	firefox.exe
1888	firefox.exe
1888	firefox.exe
1888	firefox.exe
1888	firefox.exe
1888	firefox.exe
1888	firefox.exe
1888	firefox.exe
1888	firefox.exe
1888	firefox.exe
1888	firefox.exe
1888	firefox.exe
1888	firefox.exe
564	VanToM-Rat.bat
2200	Server.exe
4008	6AdwCleaner.exe
4008	6AdwCleaner.exe
4564	6AdwCleaner.exe
4564	6AdwCleaner.exe
2008	Userdata.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 844 wrote to memory of 1888	844	firefox.exe	81
PID 844 wrote to memory of 1888	844	firefox.exe	81
PID 844 wrote to memory of 1888	844	firefox.exe	81
PID 844 wrote to memory of 1888	844	firefox.exe	81
PID 844 wrote to memory of 1888	844	firefox.exe	81
PID 844 wrote to memory of 1888	844	firefox.exe	81
PID 844 wrote to memory of 1888	844	firefox.exe	81
PID 844 wrote to memory of 1888	844	firefox.exe	81
PID 844 wrote to memory of 1888	844	firefox.exe	81
PID 844 wrote to memory of 1888	844	firefox.exe	81
PID 844 wrote to memory of 1888	844	firefox.exe	81
PID 1888 wrote to memory of 2860	1888	firefox.exe	82
PID 1888 wrote to memory of 2860	1888	firefox.exe	82
PID 1888 wrote to memory of 2860	1888	firefox.exe	82
PID 1888 wrote to memory of 2860	1888	firefox.exe	82
PID 1888 wrote to memory of 2860	1888	firefox.exe	82
PID 1888 wrote to memory of 2860	1888	firefox.exe	82
PID 1888 wrote to memory of 2860	1888	firefox.exe	82
PID 1888 wrote to memory of 2860	1888	firefox.exe	82
PID 1888 wrote to memory of 2860	1888	firefox.exe	82
PID 1888 wrote to memory of 2860	1888	firefox.exe	82
PID 1888 wrote to memory of 2860	1888	firefox.exe	82
PID 1888 wrote to memory of 2860	1888	firefox.exe	82
PID 1888 wrote to memory of 2860	1888	firefox.exe	82
PID 1888 wrote to memory of 2860	1888	firefox.exe	82
PID 1888 wrote to memory of 2860	1888	firefox.exe	82
PID 1888 wrote to memory of 2860	1888	firefox.exe	82
PID 1888 wrote to memory of 2860	1888	firefox.exe	82
PID 1888 wrote to memory of 2860	1888	firefox.exe	82
PID 1888 wrote to memory of 2860	1888	firefox.exe	82
PID 1888 wrote to memory of 2860	1888	firefox.exe	82
PID 1888 wrote to memory of 2860	1888	firefox.exe	82
PID 1888 wrote to memory of 2860	1888	firefox.exe	82
PID 1888 wrote to memory of 2860	1888	firefox.exe	82
PID 1888 wrote to memory of 2860	1888	firefox.exe	82
PID 1888 wrote to memory of 2860	1888	firefox.exe	82
PID 1888 wrote to memory of 2860	1888	firefox.exe	82
PID 1888 wrote to memory of 2860	1888	firefox.exe	82
PID 1888 wrote to memory of 2860	1888	firefox.exe	82
PID 1888 wrote to memory of 2860	1888	firefox.exe	82
PID 1888 wrote to memory of 2860	1888	firefox.exe	82
PID 1888 wrote to memory of 2860	1888	firefox.exe	82
PID 1888 wrote to memory of 2860	1888	firefox.exe	82
PID 1888 wrote to memory of 2860	1888	firefox.exe	82
PID 1888 wrote to memory of 2860	1888	firefox.exe	82
PID 1888 wrote to memory of 2860	1888	firefox.exe	82
PID 1888 wrote to memory of 2860	1888	firefox.exe	82
PID 1888 wrote to memory of 2860	1888	firefox.exe	82
PID 1888 wrote to memory of 2860	1888	firefox.exe	82
PID 1888 wrote to memory of 2860	1888	firefox.exe	82
PID 1888 wrote to memory of 2860	1888	firefox.exe	82
PID 1888 wrote to memory of 2860	1888	firefox.exe	82
PID 1888 wrote to memory of 2860	1888	firefox.exe	82
PID 1888 wrote to memory of 2860	1888	firefox.exe	82
PID 1888 wrote to memory of 2860	1888	firefox.exe	82
PID 1888 wrote to memory of 2860	1888	firefox.exe	82
PID 1888 wrote to memory of 1964	1888	firefox.exe	83
PID 1888 wrote to memory of 1964	1888	firefox.exe	83
PID 1888 wrote to memory of 1964	1888	firefox.exe	83
PID 1888 wrote to memory of 1964	1888	firefox.exe	83
PID 1888 wrote to memory of 1964	1888	firefox.exe	83
PID 1888 wrote to memory of 1964	1888	firefox.exe	83
PID 1888 wrote to memory of 1964	1888	firefox.exe	83
PID 1888 wrote to memory of 1964	1888	firefox.exe	83

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "https://github.com/Da2dalus/The-MALWARE-Repo"
1⤵
- Suspicious use of WriteProcessMemory
PID:844
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url https://github.com/Da2dalus/The-MALWARE-Repo
  2⤵
  - Downloads MZ/PE file
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - Checks processor information in registry
  - NTFS ADS
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1888
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1964 -prefsLen 27097 -prefMapHandle 1968 -prefMapSize 270279 -ipcHandle 2040 -initialChannelId {aafe3699-8b65-4c4c-90a2-bf8f3d8be687} -parentPid 1888 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1888" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
    3⤵
    PID:2860
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2424 -prefsLen 27133 -prefMapHandle 2428 -prefMapSize 270279 -ipcHandle 2436 -initialChannelId {251f13de-57c1-403a-8817-c578fd956fcd} -parentPid 1888 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1888" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
    3⤵
    PID:1964
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3868 -prefsLen 25213 -prefMapHandle 3872 -prefMapSize 270279 -jsInitHandle 3876 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3884 -initialChannelId {a7f83468-c1d1-4821-bce5-1c452bc6fec1} -parentPid 1888 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1888" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
    3⤵
    - Checks processor information in registry
    PID:128
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 4080 -prefsLen 27323 -prefMapHandle 4084 -prefMapSize 270279 -ipcHandle 4156 -initialChannelId {c08fd3ef-9898-438e-938f-46af10e0e7e4} -parentPid 1888 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1888" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
    3⤵
    PID:1980
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3044 -prefsLen 34822 -prefMapHandle 2680 -prefMapSize 270279 -jsInitHandle 2976 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 2812 -initialChannelId {b06bf41c-e262-4043-88d5-3197fa9a9d92} -parentPid 1888 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1888" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
    3⤵
    - Checks processor information in registry
    PID:4368
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 5024 -prefsLen 35010 -prefMapHandle 5076 -prefMapSize 270279 -ipcHandle 5092 -initialChannelId {1974f87b-5298-4784-bee6-be206f44e112} -parentPid 1888 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1888" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
    3⤵
    - Checks processor information in registry
    PID:5224
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5324 -prefsLen 32900 -prefMapHandle 5328 -prefMapSize 270279 -jsInitHandle 5332 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5340 -initialChannelId {707e7c3f-4732-4e7d-bf8d-d84a06a7b861} -parentPid 1888 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1888" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
    3⤵
    - Checks processor information in registry
    PID:5380
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5576 -prefsLen 32952 -prefMapHandle 5580 -prefMapSize 270279 -jsInitHandle 5584 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5592 -initialChannelId {82854987-824d-4501-82cf-b12b73c283a8} -parentPid 1888 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1888" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
    3⤵
    - Checks processor information in registry
    PID:5428
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5800 -prefsLen 32952 -prefMapHandle 5804 -prefMapSize 270279 -jsInitHandle 5808 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5816 -initialChannelId {55545fea-acc1-46df-944f-c2aaf22424f9} -parentPid 1888 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1888" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
    3⤵
    - Checks processor information in registry
    PID:5440

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc
1⤵
PID:1868

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4984

C:\Users\Admin\Desktop\VanToM-Rat.bat
"C:\Users\Admin\Desktop\VanToM-Rat.bat"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- NTFS ADS
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:564
- C:\Users\Admin\AppData\Roaming\VanToM Folder\Server.exe
  "C:\Users\Admin\AppData\Roaming\VanToM Folder\Server.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  PID:2200

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\Desktop\VanToM-Rat.bat
1⤵
PID:720

C:\Users\Admin\Desktop\WarzoneRAT.exe
"C:\Users\Admin\Desktop\WarzoneRAT.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1380
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\jFvfxe" /XML "C:\Users\Admin\AppData\Local\Temp\tmp8ED8.tmp"
  2⤵
  - System Location Discovery: System Language Discovery
  - Scheduled Task/Job: Scheduled Task
  PID:5104
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
  2⤵
  PID:3508
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5876

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\VanToM Folder\Server.exe
1⤵
PID:5208

C:\Users\Admin\Desktop\WinNuke.98.exe
"C:\Users\Admin\Desktop\WinNuke.98.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:6036

C:\Users\Admin\Desktop\SpySheriff.exe
"C:\Users\Admin\Desktop\SpySheriff.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1372

C:\Users\Admin\Desktop\AdwereCleaner.exe
"C:\Users\Admin\Desktop\AdwereCleaner.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5608
- C:\Users\Admin\AppData\Local\6AdwCleaner.exe
  "C:\Users\Admin\AppData\Local\6AdwCleaner.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:4008

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\6AdwCleaner.exe" -auto
1⤵
PID:1992
- C:\Users\Admin\AppData\Local\6AdwCleaner.exe
  C:\Users\Admin\AppData\Local\6AdwCleaner.exe -auto
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:4564

C:\Windows\system32\werfault.exe
werfault.exe /h /shared Global\2523bb82f83d4643847edda2ffdf0493 /t 5864 /p 4564
1⤵
PID:2688

C:\Users\Admin\Desktop\Remcos.exe
"C:\Users\Admin\Desktop\Remcos.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:4900
- C:\Windows\SysWOW64\cmd.exe
  /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3048
- - C:\Windows\SysWOW64\reg.exe
    C:\Windows\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
    3⤵
    - UAC bypass
    - System Location Discovery: System Language Discovery
    - Modifies registry key
    PID:1504
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\install.bat" "
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2004
- - C:\Windows\SysWOW64\PING.EXE
    PING 127.0.0.1 -n 2
    3⤵
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:1128
- - C:\Windows\SysWOW64\Userdata\Userdata.exe
    "C:\Windows\SysWOW64\Userdata\Userdata.exe"
    3⤵
    - Executes dropped EXE
    PID:5288

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Windows\SysWOW64\Userdata\Userdata.exe"
1⤵
PID:2664
- C:\Windows\SysWOW64\Userdata\Userdata.exe
  C:\Windows\SysWOW64\Userdata\Userdata.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:2008
- - C:\Windows\SysWOW64\cmd.exe
    /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:792
  - - C:\Windows\SysWOW64\reg.exe
      C:\Windows\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
      4⤵
      UAC bypass
      System Location Discovery: System Language Discovery
      Modifies registry key
      PID:3248
- - C:\Program Files (x86)\Internet Explorer\iexplore.exe
    "C:\Program Files (x86)\Internet Explorer\iexplore.exe"
    3⤵
    PID:1572

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Windows\SysWOW64\Userdata\Userdata.exe"
1⤵
PID:2328
- C:\Windows\SysWOW64\Userdata\Userdata.exe
  C:\Windows\SysWOW64\Userdata\Userdata.exe
  2⤵
  - Executes dropped EXE
  PID:6000

C:\Users\Admin\Desktop\CrimsonRAT.exe
"C:\Users\Admin\Desktop\CrimsonRAT.exe"
1⤵
- Executes dropped EXE
PID:4640
- C:\ProgramData\Hdlharas\dlrarhsiva.exe
  "C:\ProgramData\Hdlharas\dlrarhsiva.exe"
  2⤵
  - Executes dropped EXE
  PID:2540

C:\Users\Admin\Desktop\NJRat.exe
"C:\Users\Admin\Desktop\NJRat.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:6004
- C:\Windows\SysWOW64\netsh.exe
  netsh firewall add allowedprogram "C:\Users\Admin\Desktop\NJRat.exe" "NJRat.exe" ENABLE
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:7092

C:\Users\Admin\Desktop\NetWire.exe
"C:\Users\Admin\Desktop\NetWire.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5272
- C:\Users\Admin\Desktop\NetWire.exe
  "C:\Users\Admin\Desktop\NetWire.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5608

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004E8 0x00000000000004E4
1⤵
PID:6868

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\Desktop\NJRat.exe" ..
1⤵
PID:5404
- C:\Users\Admin\Desktop\NJRat.exe
  C:\Users\Admin\Desktop\NJRat.exe ..
  2⤵
  PID:6456

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\Desktop\NJRat.exe" ..
1⤵
PID:4796
- C:\Users\Admin\Desktop\NJRat.exe
  C:\Users\Admin\Desktop\NJRat.exe ..
  2⤵
  PID:6492

C:\Users\Admin\Desktop\AdwereCleaner.exe
"C:\Users\Admin\Desktop\AdwereCleaner.exe"
1⤵
PID:5660
- C:\Users\Admin\AppData\Local\6AdwCleaner.exe
  "C:\Users\Admin\AppData\Local\6AdwCleaner.exe"
  2⤵
  PID:4064

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\Desktop\NJRat.exe" ..
1⤵
PID:2592
- C:\Users\Admin\Desktop\NJRat.exe
  C:\Users\Admin\Desktop\NJRat.exe ..
  2⤵
  PID:5880

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\Desktop\NJRat.exe" ..
1⤵
PID:692
- C:\Users\Admin\Desktop\NJRat.exe
  C:\Users\Admin\Desktop\NJRat.exe ..
  2⤵
  PID:4764

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\Desktop\NJRat.exe" ..
1⤵
PID:2712
- C:\Users\Admin\Desktop\NJRat.exe
  C:\Users\Admin\Desktop\NJRat.exe ..
  2⤵
  PID:496

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\Desktop\NJRat.exe" ..
1⤵
PID:4344
- C:\Users\Admin\Desktop\NJRat.exe
  C:\Users\Admin\Desktop\NJRat.exe ..
  2⤵
  PID:4648

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\Desktop\NJRat.exe" ..
1⤵
PID:2544
- C:\Users\Admin\Desktop\NJRat.exe
  C:\Users\Admin\Desktop\NJRat.exe ..
  2⤵
  PID:340

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\Desktop\NJRat.exe" ..
1⤵
PID:4808
- C:\Users\Admin\Desktop\NJRat.exe
  C:\Users\Admin\Desktop\NJRat.exe ..
  2⤵
  PID:1504

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\Desktop\NJRat.exe" ..
1⤵
PID:4252
- C:\Users\Admin\Desktop\NJRat.exe
  C:\Users\Admin\Desktop\NJRat.exe ..
  2⤵
  PID:6424

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\Desktop\NJRat.exe" ..
1⤵
PID:232
- C:\Users\Admin\Desktop\NJRat.exe
  C:\Users\Admin\Desktop\NJRat.exe ..
  2⤵
  PID:6884

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\Desktop\NJRat.exe" ..
1⤵
PID:1756
- C:\Users\Admin\Desktop\NJRat.exe
  C:\Users\Admin\Desktop\NJRat.exe ..
  2⤵
  PID:6484

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\Desktop\NJRat.exe" ..
1⤵
PID:5196
- C:\Users\Admin\Desktop\NJRat.exe
  C:\Users\Admin\Desktop\NJRat.exe ..
  2⤵
  PID:6508

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\Desktop\NJRat.exe" ..
1⤵
PID:6656
- C:\Users\Admin\Desktop\NJRat.exe
  C:\Users\Admin\Desktop\NJRat.exe ..
  2⤵
  PID:5076

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\Desktop\NJRat.exe" ..
1⤵
PID:6680
- C:\Users\Admin\Desktop\NJRat.exe
  C:\Users\Admin\Desktop\NJRat.exe ..
  2⤵
  PID:6216

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\Desktop\NJRat.exe" ..
1⤵
PID:6460
- C:\Users\Admin\Desktop\NJRat.exe
  C:\Users\Admin\Desktop\NJRat.exe ..
  2⤵
  PID:6488

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\Desktop\NJRat.exe" ..
1⤵
PID:6496
- C:\Users\Admin\Desktop\NJRat.exe
  C:\Users\Admin\Desktop\NJRat.exe ..
  2⤵
  PID:5904

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\Desktop\NJRat.exe" ..
1⤵
PID:6372
- C:\Users\Admin\Desktop\NJRat.exe
  C:\Users\Admin\Desktop\NJRat.exe ..
  2⤵
  PID:1400

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\Desktop\NJRat.exe" ..
1⤵
PID:6180
- C:\Users\Admin\Desktop\NJRat.exe
  C:\Users\Admin\Desktop\NJRat.exe ..
  2⤵
  PID:3452

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\Desktop\NJRat.exe" ..
1⤵
PID:7116
- C:\Users\Admin\Desktop\NJRat.exe
  C:\Users\Admin\Desktop\NJRat.exe ..
  2⤵
  PID:6448

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\Desktop\NJRat.exe" ..
1⤵
PID:5356

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\Desktop\NJRat.exe" ..
1⤵
PID:960
- C:\Users\Admin\Desktop\NJRat.exe
  C:\Users\Admin\Desktop\NJRat.exe ..
  2⤵
  PID:6268

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\Desktop\NJRat.exe" ..
1⤵
PID:864

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\Desktop\NJRat.exe" ..
1⤵
PID:6276

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\Desktop\NJRat.exe" ..
1⤵
PID:5392

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Hdlharas\dlrarhsiva.exe

Filesize
9.1MB

MD5
64261d5f3b07671f15b7f10f2f78da3f

SHA1
d4f978177394024bb4d0e5b6b972a5f72f830181

SHA256
87f51b4632c5fbc351a59a234dfefef506d807f2c173aac23162b85d0d73c2ad

SHA512
3a9ff39e6bc7585b0b03f7327652e4c3b766563e8b183c25b6497e30956945add5684f1579862117e44c6bac2802601fc7c4d2a0daa1824f16c4da1fd6c9c91a

Download Submit
C:\ProgramData\Hdlharas\mdkhm.zip

Filesize
56KB

MD5
b635f6f767e485c7e17833411d567712

SHA1
5a9cbdca7794aae308c44edfa7a1ff5b155e4aa8

SHA256
6838286fb88e9e4e68882601a13fa770f1b510a0a86389b6a29070a129bf2e5e

SHA512
551ba05bd44e66685f359802b35a8c9775792a12844906b4b53e1a000d56624c6db323754331c9f399072790991c1b256d9114a50fb78111652a1c973d2880af

Download Submit
C:\Users\Admin\AppData\Local\6AdwCleaner.exe

Filesize
168KB

MD5
87e4959fefec297ebbf42de79b5c88f6

SHA1
eba50d6b266b527025cd624003799bdda9a6bc86

SHA256
4f0033e811fe2497b38f0d45df958829d01933ebe7d331079eefc8e38fbeaa61

SHA512
232fedec0180e85560a226870a244a22f54ca130ed6d6dc95dc02a1ff85f17da396925c9ff27d522067a30ee3e74a38adff375d8752161ee629df14f39cf6ba9

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\epe2yyab.default-release\activity-stream.discovery_stream.json

Filesize
21KB

MD5
fdfb19b97362c173b711445cf8394054

SHA1
01c44e70aa30e903d094c146be93b047d9b8105e

SHA256
dba37750c0cf55826e9f58de72f42fcffe63a227ca67a3487ca42b37b7a033b5

SHA512
2bf50c3bdb7bbcd55e3975a9fb1d95687f9efd5a3b953bad4a9f89a41ada30f8a186f9f982f174d2b98f65abf935f896cbc2a9d65cb6e5ce777e0c6ae5778b58

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\epe2yyab.default-release\cache2\entries\A585344A45AF937E3AB7D706291A9A3ED8D581D9

Filesize
13KB

MD5
f4d637a9f1ec93af5bc82dfa1ee984b0

SHA1
5530a655015688f0911ef926f3be9974e45daa9d

SHA256
4b6cc4949788d981ad1b2ddc1feb0556552f8d55e65720949bee72c3fd19f781

SHA512
477ab0ba44c0621e8c7d23d08535c16c112733e28397059eea957cea4141aa988ba7aa4d831bb45266f17af38afdbea350114aa2d41a22163f914eb53113ccd7

Download Submit
C:\Users\Admin\AppData\Local\Temp\install.bat

Filesize
133B

MD5
10ca4bba76803018a30c280fcc1f907e

SHA1
df6af0b7d414774a323ab5cfc1e4af5bcd7c7a7f

SHA256
da27e7f6ec839e25aef165cc13a000284a039c5ffbf7e5574c89f709b172f078

SHA512
9837f60c3318dfc3db12b7b207123d690768e970c4ac542a30c0f82202811281a7f3176640657ef734f8e8739184fab7591a1e3f17a2a0cea78d5ac48effad9b

Download Submit
C:\Users\Admin\AppData\Local\Temp\melt.txt

Filesize
37B

MD5
8051baeb7872e3267b6ccee66d32c624

SHA1
58d10754cd648373b832d4d22d80a43aba37b71a

SHA256
4d51b460608d46c4224425f52d379e93b2a3ceb3b296142a258d74ad902ccc5d

SHA512
266d96884961006627d85cb969a7a5cde5b4f2dfa6bb6145e50e9e07f554daf06455cb65f2c1f8a42f704e534170f63e473cdd0b3e363a71286baa30fc0046d9

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp8ED8.tmp

Filesize
1KB

MD5
59b22fee13645b39a3a53ac2ea96c684

SHA1
ece9f2f3cbd008cfc8b628bc43b010577240fe18

SHA256
a97f0e341125de06bf6557f6053c9fb77d30afe1ed17984772d0cc9079d7354d

SHA512
8f2c910937df3a8279e73ab52cbe87614ab3dd7fec8d497273524186668d3ce0c73f2c02dfb3d4ef9c2ca86e4b3bc702151023c893b3ea72206daafd6896afe5

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon

Filesize
11KB

MD5
25e8156b7f7ca8dad999ee2b93a32b71

SHA1
db587e9e9559b433cee57435cb97a83963659430

SHA256
ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986

SHA512
1211b2fa997ba13ff926aec58b6b35a81d7fe108b0caa8f4d6369d0a37f8481373b78a4b201651243adde9e2b2699ce929482a46226ff6299b0a0e40fe2ddc56

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon

Filesize
14.0MB

MD5
bcceccab13375513a6e8ab48e7b63496

SHA1
63d8a68cf562424d3fc3be1297d83f8247e24142

SHA256
a6af95a209b2e652ed6766804b9b8ad6b6a68f2c610b8f14713cd40df0d62bf9

SHA512
d94483deaae98bf9212699f1ab0bd913f6151a63e65ebc1ea644ab98d5e3ebd74ecaa08f70aca31e11a5d2c64d1504b723817af35bbe9d7b05c758dd6945d484

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon

Filesize
502KB

MD5
e690f995973164fe425f76589b1be2d9

SHA1
e947c4dad203aab37a003194dddc7980c74fa712

SHA256
87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171

SHA512
77991110c1d195616e936d27151d02e4d957be6c20a4f3b3511567868b5ddffc6abbfdc668d17672f5d681f12b20237c7905f9b0daaa6d71dcdac4b38f2448b2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\epe2yyab.default-release\datareporting\glean\db\data.safe.tmp

Filesize
6KB

MD5
e122c42a12bb79b331006af2851226e3

SHA1
c35955ae0084faca178c1a601b61630e71027530

SHA256
ecb6be9551fd7852d1d57f81f090022c322439989dd23a230ceb38b527d005d1

SHA512
dbb9d5ce10ab5f491c8315f145b36c5fb3ed146f79d81a6ec0f73ad222620d1bed4098f279e88bfe0291dd6b7c911624d5b0515afc1b8a2dac4d20addfa1777b

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\epe2yyab.default-release\datareporting\glean\db\data.safe.tmp

Filesize
7KB

MD5
3fb9ecc0a945fe18d15018aa40603386

SHA1
98ad9bb0f1634a8f26de9034b2e896f22e246b3b

SHA256
7ad91304518c296caac4aa569b0a6b2001c74e073562b2cd75688dc27187650c

SHA512
f6bb93a7cb36f0850b3599e195faa802ad6a54b96d4f61066e9806b4780873f85ea3ab2a60af742e746ebe242b98ab856a50a2c42dc66596273b697c63172ede

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\epe2yyab.default-release\datareporting\glean\events\events

Filesize
4KB

MD5
30e57d80dfb72234aeb703f2fd47bcd4

SHA1
438a8aedf99d4c97140a3c81bd2e9cafc2462d6f

SHA256
327433bf0eccbc0021aaaf4b2140ee58113cc1c4bfee58be79c6fefb2636d791

SHA512
955cb1bfb6034856e7026533e887b06702dc66812beba2204eca5f165bb6ad9914b3a094ff562d7d44af46e0481afd47f1c670018653f203d8253c1b91b7e3c8

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\epe2yyab.default-release\datareporting\glean\events\events

Filesize
1KB

MD5
8d502b3adefee183ac05a4fea6e00e96

SHA1
da8357ace096b2bf24881603b776c50e1680bc01

SHA256
e1b77f1ae8e3a307575941eb8d48dc921342129a3f6512243fe58c81ac0cf199

SHA512
62ad34c513a35489bad2f4f1715de23f3c064de8af99b51f966c3634345d9ee187e9787393a6a0ebc42733bad267c87c126845dd4b1ebddfbac3dbace4b06b65

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\epe2yyab.default-release\datareporting\glean\pending_pings\2613407a-0885-461a-b050-be796e1efaae

Filesize
886B

MD5
6b90bf7a2b8961663284c7e9559aa8d4

SHA1
41ca493dca3e942b8ba847a7f9b02ef48ce16817

SHA256
2480ace47f181eea3bb3d835701675e735133c9d84340fd7bdc3dfb85fe19893

SHA512
43432bf5eaa52444b922a55c944d6a66b4bc119beb359cc955f6dfc0574b112c05e68a7be7d80036e492e9811e64e6147ae9b2902162b3fc915d9459ddf751f7

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\epe2yyab.default-release\datareporting\glean\pending_pings\3c5f5907-7e6b-4c92-9a5d-e33acf9b5472

Filesize
16KB

MD5
132b3da746ddd66e080bbcad9ff447a5

SHA1
c73494014963e1576fd570ffe2a52a22eed6bb35

SHA256
e0190318d71d06618dc74d1dea34ac133c73a3f9f87492cc8222f75003bdb082

SHA512
bd2b07b4ff1d5f9b4240b1c7da160135c57f445d7274a5b5a3533ed069cfd9109483a88c69f272d76ebb885cd90653f8408d2cc25f9d1c5b9e3cfff97490967e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\epe2yyab.default-release\datareporting\glean\pending_pings\77e29ee1-c480-49bb-8336-195b603ddfa7

Filesize
235B

MD5
bc3b977828302aebc582d119e223d231

SHA1
868dab8b34a7b9b3fb43f7640077485052160df2

SHA256
c6d268a5b40413de4d7a65b3b187714db4fe10f836e5df449cca25a8ab0e3d65

SHA512
de94fa7421e02d8daa36774e9d84235ff67a516446119b0018b826f8ed61a7de31bb4776742886a87ef155ae4cb26557d6f3c8e753584b3e54eeeb8c8b23ba72

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\epe2yyab.default-release\datareporting\glean\pending_pings\df8698c7-7771-4379-9da7-3409d545700c

Filesize
235B

MD5
7c3b4cae194c0ff02e69ad3a85e936e7

SHA1
ea87d8782b3a9cc98d8caf6c6f407ec08cfa418b

SHA256
a1f495962d206ad21f41196e221aaba5fb0e69db5b29e46f7ab05b2e51f90249

SHA512
5a0d947b82dbe51874c947393b4ff3599b5252066e5990411a680c83cd52ed417342ce5e97362b88a4eda1f92e085068096cf50cbd250e2875879641078f5892

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\epe2yyab.default-release\datareporting\glean\pending_pings\e0ced6d3-d4ce-45c3-9f6a-75c99d10cfad

Filesize
2KB

MD5
a19c5db680c791f64b7e9ab13d11d139

SHA1
499099ac4bd7d35ee85434960133cef5e6083758

SHA256
da0698bfdbfc90e90ba8c15c591d4a816deea80d1977ecc9e1555c595ba316ac

SHA512
2832ee397cea688a115c6e35267f2067126cd240a2e46c4daaefcf9a305680429e4d34d288a907f014a862a80ae03854c94fb1ffd6674941d6700b1e0279266d

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\epe2yyab.default-release\datareporting\glean\pending_pings\e4c70397-0000-4e02-aa26-a69e885b7ca9

Filesize
883B

MD5
3128992b51a1e89b28d4291318d848d1

SHA1
2843df02de0ccf947db93289b6e2b50727e158b3

SHA256
4ca93960627959826ec18c118098e0ace09748095dbbd0f923f1da4513c89c66

SHA512
36171fec0f6e11a03b27bb40d46afb4d1ba7ed97ca918168d324fb46c834efa005b4c64c98659953d8f4c23765d86e89b5659a3163c3a91cbac2be8c076c101c

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\epe2yyab.default-release\extensions.json

Filesize
16KB

MD5
cf2e14055436dc129e7c7ee6f761e27a

SHA1
e3d9a4fcba58cc57f52837cff0db8c17595d63aa

SHA256
353f61c20e84bec29d6065069e66064086a7a4b8814ade47e1a8155e1065275d

SHA512
31d3318481e93a2c6c880bcfc2b556413b5a80a5c5d22fccc0bfbf3fc315ea29614547eaf169ad373ce831f339dd7e266e50b13498a70554f0486d75e3721674

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\epe2yyab.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll

Filesize
1.1MB

MD5
626073e8dcf656ac4130e3283c51cbba

SHA1
7e3197e5792e34a67bfef9727ce1dd7dc151284c

SHA256
37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651

SHA512
eebdeef5e47aeadfeebdbab8625f4ec91e15c4c4e4db4be91ea41be4a3da1e1afeed305f6470e5d6b2a31c41cbfb5548b35a15fccd7896d3fde7cdf402d7a339

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\epe2yyab.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info

Filesize
116B

MD5
ae29912407dfadf0d683982d4fb57293

SHA1
0542053f5a6ce07dc206f69230109be4a5e25775

SHA256
fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6

SHA512
6f9083152c02f93a900cb69b1ce879e0c0d69453f1046280ca549a0301ae7925facdda6329f7ccb61726addee78ba2fffc5ba3491a185f139f3155716caf0a8d

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\epe2yyab.default-release\gmp-widevinecdm\4.10.2891.0\manifest.json

Filesize
1001B

MD5
32aeacedce82bafbcba8d1ade9e88d5a

SHA1
a9b4858d2ae0b6595705634fd024f7e076426a24

SHA256
4ed3c6389f6f7cd94db5cd0f870c34a296fc0de3b1e707fccf01645b455790ce

SHA512
67dfe5632188714ec87f3c79dbe217a0ae4dfb784f3fac63affd20fef8b8ef1978c28b3bf7955f3daaf3004ac5316b1ffa964683b0676841bab4274c325c6e2b

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\epe2yyab.default-release\gmp-widevinecdm\4.10.2891.0\widevinecdm.dll

Filesize
18.5MB

MD5
1b32d1ec35a7ead1671efc0782b7edf0

SHA1
8e3274b9f2938ff2252ed74779dd6322c601a0c8

SHA256
3ed0dec36754402707c2ae4fbfa887fe3089945f6f7c1a8a3e6c1e64ad1c2648

SHA512
ab452caa2a529b5bf3874c291f1ffb2a30d9ea43dae5df6a6995dde4bc3506648c749317f0d8e94c31214e62f18f855d933b6d0b6b44634b01e058d3c5fcb499

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\epe2yyab.default-release\prefs-1.js

Filesize
8KB

MD5
c97598feb8d806b5f14c2da21f22e2c1

SHA1
039f668925dc72c2da927b192e59c27227dbd09e

SHA256
bbd7a44ee64c1e680d0fff1da37976d21f08b258608b31815b51911f1e63ae29

SHA512
4e7b48b38a70c03977fa46d7c7b0e9f22dee66ef568d9455c4d3f44e778d5ec4c406923c4e49c6e85fa9052b80de337fc72d05000e51b3067ee79f2c9be458b7

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\epe2yyab.default-release\prefs.js

Filesize
6KB

MD5
99961276f6baf8665b74afdd890292ac

SHA1
dea2df6d0feadfc430de5748b415e9ab244ef690

SHA256
a2f79f11ede2c2e803ffe1842718c24ccd330409bf7a5c7087f1e590704f055d

SHA512
d19d6d182ac7cd6d994cfb91d11197c3c96b75cfd273edfc7d6c36e6bf0b7a2d64b06809103bc31e5fcfdf1e6b4825a28d200762eff0177d2e25fe6598e69dfc

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\epe2yyab.default-release\prefs.js

Filesize
6KB

MD5
ae0d62217e516a26acca3124c28df446

SHA1
0dfc1ce8313d913c9982c361edcf605e9c49fc73

SHA256
320ca8643b0abdb60b28f7cface96101f522a210443156128c2b53508e1c4587

SHA512
24b6815df173bce11c5d5f8701c1fc42ef269568f3b8b8dc7e0d1c09f1c408d474b29409d4d53198f4e08524bb20903eddb71942c2e63e943d139474a8f0fd37

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\epe2yyab.default-release\prefs.js

Filesize
6KB

MD5
9f621431b117d5a715b280cb8c796f0e

SHA1
a94161d50bf37fae8d2b8955e92e8ddb35769441

SHA256
ccffb536851c67c2e7c0eebffb46748287e4d99f063de38fc62d9e74980f22fa

SHA512
0a6268755281a21ccff01a2ad270b3210ac842470317d41cf8289ae0e8556d0a2f59f6cec12184b8c821779df45b0d858e8ba8e39c53ab7d28cb2491cfb3e473

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\epe2yyab.default-release\sessionstore-backups\recovery.baklz4

Filesize
4KB

MD5
80644affab4cd76482c989f4c958b963

SHA1
c0ec3af229f29961dec40b68511299845bf806cd

SHA256
d89253cdddd089be027f3ad9af3d1c7957ce133e4616d61352e32aa9f6627cd6

SHA512
9769ec329ead88f8ff769cbe03abc9d819e007dbd23e71f4cc141e6a6ffbc491e8459be2d9093c8497957bcae136b97413a61b7f2b9781193d864dc1ac7eada0

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\epe2yyab.default-release\sessionstore-backups\recovery.baklz4

Filesize
5KB

MD5
116aa882156f234e9bf7cbab0c582f91

SHA1
9ac8219a41290f781f1720a1f1c681a005772ae7

SHA256
73bcbb9585fb072d77abbebab4158aebdfd62c66f570b86a56d95db705404cce

SHA512
54ea47cf956ae45cdd6773bdeac09ae3a1018a5573a0a23c7ec1d4236625ebd36569ef261317bcdc4197ada2aba7a0f64301512825b50c1254002660bc05533c

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\epe2yyab.default-release\sessionstore-backups\recovery.baklz4

Filesize
3KB

MD5
057eedcddb908a21aa3f5c59351e3065

SHA1
00584d4dffe0f5d996db35b7cbcc72cb5cbf982a

SHA256
80b865ce6016fb6590f05aebe409e25eaf8b2bf26a555f5cb2815e265e80f605

SHA512
88ef41e2a4e4368b77ac197a292d00b655eb239920ca468bc1d2da11e2502e6d1225e316c3d0f9bd1d9a9cc769591125fde0c67beb4a44595ae58d840e809557

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\epe2yyab.default-release\sessionstore-backups\recovery.baklz4

Filesize
4KB

MD5
9f29b0ed159642f3d80907bc6a4f943b

SHA1
606b989950c4856b1fc16f7e22efc254b9e3fc9a

SHA256
91379d20d04c5085af133cf4ce521f052b04eca2dabe4af107371d4385c02e7a

SHA512
b8463955c4657a540ed5ed28a837e094de8f694582298d7d923864ded02828ef4c956dee01b4762b8c05f2a269959d25f5508e972f3fe4cbcd22870e7e742820

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\epe2yyab.default-release\sessionstore-backups\recovery.baklz4

Filesize
4KB

MD5
4b1852e9ed99b756a47f5ef81d763480

SHA1
df0d8d286d698c8162ab7b6f7d516ddbc4f943af

SHA256
bf507bb07431040ea6f5a9780449d7957da16f68cb7c17dcfbe7397b604dc7be

SHA512
ca5512cd6c5734eef52b61b0bbde137b17f92dc8679930e9d64bd1d8d824b7e505722c3c3492918655fe848505cabfc370d30ecee76114938a3ce38dd12507a4

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\epe2yyab.default-release\sessionstore-backups\recovery.baklz4

Filesize
4KB

MD5
0a0a06184a00679fe5fb4f457fd3d352

SHA1
45981d4b8be17869b519489f28999974b40c408a

SHA256
b83bfef884be2f4b6ea8e78852e68111c0b764db058f0820b5c798f7a9773e0e

SHA512
5811949c48c475bf357c02a19763434efc8b091f533a8175b78416ec440d9cc10f60195f514a392b650914d6ebfc31391048d505cf7894b7247745223e5ce8e0

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\epe2yyab.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite

Filesize
3.5MB

MD5
6fb9ab74619dc79bf75b2b7465b6dc53

SHA1
6859e784852ffba6445b6f709ef43e7e6238bd07

SHA256
a6fb90db45002f3f6dbb36fc682cdac7bfc7cd355b191c1ea919bd5a7e39c8fe

SHA512
5214eee3849f0ba63c704b5ab6e25050ff0d11a823f913f19fa3aa6d0b5d432fa2da301a700513484504ecaaa74089d580d2381cbbed616652e8cea62175ae92

Download Submit
C:\Users\Admin\AppData\Roaming\VanToM Folder\Server.exe:Zone.Identifier

Filesize
221B

MD5
c3de82bd60c06c27df22fd9fcab5e07a

SHA1
94d07c3e58d6173b52c4ca363a849a21fdb60538

SHA256
d788f92a19da57ea9b6be3853bb2fc9ab1447f13613f95f59b0a463c419bfc3b

SHA512
c432c5d7231921f74233e1a45e3e60ca58b60f4947a4e31a7b793a6954938a3643e763c4d5309af8b151db33cc06e3bb79774c7ea4e65dabf2b4de1283d20da5

Download Submit
C:\Users\Admin\Desktop\AddApprove.wdp

Filesize
268KB

MD5
f9b6fc59caffd12385415cd708a3a130

SHA1
9f81fdcfcbc7c295f12a997ddcce24138ac0a743

SHA256
03345b52d6ee34d98b4b8bff499ce3d46b5147e874a6ec21d14e74b112cf312b

SHA512
339c2bba79e37ff228f09d473ee828287c8c71be0da592d3f8c46ab48fb4ca487e8b9fa1608984c945d83e918fc341d40e30de9161a4c0be84a42189213c2cca

Download Submit
C:\Users\Admin\Desktop\AssertGrant.wav

Filesize
191KB

MD5
979ef52b3ad09a4afd4f55ddacc2bd66

SHA1
be43e1983f7e8ddff5ad4a9edd57a4b118860ffe

SHA256
a00c4dc73bd2e20fa388ec2155dbd1885135eaa381c523aceb4b4bbaf237a4c1

SHA512
1573456607026cc72bf809d76a6d44a9b03274465d4a782a22ab5cd8de9ab8d848439bf97b279f062a08cd71a58068ae77b59bc701b1799c59eddf0827ed4e4b

Download Submit
C:\Users\Admin\Desktop\BlockExpand.cab

Filesize
251KB

MD5
acdd114853d3a3709ab91e0bfff910a2

SHA1
fa2b1f0dde4212954e543e3bdcd906be34e83f1d

SHA256
56dd3af024fa055895354a525f01dd77c8d5d7468ef004ab0251b321f4171f4d

SHA512
5918fdf458f32b0941d1b53656959d675b3e09f5cb1a9a65d0d12ff2c85376dc23ce62d3a613c07b674551d488c5bca4635b34f35b370bb5e7c8ccffee5892a2

Download Submit
C:\Users\Admin\Desktop\BlockInstall.mpe

Filesize
166KB

MD5
3f7c3e4e67893e0450cc9e84519c85b1

SHA1
cadffb8ae11a967475ac6def263d7cc5dba62db8

SHA256
d7a69d72fdeb55e69686416bf6b921ef5656e09edf17c37b5ddf0d8bfb7ff5bf

SHA512
61c6d4a7f985abf9420c5c88ceca977d3662bd0a7bbbf99c8d3207f54c4e3906a57b7a6d1b36ceb6dd310bb00427e01d54cb824bc596b26a90923f5ec2c3e02b

Download Submit
C:\Users\Admin\Desktop\CheckpointOptimize.au

Filesize
259KB

MD5
3773d9c021779ab6bdd1244c865a06b3

SHA1
d56dfa8938bc75df0a14fc81b364cda08315fb16

SHA256
7267b9a1ca9776147d40cc99881d5efdf194d90a73f3917511293d5735dbf5f6

SHA512
54ad947afce100eadb46fc6f7a8af4e9e3791d7f3c3c5cb8dc33f1581adb5653c9356297ca3b847ac4c5f207de08dfd84cc98eed3a45123761628ce768f40b8a

Download Submit
C:\Users\Admin\Desktop\CompressConnect.AAC

Filesize
485KB

MD5
c7056214cd5fdbb25405e6b8212bd39a

SHA1
14a2dbaeb87840740199afd03ad8fc544cca7fe3

SHA256
89882f9d2083531cae5a7494b845379d20c2658145c647cad8fe85a8dd0a124a

SHA512
566342895d3b68b438cf096fcf8a35cf7643adf99373e1b19e288b3ae8b2bb388f7dc05b248965636d5e24cc5c6864255bb9c2315a9fee9b99916f0afa175e7a

Download Submit
C:\Users\Admin\Desktop\CopyApprove.emf

Filesize
302KB

MD5
2d7d551a68705130ae31280d719c539d

SHA1
7494b485c14fca6eb213eb5b96f597a9591e291e

SHA256
e9e19f4c5f056275297959b20f8b50bcfd9ce065b547a10ac4cd560798b5ce8a

SHA512
0ff8c412472524be539080c41962e4501719453a5680338d1f5913d25be353427a49799a8ad4ad1d36efc0a8865e8a3fa962a926d9811beb7e61896935b105ca

Download Submit
C:\Users\Admin\Desktop\EnableOpen.mp4

Filesize
336KB

MD5
94117d8a49db740d0a6ef6ee6529773e

SHA1
050979ab9356446b4a583308c6b9acfc2146b98d

SHA256
7b3df65f1c57ca500699746ba483e694a99b883dc08c345c676f4aa609c9026d

SHA512
d1df133627f82a3d1fe4c600aca38ca56c108b5799823bc512ca315c9d00ed2f1ae9898d35a3628a96d215c9301e592a03d5c990e05beeac9441128c154e2166

Download Submit
C:\Users\Admin\Desktop\GrantDebug.vbe

Filesize
225KB

MD5
34142e792d23c29b27f2603471e3d1fa

SHA1
c19e9172592326de232b11eb97ca9b6c64649da1

SHA256
bb719dd099bd19a6afda57b0c97af7b37383a0b425420c1f9c21ec884a2a71c7

SHA512
41acf0ce6c1e2d5bb47013d37acf83f123e1e3e8e2375db3e3d6f3b196bffaaf8864473ec0a442242a6cf1b6fd26d2b7c6f11f2561181d5f4051b2ebf98c872d

Download Submit
C:\Users\Admin\Desktop\HideConvertTo.html

Filesize
328KB

MD5
220032603eadd325051301d96ed07129

SHA1
0c045132a637ea374ff3d5cfeb8011829a4a6f01

SHA256
69bc9dd3a0057df4987e4fdcf694d60faee9fec7a86d31b8eebb621d531271bb

SHA512
3eb1974f9af5b7c554e4bfc5a6acac606c6ec35a4f1b054c0a20efe07f0d0dc5ecc92a83c46510acc7db01a65ed96228870cba9e7e58fa1a09702c9e270d0a47

Download Submit
C:\Users\Admin\Desktop\JoinGroup.ods

Filesize
174KB

MD5
e1aa3cd27bc2bb74c37f500008c11dbc

SHA1
8eb76e015c4b59b79939a01908397568b400475f

SHA256
78dd65b1395ea4c932ee24a7dc508f388fbf809e62ad3099c62bb5c9cd9d857d

SHA512
090ca1b3d242f0e99ecf339a0b3e52303a986c3128e39e7317c59f29a20f5b623ff43b1aa1571dac2fc60cf78e5685ca3d86926ac5cb649b9277bc9cf6286ab9

Download Submit
C:\Users\Admin\Desktop\LimitBlock.ps1

Filesize
183KB

MD5
7f4fb69f78017593b844363007f0b5c2

SHA1
d25a4c14f6e373f036fda80f445d37de722c1364

SHA256
d9d88f48d4d9deb455da7b53470b9fabbce82ac3828904f28df1173665240cae

SHA512
7ae2f0e511452813a83f1504879b65acb83830f7a6f208d3c80aafd167565fd59a483e99ad9cb3b59c103a61d022a13fda43826bfc68b60b1a9d40f6b54f191b

Download Submit
C:\Users\Admin\Desktop\Microsoft Edge.lnk

Filesize
2KB

MD5
9644002f4a89e0443ee44be7a448f992

SHA1
a7428b05610c015d60c72c5f37162cc04eb5ea02

SHA256
7014d59d9628d008d8783f8b11e7cb9404a29b3e97dedbe4c0a229700ccd051d

SHA512
0a5c6f88ef317c555018955a5766c10500a40572a7beb5e8330b9991753acf47da10a3bc81a3fefaebb097ac6353c8ad07f3366cd35222802a101f0e2b5a7946

Download Submit
C:\Users\Admin\Desktop\MountConvertFrom.hta

Filesize
140KB

MD5
a64cabdf2a96aa05f347b9d62d97a71a

SHA1
fd31ef261152fb51971f9694cb05cd4c99cd7a20

SHA256
ceb79f6dfa06108bd32431d0ce0250153690f31ff7370d57450c4c2a4c25c745

SHA512
f04ea1fa53453a256b60fb0775358fc1e6d04dc5cd1e65b71ce1d762120e52b8180ecc1b2abc07355addc81152db3972dbe45dc6e078638350d5215f3fe1b4ad

Download Submit
C:\Users\Admin\Desktop\OutMeasure.docx

Filesize
14KB

MD5
f9f8eae1f27f38420029e1995b4de3ea

SHA1
3219598cb4121728241cdee1762da9c3f2456c82

SHA256
e9596a200dcb4e204f23ddcf47571c47b4758c97cea056306d677c4ce753a6f3

SHA512
fe2758811f1dc31161ab966f112ec2800efa5216b127fc35e716f59cb6b375d8f960265de527a1b834a1f97e68d94c56a5b644dad0dbab2943610a6137971530

Download Submit
C:\Users\Admin\Desktop\PushUpdate.ogg

Filesize
217KB

MD5
c906628904b4fe724b707e034b1b9327

SHA1
dcc6245b35f655364f61343fd3233587ae5e4543

SHA256
3712b877534e29d89670954b0ee9a6bd547de608ce135c79cedd7eb7cf70a3ab

SHA512
f410ad3a1e98beba6088ea0b9e07ad8b755782df3c01d4561916be435b2dfa4147db8c8c4464a475ec21e9572d053bb43db1740fc1ed52d156265225cae8744a

Download Submit
C:\Users\Admin\Desktop\ReadExit.wmv

Filesize
234KB

MD5
e891643d1fe61ffcae291595908349aa

SHA1
dbc2499fbcae9e29cf3a8112d83cb680e6289abb

SHA256
1097db8be58211a2bf8036590236f73a99eef5f75d378e2a20c26b1a6a3b994e

SHA512
3871ac4f049350706ec91b59ec93a67c854d594fe5e5d8100fab1df1bcd2b749fc6cc56bf71e0fa481c0bd28f1f78a11eaf83718d5f3cc00e6498277554d54cb

Download Submit
C:\Users\Admin\Desktop\ReadUnregister.emf

Filesize
149KB

MD5
3c9e15c95d48f5d140c19582629d5446

SHA1
fec65c212a7abc0fe52b07181eb5563949f3aca3

SHA256
620bace9b84f801cb4e8d762f0da16f6bd57daaafd663387c130d613c074fcca

SHA512
322599ba588625fce5cd5c7a9129e2b9ac16f8098546d8137bbe09b273b366733be1f926e6f4234022a835b388d6781660e453045761bec297821bd365d0b6e3

Download Submit
C:\Users\Admin\Desktop\ResumeSync.M2T

Filesize
132KB

MD5
0840d3ec2d90d2d27847bb4d36de1b50

SHA1
fcdd06de167a1f8beadad18b53617d70f1c05946

SHA256
34b1ee811fde82f6d81ef5ad8ed9f3cc9bb2bc327267e7bcd47b4e50e53826d4

SHA512
c228d8131461082543033aee2d53d301feff23e8cd9789e13c8eb1aafcca79b319156ab827399afb9914a31a5053ed4ab47a5ee84c804bec675b3f072235bfed

Download Submit
C:\Users\Admin\Desktop\SaveWatch.pptm

Filesize
294KB

MD5
a3d8d202d969bfff57298c41a9813df8

SHA1
9570ea7ffdd76a0e58fba7c0859af58aee92b162

SHA256
66fcd1dbad79a79752ee0ea5374b914dfa045f11f02882efcf9c7ab90a8d00d5

SHA512
1d6cec7d1125cdc48f858b75b2f5c148566f04fb540820c4a88704e0873a634fcd3e27da9dc02d6ea604a9e2f814b1a5b3fb952763e602a194abc1ad80e3ba85

Download Submit
C:\Users\Admin\Desktop\SetConvertTo.wmx

Filesize
319KB

MD5
126fcfe7e379f90b9d4710709a1a8872

SHA1
d4ed6fcd1dd34544b833c0f34bca721b6a0d3d7a

SHA256
aa445bf7d25afecbf54c6b668ca4303f52018ec8436c7b3523a21514b1d35aa2

SHA512
5794c9077fa0c8d506d663db5f48fbe5d920470556cdace5bbb41d80183add37c96ba1b915128e1b3e68beb270ca041d9cccf497d578d5f01f7b88d0c474b746

Download Submit
C:\Users\Admin\Desktop\SkipApprove.mpg

Filesize
208KB

MD5
5109135022a2e0e433ab856ee431d6e7

SHA1
536c1e2e41b992b968e333f7ecd61571f800ebca

SHA256
434169135343aa30af3340539f31b6c359d7a28685440d3020f9790d5d1b0e69

SHA512
bfd7fcd170358765c7285e022986d9524851882da8eacdf39742b2131d83ee1de125ac397b0977634d879c6fa1fd1225b89e5c7048f5071cf4ec178f9ea662bf

Download Submit
C:\Users\Admin\Desktop\SkipRename.temp

Filesize
353KB

MD5
5b19cf72861af0d4bc5d903bad6d8bbc

SHA1
bc58834ef166b20e129899b118a0825b55c847b2

SHA256
51da5c7bea4e9118de57cd42f670fe548a17b48d58bec10ad30e6129ecf8e8d1

SHA512
8ec547e9035459b8dffafca3e15ff257caad2535bbe175e6011591693a87b27f83030a926e83fc638f32ff1ab8be1fce955e1368d6d83ac83661c11619b2aa37

Download Submit
C:\Users\Admin\Desktop\SplitInitialize.vb

Filesize
242KB

MD5
162fa2d0259020e4439814a33c81eeb2

SHA1
19e4d0feab7665c3ef451283eb999ed5fa7bc84c

SHA256
67c1c4e6c2eaec01ab53a4cd903796d7b8bedd9e077d7e0e9a62938aeac4ef82

SHA512
de841cf294a0aaf25d1bbdd8b665e7198c6320b0a635d0151b12e87eecfd0a71ec9582e49955dfe088eba2a087dfca9b9a793f99cbb0e1e547858d6ffadaf424

Download Submit
C:\Users\Admin\Desktop\SubmitMeasure.gif

Filesize
157KB

MD5
e41fe3b9821498252245ce90b0043c6e

SHA1
310f7dc81aad342d564a4d7f24f92489fbe9e7f3

SHA256
b166689ecda16036ca991383f2fc7eb416cd6fc207ab35191c4c8924f05f0c68

SHA512
498558d58935a8b4c85b0f96e93e41ff63a4b3e01014cca9078e2b113d4c20c5f9232c1dadfff3ef1a8f9804df6cf45d4534bb669ab5280be71b3993d2e7c3a4

Download Submit
C:\Users\Admin\Desktop\UndoTest.ini

Filesize
345KB

MD5
bc0ce34974013bb54f581a437539d0f1

SHA1
c94430bcdfa7f4b5e5b907c1e42465c4c92bb8cd

SHA256
a93e17b5f750c0b509287820603c470d55ac253ae48b5cdf1448f72a709e41d6

SHA512
a799b723f24d532fb733d9146587e5d73251fdc2c428cdcd10f93d801e1414384435cdc48a1b01676c142ffbb5d41e217989bb2f4638f57bb8e64e6df6e36750

Download Submit
C:\Users\Admin\Desktop\UndoUpdate.vsx

Filesize
123KB

MD5
32cc35d94b0202222bb39346e7908c1f

SHA1
a5d5b7c2dda6ef1ec6a82f45c8792bfebdce0373

SHA256
47f9797c79bb404e10fb74ae7f404808e3cf068d2452c3ae6bc40cf7a303413e

SHA512
c2483b3148b20155493c0248b39ade2c908d7902169dbf6c1533897d6d7b1c36d307caf6c3e8fd2d28aa383c3bc82edb47aae1f202d48b969bc10fa6e49ea75b

Download Submit
C:\Users\Admin\Desktop\UninstallRemove.ttc

Filesize
200KB

MD5
6af6f1e8799da2e0af53622920bd7b15

SHA1
17274ff0d620d9037d53bc38ad5470d737c802f0

SHA256
8189806014801630f2ccf6a8cf6c57f8297365b2bbef40fd001601a5feb6469f

SHA512
886cc60c52bfd25207ef9f2d6c32428fe4ea10cb9f067ea772937516208d968ae8730f02b8a0eed5b7e64be8287ba527bfdee36f89f3642a306bd06cbb09be41

Download Submit
C:\Users\Admin\Desktop\UnlockRequest.vdx

Filesize
285KB

MD5
3d14d2d6f00f41d81624152fb2b291b0

SHA1
49573ab42a0110794c8de85f378145eb7bbe52fd

SHA256
ce997737eadb716abe00a79c840f9b21fc5825fc2c879461d657f1b4eef4638b

SHA512
fb4fd2bcb6c852437f64ac167788c29a5ba6f803f2ade9bc385100ae74981a891ee50010358c3815830b035f2c699ad9d1e2a8c8ec6b04a5b1bdba1dcbf6acf8

Download Submit
C:\Users\Admin\Desktop\UnpublishAdd.xlsx

Filesize
10KB

MD5
224f8f25e054943ddce962cd6cdb8fd9

SHA1
c4e53f187e4c3cd66012c98833cc10f3c10c3c19

SHA256
7b2926294bb5d0c790a838cba61c124793bfc88c898d10d6f4e309b4f17c5663

SHA512
8bbb7c658e35f1647eb32ffdb7ffe01e07fcf710ceec27a7ab8c20a57eedf75c27e4ef40ef598edd1f4bd908d94d1e10a4a01f20ddda4cc27cfb4dff9adeb6b8

Download Submit
C:\Users\Admin\Desktop\UsePop.htm

Filesize
277KB

MD5
93149d0f732596db894f0378df52188d

SHA1
743a8b544911a1e224c5bc2cfbd1f8ac47fa5bf8

SHA256
c1df27d5cf4453477262bc0a0ab6b13c924562e5fa44fa39202875385bf6c101

SHA512
68c8e6cf0bdbc8518d1752666fcffd3751e26eb3f93293b41b5738c31808ce756dfa0b75c27383f6a007a0df1e3c0c4d815cde3d5fe1b9c1d98cf44584fd061e

Download Submit
C:\Users\Admin\Desktop\WatchOptimize.emf

Filesize
311KB

MD5
de25c8aa60ab1c1fbdcd03a435a0cc3a

SHA1
1ec4cba1b045c03a96326fb0eb6cf5f9ceb5a7c5

SHA256
9e69b22a30cffa0e3f19e7b383d4bfa406e0cb9a5c1b0170da9f69a9260bf791

SHA512
06a3e98e153b644e4834303c25438b2ad4036b998d0cddce859d5f178dc05178f6fa42cd00c784af045f1e1f168ddbe89e3b50b68bc61ab6336d149435fe8d65

Download Submit
C:\Users\Admin\Downloads\1Bp2dCwt.com.part

Filesize
4KB

MD5
93ceffafe7bb69ec3f9b4a90908ece46

SHA1
14c85fa8930f8bfbe1f9102a10f4b03d24a16d02

SHA256
b87b48dcbf779b06c6ca6491cd31328cf840578d29a6327b7a44f9043ce1eb07

SHA512
c1cb5f15e2487f42d57ae0fa340e29c677fe24b44c945615ef617d77c2737ce4227d5a571547714973d263ed0a69c8893b6c51e89409261cdbedff612339d144

Download Submit
C:\Users\Admin\Downloads\AdwereCleaner.S4J8Atyc.exe.part

Filesize
190KB

MD5
248aadd395ffa7ffb1670392a9398454

SHA1
c53c140bbdeb556fca33bc7f9b2e44e9061ea3e5

SHA256
51290129cccca38c6e3b4444d0dfb8d848c8f3fc2e5291fc0d219fd642530adc

SHA512
582b917864903252731c3d0dff536d7b1e44541ee866dc20e0341cbee5450f2f0ff4d82e1eee75f770e4dad9d8b9270ab5664ffedfe21d1ad2bd7fe6bc42cf0e

Download Submit
C:\Users\Admin\Downloads\CrimsonRAT.exe

Filesize
84KB

MD5
b6e148ee1a2a3b460dd2a0adbf1dd39c

SHA1
ec0efbe8fd2fa5300164e9e4eded0d40da549c60

SHA256
dc31e710277eac1b125de6f4626765a2684d992147691a33964e368e5f269cba

SHA512
4b8c62ddfc7cd3e5ce1f8b5a1ba4a611ab1bfccf81d80cf2cfc831cffa1d7a4b6da0494616a53b419168bc3a324b57382d4a6186af083de6fc93d144c4503741

Download Submit
C:\Users\Admin\Downloads\NJRat.exe

Filesize
31KB

MD5
29a37b6532a7acefa7580b826f23f6dd

SHA1
a0f4f3a1c5e159b6e2dadaa6615c5e4eb762479f

SHA256
7a84dd83f4f00cf0723b76a6a56587bdce6d57bd8024cc9c55565a442806cf69

SHA512
a54e2b097ffdaa51d49339bd7d15d6e8770b02603e3c864a13e5945322e28eb2eebc32680c6ddddbad1d9a3001aa02e944b6cef86d4a260db7e4b50f67ac9818

Download Submit
C:\Users\Admin\Downloads\NetWire.sv-Nj8oQ.exe.part

Filesize
1.2MB

MD5
7621f79a7f66c25ad6c636d5248abeb9

SHA1
98304e41f82c3aee82213a286abdee9abf79bcce

SHA256
086d35f26bd2fd886e99744960b394d94e74133c40145a3e2bc6b3877b91ec5d

SHA512
59ffcf6eeac00c089e9c77192663d0dc97b2e62cedb6d64fe7dc2e67499abc34e33977e05113c9d39ca6d3e37e8b5c3e6aa926c8526215808b147c0152f7dbfd

Download Submit
C:\Users\Admin\Downloads\Remcos.kXE5kyZJ.exe.part

Filesize
92KB

MD5
fb598b93c04baafe98683dc210e779c9

SHA1
c7ccd43a721a508b807c9bf6d774344df58e752f

SHA256
c851749fd6c9fa19293d8ee2c5b45b3dc8561115ddfe7166fbaefcb9b353b7c4

SHA512
1185ffe7e296eaaae50b7bd63baa6ffb8f5e76d4a897cb3800cead507a67c4e5075e677abdbf9831f3f81d01bdf1c06675a7c21985ef20a4bae5a256fd41cc0f

Download Submit
C:\Users\Admin\Downloads\SpySheriff.naVYzg37.exe.part

Filesize
48KB

MD5
ab3e43a60f47a98962d50f2da0507df7

SHA1
4177228a54c15ac42855e87854d4cd9a1722fe39

SHA256
4f5f0d9a2b6ef077402a17136ff066dda4c8175ceb6086877aaa3570cabb638f

SHA512
9e3365c7860c4766091183d633462f1cc8c30d28871ae2cd8a9a086ce61c0bccf457f919db6826b708f0cf4f88e90f71185420edc4756b7d70137e2096f8797f

Download Submit
C:\Users\Admin\Downloads\VanToM-Rat.flxVxNOY.bat.part

Filesize
183KB

MD5
3d4e3f149f3d0cdfe76bf8b235742c97

SHA1
0e0e34b5fd8c15547ca98027e49b1dcf37146d95

SHA256
b15c7cf9097195fb5426d4028fd2f6352325400beb1e32431395393910e0b10a

SHA512
8c9d2a506135431adcfd35446b69b20fe12f39c0694f1464c534a6bf01ebc5f815c948783508e06b14ff4cc33f44e220122bf2a42d2e97afa646b714a88addff

Download Submit
C:\Users\Admin\Downloads\WarzoneRAT.exe

Filesize
321KB

MD5
600e0dbaefc03f7bf50abb0def3fb465

SHA1
1b5f0ac48e06edc4ed8243be61d71077f770f2b4

SHA256
61e6a93f43049712b5f2d949fd233fa8015fe4bef01b9e1285d3d87b12f894f2

SHA512
151eebac8f8f6e72d130114f030f048dff5bce0f99ff8d3a22e8fed7616155b3e87d29acf79f488d6b53ed2c5c9b05b57f76f1f91a568c21fe9bca228efb23d9

Download Submit
C:\Users\Admin\Downloads\WinNuke.98.exe

Filesize
32KB

MD5
eb9324121994e5e41f1738b5af8944b1

SHA1
aa63c521b64602fa9c3a73dadd412fdaf181b690

SHA256
2f1f93ede80502d153e301baf9b7f68e7c7a9344cfa90cfae396aac17e81ce5a

SHA512
7f7a702ddec8d94cb2177b4736d94ec53e575be3dd2d610410cb3154ba9ad2936c98e0e72ed7ab5ebbcbe0329be0d9b20a3bcd84670a6d1c8d7e0a9a3056edd2

Download Submit
C:\Users\Public\Desktop\Acrobat Reader DC.lnk

Filesize
2KB

MD5
5ab62d812dc0a7cd8f4c58a8a867704b

SHA1
abd16b55d872cc74b699d635aa5ac196c95c9420

SHA256
f154a135d00810dc3a80239cb5b24412737538f666d16b7f09b100d6c3713b99

SHA512
26c8d272e596d3bfecb2a3349f8e6cca4ce0a91daf94b304bf85b0081e0ee43acc5a37e0cf5d56c1e205061c92fdcdf6821a1d2d7ba70e72021e9f91bbbd6485

Download Submit
C:\Users\Public\Desktop\Firefox.lnk

Filesize
1KB

MD5
cc3daa8de4e832c174e90081de3f4282

SHA1
bacf436ec3f1d7499076d99c0916f9991378e34c

SHA256
8c9486f9cd6b04fd9c64514636478c0f9e20511218001d0ec3700bfd596e4073

SHA512
38b20693de7ad0d48859534e3d0dd36fcc714b74441cefed7586c203c72b465a97538daa3949e6e6d75e8ae573a4cefc1f70d208abcc54b41dc1d2798b78785e

Download Submit
C:\Users\Public\Desktop\Google Chrome.lnk

Filesize
2KB

MD5
99c76912186ff99d93d9f373fbb3bc9b

SHA1
c7575ea0d998dba52c291c9c610a13fb3f9c0b8a

SHA256
c94e0fa2c9e606b939c3d932fd36ad35d1e3938ea956e9454ad60cd914c7a9c3

SHA512
8dd6f33f90bbbd8b7954a7df49d90bbc4088d0175535552ee25026a6bd429a54a7a55d472ec696ec9c185be23e759d659e112d1f81ec1e399e02dd832027754b

Download Submit
C:\Users\Public\Desktop\Microsoft Edge.lnk

Filesize
2KB

MD5
fe77bc0b77b03745a0356ee6fa765c89

SHA1
80b916373f28b1b129704b4ba6a924a657bca793

SHA256
4b115fc0b827f2e75a15b3163fe91a39f6f114af0e57bd1297b313248a16fc29

SHA512
cf0089ce4a8266ff8654c92a92df8c0be326da46b09efde9f0ff959e76c80bc3c34aaa67d7b0f68de531f597ddfafcac5f5a6ac4fa32c2fd35572b3064210a56

Download Submit
C:\Users\Public\Desktop\VLC media player.lnk

Filesize
923B

MD5
7cff957ad41b289ae9eba6b45c96dbad

SHA1
7471be2d1a10e5256d0a6c02c9861b1bd0de339d

SHA256
f5d0d25471569abb206c103f88f158164ab787bba92bba4f96c048a05fcf801d

SHA512
beaa51f7699f6ed4c5de08d38bcb193043f82836280ff3bbc6398925ebd8c10a675dc79b9da8f873dc88e09e5b5db399350b534c0d0cee33ab32873297d82c02

Download Submit
C:\Windows\SysWOW64\remcos\logs.dat

Filesize
160B

MD5
840901de57f338593be98a6397b9b479

SHA1
026afa622a4991ef579849968c1b7dc03cc75219

SHA256
a1211a1af922af374c6e593ad94555923a4173c79bbd5961899c839d499d99a5

SHA512
ab58d551adc2777a90eb5cb700fa523e603432f3e16f96a92e8f51c43abfc6d53fdc97d03762a7539c5f1225476eebf7873c85996e6e0fa01653b1dd32f48d62

Download Submit
memory/564-1225-0x000000001C2A0000-0x000000001C33C000-memory.dmp

Filesize
624KB

Download
memory/564-1224-0x000000001BD30000-0x000000001C1FE000-memory.dmp

Filesize
4.8MB

Download
memory/564-1229-0x000000001E6B0000-0x000000001E9C0000-memory.dmp

Filesize
3.1MB

Download
memory/564-1221-0x00007FF92AB15000-0x00007FF92AB16000-memory.dmp

Filesize
4KB

Download
memory/564-1222-0x000000001B710000-0x000000001B7B6000-memory.dmp

Filesize
664KB

Download
memory/564-1223-0x00007FF92A860000-0x00007FF92B201000-memory.dmp

Filesize
9.6MB

Download
memory/564-1230-0x00007FF92A860000-0x00007FF92B201000-memory.dmp

Filesize
9.6MB

Download
memory/564-1226-0x00007FF92A860000-0x00007FF92B201000-memory.dmp

Filesize
9.6MB

Download
memory/564-1227-0x0000000001230000-0x0000000001238000-memory.dmp

Filesize
32KB

Download
memory/564-1228-0x000000001C540000-0x000000001C58C000-memory.dmp

Filesize
304KB

Download
memory/564-1273-0x00007FF92A860000-0x00007FF92B201000-memory.dmp

Filesize
9.6MB

Download
memory/564-1262-0x00007FF92A860000-0x00007FF92B201000-memory.dmp

Filesize
9.6MB

Download
memory/564-1260-0x00007FF92AB15000-0x00007FF92AB16000-memory.dmp

Filesize
4KB

Download
memory/564-1261-0x00007FF92A860000-0x00007FF92B201000-memory.dmp

Filesize
9.6MB

Download
memory/1372-1278-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/1372-1296-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/1380-1248-0x00000000057F0000-0x00000000057F8000-memory.dmp

Filesize
32KB

Download
memory/1380-1246-0x00000000060D0000-0x0000000006676000-memory.dmp

Filesize
5.6MB

Download
memory/1380-1249-0x0000000005F50000-0x0000000005FEC000-memory.dmp

Filesize
624KB

Download
memory/1380-1245-0x0000000000C70000-0x0000000000CC6000-memory.dmp

Filesize
344KB

Download
memory/1380-1250-0x0000000005EB0000-0x0000000005ED8000-memory.dmp

Filesize
160KB

Download
memory/1380-1247-0x0000000005B20000-0x0000000005BB2000-memory.dmp

Filesize
584KB

Download
memory/2540-1359-0x000001E5EE0A0000-0x000001E5EE9B4000-memory.dmp

Filesize
9.1MB

Download
memory/4008-1294-0x0000000000BD0000-0x0000000000BFE000-memory.dmp

Filesize
184KB

Download
memory/4564-1302-0x0000000021E20000-0x00000000225C6000-memory.dmp

Filesize
7.6MB

Download
memory/4640-1328-0x000001AD7AB50000-0x000001AD7AB6E000-memory.dmp

Filesize
120KB

Download
memory/5272-1363-0x0000000010410000-0x000000001047E000-memory.dmp

Filesize
440KB

Download
memory/5608-1365-0x00000000006B0000-0x00000000006B1000-memory.dmp

Filesize
4KB

Download
memory/5608-1364-0x00000000001F0000-0x00000000001F1000-memory.dmp

Filesize
4KB

Download
memory/5876-1259-0x0000000000400000-0x0000000000553000-memory.dmp

Filesize
1.3MB

Download
memory/5876-1257-0x0000000000400000-0x0000000000553000-memory.dmp

Filesize
1.3MB

Download