hxxp://upd[.]emule-security[.]org/nodes[.]dat

Analysis

user interaction
yes
max time kernel
56s
max time network
56s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
01/08/2026, 20:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://upd.emule-security.org/nodes.dat
Sample260801-zf2ddsxtcy

Score

3^/10

discovery ransomware

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4304	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134300904318396337"	msedge.exe

Modifies registry class 6 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-889581200-2041691093-2048517887-1000\{48E5E9D4-4116-4C06-93C9-3F529700908C}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings	OpenWith.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
4556	NOTEPAD.EXE

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3336	OpenWith.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
1992	msedge.exe
1992	msedge.exe
1992	msedge.exe
1992	msedge.exe
1992	msedge.exe

Suspicious use of FindShellTrayWindow 43 IoCs

pid	Process
1992	msedge.exe
1992	msedge.exe
1992	msedge.exe
1992	msedge.exe
1992	msedge.exe
1992	msedge.exe
1992	msedge.exe
1992	msedge.exe
1992	msedge.exe
1992	msedge.exe
1992	msedge.exe
1992	msedge.exe
1992	msedge.exe
1992	msedge.exe
1992	msedge.exe
1992	msedge.exe
1992	msedge.exe
1992	msedge.exe
1992	msedge.exe
1992	msedge.exe
1992	msedge.exe
1992	msedge.exe
1992	msedge.exe
1992	msedge.exe
1992	msedge.exe
1992	msedge.exe
1992	msedge.exe
1992	msedge.exe
1992	msedge.exe
1992	msedge.exe
1992	msedge.exe
1992	msedge.exe
1992	msedge.exe
1992	msedge.exe
1992	msedge.exe
1992	msedge.exe
1992	msedge.exe
1992	msedge.exe
1992	msedge.exe
1992	msedge.exe
1992	msedge.exe
1992	msedge.exe
1992	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
1992	msedge.exe
1992	msedge.exe
1992	msedge.exe
1992	msedge.exe
1992	msedge.exe
1992	msedge.exe
1992	msedge.exe
1992	msedge.exe
1992	msedge.exe
1992	msedge.exe
1992	msedge.exe
1992	msedge.exe
1992	msedge.exe
1992	msedge.exe
1992	msedge.exe
1992	msedge.exe
1992	msedge.exe
1992	msedge.exe
1992	msedge.exe
1992	msedge.exe
1992	msedge.exe
1992	msedge.exe
1992	msedge.exe
1992	msedge.exe
1992	msedge.exe
1992	msedge.exe
1992	msedge.exe
1992	msedge.exe
1992	msedge.exe
1992	msedge.exe
1992	msedge.exe
1992	msedge.exe

Suspicious use of SetWindowsHookEx 62 IoCs

pid	Process
968	OpenWith.exe
968	OpenWith.exe
968	OpenWith.exe
968	OpenWith.exe
968	OpenWith.exe
968	OpenWith.exe
968	OpenWith.exe
968	OpenWith.exe
968	OpenWith.exe
968	OpenWith.exe
968	OpenWith.exe
968	OpenWith.exe
968	OpenWith.exe
968	OpenWith.exe
968	OpenWith.exe
3336	OpenWith.exe
3336	OpenWith.exe
3336	OpenWith.exe
3336	OpenWith.exe
3336	OpenWith.exe
3336	OpenWith.exe
3336	OpenWith.exe
3336	OpenWith.exe
3336	OpenWith.exe
3336	OpenWith.exe
3336	OpenWith.exe
3336	OpenWith.exe
3336	OpenWith.exe
3336	OpenWith.exe
3336	OpenWith.exe
3336	OpenWith.exe
3336	OpenWith.exe
3336	OpenWith.exe
3336	OpenWith.exe
3336	OpenWith.exe
3336	OpenWith.exe
3336	OpenWith.exe
3336	OpenWith.exe
3336	OpenWith.exe
3336	OpenWith.exe
3336	OpenWith.exe
3336	OpenWith.exe
3336	OpenWith.exe
3336	OpenWith.exe
3336	OpenWith.exe
3336	OpenWith.exe
3336	OpenWith.exe
3336	OpenWith.exe
3336	OpenWith.exe
3336	OpenWith.exe
3336	OpenWith.exe
3336	OpenWith.exe
3336	OpenWith.exe
3336	OpenWith.exe
3336	OpenWith.exe
3336	OpenWith.exe
3336	OpenWith.exe
3336	OpenWith.exe
3336	OpenWith.exe
3336	OpenWith.exe
3336	OpenWith.exe
3336	OpenWith.exe

Suspicious use of WriteProcessMemory 34 IoCs

description	pid	Process	procid_target
PID 1992 wrote to memory of 4864	1992	msedge.exe	86
PID 1992 wrote to memory of 4304	1992	msedge.exe	88
PID 1992 wrote to memory of 4100	1992	msedge.exe	89
PID 1992 wrote to memory of 4100	1992	msedge.exe	89
PID 1992 wrote to memory of 4100	1992	msedge.exe	89
PID 1992 wrote to memory of 756	1992	msedge.exe	90
PID 1992 wrote to memory of 756	1992	msedge.exe	90
PID 1992 wrote to memory of 2016	1992	msedge.exe	91
PID 1992 wrote to memory of 2016	1992	msedge.exe	91
PID 1992 wrote to memory of 2016	1992	msedge.exe	91
PID 1992 wrote to memory of 2208	1992	msedge.exe	92
PID 1992 wrote to memory of 2208	1992	msedge.exe	92
PID 1992 wrote to memory of 2208	1992	msedge.exe	92
PID 1992 wrote to memory of 3984	1992	msedge.exe	93
PID 1992 wrote to memory of 3984	1992	msedge.exe	93
PID 1992 wrote to memory of 3984	1992	msedge.exe	93
PID 1992 wrote to memory of 628	1992	msedge.exe	94
PID 1992 wrote to memory of 628	1992	msedge.exe	94
PID 1992 wrote to memory of 628	1992	msedge.exe	94
PID 1992 wrote to memory of 2100	1992	msedge.exe	96
PID 1992 wrote to memory of 2100	1992	msedge.exe	96
PID 1992 wrote to memory of 2388	1992	msedge.exe	97
PID 1992 wrote to memory of 2388	1992	msedge.exe	97
PID 1992 wrote to memory of 2276	1992	msedge.exe	98
PID 1992 wrote to memory of 2276	1992	msedge.exe	98
PID 1992 wrote to memory of 4916	1992	msedge.exe	99
PID 1992 wrote to memory of 4916	1992	msedge.exe	99
PID 1992 wrote to memory of 4916	1992	msedge.exe	99
PID 1992 wrote to memory of 3964	1992	msedge.exe	100
PID 1992 wrote to memory of 1680	1992	msedge.exe	103
PID 968 wrote to memory of 4556	968	OpenWith.exe	106
PID 1992 wrote to memory of 3836	1992	msedge.exe	117
PID 1992 wrote to memory of 1356	1992	msedge.exe	118
PID 1992 wrote to memory of 1844	1992	msedge.exe	119

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://upd.emule-security.org/nodes.dat
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ffcb753c188,0x7ffcb753c194,0x7ffcb753c1a0
  2⤵
  PID:4864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1872,i,9727367600252411740,1555558268522519765,524288 --field-trial-handle=2308,i,573097457607662467,12046063330359218236,262144 --variations-seed-version --mojo-platform-channel-handle=2352 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1652,i,4516896504711994379,17904656976606409619,262144 --field-trial-handle=2308,i,573097457607662467,12046063330359218236,262144 --variations-seed-version --mojo-platform-channel-handle=2304 /prefetch:2
  2⤵
  PID:4100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2328,i,6998928747492747468,17607034046960917512,524288 --field-trial-handle=2308,i,573097457607662467,12046063330359218236,262144 --variations-seed-version --mojo-platform-channel-handle=2428 /prefetch:8
  2⤵
  PID:756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3464,i,7099698382181562783,15720251646971359275,2097152 --field-trial-handle=2308,i,573097457607662467,12046063330359218236,262144 --variations-seed-version --mojo-platform-channel-handle=3472 /prefetch:1
  2⤵
  PID:2016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3468,i,17477442689633749994,570313689058596624,2097152 --field-trial-handle=2308,i,573097457607662467,12046063330359218236,262144 --variations-seed-version --mojo-platform-channel-handle=3544 /prefetch:1
  2⤵
  PID:2208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4204,i,11474569583554817494,14878873497898768715,2097152 --field-trial-handle=2308,i,573097457607662467,12046063330359218236,262144 --variations-seed-version --mojo-platform-channel-handle=4212 /prefetch:1
  2⤵
  PID:3984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4248,i,16089647329336116559,17493208502037162727,2097152 --field-trial-handle=2308,i,573097457607662467,12046063330359218236,262144 --variations-seed-version --mojo-platform-channel-handle=3444 /prefetch:2
  2⤵
  PID:628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5112,i,16496492559697754480,1528623816070616754,524288 --field-trial-handle=2308,i,573097457607662467,12046063330359218236,262144 --variations-seed-version --mojo-platform-channel-handle=5144 /prefetch:8
  2⤵
  PID:2100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5116,i,8103788795100703494,15265631967100665232,524288 --field-trial-handle=2308,i,573097457607662467,12046063330359218236,262144 --variations-seed-version --mojo-platform-channel-handle=5180 /prefetch:8
  2⤵
  PID:2388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5728,i,12072343697576568525,12932593856594093851,524288 --field-trial-handle=2308,i,573097457607662467,12046063330359218236,262144 --variations-seed-version --mojo-platform-channel-handle=5744 /prefetch:8
  2⤵
  PID:2276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=5740,i,16719515517552261800,7030564353662904528,2097152 --field-trial-handle=2308,i,573097457607662467,12046063330359218236,262144 --variations-seed-version --mojo-platform-channel-handle=5716 /prefetch:1
  2⤵
  PID:4916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5980,i,7855391669934271114,17504196576659334197,524288 --field-trial-handle=2308,i,573097457607662467,12046063330359218236,262144 --variations-seed-version --mojo-platform-channel-handle=6024 /prefetch:8
  2⤵
  PID:3964
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6032,i,11737946322309832543,11019036542167252204,524288 --field-trial-handle=2308,i,573097457607662467,12046063330359218236,262144 --variations-seed-version --mojo-platform-channel-handle=6572 /prefetch:8
  2⤵
  PID:4784
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6032,i,11737946322309832543,11019036542167252204,524288 --field-trial-handle=2308,i,573097457607662467,12046063330359218236,262144 --variations-seed-version --mojo-platform-channel-handle=6572 /prefetch:8
  2⤵
  PID:1680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4464,i,6554554354312510756,11110827242454740423,524288 --field-trial-handle=2308,i,573097457607662467,12046063330359218236,262144 --variations-seed-version --mojo-platform-channel-handle=4468 /prefetch:8
  2⤵
  PID:3836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4220,i,16744240337940424424,12692774318227250305,524288 --field-trial-handle=2308,i,573097457607662467,12046063330359218236,262144 --variations-seed-version --mojo-platform-channel-handle=4516 /prefetch:8
  2⤵
  PID:1356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4356,i,3326944402063734017,319220257391246149,524288 --field-trial-handle=2308,i,573097457607662467,12046063330359218236,262144 --variations-seed-version --mojo-platform-channel-handle=4508 /prefetch:8
  2⤵
  PID:1844

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4352

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:968
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Downloads\nodes.dat
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:4556

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:3336

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 bb198c81963e699455b64b9ce7875c63551bac1db146ac9e8b16246add4890ae
MD5 e5b55006b588cbfd0a0c4801b2c1055a
SHA1 ddde08e8f44660d59ca273351189083ac43d8809
SHA512 453a760669986555d9c71b4c1e974d6f1c226d7ff4ac867acc428d6346dc81990eb139eda65972c93abd04637b774055ff3725b789c9ae8f2d1492ee6187b2dd
TLSH
T1DCD023707D35EBD6D11E10F45420494112374273315757B5B155584EDEB4081F2DFDF6
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 11d3c4c52f9fc9cd2b10a22b48769759f994fd6364f9a0fc145f4cd2c2a22e9d
MD5 4751cf705a737c4226029624bf43b9a8
SHA1 fd8cf726ee3f8f75b97147829de5553530caa82c
SHA512 46e3fedbf7fa14bdc2b3aad129f2879a9d24252f5d7bd9b55766bc32a6b82ea77aaf193bcdbdf4423e3b67ef84955e589b6077609344091ef72204c1d50b0dab
TLSH
T17ED09B307A58A58BD14360F1A4114B4115375557205397757521508E9E98055B3CA057
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 701082e4ac35f878dc5ff6eb27989aae9d20d9b5662643e20b3acd1720b367fc
MD5 2b3686986ce1fd99f079eb226e8b0a8b
SHA1 0d2cdee36351378b91ed7f6ecdb43457fe4d7b5d
SHA512 937da61c495fd21a02bb76a63556dec83ce132f1d1830ff8d9af6212d15f1844766dd4abadd15ea61b48f8ae03b52baca44c99117714c705da840dbff8f116dd
TLSH
T182D09B303A58A98BD54360F1A4104B41153755572053D7757521508E9E99095B3CA057
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 01353c0f0ddc41f4e8bb9df774b4f2f0a7f19fd62403e36e6a4e08798e74184d
MD5 1682f831681c75128fdefb65eb9f5063
SHA1 8f10c15dc1b93f07f2cac5513047812ee4d64025
SHA512 ab1c8f9628273d149f650ac3e0155fbfb204abe24f24cfaf07eb3fd7746aa83dfd5c07fa6b12e3cdba02281fd4e12b24bcc8ea2fe79d0e2a8ae62e0b44ffa3a2
TLSH
T1A961E5BE0582EDF6E3D13A3190C03A8738F190E8FD63FD5D02E348B5641AB118A6A4CD
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe588bef.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe588bef.TMP
Size 3KB
SHA256 e1d8bd83b8a18bc23cc9631cad4f0aea05e16480e6e69510db0d43c3fabe884c
MD5 b27112025b48e795501f5dc358b071c7
SHA1 0e4ca69981a62b1dc8673f86aa659a0baee546ea
SHA512 67b36e381b49f16ac9103736546d7c759ae6b29fbec21f41f902171a88c5975c27f12469002f2468c17f146f576360c65b8ff72850d0bd3365dd1c6322ea2bc5
TLSH
T1B761C3BE0586EDF6E3D13A3190C03A8738F190E8F823BD5D01E348B5640AB514A6A4CD
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DawnGraphiteCache\data_1
Size 264KB
SHA256 1b17a7ab356d3f3a5f6b37cbec16c043bc29f9249e40bfa30d00891e31cf06f6
MD5 95800a59311cd6f2c9f865bd657c0fde
SHA1 18abaca2184f977c218455d63ca0aee2dc28f186
SHA512 b7ad20e5aa795af3f50586f9e41bbe93970340a0bc3aef642f94edabc6c0c0275dd7cc3deaec050a435ebeea89bd814a9a1d56d538bb97ae9577f8686cb5e701
SSDEEP 3:MsEllllkEthXllkl2zEklEA:/M/xT02znE
TLSH
T12944041DFFC4040DC50010704011C35003F1D410051157433471041FFCC75501D40140
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 776dd857fa88ae4fe7b84513107916a4f1d71410f9629a5419e1f6102da00f39
MD5 33da0c9c5302950a96e43e130561f2ba
SHA1 fca267e18e89f6682c4902825b8999cdbff20d39
SHA512 52e162759e8ebec7a2fb88deb795a60a76ff4518c1ce46e544caa6f212b43bea0deba7b06913b9671643f5549ce21262d4ce244087a691d3ac5167c90b659d11
TLSH
T1682179B3C3E585AE9D1156F0AA28AE2BCE1D0906421C7C1AC5D4FF2B93F2475E10285F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 eb86e9423606799fb5211d6879d92ebe60e67a11c67e636ebfd595934299dfbc
MD5 a890c1983685195f6b5dd86ddfa57321
SHA1 ba8bd99b0d42422a17287635c4539203c619008e
SHA512 66bc715aab5ddfbf75598eb3555c72ae50522c87abdabdf3d6df4815b9ecbb4b41950bd77dda3a0413b3b0570c504355b96f7c82e35343f52a878d2f81db5409
SSDEEP 192:sxZzRRyM/jK1Ml8M9d/fSsDKn3TIdpJHW6+WNGY9Io/qpIgrJ:sxZzp1d/fSsDI8JHbGj9
TLSH
T12342E912AB34697BCCCBD20DFA557F53D6F8447292900E54AAFCDA0C04E6AED221781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 adc633745ebfcb5fbd8cb3152df8e25c50ff1b7fe48b2964e0b56bc691c7f14d
MD5 91655e79355477760b301d90987cbd89
SHA1 58ed2ca3a78cc7d2feb7b9bd7fe94f023d22a48a
SHA512 7dca087c98f7599cbf2494480db09acae37221ce2ad152ee0e0ded9be5f969f4856a7186a26960435a9fceda67519827428ef7f787336ecb415876738880e234
SSDEEP 192:sxZzRRyM/jK1Ml879d/fSsFWpVwKmL3TIdpJHW6+WNGY9IRC6vIgbaJ:sxZzpod/fSsFWvwx8JHbGJ6
TLSH
T16952E712AA34697BCCCBD20DFA557F53D6F8047292900E54AAFCDA1C01E7AED221781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 5f69169a175edcea65f54b4069e057e08137dab909761469c2c9ec7982ea423b
MD5 4b298389633f8c5fbf52fc9bd9c6bd5a
SHA1 a363608cf8038dbd2fa77159b6bd61c99a31409a
SHA512 288b600323331c34fd9b7af7339ea6e6f60a1392020c6668e5a8144781e3c87b0cb9fe6b5291aa2344a6892241d311a91a2da8d4ade7d2bc5ad08fc8201941d7
SSDEEP 768:gZcv21wWvu+Z+8F1+UoAYDCx9Tuqh0VfUC9xbog/OVjFLlwmWNXroSg6f:gZcv21wWvu+Z+u1jaeFLeRNESP
TLSH
T1B7D20A2B280CCB7E4F841E9CED2A6F866ED801CB56988D5447FA494C03C77EB511B5DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 d48cd20a038ba08cb332904838dc0fecb9b3e7b42daa33c29796e09c47cb96ec
MD5 9011e6dfc453c28a2d9c7701aee395d6
SHA1 8d6510b271ebcde76b3b2a7f2fb0c10000b4641b
SHA512 d34bb36d9726017b56972c1657a0b920f91890ae3b6fe40cd9660524e6ad514088824fb5c0ce3527818d29ba0f2239b0924b52fe85bd555c677cca41bd8b1fb9
SSDEEP 96:KaRklRnHnqlPKZThqKLfTzqHxJSrBDCygKTya+LWK8QGV:mTfHlVV
TLSH
T149916201B0BE02823C7F698CA7A595665E4235677408A9BFBFF800D58E67E115CFC8ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 f9e4d7e7f8ce51b33a5f53958e88887321313fc292cd4c09b2d389c616cf1a4f
MD5 11e5bf3b362ca5b31845ef88cc132bb6
SHA1 ba7828b7bbd920ddb0dbd33cc602de4dca7c032b
SHA512 40fd099b4e74fb788736d759d4ab11059f59451be046f8b1815bea8ce7c6355dbe0e5d4a072ce8e75cfd798a5fc7d0593e4cf8be4d7e5cb7b61356cb570726e1
SSDEEP 384:6ZcINsNOae1zi0j1e+CXOmep3JrAshnTKwBODNZOCJ08:4NjFBkvO9p3hAshnewBKZOo08
TLSH
T1F1927C71AD385C7A8EE7A145F94B36178FF890A3E6C42B94D6EC7F1C01DA64C130AC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 09f4739877939160112713405d3f4bec26c71d0fd681f59acac7c1ea614c28ea
MD5 e3a4957c408e38a12a3022a177743fc0
SHA1 6877ea780e83657a99a43b8cb0b5a2b03b98f672
SHA512 23554058b322eaf3fcda47ad60ee7d9b035107f37f61aaca8acd40901fa1d867126d502916ccb78a4ee04ccf75718ccc437b870f2a89aa119a662eb6328c88b0
SSDEEP 192:JONO6v+YLNQmiUyVHZh+CG6Om9oEusdlU6:JONO6vz/cZh+CXOme63U6
TLSH
T16102E935BD381C6B9FF25E49F9873B275FA8217BE9952F80D9E42E1C01D764C2306826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 0441d017b9607bfa04d190a79fe35ee320d84fcb7ef70e5df0d7f26b6d926f6c
MD5 782c28327c35fe80a963744d447e5a0f
SHA1 610dd170b6be5eb341b2a65af074db2d412295d9
SHA512 28d3cd759fc3867c0618f4f2b209c03a60c6a23a693c67d00b0972dfb25c96bfe4f574aa8eee17888b5e2b0c45ea162009b1efc52be37485780594480037085e
SSDEEP 384:kZcIXsNO9e1zi1j1e+CXOmep3Jr7shnTKwBODNZOCJ08:CXKFEkvO9p3h7shnewBKZOo08
TLSH
T137927C71AD385C7B8EE6A145F94B36178FB89063E6C42B94D6EC7F1C01DA64C130AC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 5cd4419bb5652a2cce51cd7acc3680b4359932fbe54dffd7c8fbc65a764bb9db
MD5 eed90f5e7b11b8cb543a1d2f33b3790f
SHA1 238c068756aee02e8d6afacbdfd29f990aa0fe74
SHA512 2a1dd7c953ca73b678d1b98b29560de841bb83847ac8ffc16717667f1189a571adbfc3e70d3e15037055d224b31e96679bea4dc3b419b46344b0700ccfd5e6a2
SSDEEP 384:LZcI5sNj9e1zi+J1e+CXOmep3Jrkq5vFA8BNt/oQR9lM+jnTKwBODNZOCJ08:T5vFtkvO9p3hkc686w9m+newBKZOo08
TLSH
T140C28DB0E8281CEB89E2E9C5B64AE5071EBC0177D588195CD3F97E3D319F5B81312C22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 85a701846e06a88d00017e49dde6c8889ff248d85b481f85b37d44a42626bd78
MD5 49d04ed25e475f522c7304c2d1ae6c2f
SHA1 4adb30591e576cdedf6649da362065b81ee80a4b
SHA512 d2537fb0e2a67d2588b465de1bc300b1787b79d109afcc3e40957c2e30ad1a3e62994dccb65e92fbc46988a06fd527aedcf32a791b1b07393b698b069ea2d54e
SSDEEP 192:nONn6v+YLOQmiUy+HHh+CG6Om9opwSJrHaCHsbqyU6:nONn6vzO1Hh+CXOmep3JrjshU6
TLSH
T1F5123C3678385C6B5EE3A595F48735139EA85177EA4A3F80D5EC3E0C02EF69C134A827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 149f442340788731ed3c68da23f50a86a941cec0d72366d8df4bd84d332b28a0
MD5 f5ba7d03dfa583a74eded11016e453a7
SHA1 9e99e5f320989bfe64dbfbdbd74f20ad28c4d851
SHA512 f45abc197aa272812e8130175fcf27a4fba97ce7ddf05433c675dfe3f6aa357ea756b2f9f5a81e7dfa3988cd8f9c9b2ef0ce9d4fe01dcd99c4aad2d9d639683c
TLSH
T1D341E658B6E92148B3B77E46ABF7A46D547BB8772F07959E10110E4E0A62B00C8B1737
MD5 SHA1 SHA512 TLSH

Submit Download

nodes.dat

Path C:\Users\Admin\Downloads\nodes.dat
Size 6KB
SHA256 8236c66349919275029fde205eed04b6960522fe0f9ce91d271d4df36eb4ae97
MD5 574c66e8d12542fcad72223950a79f47
SHA1 373124e7a0326624da32005c29201692beb3a7ed
SHA512 fa2db8dbc77a96ad2c44b46ddff68795eea8747cb2a4f67ea3f8baa204ca76157c7282bb9f00b5d9a112376cc3065c2b3e2fb36f5f37400ecf5402258b78c851
SSDEEP 96:5Nttk90vHk/GobwrEW/BThZUX9hnyS8GR+CaaRUnR14nFSekx8IVBy:lA0vE/HwgW/BThZUX9h2GR+Cu8IV0
TLSH
T1BFD139FC49E720116918F1E2EFA7C2E034519393F7F468B60C31AD68408ECAE070F994
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads