njrat | hxxps://github[.]com/gh8054w-pixel/ntk/raw/refs/heads/main/Payload[.]exe

Analysis

user interaction
yes
max time kernel
149s
max time network
145s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260513-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260513-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
18/07/2026, 11:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://github.com/gh8054w-pixel/ntk/raw/refs/heads/main/Payload.exe
Sample260718-nvy12adv71

Score

10^/10

victim discovery njrat persistence ransomware trojan

Malware Config

Extracted

Family

njrat

Version

<- NjRAT 0.7d Horror Edition ->

Botnet

Victim

bore.pub:40498

Mutex

81a67b839f4692420d45ee7f4b24f8af

Attributes

reg_key
81a67b839f4692420d45ee7f4b24f8af
splitter
Y262SUCZ4UJJ

Signatures

Family: njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat

Downloads MZ/PE file 1 IoCs

flow	pid	Process
28	1420	msedge.exe

Contacts third-party web service commonly abused for C2 1 TTPs 3 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
28	raw.githubusercontent.com
26	raw.githubusercontent.com
27	raw.githubusercontent.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1420	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134288486408966951"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-4146128427-3460078792-3629963422-1000\{5A7DBB2D-0EB6-434B-BA6E-D2D47CE01A6D}	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe

Suspicious use of FindShellTrayWindow 43 IoCs

pid	Process
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe

Suspicious use of WriteProcessMemory 35 IoCs

description	pid	Process	procid_target
PID 3404 wrote to memory of 4704	3404	msedge.exe	83
PID 3404 wrote to memory of 1420	3404	msedge.exe	84
PID 3404 wrote to memory of 3816	3404	msedge.exe	85
PID 3404 wrote to memory of 1424	3404	msedge.exe	86
PID 3404 wrote to memory of 3816	3404	msedge.exe	85
PID 3404 wrote to memory of 3816	3404	msedge.exe	85
PID 3404 wrote to memory of 1424	3404	msedge.exe	86
PID 3404 wrote to memory of 3380	3404	msedge.exe	87
PID 3404 wrote to memory of 3380	3404	msedge.exe	87
PID 3404 wrote to memory of 4464	3404	msedge.exe	88
PID 3404 wrote to memory of 3380	3404	msedge.exe	87
PID 3404 wrote to memory of 4464	3404	msedge.exe	88
PID 3404 wrote to memory of 4464	3404	msedge.exe	88
PID 3404 wrote to memory of 3208	3404	msedge.exe	90
PID 3404 wrote to memory of 3208	3404	msedge.exe	90
PID 3404 wrote to memory of 3208	3404	msedge.exe	90
PID 3404 wrote to memory of 1028	3404	msedge.exe	91
PID 3404 wrote to memory of 1028	3404	msedge.exe	91
PID 3404 wrote to memory of 1028	3404	msedge.exe	91
PID 3404 wrote to memory of 3184	3404	msedge.exe	94
PID 3404 wrote to memory of 3184	3404	msedge.exe	94
PID 3404 wrote to memory of 1904	3404	msedge.exe	95
PID 3404 wrote to memory of 1904	3404	msedge.exe	95
PID 3404 wrote to memory of 4224	3404	msedge.exe	97
PID 3404 wrote to memory of 4224	3404	msedge.exe	97
PID 3404 wrote to memory of 456	3404	msedge.exe	98
PID 3404 wrote to memory of 456	3404	msedge.exe	98
PID 3404 wrote to memory of 456	3404	msedge.exe	98
PID 3404 wrote to memory of 1280	3404	msedge.exe	99
PID 3404 wrote to memory of 4696	3404	msedge.exe	100
PID 3404 wrote to memory of 4696	3404	msedge.exe	100
PID 3404 wrote to memory of 4576	3404	msedge.exe	103
PID 3404 wrote to memory of 4716	3404	msedge.exe	111
PID 3404 wrote to memory of 2368	3404	msedge.exe	112
PID 3404 wrote to memory of 3692	3404	msedge.exe	113

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://github.com/gh8054w-pixel/ntk/raw/refs/heads/main/Payload.exe
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x308,0x7ff8b0d8c188,0x7ff8b0d8c194,0x7ff8b0d8c1a0
  2⤵
  PID:4704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1964,i,3615314966945113875,17641660318533749635,524288 --field-trial-handle=2536,i,11448071325050061913,8927765755758039074,262144 --variations-seed-version --mojo-platform-channel-handle=2568 /prefetch:3
  2⤵
  - Downloads MZ/PE file
  - System Time Discovery
  PID:1420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1744,i,2625832618336011762,6897269620268958592,262144 --field-trial-handle=2536,i,11448071325050061913,8927765755758039074,262144 --variations-seed-version --mojo-platform-channel-handle=2532 /prefetch:2
  2⤵
  PID:3816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2144,i,2888674787005863779,8635195026523705045,524288 --field-trial-handle=2536,i,11448071325050061913,8927765755758039074,262144 --variations-seed-version --mojo-platform-channel-handle=2592 /prefetch:8
  2⤵
  PID:1424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3444,i,4771593145517165154,10530815646531042972,2097152 --field-trial-handle=2536,i,11448071325050061913,8927765755758039074,262144 --variations-seed-version --mojo-platform-channel-handle=3488 /prefetch:1
  2⤵
  PID:3380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3452,i,269792945227547629,12306578469940869246,2097152 --field-trial-handle=2536,i,11448071325050061913,8927765755758039074,262144 --variations-seed-version --mojo-platform-channel-handle=3492 /prefetch:1
  2⤵
  PID:4464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4164,i,2870850783804194268,378828974398074719,2097152 --field-trial-handle=2536,i,11448071325050061913,8927765755758039074,262144 --variations-seed-version --mojo-platform-channel-handle=4168 /prefetch:1
  2⤵
  PID:3208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4196,i,4507525075429208746,16386991788470370413,2097152 --field-trial-handle=2536,i,11448071325050061913,8927765755758039074,262144 --variations-seed-version --mojo-platform-channel-handle=4212 /prefetch:2
  2⤵
  PID:1028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5124,i,5338848405716652865,94597916567823402,524288 --field-trial-handle=2536,i,11448071325050061913,8927765755758039074,262144 --variations-seed-version --mojo-platform-channel-handle=5204 /prefetch:8
  2⤵
  PID:3184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5136,i,3971859480997411068,13599692101262556186,524288 --field-trial-handle=2536,i,11448071325050061913,8927765755758039074,262144 --variations-seed-version --mojo-platform-channel-handle=5192 /prefetch:8
  2⤵
  PID:1904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5736,i,12199458809208219345,17714979926071113283,524288 --field-trial-handle=2536,i,11448071325050061913,8927765755758039074,262144 --variations-seed-version --mojo-platform-channel-handle=5800 /prefetch:8
  2⤵
  PID:4224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=5784,i,13154845935780626323,16809018896004450883,2097152 --field-trial-handle=2536,i,11448071325050061913,8927765755758039074,262144 --variations-seed-version --mojo-platform-channel-handle=5812 /prefetch:1
  2⤵
  PID:456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6072,i,11404865430487413191,9275058842090387078,524288 --field-trial-handle=2536,i,11448071325050061913,8927765755758039074,262144 --variations-seed-version --mojo-platform-channel-handle=6136 /prefetch:8
  2⤵
  PID:1280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6316,i,4323161446619959084,3222866275237311826,524288 --field-trial-handle=2536,i,11448071325050061913,8927765755758039074,262144 --variations-seed-version --mojo-platform-channel-handle=6320 /prefetch:8
  2⤵
  PID:4696
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6452,i,8761437888665338821,18445525714563454002,524288 --field-trial-handle=2536,i,11448071325050061913,8927765755758039074,262144 --variations-seed-version --mojo-platform-channel-handle=6348 /prefetch:8
  2⤵
  PID:3304
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6452,i,8761437888665338821,18445525714563454002,524288 --field-trial-handle=2536,i,11448071325050061913,8927765755758039074,262144 --variations-seed-version --mojo-platform-channel-handle=6348 /prefetch:8
  2⤵
  PID:4576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4156,i,15605879237725937703,17349752050205574311,524288 --field-trial-handle=2536,i,11448071325050061913,8927765755758039074,262144 --variations-seed-version --mojo-platform-channel-handle=4172 /prefetch:8
  2⤵
  PID:4716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5740,i,8073053057213997888,852934329035848705,524288 --field-trial-handle=2536,i,11448071325050061913,8927765755758039074,262144 --variations-seed-version --mojo-platform-channel-handle=4224 /prefetch:8
  2⤵
  PID:2368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4348,i,3468428486854729836,13050687697468355144,524288 --field-trial-handle=2536,i,11448071325050061913,8927765755758039074,262144 --variations-seed-version --mojo-platform-channel-handle=3596 /prefetch:8
  2⤵
  PID:3692

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:116

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

34b86807-8547-4bdd-af9b-98f786b7a7b9.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\34b86807-8547-4bdd-af9b-98f786b7a7b9.tmp
Size 8KB
SHA256 c3d818f59e4dfdd965a502bd593733d3b5a975901628b616d28776eb5c8585a0
MD5 df8cca2f41b36cc3af6ca3f02d96e9d8
SHA1 9f4b3666d563ac0dbf414092505431c1fdec36f9
SHA512 ded81c4b04400ffe58855458a49b3e2585cae8b96939029bb3472b1d50c59bb0ef4fe7ed2f4015bec7ba40a32021c2f4fa6e8affdd3db3933965005de52b7179
SSDEEP 192:+ONQ6JpAQmiUy+T8cQ4sw2pwjzoESKdVynXMSJrKshsDqrU6:+ONQ6oF8cQ4sw2pYNSKzynX7JrK7QU6
TLSH
T1B3121B36A878AC7B1DE3A955F54B36239EA44127EB84BB50D6EC1F0C01EF65D130A826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 deae8ba3a07225fe9f1490e4968fd83f8d308707a88a6d3d541d8ab416841ddf
MD5 1fcf11901014bf515178c91bdb7a6c5c
SHA1 4746b018067d9671617515224b7697b27fd2fc5f
SHA512 6059830103275d34e1aa4dd4e8d4177b6c2b684b2b3ad5417753387a227c838c0b258e662c78853cf649656ebd762f5d160c10349cd19ac1953380bd6572c660
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7p:fwUQC5VwBIiElEd2K57P7p
TLSH
T16EB3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 8b1285abba76de6acee28c8e687c90adee3fb39231133781ff4c19b3fd0c0ec3
MD5 07e265d0caeb3be1b7eec8a54d6d1d83
SHA1 0e2fa3563acd7dcc0480400af954996cf05a8e85
SHA512 ea0919fe23da856e2a004670ee37cfb2ef036365e665c70a5934e35c520717bbeb757f2bc5da1b8c6fcf696a9c102456af5b734e7865c048aa1dba666e4a4b0a
TLSH
T148D0A710767D79D2E63820796C208B00A73555A2225AC341A100C44D8D380C9A6D6A96
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 e51b9bee3c2dbb63afcbacc2cde944a53371e66aaf1c8ba0bf71c7ee6eab83a5
MD5 2857cf1b0f1c8c30a6b756a34a37a836
SHA1 b21564c162ba15d8314ad459931f7f7c36b82ddb
SHA512 9fbd8c2a41b37b8a8425570de1371b59602556a9f89dcecaf471ea286b3538f518e368873fcf7b34ac36d9a7de7577953a1abe80c4995e05e1202c1b270d8dab
TLSH
T1F9D012232A5DB011FB695274A812CB00173655A024868711E211C49C96741D862D7587
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7a531d1df9cdae01b650e532ebd4a8c9a4289931e89fb896753dce715d03331d
MD5 e993dcf44300205328a008fa868eaab8
SHA1 005ea0762927bd4df122a5932c9a47e268573e57
SHA512 021dc142847ba30397366fece985ced0649c66fc9ddfa58b99261463107dce9ca4fc43a79aa0b2985989883dd5a6644c2fe5b1c87d24a8455123f7d724943ff2
TLSH
T1D6D012232A9DB411FB695274A812CB00173655A024868711E211C49C86741D862D7587
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 3KB
SHA256 c483a8ae21eb8b77c7e78ab67ba6b9577a05c2bbdc0577b7f95571692026a755
MD5 82528669b8ca2644ebbb575d0703616c
SHA1 afa38ed2ea14633319c95c3f4fa04eb9c657acea
SHA512 a704669e2cb082ba59056db691692814ff5be41b9b0230fe89ef8681813f1e4a4740cce778cbec979cb18f084624a3c69e10108185726babe7ac194a9afa6265
TLSH
T16771F92837434862FBE04032A0D1F271B9F0CAD5795B6E52341C98FAEFDB72D1765989
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe581c8c.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe581c8c.TMP
Size 3KB
SHA256 3168866a8a373da13f4148f36a6d71fc58d7cf3b99594bff629a58561776d282
MD5 5f77e7ef6445c317b52245d3dcc16434
SHA1 d67aa623b3407c4d4408fd524ed0e020d814675e
SHA512 791b09bba219879ddb84dbccb15d2255ba4f7b2f1f990e3b56cf712408f126fddf316dc83d9ed30043950d1f80d848ec2a17cd5b1accd69761cf03564887b51f
TLSH
T15F711B1837438462FBE04032A0D1F271B8F0C6C5795B2E12341C98FAEFDB72D1765988
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DawnGraphiteCache\data_1
Size 264KB
SHA256 041ea2e369dd5b000f69a19f387abf2d80f8bedd27cc22bb7c35ecd48ca0748b
MD5 62cb0ce1e2c8efc3e74dea5c48ade5b3
SHA1 d7c2e54930f3794eb07d264dd278ae2474d7ca90
SHA512 8b62100855eeead624c2e35da6df47b298249ab6b4e453f1d6a782381adce7493bfe754b09bda1271cdef0299773f505d2d9fec95519a7f2f7b90c0f37e7afdf
SSDEEP 3:MsEllllkEthXllkl2zEkl7lX:/M/xT02zn7lX
TLSH
T1E74404077FC00C15C50010304015C350577CDC100535D77F34710453DCD55401C03000
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 424e4f7b050776979b260aa81e69ae79ca28e2bd9016ac3991bd487d85afb036
MD5 4466299e2fc2701965130e806a312d62
SHA1 0274d3f055059db5a450b3564db80e375360f022
SHA512 930342435513f0b2001394e66e9873c665be62767961b0b1fa8813ce74e7a2653fdc1a1ec4b62e6f4047e673cb2f02c2ebdc8298713765f895a4f18c9d979322
TLSH
T1A521CDF383E1856E8E0156F06A14AE1BCE2D0511832C7C2989E4FF57D3E3431E101A5F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 0598e9e193ce680623f3154a1133f789f6b765f1327550e6bd72eb4aca0c7903
MD5 b5d13c2640faac51f00b17a61ef95d1d
SHA1 c53b4d724d95fb7c4fa3fc730d6376d8aac950e6
SHA512 71868abcebfcf394463c1f2539c9ef9bbce3d9ffc2ea93ff2c4da9b2b16c4aa0482978788b57385cfdb8b5ae35d02ebb8bf5f99a269e5c04c3c1ba963fd20c07
SSDEEP 192:sxZbRhyM/jK1Ml8M9G/f4s/okD3IdpJHW6+WNGYcDsOi8IgrJ:sxZbV1G/f4s/ok0JHbGB9
TLSH
T18D42E8126A349977CCDBD209BA557F93D6F94533A2940E44A9FCCA0C04E6AED2217C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 4b3ca70668f7752b26f9823b9ca6bc8b0d7b4672d1a89f9a70b2f037007a9d63
MD5 575a51ad75f20b2eee64b98f6beedaff
SHA1 deeb171a3390ac243098565805363e53209c287d
SHA512 a2bcb950b1ea35922032c80eef821e0f272a85c01902721f62f02a8217684f1c560d7c8be0f89be3d1f85087654faf6b834a88065dc41b66f6b86407497d78df
SSDEEP 192:sxZbRhyM/jK1Ml8D9G/f4sHWpVlo1D3IdpJHW6+WNGYcDiC3CIgbAJ:sxZbV8G/f4sHWvlo10JHbGEg
TLSH
T1D352B6126A349977CCDBD209BA557F53D6F94573A2900E44AAFCCA0C01E6AED221781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 8cf6c0be2c293f2a6dd55e610aef590d09577a956d6fc4b7f7fc88b484254be6
MD5 03af7943dab06e185a3bf09d651012d3
SHA1 fc1c5f440ede6f9a8a2f052b6d416b94fc0a9ae8
SHA512 11b8eb77e7203a76a01736dbdcd6cfabcc6e399634bfc6b70e918bfc4941d810aa14cfb543494e77e26d1ac5c2b635f73c18a4fb2e11f4e506e5147dede10dfc
SSDEEP 768:JXs4RkXUWvssLg8F1+UoAYDCx9Tuqh0VfUC9xbog/OVFTLlLBERXCro+MQ0cfuO:JXs4RkXUWvssLgu1jacTLBWRXZHt/O
TLSH
T120D21C2B284CCB7E4F845E9CEC26AF966ED802CB97644D4447FA844C03C77EA511B5DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 7KB
SHA256 c9ba80465001d17e3003d23c713c9d9dd022f26e656e7245439c44a31bedb3e1
MD5 78b908e28d4911f36d12a3dbae6547ec
SHA1 63401614bf594b307bc9898349168f71dc46ed73
SHA512 3438c04fc90fdabe6622927260bfb2ddbcd189194062582af9de7a12b70e15972b3bab3f4aa9796f1ae4f57eb892bd54e58bab979fd8fde91d64772be3025132
SSDEEP 96:KUQwKl2CacAKl+OqAgKdiu3CKo8OiC8KTSsSwKN:yLzH3YhfG
TLSH
T176F11713313A16013DFE2918A396E677AE5231737019B67F77A910960E67E224CFE8CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 475d432fc221b8e4e11d45e3cd3cf77535162d236c90c4f5eff0f073fa29df30
MD5 0d06d945722401f51c1195cbdfff1185
SHA1 9c4a66b8a114eef4e1c25872ec8d0591cdc0747b
SHA512 f8bf47b979a79cf0406b613f716922661e8bfcfb99905d505ce1a559e479ba6d1f652075a4037624b8fef35c7370ee36d76f0c679ac6cdb2c1b5578a768415ec
SSDEEP 384:HtNn/s3n9SYsNTkilaissdQ4sw2pYNSKzynX7Jrfn6VteNYqKWI48PAHOObjI9GQ:Hj+9Dh829K2X7hfn6mNrKWI4kAH29Ms
TLSH
T199C25B3E9C669D3E04EEBB08B64E2A379DB8113BD6F45A08D7D84B0DC1B295CF706425
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 fd7c451c02b84d712484eaa15e9d833e7064f6577f9041d4ce05e425d71edc55
MD5 9fa93c8e02da7f9272b64c312ec87582
SHA1 e2704d034a7d1c2e7f9c5e87a289dcce0c6ebbf8
SHA512 b1a2a579e2114dc468f0a8db3e93a3c31d3812e3661f3aea08ab39f1aee76d3f6f85d309fae3a06b8a208be190cd617050b9af1ddd56ec582561a2b37c897801
SSDEEP 192:lONQV6JpdQmiUylTgcQ4sw2pwjzoESKdVssFHyzU6:lONe6jogcQ4sw2pYNSKzsk0U6
TLSH
T1D302C735AD786C7B8EF3AE45B54B2B23AFA41137E6946B44DAE81F0C00E765C1307826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 83f5bbe29fcadee04b40e7cea0eb085da386daefe3146f126d843d8ae01e3df1
MD5 8295bbb80d2012f7492ccd76b1f4ad58
SHA1 8b7b3879053ec5b0c9c79db308185dfbd8a12852
SHA512 86fd7c77a81038fc4be831974ea2ec0d80ad805c38a3b6b14fe885764184515fe88863bc272c4ca553fe0771c07780c3606307b0ee79f69f5c25da06ad317549
SSDEEP 384:WtNn/s3n9SfsN1kjlaiesdQ4sw2pYNSKzynX7JrfnQOObjI9G6w7s:Wj+9UG829K2X7hfnQ29Ms
TLSH
T1A5928D37AC799D7A0DE39694F54B3A279EF4417B97C42F48D6EC6F0C01DA6AC0306826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ebfdf406-2777-498a-8d87-948a8b502433.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\ebfdf406-2777-498a-8d87-948a8b502433.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 44e06fef4ca33b61bfced7085ec0c2e749f57102adf9a410972a54bb2bb14342
MD5 24a3402e75058eb1465ee1839e0342cc
SHA1 48feaff9b569325bc6141ff2c827816a7981f799
SHA512 dea099c0867e74103351cdf7441573b1a78cbad69874bf8829e20a8f70e07d6b3cd232c19d9127208a873c063913e598098dce3f4b7388be05043efdfec4c247
TLSH
T130411A48BAFA1148B3B76F569BF6A8AD587F78772E06D55D10110E4E0A23B40C871737
MD5 SHA1 SHA512 TLSH

Submit Download

Payload.exe

Path C:\Users\Admin\Downloads\Payload.exe
Size 54KB
SHA256 cf48ca0e35d11fdb349da6ea63707b7cf6df26a6432d5b4a244787b173803969
MD5 5a2ea8d655069838eda6ed70a5a571bc
SHA1 a8e6c306559f82cae46d343affe540415eb88e04
SHA512 cc5d6fc55e52ab2c28002aac0da7a3c885f25aab4db7bd1c6e8fe138c4f049907b5cd6fb110890451f66f1882b6f8a54b6f5e3387149b6721be2f1ea9512a107
SSDEEP 1536:vDAA8DnYNe0J5T6D9wsNMDiXExI3pmOm:H8DnZux6D9wsNMDiXExI3pm
TLSH
T100431744BFEA4A01E2BD8F7468F555150A34AA23F532EB1E8CD668DB17327C58C40FE6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads