Overview

overview

10

Static

static

3

NjRAT_0.7d.zip

windows11-ltsc_2024-x64

10

Resubmissions

14/11/2026, 05:43

261114-ge37gsaz4k10

14/11/2026, 02:44

261114-c8jbysbz8y10

13/11/2026, 21:51

261113-1qtxqsg16w10

13/11/2026, 21:49

261113-1psy2sss7n3

13/11/2026, 21:19

261113-z6fvda116k3

Analysis

  • user interaction
    yes
  • max time kernel
    197s
  • max time network
    201s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-es
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-eslocale:es-esos:windows11-ltsc_2024-x64systemwindows
  • submitted
    14/11/2026, 02:44

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    NjRAT_0.7d.zip
  • Size 14.2MB
  • Sample261114-c8jbysbz8y
  • SHA256 d1b368392d8143ba7038493570f34c994018cc46855918e3022085de32f6b653
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
mybotdefense_evasiondiscoverynjratpersistenceprivilege_escalationtrojan

Malware Config

Extracted

Family

  • njrat

Version

  • 0.7d

Botnet

  • MyBot

C2

  • 127.0.0.1:6522

Mutex

  • 60c28f2ec9c1d3d7f391e11534af955e

Attributes
  • reg_key

    60c28f2ec9c1d3d7f391e11534af955e

  • splitter

    Y262SUCZ4UJJ

Signatures

  • Family: njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat
  • Modifies Windows Firewall 2 TTPs 1 IoCs
    defense_evasion
  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 4 IoCs
  • Enumerates video capture drivers 2 TTPs 1 IoCs

    Queries the legacy Video for Windows capture drivers. This is commonly abused by RATs to check for available webcams on the system before reporting to their C2.

    discoverydefense_evasion
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

    Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

    persistenceprivilege_escalation
  • Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Time Discovery 1 TTPs 1 IoCs

    Adversary may gather the system time and/or time zone settings from a local or remote system.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies Control Panel 1 IoCs
    defense_evasion
  • Modifies registry class 47 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
  • Suspicious use of AdjustPrivilegeToken 24 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 46 IoCs

Processes

  • C:\Windows\Explorer.exe
    C:\Windows\Explorer.exe /idlist,,C:\Users\Admin\AppData\Local\Temp\NjRAT_0.7d.zip
    1⤵
      PID:2916
    • C:\Windows\System32\rundll32.exe
      C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
      1⤵
        PID:5836
      • C:\Program Files\7-Zip\7zG.exe
        "C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Desktop\NjRAT_0.7d\" -spe -an -ai#7zMap20145:78:7zEvent13008
        1⤵
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of FindShellTrayWindow
        PID:2944
      • C:\Program Files\7-Zip\7zG.exe
        "C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Desktop\" -an -ai#7zMap4907:78:7zEvent4029
        1⤵
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of FindShellTrayWindow
        PID:6120
      • C:\Program Files\7-Zip\7zG.exe
        "C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Desktop\NjRAT_0.7d\" -spe -an -ai#7zMap22085:78:7zEvent13870
        1⤵
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of FindShellTrayWindow
        PID:4132
      • C:\Users\Admin\Desktop\NjRAT_0.7d\APP - NjRat 0.7D Moded\NjRat 0.7D.exe
        "C:\Users\Admin\Desktop\NjRAT_0.7d\APP - NjRat 0.7D Moded\NjRat 0.7D.exe"
        1⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Modifies Control Panel
        • Modifies registry class
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:4432
        • C:\Windows\Microsoft.NET\Framework\v2.0.50727\ilasm.exe
          "C:\Windows\Microsoft.NET\Framework\v2.0.50727\ilasm.exe" /alignment=512 /QUIET "C:\Users\Admin\AppData\Local\Temp\stub.il" /output:"C:\Users\Admin\Desktop\NjRAT_0.7d\APP - NjRat 0.7D Moded\Client.exe"
          2⤵
          • System Location Discovery: System Language Discovery
          PID:3116
      • C:\Windows\system32\taskmgr.exe
        "C:\Windows\system32\taskmgr.exe" /4
        1⤵
        • Checks SCSI registry key(s)
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        • Suspicious use of SetWindowsHookEx
        PID:4572
      • C:\Windows\system32\AUDIODG.EXE
        C:\Windows\system32\AUDIODG.EXE 0x00000000000004D8 0x00000000000004E0
        1⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:5872
      • C:\Windows\system32\svchost.exe
        C:\Windows\system32\svchost.exe -k GPSvcGroup
        1⤵
          PID:3368
        • C:\Users\Admin\Desktop\NjRAT_0.7d\APP - NjRat 0.7D Moded\Client.exe
          "C:\Users\Admin\Desktop\NjRAT_0.7d\APP - NjRat 0.7D Moded\Client.exe"
          1⤵
          • Executes dropped EXE
          • Enumerates video capture drivers
          • Reads the TCP/IP host and domain name from the registry
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:3396
          • C:\Windows\SysWOW64\netsh.exe
            netsh firewall add allowedprogram "C:\Users\Admin\Desktop\NjRAT_0.7d\APP - NjRat 0.7D Moded\Client.exe" "Client.exe" ENABLE
            2⤵
            • Modifies Windows Firewall
            • Event Triggered Execution: Netsh Helper DLL
            • System Location Discovery: System Language Discovery
            PID:5436
        • C:\Users\Admin\Desktop\NjRAT_0.7d\APP - NjRat 0.7D Moded\Client.exe
          "C:\Users\Admin\Desktop\NjRAT_0.7d\APP - NjRat 0.7D Moded\Client.exe"
          1⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:3168
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
          1⤵
          • Enumerates system info in registry
          • Modifies registry class
          • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
          • Suspicious use of WriteProcessMemory
          PID:1396
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x318,0x7ffb6ee7c188,0x7ffb6ee7c194,0x7ffb6ee7c1a0
            2⤵
              PID:1144
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=es --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2100,i,12949610107382616980,17934796322908056302,524288 --field-trial-handle=2368,i,5438899236813579004,17955663340429990164,262144 --variations-seed-version --mojo-platform-channel-handle=2400 /prefetch:11
              2⤵
              • System Time Discovery
              PID:5228
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1860,i,16693475535754483616,3369543187812870545,262144 --field-trial-handle=2368,i,5438899236813579004,17955663340429990164,262144 --variations-seed-version --mojo-platform-channel-handle=2364 /prefetch:2
              2⤵
                PID:2320
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=es --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2440,i,16659733608082256135,16105316340915912935,524288 --field-trial-handle=2368,i,5438899236813579004,17955663340429990164,262144 --variations-seed-version --mojo-platform-channel-handle=2540 /prefetch:13
                2⤵
                  PID:6028
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=es --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3628,i,4218822642545599504,10870001627709084585,2097152 --field-trial-handle=2368,i,5438899236813579004,17955663340429990164,262144 --variations-seed-version --mojo-platform-channel-handle=3840 /prefetch:1
                  2⤵
                    PID:3788
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=es --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3632,i,244854833205503789,14889195511969371676,2097152 --field-trial-handle=2368,i,5438899236813579004,17955663340429990164,262144 --variations-seed-version --mojo-platform-channel-handle=3844 /prefetch:1
                    2⤵
                      PID:928
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=es --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4292,i,9021190791019294989,12554115122234523547,2097152 --field-trial-handle=2368,i,5438899236813579004,17955663340429990164,262144 --variations-seed-version --mojo-platform-channel-handle=4564 /prefetch:1
                      2⤵
                        PID:5632
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=es --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4304,i,12279790522619473303,6433286950767646166,2097152 --field-trial-handle=2368,i,5438899236813579004,17955663340429990164,262144 --variations-seed-version --mojo-platform-channel-handle=4576 /prefetch:9
                        2⤵
                          PID:6040
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=es --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5288,i,4147884475671934663,2832080061149686815,524288 --field-trial-handle=2368,i,5438899236813579004,17955663340429990164,262144 --variations-seed-version --mojo-platform-channel-handle=5264 /prefetch:14
                          2⤵
                            PID:2912
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=es --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5440,i,14144372811606613332,11195600518596773414,524288 --field-trial-handle=2368,i,5438899236813579004,17955663340429990164,262144 --variations-seed-version --mojo-platform-channel-handle=5344 /prefetch:14
                            2⤵
                              PID:4440
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=es --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5408,i,1013354266040584428,2626930843215015943,524288 --field-trial-handle=2368,i,5438899236813579004,17955663340429990164,262144 --variations-seed-version --mojo-platform-channel-handle=5384 /prefetch:14
                              2⤵
                                PID:3904
                              • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=es --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6172,i,6184942514244814330,1309685372727370412,524288 --field-trial-handle=2368,i,5438899236813579004,17955663340429990164,262144 --variations-seed-version --mojo-platform-channel-handle=6208 /prefetch:14
                                2⤵
                                  PID:2912
                                • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=es --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6172,i,6184942514244814330,1309685372727370412,524288 --field-trial-handle=2368,i,5438899236813579004,17955663340429990164,262144 --variations-seed-version --mojo-platform-channel-handle=6208 /prefetch:14
                                  2⤵
                                    PID:1720
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=es --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6476,i,5348365262263720999,13324772919293866306,524288 --field-trial-handle=2368,i,5438899236813579004,17955663340429990164,262144 --variations-seed-version --mojo-platform-channel-handle=6604 /prefetch:14
                                    2⤵
                                      PID:2384
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=es --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6712,i,2985501704448661801,17410288802125562363,524288 --field-trial-handle=2368,i,5438899236813579004,17955663340429990164,262144 --variations-seed-version --mojo-platform-channel-handle=6716 /prefetch:14
                                      2⤵
                                        PID:1708
                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=es --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7088,i,13989045937923489253,9618568888959191010,524288 --field-trial-handle=2368,i,5438899236813579004,17955663340429990164,262144 --variations-seed-version --mojo-platform-channel-handle=6840 /prefetch:14
                                        2⤵
                                          PID:1064
                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=es --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=7108,i,12791884075700580964,12664286067928386193,2097152 --field-trial-handle=2368,i,5438899236813579004,17955663340429990164,262144 --variations-seed-version --mojo-platform-channel-handle=6760 /prefetch:1
                                          2⤵
                                            PID:2736
                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=es --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=6780,i,10991296045156788739,6892649687479750128,2097152 --field-trial-handle=2368,i,5438899236813579004,17955663340429990164,262144 --variations-seed-version --mojo-platform-channel-handle=6844 /prefetch:1
                                            2⤵
                                              PID:5144
                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=es --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=6964,i,12815343535559436984,7727035074339198664,2097152 --field-trial-handle=2368,i,5438899236813579004,17955663340429990164,262144 --variations-seed-version --mojo-platform-channel-handle=6868 /prefetch:1
                                              2⤵
                                                PID:6412
                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=es --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1184,i,1321627930728941749,4570272620476850089,524288 --field-trial-handle=2368,i,5438899236813579004,17955663340429990164,262144 --variations-seed-version --mojo-platform-channel-handle=7288 /prefetch:14
                                                2⤵
                                                  PID:6632
                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=es --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1212,i,5308939649275032681,3996617368865003563,524288 --field-trial-handle=2368,i,5438899236813579004,17955663340429990164,262144 --variations-seed-version --mojo-platform-channel-handle=1408 /prefetch:14
                                                  2⤵
                                                    PID:5840
                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=es --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1216,i,17588673377980371140,3307315891242741726,524288 --field-trial-handle=2368,i,5438899236813579004,17955663340429990164,262144 --variations-seed-version --mojo-platform-channel-handle=4612 /prefetch:14
                                                    2⤵
                                                      PID:6104
                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
                                                    1⤵
                                                      PID:4792
                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
                                                      1⤵
                                                        PID:4796

                                                      Network

                                                            MITRE ATT&CK Enterprise v16

                                                            Reconnaissance

                                                            Resource Development

                                                            Initial Access

                                                            Execution

                                                            Persistence

                                                            Create or Modify System Process

                                                            1
                                                            T1543

                                                            Windows Service

                                                            1
                                                            T1543.003

                                                            Event Triggered Execution

                                                            1
                                                            T1546

                                                            Netsh Helper DLL

                                                            1
                                                            T1546.007

                                                            Privilege Escalation

                                                            Create or Modify System Process

                                                            1
                                                            T1543

                                                            Windows Service

                                                            1
                                                            T1543.003

                                                            Event Triggered Execution

                                                            1
                                                            T1546

                                                            Netsh Helper DLL

                                                            1
                                                            T1546.007

                                                            Defense Evasion

                                                            Impair Defenses

                                                            1
                                                            T1562

                                                            Disable or Modify System Firewall

                                                            1
                                                            T1562.004

                                                            Credential Access

                                                            Discovery

                                                            Browser Information Discovery

                                                            1
                                                            T1217

                                                            Peripheral Device Discovery

                                                            2
                                                            T1120

                                                            Query Registry

                                                            2
                                                            T1012

                                                            System Information Discovery

                                                            3
                                                            T1082

                                                            System Location Discovery

                                                            1
                                                            T1614

                                                            System Language Discovery

                                                            1
                                                            T1614.001

                                                            System Network Configuration Discovery

                                                            1
                                                            T1016

                                                            System Time Discovery

                                                            1
                                                            T1124

                                                            Lateral Movement

                                                            Collection

                                                            Video Capture

                                                            1
                                                            T1125

                                                            Command and Control

                                                            Exfiltration

                                                            Impact

                                                            Replay Monitor

                                                            Loading Replay Monitor...

                                                            Downloads

                                                            2992822b-fb80-4891-8e72-c0ea49daea43.tmp
                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\2992822b-fb80-4891-8e72-c0ea49daea43.tmp
                                                            • Size 38KB
                                                            • SHA256 f10ee3dc28e868d3d315264361426ca9d3956dbf0b04ae61d88e701b687d950d
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            9fc300b4-fdbd-4db3-9898-10e7be70e225.tmp
                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\9fc300b4-fdbd-4db3-9898-10e7be70e225.tmp
                                                            • Size 33KB
                                                            • SHA256 abfaa6cca65d31ae3de22d64c52d78830b175f915a040875c1f2e476b59b8300
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            settings.dat
                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                            • Size 280B
                                                            • SHA256 4123fa2cc2e73053b7602d1d53a57b01f3a6cd8872729fcd7ed66886082b1b99
                                                            • MD5 SHA1 SHA512 TLSH
                                                            Submit Download

                                                            settings.dat
                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                            • Size 280B
                                                            • SHA256 a201096456be1e380b7687844e70aa8e2d987a06740acf66db0d56e000a3b50d
                                                            • MD5 SHA1 SHA512 TLSH
                                                            Submit Download

                                                            60005ddc-4908-45c2-a15a-c57dfab27c5f.tmp
                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\60005ddc-4908-45c2-a15a-c57dfab27c5f.tmp
                                                            • Size 29KB
                                                            • SHA256 5eea300f5a09085cfbc433726577e1003d365cfe58b31d64029c6022fe93f2b3
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            7eb6c592-a91a-4bef-8562-db424eecb287.tmp
                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\7eb6c592-a91a-4bef-8562-db424eecb287.tmp
                                                            • Size 15KB
                                                            • SHA256 719ada4cc4669a94b32010075cc1ec75ebb4f33f2319d3282092dfb894afbb60
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            f_000060
                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000060
                                                            • Size 120KB
                                                            • SHA256 ad58ca73f2b8f132ed15ee724e1731cbd7510af65eea7ef3c93e5ac2a5ca3541
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            f_000061
                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000061
                                                            • Size 102KB
                                                            • SHA256 1027c1fd63d1c619daae437c8583a7ed5e8c476980c0e21bd0ebdda4420a8bb8
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            f_000062
                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000062
                                                            • Size 24KB
                                                            • SHA256 7e170ea7f2ac873c595b9f72cf35b8c15af17b5bfd3488b101bb5aca034d07cf
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            f_000064
                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000064
                                                            • Size 260KB
                                                            • SHA256 33afa2a565936a212e6d70e3f790672986c24bb370ea5b6ee06b3e0eb44558b6
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            f_000066
                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000066
                                                            • Size 36KB
                                                            • SHA256 b3c622445678ddc9dddfb67e7f343ce4693170f502b9410740b944195c402c24
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            f_000067
                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000067
                                                            • Size 16KB
                                                            • SHA256 337e833eeec5d082813ced903aa54622827f234f3dede039ff9214db457f1fd5
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            f_000069
                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000069
                                                            • Size 20KB
                                                            • SHA256 fab436a127c29499e0ddbe96f33c5547b050fd49092ceaf6bad0dc1e04b36935
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            f_000074
                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000074
                                                            • Size 41KB
                                                            • SHA256 6f32dd3791bdb95d7fa1fc7c94e24964c3588bccfe454f6b0fc579572fdafca0
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            f_00009a
                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00009a
                                                            • Size 351KB
                                                            • SHA256 3fe90e0e5787638faec9dbbe15ffed7f89575f952316d1aa1b4b1efd7f311f9e
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            f_00009c
                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00009c
                                                            • Size 42KB
                                                            • SHA256 ec95f51424bfec5eca4f50f1741aaf63bfc4a505002914566b970b822f4df705
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            a0514738-9fd0-4566-9efd-6d1441e4ae64.tmp
                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\a0514738-9fd0-4566-9efd-6d1441e4ae64.tmp
                                                            • Size 2B
                                                            • SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
                                                            • MD5 SHA1 SHA512
                                                            Submit Download

                                                            a6a68043-5961-4bed-a04d-60497a66fc78.tmp
                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\a6a68043-5961-4bed-a04d-60497a66fc78.tmp
                                                            • Size 2B
                                                            • SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
                                                            • MD5 SHA1 SHA512
                                                            Submit Download

                                                            a719f58f-ecf5-4755-9101-4bf20b595ecb.tmp
                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\a719f58f-ecf5-4755-9101-4bf20b595ecb.tmp
                                                            • Size 210B
                                                            • SHA256 f263a3f79693a0c32addb0ac001a3c4cd340c76e5ee02dd8919ae1c7862f835c
                                                            • MD5 SHA1 SHA512 TLSH
                                                            Submit Download

                                                            d37aadcf-00af-40cb-a478-ce0c83b6896d.tmp
                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\d37aadcf-00af-40cb-a478-ce0c83b6896d.tmp
                                                            • Size 40B
                                                            • SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
                                                            • MD5 SHA1 SHA512
                                                            Submit Download

                                                            temp-index
                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\402aff3e-1de5-47bd-9d4c-f2a80d9e59ba\index-dir\temp-index
                                                            • Size 2KB
                                                            • SHA256 c7215144cb2ce4288737518695dc3d6e2c5c4b29491f2fac0cb498fcbd9d0298
                                                            • MD5 SHA1 SHA512 TLSH
                                                            Submit Download

                                                            the-real-index
                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\402aff3e-1de5-47bd-9d4c-f2a80d9e59ba\index-dir\the-real-index
                                                            • Size 48B
                                                            • SHA256 6be84a8896bd2d0d8332ba02bf73455ddbbd6e18e1ad2ba1edfa254543df5448
                                                            • MD5 SHA1 SHA512
                                                            Submit Download

                                                            temp-index
                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\4419c825-b155-4465-9c7a-ff6e3bcf399f\index-dir\temp-index
                                                            • Size 408B
                                                            • SHA256 1689dd15a481f7a51ca6b6e0382d3347dd075c017aa0950c2d473dbac4966edf
                                                            • MD5 SHA1 SHA512 TLSH
                                                            Submit Download

                                                            the-real-index
                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\4419c825-b155-4465-9c7a-ff6e3bcf399f\index-dir\the-real-index
                                                            • Size 408B
                                                            • SHA256 8f79b836fa477da7d78cef9040db82e094be506e6d87f4ac0e6dcdc947e414e2
                                                            • MD5 SHA1 SHA512 TLSH
                                                            Submit Download

                                                            index.txt.tmp
                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt.tmp
                                                            • Size 488B
                                                            • SHA256 5579e5980ba3b64babaf90a8a748b6592215a940273134734f864327b28050ca
                                                            • MD5 SHA1 SHA512 TLSH
                                                            Submit Download

                                                            index.txt.tmp
                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt.tmp
                                                            • Size 484B
                                                            • SHA256 e81d8e268cb71169b3f2f77bdfbaf02f9feb1193fb3c8321080bb2618a3dd8f8
                                                            • MD5 SHA1 SHA512 TLSH
                                                            Submit Download

                                                            temp-index
                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\temp-index
                                                            • Size 96B
                                                            • SHA256 d86922e3795f73577d8be412194c5cd516456ee12ced3d6f04362e72aa0c2d83
                                                            • MD5 SHA1 SHA512 TLSH
                                                            Submit Download

                                                            the-real-index
                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
                                                            • Size 48B
                                                            • SHA256 d179468d4c527a4b290d44dd42c13c92e9b66bf60b59feae7ff498dd31030ed2
                                                            • MD5 SHA1 SHA512
                                                            Submit Download

                                                            db05e13e-9b63-451c-9386-e6fc518dea7e.tmp
                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\db05e13e-9b63-451c-9386-e6fc518dea7e.tmp
                                                            • Size 16KB
                                                            • SHA256 b297ae22216338da183b2bf425c6ce151bf1995bcc040eaf573d8e7b45a035c4
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            e69f62ed-0e9e-42e6-834f-de50bd540c40.tmp
                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\e69f62ed-0e9e-42e6-834f-de50bd540c40.tmp
                                                            • Size 70KB
                                                            • SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            eb10c5d9-b386-41ab-b497-abec47ca176a.tmp
                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\eb10c5d9-b386-41ab-b497-abec47ca176a.tmp
                                                            • Size 16KB
                                                            • SHA256 4c5d3badbf43ddcb23e602570cf8e4e89dc14e9dc62cab686f18cb33b8a3a039
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            RevisitationBloomfilter
                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
                                                            • Size 392B
                                                            • SHA256 d6f655c6adcf3dfcd4deb5cd992745b095fdc54682baa69d8cd5199508c80027
                                                            • MD5 SHA1 SHA512
                                                            Submit Download

                                                            aa9de835-469a-4d60-a58f-00ecf96eec52.tmp
                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\aa9de835-469a-4d60-a58f-00ecf96eec52.tmp
                                                            • Size 392B
                                                            • SHA256 c432abc10cd52ac4140a8218270984d8c222e2446f61f7156dea867eec79a01c
                                                            • MD5 SHA1 SHA512 TLSH
                                                            Submit Download

                                                            cfe88be1-eee6-482d-a519-e0e7c042336c.tmp
                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\cfe88be1-eee6-482d-a519-e0e7c042336c.tmp
                                                            • Size 392B
                                                            • SHA256 11bf358d3a1f60293440600ff5367236ed93bfe290b95abbed095e90b19d98fb
                                                            • MD5 SHA1 SHA512 TLSH
                                                            Submit Download

                                                            e1227c7d-afa7-4524-8f49-25ef17ad4714.tmp
                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\e1227c7d-afa7-4524-8f49-25ef17ad4714.tmp
                                                            • Size 37KB
                                                            • SHA256 450001afce5e8643414324e87daaade16da6167b8c54c462627ccffef9c65c60
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            e330c0b5-9c26-4a43-b12b-df79299a2f6e.tmp
                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\e330c0b5-9c26-4a43-b12b-df79299a2f6e.tmp
                                                            • Size 33KB
                                                            • SHA256 748a03d5f8653ce1eed9fcd123cf39c35acf58332bc371b1908ce8d19454b455
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            e3822d94-aee7-4037-bfac-e43190eba097.tmp
                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\e3822d94-aee7-4037-bfac-e43190eba097.tmp
                                                            • Size 38KB
                                                            • SHA256 18dd876142214802e0db9bfc0b82c92b5b65740ef7b0f08df38490b42d8cd498
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            c53ca55a-06ff-450c-b645-cae114f4aa6a.tmp
                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\c53ca55a-06ff-450c-b645-cae114f4aa6a.tmp
                                                            • Size 13B
                                                            • SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
                                                            • MD5 SHA1 SHA512
                                                            Submit Download

                                                            641d8507-8844-460a-97be-4883bf77ff2b.tmp
                                                            • Path C:\Users\Admin\AppData\Local\Temp\641d8507-8844-460a-97be-4883bf77ff2b.tmp
                                                            • Size 1B
                                                            • SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
                                                            • MD5 SHA1 SHA512
                                                            Submit Download

                                                            23d1fbab-ca2d-4179-9cbb-e9503f462028.tmp
                                                            • Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1396_86609848\23d1fbab-ca2d-4179-9cbb-e9503f462028.tmp
                                                            • Size 10KB
                                                            • SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            content.js
                                                            • Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1396_86609848\CRX_INSTALL\content.js
                                                            • Size 9KB
                                                            • SHA256 0d40a5153cb66b5bde64906ca3ae750494098f68ad0b4d091256939eea243643
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            stub.il
                                                            • Path C:\Users\Admin\AppData\Local\Temp\stub.il
                                                            • Size 338KB
                                                            • SHA256 47296718f8989a56b09ebff98db9d9240f5bfd7886985bb64a8fdd17ba006ca5
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            Client.exe
                                                            • Path C:\Users\Admin\Desktop\NjRAT_0.7d\APP - NjRat 0.7D Moded\Client.exe
                                                            • Size 30KB
                                                            • SHA256 0c453e046409e10147d5f3a49093b409c83ca2f5d8f3dc38ad3f9602508737c7
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            NjRat 0.7D.exe
                                                            • Path C:\Users\Admin\Desktop\NjRAT_0.7d\APP - NjRat 0.7D Moded\NjRat 0.7D.exe
                                                            • Size 8.5MB
                                                            • SHA256 b78fb092e151db613cba51d7f2532547e48c6f4712809a485f272e2ab55776a5
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            Asemb.resx
                                                            • Path C:\Users\Admin\Desktop\NjRAT_0.7d\SRC - NjRAT 0.7D\NjRAT\Forms\Asemb.resx
                                                            • Size 295KB
                                                            • SHA256 8f4923a2543dcd813a46583c4683d7eff17b6910e63c72079741bd0e537b1f90
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            NJRAT 2.vshost.exe.config
                                                            • Path C:\Users\Admin\Desktop\NjRAT_0.7d\SRC - NjRAT 0.7D\NjRAT\NJRAT 2.vshost.exe.config
                                                            • Size 1KB
                                                            • SHA256 c45c9d1d30f940289498be2af978d74178a5c24ceb7755c2648f6c7a89353813
                                                            • MD5 SHA1 SHA512 TLSH
                                                            Submit Download

                                                            WinMM.Net.dll
                                                            • Path C:\Users\Admin\Desktop\NjRAT_0.7d\SRC - NjRAT 0.7D\NjRAT\Referencias\WinMM.Net.dll
                                                            • Size 43KB
                                                            • SHA256 59e2ac1b79840274bdfcef412a10058654e42f4285d732d1487e65e60ffbfb46
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            icon.Ico
                                                            • Path C:\Users\Admin\Desktop\NjRAT_0.7d\SRC - NjRAT 0.7D\NjRAT\icon.Ico
                                                            • Size 31KB
                                                            • SHA256 b33ba45617295b330a2b7f403dbb37f9358086e7440c3fd73eab813465259e44
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            GeoIP.dat
                                                            • Path C:\Users\Admin\Desktop\NjRAT_0.7d\SRC - NjRAT 0.7D\NjRAT\xbin\GeoIP.dat
                                                            • Size 1.1MB
                                                            • SHA256 b4bfd1ebc50f0eaab3d3f4c2152feae7aa8efad380b85064153a6bfd006c6210
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            cam.dll
                                                            • Path C:\Users\Admin\Desktop\NjRAT_0.7d\SRC - NjRAT 0.7D\NjRAT\xbin\Plugin\cam.dll
                                                            • Size 99KB
                                                            • SHA256 881d5afb9aa4799c73e75dcd28587dba85dd844e4137287ea48c6b66525e2638
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            ch.dll
                                                            • Path C:\Users\Admin\Desktop\NjRAT_0.7d\SRC - NjRAT 0.7D\NjRAT\xbin\Plugin\ch.dll
                                                            • Size 45KB
                                                            • SHA256 3c088df7119c494e3df95af42456225f4dab1c3abe003869f8c79afb0993b027
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            mic.dll
                                                            • Path C:\Users\Admin\Desktop\NjRAT_0.7d\SRC - NjRAT 0.7D\NjRAT\xbin\Plugin\mic.dll
                                                            • Size 77KB
                                                            • SHA256 27528a77e27d02aadecabfdf658b2da638bb0ca2f2c60bdd9d0fd5338c1fc346
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            plg.dll
                                                            • Path C:\Users\Admin\Desktop\NjRAT_0.7d\SRC - NjRAT 0.7D\NjRAT\xbin\Plugin\plg.dll
                                                            • Size 65KB
                                                            • SHA256 13043521ed6876edf2736fc46a7c49e6b639cfa7a866ca11de26f119796cd521
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            pw.dll
                                                            • Path C:\Users\Admin\Desktop\NjRAT_0.7d\SRC - NjRAT 0.7D\NjRAT\xbin\Plugin\pw.dll
                                                            • Size 284KB
                                                            • SHA256 ca6367d1ab873a55ced13d7024c530bbe4a6a703813225233e59041c7ce14eaa
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            sc2.dll
                                                            • Path C:\Users\Admin\Desktop\NjRAT_0.7d\SRC - NjRAT 0.7D\NjRAT\xbin\Plugin\sc2.dll
                                                            • Size 46KB
                                                            • SHA256 010b1ec566be774a2d12146f9826aa31fd7eb6ffe7b45ce5e572b2d8c7f815c3
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            Stub.il
                                                            • Path C:\Users\Admin\Desktop\NjRAT_0.7d\SRC - NjRAT 0.7D\NjRAT\xbin\Stub\Stub.il
                                                            • Size 338KB
                                                            • SHA256 8c57706fdafbf6981da459d8ef85654b1a8830381652b44cd486f6747245a2fd
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            Stub.manifest
                                                            • Path C:\Users\Admin\Desktop\NjRAT_0.7d\SRC - NjRAT 0.7D\NjRAT\xbin\Stub\Stub.manifest
                                                            • Size 487B
                                                            • SHA256 835a00d6e7c43db49ae7b3fa12559f23c2920b7530f4d3f960fd285b42b1efb5
                                                            • MD5 SHA1 SHA512 TLSH
                                                            Submit Download

                                                            memory/4572-425-0x0000018546FA0000-0x0000018546FA1000-memory.dmp
                                                            Download

                                                            memory/4572-423-0x0000018546FA0000-0x0000018546FA1000-memory.dmp
                                                            Download

                                                            memory/4572-434-0x0000018546FA0000-0x0000018546FA1000-memory.dmp
                                                            Download

                                                            memory/4572-433-0x0000018546FA0000-0x0000018546FA1000-memory.dmp
                                                            Download

                                                            memory/4572-432-0x0000018546FA0000-0x0000018546FA1000-memory.dmp
                                                            Download

                                                            memory/4572-431-0x0000018546FA0000-0x0000018546FA1000-memory.dmp
                                                            Download

                                                            memory/4572-430-0x0000018546FA0000-0x0000018546FA1000-memory.dmp
                                                            Download

                                                            memory/4572-429-0x0000018546FA0000-0x0000018546FA1000-memory.dmp
                                                            Download