hxxps://www[.]mediafire[.]com/file/eowx64ci4xmil00/Intave[.]rar/file

Analysis

user interaction
yes
max time kernel
898s
max time network
799s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
08/08/2026, 20:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://www.mediafire.com/file/eowx64ci4xmil00/Intave.rar/file
Sample260808-ysgdbafc63

Score

3^/10

discovery ransomware

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1420	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134306929739763562"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 26 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\ᇴŕ\ = "yml_auto_file"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\yml_auto_file\shell\edit	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\yml_auto_file\shell\edit\command	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2937465464-4167303362-2236413517-1000\{99AF0E31-A7EC-4C91-8A1C-C97691A51A17}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\.yml\ = "yml_auto_file"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\yml_auto_file\shell\open\command	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\yml_auto_file\shell\open\command\ = "%SystemRoot%\\system32\\NOTEPAD.EXE %1"	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\yml_auto_file\shell	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\.yml	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\yml_auto_file\shell\open	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\yml_auto_file\shell\edit\command\ = "%SystemRoot%\\system32\\NOTEPAD.EXE %1"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\yml_auto_file	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\ᇴŕ	OpenWith.exe

Opens file in notepad (likely ransom note) 2 IoCs

ransomware

pid	Process
6088	NOTEPAD.EXE
836	NOTEPAD.EXE

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5408	msedge.exe
5408	msedge.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
1708	OpenWith.exe
6012	OpenWith.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 18 IoCs

pid	Process
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeRestorePrivilege	5752	7zG.exe
Token: 35	5752	7zG.exe
Token: SeSecurityPrivilege	5752	7zG.exe
Token: SeSecurityPrivilege	5752	7zG.exe

Suspicious use of FindShellTrayWindow 50 IoCs

pid	Process
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
5752	7zG.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe

Suspicious use of SetWindowsHookEx 61 IoCs

pid	Process
1708	OpenWith.exe
1708	OpenWith.exe
1708	OpenWith.exe
1708	OpenWith.exe
1708	OpenWith.exe
1708	OpenWith.exe
1708	OpenWith.exe
1708	OpenWith.exe
1708	OpenWith.exe
1708	OpenWith.exe
1708	OpenWith.exe
1708	OpenWith.exe
1708	OpenWith.exe
1708	OpenWith.exe
1708	OpenWith.exe
1708	OpenWith.exe
1708	OpenWith.exe
1708	OpenWith.exe
1708	OpenWith.exe
1708	OpenWith.exe
1708	OpenWith.exe
1708	OpenWith.exe
1708	OpenWith.exe
1708	OpenWith.exe
1708	OpenWith.exe
1708	OpenWith.exe
1708	OpenWith.exe
6012	OpenWith.exe
6012	OpenWith.exe
6012	OpenWith.exe
6012	OpenWith.exe
6012	OpenWith.exe
6012	OpenWith.exe
6012	OpenWith.exe
6012	OpenWith.exe
6012	OpenWith.exe
6012	OpenWith.exe
6012	OpenWith.exe
6012	OpenWith.exe
6012	OpenWith.exe
6012	OpenWith.exe
6012	OpenWith.exe
6012	OpenWith.exe
6012	OpenWith.exe
6012	OpenWith.exe
6012	OpenWith.exe
6012	OpenWith.exe
6012	OpenWith.exe
6012	OpenWith.exe
6012	OpenWith.exe
6012	OpenWith.exe
6012	OpenWith.exe
6012	OpenWith.exe
6012	OpenWith.exe
6012	OpenWith.exe
6012	OpenWith.exe
5612	OpenWith.exe
5612	OpenWith.exe
5612	OpenWith.exe
5612	OpenWith.exe
5612	OpenWith.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4524 wrote to memory of 2712	4524	msedge.exe	85
PID 4524 wrote to memory of 1420	4524	msedge.exe	86
PID 4524 wrote to memory of 4352	4524	msedge.exe	87
PID 4524 wrote to memory of 4352	4524	msedge.exe	87
PID 4524 wrote to memory of 4352	4524	msedge.exe	87
PID 4524 wrote to memory of 2436	4524	msedge.exe	88
PID 4524 wrote to memory of 2436	4524	msedge.exe	88
PID 4524 wrote to memory of 2300	4524	msedge.exe	90
PID 4524 wrote to memory of 2620	4524	msedge.exe	89
PID 4524 wrote to memory of 2300	4524	msedge.exe	90
PID 4524 wrote to memory of 2300	4524	msedge.exe	90
PID 4524 wrote to memory of 2620	4524	msedge.exe	89
PID 4524 wrote to memory of 2620	4524	msedge.exe	89
PID 4524 wrote to memory of 4432	4524	msedge.exe	92
PID 4524 wrote to memory of 2332	4524	msedge.exe	93
PID 4524 wrote to memory of 4432	4524	msedge.exe	92
PID 4524 wrote to memory of 4432	4524	msedge.exe	92
PID 4524 wrote to memory of 2332	4524	msedge.exe	93
PID 4524 wrote to memory of 2332	4524	msedge.exe	93
PID 4524 wrote to memory of 3032	4524	msedge.exe	98
PID 4524 wrote to memory of 3032	4524	msedge.exe	98
PID 4524 wrote to memory of 3032	4524	msedge.exe	98
PID 4524 wrote to memory of 1656	4524	msedge.exe	99
PID 4524 wrote to memory of 1656	4524	msedge.exe	99
PID 4524 wrote to memory of 1656	4524	msedge.exe	99
PID 4524 wrote to memory of 4948	4524	msedge.exe	100
PID 4524 wrote to memory of 4948	4524	msedge.exe	100
PID 4524 wrote to memory of 4948	4524	msedge.exe	100
PID 4524 wrote to memory of 5032	4524	msedge.exe	101
PID 4524 wrote to memory of 2836	4524	msedge.exe	102
PID 4524 wrote to memory of 5032	4524	msedge.exe	101
PID 4524 wrote to memory of 2836	4524	msedge.exe	102
PID 4524 wrote to memory of 4176	4524	msedge.exe	104
PID 4524 wrote to memory of 4104	4524	msedge.exe	107
PID 4524 wrote to memory of 2844	4524	msedge.exe	108
PID 4524 wrote to memory of 2888	4524	msedge.exe	109
PID 4524 wrote to memory of 4584	4524	msedge.exe	110
PID 4524 wrote to memory of 4584	4524	msedge.exe	110
PID 4524 wrote to memory of 4584	4524	msedge.exe	110
PID 4524 wrote to memory of 2044	4524	msedge.exe	111
PID 4524 wrote to memory of 2044	4524	msedge.exe	111
PID 4524 wrote to memory of 2044	4524	msedge.exe	111
PID 4524 wrote to memory of 4348	4524	msedge.exe	112
PID 4524 wrote to memory of 4348	4524	msedge.exe	112
PID 4524 wrote to memory of 4348	4524	msedge.exe	112
PID 4524 wrote to memory of 444	4524	msedge.exe	113
PID 4524 wrote to memory of 444	4524	msedge.exe	113
PID 4524 wrote to memory of 444	4524	msedge.exe	113
PID 4524 wrote to memory of 656	4524	msedge.exe	114
PID 4524 wrote to memory of 656	4524	msedge.exe	114
PID 4524 wrote to memory of 656	4524	msedge.exe	114
PID 4524 wrote to memory of 2344	4524	msedge.exe	115
PID 4524 wrote to memory of 2344	4524	msedge.exe	115
PID 4524 wrote to memory of 2344	4524	msedge.exe	115
PID 4524 wrote to memory of 3024	4524	msedge.exe	116
PID 4524 wrote to memory of 3024	4524	msedge.exe	116
PID 4524 wrote to memory of 2836	4524	msedge.exe	117
PID 4524 wrote to memory of 2836	4524	msedge.exe	117
PID 4524 wrote to memory of 2836	4524	msedge.exe	117
PID 4524 wrote to memory of 1932	4524	msedge.exe	118
PID 4524 wrote to memory of 1944	4524	msedge.exe	119
PID 4524 wrote to memory of 1944	4524	msedge.exe	119
PID 4524 wrote to memory of 1944	4524	msedge.exe	119
PID 4524 wrote to memory of 1840	4524	msedge.exe	121

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://www.mediafire.com/file/eowx64ci4xmil00/Intave.rar/file
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ffa710cc188,0x7ffa710cc194,0x7ffa710cc1a0
  2⤵
  PID:2712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1744,i,13285843947125385101,13373760943303687009,524288 --field-trial-handle=2056,i,5211905348085006382,5340133183654934087,262144 --variations-seed-version --mojo-platform-channel-handle=2152 /prefetch:3
  2⤵
  - System Time Discovery
  PID:1420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1616,i,13343671190072599462,5999916152537729012,262144 --field-trial-handle=2056,i,5211905348085006382,5340133183654934087,262144 --variations-seed-version --mojo-platform-channel-handle=2052 /prefetch:2
  2⤵
  PID:4352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2588,i,4592808827120712586,8669397601648373529,524288 --field-trial-handle=2056,i,5211905348085006382,5340133183654934087,262144 --variations-seed-version --mojo-platform-channel-handle=2652 /prefetch:8
  2⤵
  PID:2436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3416,i,7662359886969267623,9609122552725889392,2097152 --field-trial-handle=2056,i,5211905348085006382,5340133183654934087,262144 --variations-seed-version --mojo-platform-channel-handle=3468 /prefetch:1
  2⤵
  PID:2620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3420,i,5409034070132812558,8321059225502781119,2097152 --field-trial-handle=2056,i,5211905348085006382,5340133183654934087,262144 --variations-seed-version --mojo-platform-channel-handle=3480 /prefetch:1
  2⤵
  PID:2300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4116,i,16979358338655074755,1251257474712962340,2097152 --field-trial-handle=2056,i,5211905348085006382,5340133183654934087,262144 --variations-seed-version --mojo-platform-channel-handle=4520 /prefetch:1
  2⤵
  PID:4432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4128,i,2842894408391860010,13794846749364033074,2097152 --field-trial-handle=2056,i,5211905348085006382,5340133183654934087,262144 --variations-seed-version --mojo-platform-channel-handle=4564 /prefetch:2
  2⤵
  PID:2332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5040,i,5570041772709912690,4387399318534488746,2097152 --field-trial-handle=2056,i,5211905348085006382,5340133183654934087,262144 --variations-seed-version --mojo-platform-channel-handle=5068 /prefetch:1
  2⤵
  PID:3032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=5148,i,11356277761635144010,7092194346963213698,2097152 --field-trial-handle=2056,i,5211905348085006382,5340133183654934087,262144 --variations-seed-version --mojo-platform-channel-handle=5180 /prefetch:1
  2⤵
  PID:1656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=5884,i,14488006704750563370,9990518821458055618,2097152 --field-trial-handle=2056,i,5211905348085006382,5340133183654934087,262144 --variations-seed-version --mojo-platform-channel-handle=5904 /prefetch:1
  2⤵
  PID:4948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5640,i,10357087070130933790,14199005431161701465,524288 --field-trial-handle=2056,i,5211905348085006382,5340133183654934087,262144 --variations-seed-version --mojo-platform-channel-handle=5608 /prefetch:8
  2⤵
  PID:5032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5828,i,15548647957002156917,10698246827497622648,524288 --field-trial-handle=2056,i,5211905348085006382,5340133183654934087,262144 --variations-seed-version --mojo-platform-channel-handle=5572 /prefetch:8
  2⤵
  PID:2836
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6376,i,14871140934145808081,144291046643430373,524288 --field-trial-handle=2056,i,5211905348085006382,5340133183654934087,262144 --variations-seed-version --mojo-platform-channel-handle=6392 /prefetch:8
  2⤵
  PID:3896
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6376,i,14871140934145808081,144291046643430373,524288 --field-trial-handle=2056,i,5211905348085006382,5340133183654934087,262144 --variations-seed-version --mojo-platform-channel-handle=6392 /prefetch:8
  2⤵
  PID:4176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5212,i,18102345276177338196,4983874968812906796,524288 --field-trial-handle=2056,i,5211905348085006382,5340133183654934087,262144 --variations-seed-version --mojo-platform-channel-handle=5180 /prefetch:8
  2⤵
  PID:4104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5224,i,1320942178446304671,5966579746639666025,524288 --field-trial-handle=2056,i,5211905348085006382,5340133183654934087,262144 --variations-seed-version --mojo-platform-channel-handle=5276 /prefetch:8
  2⤵
  PID:2844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5144,i,5205769876687355127,15924188626200477628,524288 --field-trial-handle=2056,i,5211905348085006382,5340133183654934087,262144 --variations-seed-version --mojo-platform-channel-handle=5228 /prefetch:8
  2⤵
  PID:2888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=5492,i,1892261253094691131,232110293322878807,2097152 --field-trial-handle=2056,i,5211905348085006382,5340133183654934087,262144 --variations-seed-version --mojo-platform-channel-handle=5592 /prefetch:1
  2⤵
  PID:4584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=5272,i,17242340426810257930,4569547399641035356,2097152 --field-trial-handle=2056,i,5211905348085006382,5340133183654934087,262144 --variations-seed-version --mojo-platform-channel-handle=2956 /prefetch:1
  2⤵
  PID:2044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=4728,i,11045657444246965125,13398119777938353674,2097152 --field-trial-handle=2056,i,5211905348085006382,5340133183654934087,262144 --variations-seed-version --mojo-platform-channel-handle=4704 /prefetch:1
  2⤵
  PID:4348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=2420,i,6287758241542859157,8317056418231378061,2097152 --field-trial-handle=2056,i,5211905348085006382,5340133183654934087,262144 --variations-seed-version --mojo-platform-channel-handle=6848 /prefetch:1
  2⤵
  PID:444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=7044,i,17870421872913240648,12273872723411962723,2097152 --field-trial-handle=2056,i,5211905348085006382,5340133183654934087,262144 --variations-seed-version --mojo-platform-channel-handle=5268 /prefetch:1
  2⤵
  PID:656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=6756,i,7178698316375573697,18260194801741532387,2097152 --field-trial-handle=2056,i,5211905348085006382,5340133183654934087,262144 --variations-seed-version --mojo-platform-channel-handle=4992 /prefetch:1
  2⤵
  PID:2344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7220,i,247059896884313883,17705574760041618729,524288 --field-trial-handle=2056,i,5211905348085006382,5340133183654934087,262144 --variations-seed-version --mojo-platform-channel-handle=7212 /prefetch:8
  2⤵
  PID:3024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --metrics-shmem-handle=7248,i,16834742452248821935,5561714020501262691,2097152 --field-trial-handle=2056,i,5211905348085006382,5340133183654934087,262144 --variations-seed-version --mojo-platform-channel-handle=7276 /prefetch:1
  2⤵
  PID:2836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7732,i,14895065024698916418,2073976003801206818,524288 --field-trial-handle=2056,i,5211905348085006382,5340133183654934087,262144 --variations-seed-version --mojo-platform-channel-handle=7728 /prefetch:8
  2⤵
  PID:1932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --always-read-main-dll --metrics-shmem-handle=7772,i,5639914841959463995,17417982860145632119,2097152 --field-trial-handle=2056,i,5211905348085006382,5340133183654934087,262144 --variations-seed-version --mojo-platform-channel-handle=7724 /prefetch:1
  2⤵
  PID:1944
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7332,i,16288538245222131359,1516413437308819896,524288 --field-trial-handle=2056,i,5211905348085006382,5340133183654934087,262144 --variations-seed-version --mojo-platform-channel-handle=6828 /prefetch:8
  2⤵
  PID:400
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7332,i,16288538245222131359,1516413437308819896,524288 --field-trial-handle=2056,i,5211905348085006382,5340133183654934087,262144 --variations-seed-version --mojo-platform-channel-handle=6828 /prefetch:8
  2⤵
  PID:1840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --always-read-main-dll --metrics-shmem-handle=7012,i,2789367281934152107,9454818906054561629,2097152 --field-trial-handle=2056,i,5211905348085006382,5340133183654934087,262144 --variations-seed-version --mojo-platform-channel-handle=7144 /prefetch:1
  2⤵
  PID:4952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8004,i,14645212740887754632,932275449112256424,524288 --field-trial-handle=2056,i,5211905348085006382,5340133183654934087,262144 --variations-seed-version --mojo-platform-channel-handle=8000 /prefetch:8
  2⤵
  PID:2772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --always-read-main-dll --metrics-shmem-handle=5504,i,5848491300730558161,7974618576031611114,2097152 --field-trial-handle=2056,i,5211905348085006382,5340133183654934087,262144 --variations-seed-version --mojo-platform-channel-handle=8116 /prefetch:1
  2⤵
  PID:5244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=8012,i,4400423620324333761,4559900252568891932,262144 --field-trial-handle=2056,i,5211905348085006382,5340133183654934087,262144 --variations-seed-version --mojo-platform-channel-handle=7264 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5564,i,3482898923962450180,14199684682326038081,524288 --field-trial-handle=2056,i,5211905348085006382,5340133183654934087,262144 --variations-seed-version --mojo-platform-channel-handle=6156 /prefetch:8
  2⤵
  PID:3240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5664,i,16674271197368026075,7930647206446213500,524288 --field-trial-handle=2056,i,5211905348085006382,5340133183654934087,262144 --variations-seed-version --mojo-platform-channel-handle=5672 /prefetch:8
  2⤵
  PID:1540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7236,i,12395446177782257750,16942345766974373465,524288 --field-trial-handle=2056,i,5211905348085006382,5340133183654934087,262144 --variations-seed-version --mojo-platform-channel-handle=3980 /prefetch:8
  2⤵
  PID:3060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5932,i,3606059309106467608,4909338203894858616,524288 --field-trial-handle=2056,i,5211905348085006382,5340133183654934087,262144 --variations-seed-version --mojo-platform-channel-handle=7200 /prefetch:8
  2⤵
  PID:6124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7552,i,16336420715649263217,10013676489456767465,524288 --field-trial-handle=2056,i,5211905348085006382,5340133183654934087,262144 --variations-seed-version --mojo-platform-channel-handle=7532 /prefetch:8
  2⤵
  PID:1132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5600,i,138229509124480677,13088890358258136898,524288 --field-trial-handle=2056,i,5211905348085006382,5340133183654934087,262144 --variations-seed-version --mojo-platform-channel-handle=5664 /prefetch:8
  2⤵
  PID:4788

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2480

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3796

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1708

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\Intave\" -spe -an -ai#7zMap11082:74:7zEvent7036
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:5752

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:6012
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Downloads\Intave\Intave\config.yml
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:6088

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:5612
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Downloads\Intave\Intave\advanced.yml
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:836

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 ca4ac85fa9af9d400600502f608a3f8d8bb73aef8a60227135f105dbe1ac2307
MD5 fd67f6c669d512d4f5409397f5166524
SHA1 57fe9fe38f3185ffaf45d9ead615bedb1359e4ef
SHA512 33fb3eb9c722b4610f37fb197d6c1b499a01cc5837317c4a96cf987a38080a355b423a63a7605516c6e162ee005b1a8e5c3175e684731288f3db35ba4da31224
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7y:fwUQC5VwBIiElEd2K57P7y
TLSH
T124B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 3eacdfce7dc5d437b4447cf27ab297d2d39d13a22d53487691f060212cddb6b2
MD5 77a76342e47369b91c295856d0d136ad
SHA1 bac334fe99bd25a56aeb5cf09b273fd394730180
SHA512 5594ac61907f341c5e00a7e62a64d33fde684c855aa9b27d0c2756986334fbea5ebaf894d13dfedefe84d1f7ad65aaa17fb6b204714ed08460f06e4ed17ce733
TLSH
T1AAD012223A48F441DB4942709103CF453B26146024579A06E259D86D58B41D453D66C2
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7aa2bb81937fdcdafd5d33143cfe61093f5233469b36757de171e12cc0c6215f
MD5 6503f091cfa7258a2190ed65490b1bdd
SHA1 d722a7fd3cd82ec30e4846b9511ec1c22b9dacfd
SHA512 5f2a6a53348e4e1b7810b77abe2dd4c597357ba365cf029977f0efbbb203eab9dfb7771c9edb3561b6d22c8b7354c34611905cfbaab36c763b9d3334beb40b4c
TLSH
T1BAD012223A48F441DB4942709102CF453B26146024579A06E259D86D58B51D453D66C2
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 62d46b21930e7951117aa28c46c01064c6b04686da1b98049498513eef6d844e
MD5 b71025317d5f3208f09fbd53e0ba732e
SHA1 42bc1982975dd5feb1fb1b959ef89522683d2f1f
SHA512 2572f5531446fc200084a835f1f9aa20bc30ab1ddd7330daceef6ea97961d349a3189a520d30e32152d5d7c33cbee0df334c026b36676541433325a5ac260c3b
TLSH
T1E8E0208456C8C31FE50079CBD578434E92C0360ED6C4EDCF1F54C4543041940EBD6A7C
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 a7431dba3ca604f324039371ae435abf67500453110f734bae9f33baca881743
MD5 177a3caf8ba08af0ed0563066bde3398
SHA1 667758a21f1a80c20a330f669f07f1a9df78e357
SHA512 bb86736653847a8f35bb18a3c8f5fd6522979b3fe37e4049d792b7db6a83e54b23e1c1cb2a4cc6f17a319194fa3d4e17af024001a97f31402fa6345f90fb0e4f
TLSH
T1ACE020845DC5C35DA700654F916D434DE1C0360E96C4AD472B1488443001441F3E6EB1
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 5KB
SHA256 bd1c11e2d458e7bfacdf604ee3bf0cd591ce5b5cf38f5c4ffebfff5e6f5a8b5a
MD5 28829ad616ae1cdc8146e187ddceb490
SHA1 b224962b0b18adf4e9c66ef3378669d654962e40
SHA512 13a87c27c3cf067121ae1c704ac118afd1d2e4ec9a81cfd925998a2f8749e12747792ae048642e2b96c152c35d108ec2f5b60f15cfb17ad5404a2381bcfb522f
SSDEEP 96:qVd1SVxBfj3dMQeSg9KLB7a9utdGNfYSJbRHhCyg:qqTfj3dMQFIKLlaIDG1YSJTA
TLSH
T17AB10A3194B21C02E7DD2930D0E5BA087A3EF4D5615B4FDAB29CFC3F6A0E7578926204
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe59b1f1.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59b1f1.TMP
Size 3KB
SHA256 60c248839c26bb45fffaf3af489ca2c646b046ea1a016b9ed269bc88b7e8d457
MD5 2aa37cc723ca6d7ab5cc6036c046fca5
SHA1 ba8e0ecbf70b56106537b97adc746279cfd4e89d
SHA512 603d2978a67b5761d30601dbf2aa7bf9c429ba13fd7daae0c7f3ebcfca6ec6f5fe74a6d60e2d8c6c1bdf3ffed7316cf6f4d6c2c96ef66f67307ebc651e4cc7e5
TLSH
T1D3714FA241B34511F7ED2231D4F23646327EFAD50A0B8F6AF0ECE47F991E725C816008
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 22KB
SHA256 93857c450288deee8c4e5923a907639cca7f77774bf01636edbf42400d41aaf7
MD5 d30a1723ddd20d64b065743d778cf84d
SHA1 b1c07a09d73a86fb6ad2f7c68c2e2f33b25bc3f1
SHA512 d7e73350af6a79934870509dcaa33231ce3b52e1fc0c388499fc94c747db612bb588de1d54922590a8de9aa0836004d8af9a67c5783d61b782075ba444cbb43e
SSDEEP 384:DWdkeWEGSsb7BK4/DZTe1/4ehJiY+4Hh3Ge+BeDJeemzBJJ14IygkYmYKhLyirYu:Q8KMSIRYUu0IU2P+09WOZT3
TLSH
T137A277F793E1D52E89115BF85A14AE1BCF1C061A432C3C2589D5EE87E3A3033E16E65B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 20KB
SHA256 20c0297cdca1efc886bc23eb810efa6d5fd45da77371a987e24732186343014f
MD5 0034c6d8a92f8b82d1aaf6fb0b8379fe
SHA1 84be2fc9be8eae576c0ff858e10e6cff6e57db87
SHA512 2df53d6cd3b4a381dd6a04f8476ac7b7ef0949bfda164ef4f90067c4c9780a9d01bbf26627afa63db566ff93ef001d1dbc00cc5f36aa4d6526b1203e09e9eb19
SSDEEP 384:DAvwm9FnhbNS8PldJvMeZgrwWseZbJQDgQp14AygkYAYKhLy5rYVpvusv9wR+o4f:SQHrba+wbYFr0SazW90+PR
TLSH
T107A27AF783E5D62E89115BF85610AE1BCF1D0719432C3C2989D5EE87E3A3432E16A64F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 7c9dd7b2a02fa342c52126c8ed3adc3d73212a88decbaf951f547a4caa23effd
MD5 12fb63a5cb207df22c670d2ac8b5094a
SHA1 a38085cd1c4c9ba402d843ca20de0f3c069ccf7b
SHA512 2c0fa96808648855251fb82a6836b7c664c563eb852cc5c350ddd5354ec240fa3c5eedb21756efe382d25a9cf6fcc38e893d33de375a4f1881eaa9d8200acb0d
SSDEEP 192:sxZTRlyM/jK1Ml8MkC/fqsYxxIdp8nHW6+WNmul/YLn/JrIgrJ:sxZT3MC/fqsYx6qHbF/s9
TLSH
T13252E7116A34AA77CCDBD20DF955BB53D6F9047292900E48AAFCDA1C04E6BED220781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 2f3c8211299e4c696354d450f17350413d8af2261455d50ba97b527b54f5c8b9
MD5 1078b7af278c77267132f1315937fc14
SHA1 b0038ffa41863128040704dd5f45f031d71f8e66
SHA512 a207173d3d8b6c91e952eeb80c787111ceb4c2b3f30861cf0d59fd1a81a668d8dd4df4f93dfabbffb7da0ee6d578ca5ab5df889f8bac7b4f163a94ac226f13e3
SSDEEP 192:sxZTRlyM/jK1Ml8UQmdC/fqsu6VIdpbo44yKHW6+WNsrtSZYLXmJ4rIg5wJ:sxZT3quC/fqsu6mkHbPZ+G
TLSH
T1D262F952AA346A77CCDBD20DF945BB53D6F5047296900E94AAFCDA1C04E6BED2203C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 abf71eaa946480c7ce81a5407ef172416638b3cb0c10e4734bde85b5625eb9bb
MD5 0c13ec47710d5506a8cc4dcfc26e3f3d
SHA1 2c5f644ab777b258285f54cfde95ada7023e0d9d
SHA512 afbd8db5d86dcb9487ba5f2b2a02e8ad24376d549694f9168244a4295117c8886ce937fc6967bba0fd5d63f60188757cad42f469942bf7c4eb3149f3245cfe29
SSDEEP 192:sxZTRlyM/jK1Ml8MdC/fqsu6VIdpVo44yKHW6+WNsrtSZYLzVJrIg5wJ:sxZT31C/fqsu6m2HbPZwG
TLSH
T14C52D812AA346A77CCDBD209F945BB53D6F5047296901E94AAFCDA1C04E6BDD2203C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 aea7448d6fca120e512df06bba5466f138041b9bff39d12e9dc59a5a2423b7e6
MD5 b207c0b15cba23a5eb0c9fe5192d21f3
SHA1 e461fc31a448815cbd2417e9b4eceb70106b89f1
SHA512 34ca15b260ade2004d19f4f4488c0674252dcd1e144132625ddc5ed036ced2e3227e4c9b8c761cc55dd67b9f7a42bf99a083f788dc3c4565f4c13d1d024faf22
SSDEEP 768:jbs6pD1WvxzUj8F1+UoAYDCx9Tuqh0VfUC9xbog/OVEILlWwJNEroD3:jbs6pD1WvxzUju1jahILIsNPD3
TLSH
T1EBE2FA3B680CC77E4F844E5CAC2AAE967DD801CBAB588D5447FA484C03C77EA51275DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\903a2be3-ab32-4cfa-b622-4e95ccd6e856\index-dir\the-real-index
Size 2KB
SHA256 a989d3d372f07979605dd60ab484307a43c9d55153e76bd01a3e982342fdc829
MD5 b3375622c95f9e3ca3905a8f106cd0c8
SHA1 78d485c154bbb1d9d215cd4df06e8e0941629e49
SHA512 e256a5b930c061ff4016793ff83ecc8033d1dbead6b947873b15dcb0609aa9cf324a327f5618da230c324fd5014e5545aecd7642d849ef723e96085d95cde482
TLSH
T10851D74E0DA65A5AE8A853B314B3549037B0A8CC5615DA13ACEC2130BD87B6D3C1B2A9
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5d05fe.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\903a2be3-ab32-4cfa-b622-4e95ccd6e856\index-dir\the-real-index~RFe5d05fe.TMP
Size 2KB
SHA256 5128e8facef69fd86478c5b3c72f2f14f33ad4d5d13db05c19c41b60a2b3ff53
MD5 473ac8128c896e320dde51a2345bd245
SHA1 f66f229cc9b1d469da5718e90a152084cf6675cb
SHA512 83978a97a9c2f914b9c378f3428c69f652eea09b96a66ed7082a33804377a96a3c60c7eb9fa85f7b8cbca24362d95ff8bb862be9dbc815f6b76779ed605751d4
TLSH
T11F51A69E4D824639E8D4417709E3A8B4373929008B19BF5374FC9636AC937AE3D1E2D9
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 83961461d00777d0bf4679a73a81fd5f493a1214dd4ec0927d4daa11ed213808
MD5 a46b33a2ae4677f35ca5c343f61201cb
SHA1 a8b05bb62752aa96a804eae1a4f10bab44d96ed9
SHA512 3ec5469548e3a018181e0e9f9ddc0a70c2e9f7c6a11cdb785a6ada28e291c98ce0e8caa23c9f04eceaf29438df282fc1b67ee1caa22e8f4924c9d2e9349df279
TLSH
T177E026BB6EE76830FDAFE3E7287194B50241382CC805BC4F686EE6C750B13557846C65
MD5 SHA1 SHA512 TLSH

Submit Download

2392179048729474_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Shared Dictionary\cache\2392179048729474_0
Size 63KB
SHA256 5adaaaaa2af47bb2a802bf17c3872b181fde672311123c4aaf519178613c062b
MD5 cfefc06dd6f107b5f79d62be3bf1fdad
SHA1 3e897a5fbcb238c839be0df206169b2eab619e74
SHA512 681a4864e2315934c018841db8aece2a68f2eeffc21f0e1941d70f312715ebe36ca9af28f42b041655db70dafadb26db9e04ffc8ed86de30f4509f37ca1bf373
SSDEEP 1536:Q8k3vI6lZbRXxyqxn4Y473+KrYF03iRNjkvD:Q8k3vFpxh4Y473qW7
TLSH
T160536BA6337178B3427BA1B1906F130B713EE5A7F40484F8A198EDF45E54AA60267F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 72B
SHA256 39252cf18b29c258268587c482373f9f2ec334b4c502f4af89539fa302d33442
MD5 e88001e39e3c81906764b2d5506b7228
SHA1 2046a596929ec3ff91681562459698cbbbd5ace4
SHA512 f8d376c8c3b205566056010e05e501a09ea08f7caed9e800804b05ae0e89058053c48ed591e1582ad9ddc73622dc30a6884a39de9c2f9e405a91479b93ad90af
TLSH
T1A3A0026111C231C5C5C017715AA1434063205C130711860243F02084AA9D1474105F88
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 6KB
SHA256 96a8a412d37546ffe446d701b923b6c4ed2a42341533b26de01cc6bf09d86df9
MD5 3d53c0a0e1a255b0e78a65665181d068
SHA1 37abc3918b9c56d3341e6584b3218124a25efefb
SHA512 050ed57a8d6cefbfdecaa503fe2d9ec3033d2d263a674b59e93de91957de15eedf2dd2540ed504bae4dadc1e69bdc148119c10c28cff85d496b0e6c47903e9ae
SSDEEP 96:KUAAKtePWNKKu0S+FeKWchsAK9aOy+YKT6f:iiJFxhjnM
TLSH
T10AE15B5673BA02033C7E3B0992D597678E82B1637018A46B7BED04738E66E218DFC5DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe594ef1.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe594ef1.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 1a65e7466dfc927065580383410d83b9a0010eb28d36d5d5e3ad28b1bca85194
MD5 7b124e2d69bd5e0b70d9a3794782f213
SHA1 ad26052ee317761c0b71d74c46915fbe7fc1dd5d
SHA512 72c9a36566b89ff3c1846eacd8170647a386f495d9fc8f05b7b8fece2e8103dad815433323d3b5f3c77c7c321d906ad34029cded1463a37714e9583a5b44acdb
SSDEEP 384:LZcIhsN7lIXQga9OdsMBTFPnTKwBODNZOC2KDp:ThEJg3FPnewBKZOBy
TLSH
T1E3928D715C3C6D775DE6F506F88735074EF88073EAD92E54E6EDAB1C00EA6A82306C26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 e9fdb3d446401422c209df6df814b3a0e1ed023dc129459929806e639cb3ccfb
MD5 5035104613e2ba192871f7dc862e83e8
SHA1 beca895787fce1ec64aec5642fcfbc11c3973562
SHA512 5d28ab79ec94ef0e4fc4dde40eaafe29f373e08a9d9ad791c75231fb5577cef7c61c48209b109f7fa92b7b819dbd2ca0a323c7d83a23ec6d81f20a0715f77432
SSDEEP 192:qONq6O7+3hQmiUyvRGttb0M+Fdsh2uPgGF/FU6:qONq61SGt9OdsMUFNU6
TLSH
T1B602E835AC386CB78EF2AE46B5873B135FA5113BA9952F44D6E81E1C00D765C2347827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 3d233470e5c80e034a24fe059b156e22eaff3a41d0abe63b41517baecfc11395
MD5 07be574f7826c6792682e6bb697b0601
SHA1 e9c5dc1110270029653f69c0a40ae60e4e2143b5
SHA512 f34b469ef9714ec2b1496a009b7c2f73257f40fb4f38c003d192db7f8b2241f25545e45d9996650f88fdc9bf0ca31f20bc7a9893fd063898dc2e766d304a3505
SSDEEP 384:FZcIfsN7YIU8ea9OdsMBTFPnTKwBODNZOC2KDp:9fq/g3FPnewBKZOBy
TLSH
T1CE928D715C3C6D775DE6B505F88735034EF88073EAD92E54E6EDAF1C00EA6A82306C16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 dc031a8ec6e0014ca84dd221ed3cf3608768a905b31fffbcb90c910df9ec6c5e
MD5 8d308f8234b4697d9fc333278cfc51c6
SHA1 45ce2ea2d0146241056bed96e0533b215746e185
SHA512 6dffab740a84a7e515b6b4533fc02956f80bd72dead1ecfd6a44d1d3add9e28966d4874fdec83ed4931565fdcf162f4184a8660e802401f530848f9b3e7cd0d0
SSDEEP 384:kiFzZcI+1sNF8TUNTUlIlsIO3++9ea9OdsMBeFPnTKwBODNZOC2KDp:/Frs0wg0++9/gCFPnewBKZOBy
TLSH
T1E7D22BF248EB5936D9AE9703A77E2D038EBCC063F5952950B3D8991CCC961BFD306815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 e66899208c4e91ad6767d1bd6e051a26bce6932a97e4dec977d25f19b1ebb883
MD5 c0e60ec4ae316c094996ee8a4d1fb7ff
SHA1 3131584fff4006bbf054662a59766add44aca14d
SHA512 48391db2f78da3016614c7e6588a5fa165050a043ed83b0bae4a2acb6cc21541bc8f4b90d2931db629460d96b413bcc233dc1c4bd1d9e46367842768bed3aec5
SSDEEP 384:FZcIhsN70IXQga9OdsMBTFPnTKwBODNZOC2KDp:9hbJg3FPnewBKZOBy
TLSH
T1AF928E715C3C6D735DE6F506F88735034EF88073EAD92E54E6EDAB1C00EA6A82306C26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 aaa57ede66fa334da407301b1f76887ab118c95fdeda6b424843ca0b61c2456d
MD5 139b537fb400079338bbe7f3f2bdc231
SHA1 3f3ed0ace16e0d34b4ac4a208ee9cc46a1c72258
SHA512 5709051366bbcbd6ee4df723b2eb8e46345aefabb28b7b1652836e954cfee6a650ac574c52bd97db20f87bbeba5c6ea9cfdb0a64de5bc213cd521ede01e0ede2
SSDEEP 192:tONO6O7+38QmiUygRAttb0M+Fdsh2ue7NncNFKqQuU6:tONO6KHAt9OdsMBUFPU6
TLSH
T100121A31AC686C675DE3A541F4C736138FA5417BDE8A3F90D2EC5E1C01EF66C234A816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 0a901cf9868a2f48821d9add2340e430a17a75b63a6903860aaedace83470865
MD5 5f35778c8a48b97bc939de1e346bc567
SHA1 e4fe5b8c0065d801b1eb0670c11e4db0911c3869
SHA512 e5673ac73e90e03e51deba8ebf825c3820770bd45819babcb664dd7fa70ce910f41361e2a1806e1eea2c1a4ecc1b33c416a05c4585c5c5f0d6c8b85882e9d25c
TLSH
T1DA412A58B6FA1108B7B76F5A9BF668AD483FBC772E06D55E10110E4F0662E40C861B37
MD5 SHA1 SHA512 TLSH

Submit Download

Intave.rar

Path C:\Users\Admin\Downloads\Intave.rar
Size 3.1MB
SHA256 9495632890f06b0bfcc401719be511b434720d28acf17445037709157356dbb5
MD5 b3771460667de8cc289495202b541e23
SHA1 f757795d253e3889b0f23ff999f54e67569cb941
SHA512 1f33ff8b50c62df0807ff93e8b25fc3b60530e838c04f3724140a3c042d11ff2058565039eb6b8c248b794c4b9caad660c58649ea2ee1c703b17e02e16ad04ee
SSDEEP 98304:WxOckUASq7D7Fg7QeCj6g/s971RmyZdnrU:xckUASq7kfU6g/sR1R1nrU
TLSH
T14BE533E4FF3D0485508613F1E9867D0FA2AD4ABEBC7F813B36A5F401D58AB1B086B615
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

advanced.yml

Path C:\Users\Admin\Downloads\Intave\Intave\advanced.yml
Size 11KB
SHA256 56158f94e787230928968323bb6b372e07a35f36dcd51550591497f0c30f6351
MD5 8afb1faa858f0f798bd6f8c4b5d06ca9
SHA1 dfb53b4b86fc095c02a977daa1d5f8b5a35bb54a
SHA512 6663ff2c09e88617a9869b46a25ae0afde2c2634db3f9b2274039e8b60b8e73a46c3c146a729b04dec6ccdb7ca71cb16ddc113b3de7f0f57a3164afabaf6cc3d
SSDEEP 192:0fYxpy43MzZt3VkRHR1kFjnlmzCdl/MgAtA0llzEkXVJfcV3OWDl2l8R8G:0fYxpyjkemzptJVWZOWD4lAX
TLSH
T1803285239A56A33DE9CA508430ABB0167536086B93C36A3CF64FF57C2F4E354468B39D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

config.yml

Path C:\Users\Admin\Downloads\Intave\Intave\config.yml
Size 1KB
SHA256 22809fcf837a1a388e72009140a819a058571981e0e8338253e3a9349f66f346
MD5 bdbbc0fa3affc9890c51d1cbdda32e77
SHA1 97de441ee109ed0601fee8784092232c0a23d65d
SHA512 1c0b91ec2555e81a2752cb16b688701bc312f66354a44371915c8980429ab0789af83997343669f4af19d183f981318da41d11e0ba4cdf0aaeed09416dcd13bf
TLSH
T14831D72A858C1E77965944F0740FE6F272B0A3DDF234B9A2F40E743D87A521205833D8
MD5 SHA1 SHA512 TLSH

Submit Download