hxxps://www[.]mediafire[.]com/file/rc4bw2ug193ynf8/FF5[.]2_Internal_States_MAX_setup_%281%29[.]json/file

Analysis

user interaction
yes
max time kernel
93s
max time network
95s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
04/11/2026, 18:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://www.mediafire.com/file/rc4bw2ug193ynf8/FF5.2_Internal_States_MAX_setup_%281%29.json/file
Sample261104-xndwystyft

Score

3^/10

discovery ransomware

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4092	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-240542094-4193773837-3211495583-1000\{4C657FDE-D8B3-48BD-8889-B11A1245387E}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000_Classes\Local Settings	OpenWith.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
5932	NOTEPAD.EXE

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 19 IoCs

pid	Process
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe

Suspicious use of FindShellTrayWindow 49 IoCs

pid	Process
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe

Suspicious use of SetWindowsHookEx 21 IoCs

pid	Process
5460	OpenWith.exe
5460	OpenWith.exe
5460	OpenWith.exe
5460	OpenWith.exe
5460	OpenWith.exe
5460	OpenWith.exe
5460	OpenWith.exe
5460	OpenWith.exe
5460	OpenWith.exe
5460	OpenWith.exe
5460	OpenWith.exe
5460	OpenWith.exe
5460	OpenWith.exe
5460	OpenWith.exe
5460	OpenWith.exe
5460	OpenWith.exe
5460	OpenWith.exe
5460	OpenWith.exe
5460	OpenWith.exe
5460	OpenWith.exe
5460	OpenWith.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4932 wrote to memory of 4472	4932	msedge.exe	85
PID 4932 wrote to memory of 4092	4932	msedge.exe	86
PID 4932 wrote to memory of 4664	4932	msedge.exe	87
PID 4932 wrote to memory of 4664	4932	msedge.exe	87
PID 4932 wrote to memory of 4664	4932	msedge.exe	87
PID 4932 wrote to memory of 3188	4932	msedge.exe	88
PID 4932 wrote to memory of 3188	4932	msedge.exe	88
PID 4932 wrote to memory of 4700	4932	msedge.exe	90
PID 4932 wrote to memory of 2444	4932	msedge.exe	91
PID 4932 wrote to memory of 4700	4932	msedge.exe	90
PID 4932 wrote to memory of 4700	4932	msedge.exe	90
PID 4932 wrote to memory of 2444	4932	msedge.exe	91
PID 4932 wrote to memory of 2444	4932	msedge.exe	91
PID 4932 wrote to memory of 2700	4932	msedge.exe	92
PID 4932 wrote to memory of 632	4932	msedge.exe	93
PID 4932 wrote to memory of 2700	4932	msedge.exe	92
PID 4932 wrote to memory of 2700	4932	msedge.exe	92
PID 4932 wrote to memory of 632	4932	msedge.exe	93
PID 4932 wrote to memory of 632	4932	msedge.exe	93
PID 4932 wrote to memory of 412	4932	msedge.exe	97
PID 4932 wrote to memory of 412	4932	msedge.exe	97
PID 4932 wrote to memory of 412	4932	msedge.exe	97
PID 4932 wrote to memory of 1784	4932	msedge.exe	98
PID 4932 wrote to memory of 1784	4932	msedge.exe	98
PID 4932 wrote to memory of 1784	4932	msedge.exe	98
PID 4932 wrote to memory of 3244	4932	msedge.exe	99
PID 4932 wrote to memory of 3244	4932	msedge.exe	99
PID 4932 wrote to memory of 3244	4932	msedge.exe	99
PID 4932 wrote to memory of 620	4932	msedge.exe	100
PID 4932 wrote to memory of 4032	4932	msedge.exe	101
PID 4932 wrote to memory of 620	4932	msedge.exe	100
PID 4932 wrote to memory of 4032	4932	msedge.exe	101
PID 4932 wrote to memory of 3672	4932	msedge.exe	105
PID 4932 wrote to memory of 1252	4932	msedge.exe	109
PID 4932 wrote to memory of 1252	4932	msedge.exe	109
PID 4932 wrote to memory of 1252	4932	msedge.exe	109
PID 4932 wrote to memory of 3768	4932	msedge.exe	110
PID 4932 wrote to memory of 3768	4932	msedge.exe	110
PID 4932 wrote to memory of 3768	4932	msedge.exe	110
PID 4932 wrote to memory of 3216	4932	msedge.exe	111
PID 4932 wrote to memory of 3216	4932	msedge.exe	111
PID 4932 wrote to memory of 3216	4932	msedge.exe	111
PID 4932 wrote to memory of 3420	4932	msedge.exe	112
PID 4932 wrote to memory of 3420	4932	msedge.exe	112
PID 4932 wrote to memory of 3420	4932	msedge.exe	112
PID 4932 wrote to memory of 1904	4932	msedge.exe	113
PID 4932 wrote to memory of 1904	4932	msedge.exe	113
PID 4932 wrote to memory of 1904	4932	msedge.exe	113
PID 4932 wrote to memory of 3948	4932	msedge.exe	114
PID 4932 wrote to memory of 3948	4932	msedge.exe	114
PID 4932 wrote to memory of 3948	4932	msedge.exe	114
PID 4932 wrote to memory of 5268	4932	msedge.exe	117
PID 4932 wrote to memory of 5276	4932	msedge.exe	118
PID 4932 wrote to memory of 5268	4932	msedge.exe	117
PID 4932 wrote to memory of 5268	4932	msedge.exe	117
PID 4932 wrote to memory of 5276	4932	msedge.exe	118
PID 4932 wrote to memory of 5304	4932	msedge.exe	119
PID 4932 wrote to memory of 5412	4932	msedge.exe	120
PID 4932 wrote to memory of 5412	4932	msedge.exe	120
PID 4932 wrote to memory of 5412	4932	msedge.exe	120
PID 4932 wrote to memory of 5472	4932	msedge.exe	121
PID 4932 wrote to memory of 5472	4932	msedge.exe	121
PID 4932 wrote to memory of 5472	4932	msedge.exe	121
PID 4932 wrote to memory of 5588	4932	msedge.exe	122

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://www.mediafire.com/file/rc4bw2ug193ynf8/FF5.2_Internal_States_MAX_setup_%281%29.json/file
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ff84cb6c188,0x7ff84cb6c194,0x7ff84cb6c1a0
  2⤵
  PID:4472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1756,i,6566200194905875427,9200714545354585993,524288 --field-trial-handle=2412,i,6711326671421287872,15129435782417602179,262144 --variations-seed-version --mojo-platform-channel-handle=2452 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1628,i,12551607819812084796,15446530980420302556,262144 --field-trial-handle=2412,i,6711326671421287872,15129435782417602179,262144 --variations-seed-version --mojo-platform-channel-handle=2408 /prefetch:2
  2⤵
  PID:4664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2300,i,2325980876391196959,6372311173415294002,524288 --field-trial-handle=2412,i,6711326671421287872,15129435782417602179,262144 --variations-seed-version --mojo-platform-channel-handle=2468 /prefetch:8
  2⤵
  PID:3188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3424,i,3936588241803845822,11063977964317326403,2097152 --field-trial-handle=2412,i,6711326671421287872,15129435782417602179,262144 --variations-seed-version --mojo-platform-channel-handle=3476 /prefetch:1
  2⤵
  PID:4700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3420,i,9032149056692826690,12855831793309761505,2097152 --field-trial-handle=2412,i,6711326671421287872,15129435782417602179,262144 --variations-seed-version --mojo-platform-channel-handle=3472 /prefetch:1
  2⤵
  PID:2444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4232,i,5375411387459670435,1406350008447428148,2097152 --field-trial-handle=2412,i,6711326671421287872,15129435782417602179,262144 --variations-seed-version --mojo-platform-channel-handle=4244 /prefetch:1
  2⤵
  PID:2700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4304,i,15800190355449244380,16376514337320604843,2097152 --field-trial-handle=2412,i,6711326671421287872,15129435782417602179,262144 --variations-seed-version --mojo-platform-channel-handle=4312 /prefetch:2
  2⤵
  PID:632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5068,i,202824460323679667,12490315722063448478,2097152 --field-trial-handle=2412,i,6711326671421287872,15129435782417602179,262144 --variations-seed-version --mojo-platform-channel-handle=4996 /prefetch:1
  2⤵
  PID:412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=5232,i,16513064660034615540,2059865847416632055,2097152 --field-trial-handle=2412,i,6711326671421287872,15129435782417602179,262144 --variations-seed-version --mojo-platform-channel-handle=5240 /prefetch:1
  2⤵
  PID:1784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=5704,i,249581695752144767,787337671258251581,2097152 --field-trial-handle=2412,i,6711326671421287872,15129435782417602179,262144 --variations-seed-version --mojo-platform-channel-handle=5892 /prefetch:1
  2⤵
  PID:3244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5600,i,5472555074371092396,12641516147841423139,524288 --field-trial-handle=2412,i,6711326671421287872,15129435782417602179,262144 --variations-seed-version --mojo-platform-channel-handle=5216 /prefetch:8
  2⤵
  PID:620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5616,i,9859666904471135258,12298334530336401721,524288 --field-trial-handle=2412,i,6711326671421287872,15129435782417602179,262144 --variations-seed-version --mojo-platform-channel-handle=5584 /prefetch:8
  2⤵
  PID:4032
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6488,i,13025595922903462438,2900665640835581906,524288 --field-trial-handle=2412,i,6711326671421287872,15129435782417602179,262144 --variations-seed-version --mojo-platform-channel-handle=6508 /prefetch:8
  2⤵
  PID:2896
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6488,i,13025595922903462438,2900665640835581906,524288 --field-trial-handle=2412,i,6711326671421287872,15129435782417602179,262144 --variations-seed-version --mojo-platform-channel-handle=6508 /prefetch:8
  2⤵
  PID:3672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=5228,i,15167368101385586515,1733928985284147013,2097152 --field-trial-handle=2412,i,6711326671421287872,15129435782417602179,262144 --variations-seed-version --mojo-platform-channel-handle=5320 /prefetch:1
  2⤵
  PID:1252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=6784,i,1745468094911730691,6335404421539901731,2097152 --field-trial-handle=2412,i,6711326671421287872,15129435782417602179,262144 --variations-seed-version --mojo-platform-channel-handle=5636 /prefetch:1
  2⤵
  PID:3768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=5020,i,16575404298506704034,10272298439748198993,2097152 --field-trial-handle=2412,i,6711326671421287872,15129435782417602179,262144 --variations-seed-version --mojo-platform-channel-handle=5008 /prefetch:1
  2⤵
  PID:3216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=6960,i,12279047736818094987,7343346233154315368,2097152 --field-trial-handle=2412,i,6711326671421287872,15129435782417602179,262144 --variations-seed-version --mojo-platform-channel-handle=6996 /prefetch:1
  2⤵
  PID:3420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=7124,i,11255455703584657030,8602398218653620947,2097152 --field-trial-handle=2412,i,6711326671421287872,15129435782417602179,262144 --variations-seed-version --mojo-platform-channel-handle=7140 /prefetch:1
  2⤵
  PID:1904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=7272,i,7109418391563990287,3112292449535479902,2097152 --field-trial-handle=2412,i,6711326671421287872,15129435782417602179,262144 --variations-seed-version --mojo-platform-channel-handle=7288 /prefetch:1
  2⤵
  PID:3948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=5368,i,13751955557487840666,4388106983024314293,2097152 --field-trial-handle=2412,i,6711326671421287872,15129435782417602179,262144 --variations-seed-version --mojo-platform-channel-handle=7644 /prefetch:1
  2⤵
  PID:5268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5280,i,5215587142207818305,10133553250079103109,524288 --field-trial-handle=2412,i,6711326671421287872,15129435782417602179,262144 --variations-seed-version --mojo-platform-channel-handle=5220 /prefetch:8
  2⤵
  PID:5276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7448,i,83600977113872958,12211321596095506023,524288 --field-trial-handle=2412,i,6711326671421287872,15129435782417602179,262144 --variations-seed-version --mojo-platform-channel-handle=7840 /prefetch:8
  2⤵
  PID:5304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=7984,i,3141573937514764638,10616857214001425858,2097152 --field-trial-handle=2412,i,6711326671421287872,15129435782417602179,262144 --variations-seed-version --mojo-platform-channel-handle=7980 /prefetch:1
  2⤵
  PID:5412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --metrics-shmem-handle=8164,i,42324389003085440,7552185200507931604,2097152 --field-trial-handle=2412,i,6711326671421287872,15129435782417602179,262144 --variations-seed-version --mojo-platform-channel-handle=8156 /prefetch:1
  2⤵
  PID:5472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --metrics-shmem-handle=8356,i,15023878449628275641,2517641763228900295,2097152 --field-trial-handle=2412,i,6711326671421287872,15129435782417602179,262144 --variations-seed-version --mojo-platform-channel-handle=7840 /prefetch:1
  2⤵
  PID:5588
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7384,i,1814073901224223032,6506523440552416231,524288 --field-trial-handle=2412,i,6711326671421287872,15129435782417602179,262144 --variations-seed-version --mojo-platform-channel-handle=7276 /prefetch:8
  2⤵
  PID:6132
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7384,i,1814073901224223032,6506523440552416231,524288 --field-trial-handle=2412,i,6711326671421287872,15129435782417602179,262144 --variations-seed-version --mojo-platform-channel-handle=7276 /prefetch:8
  2⤵
  PID:6140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --always-read-main-dll --metrics-shmem-handle=7380,i,8432621724972484929,2269015521500060417,2097152 --field-trial-handle=2412,i,6711326671421287872,15129435782417602179,262144 --variations-seed-version --mojo-platform-channel-handle=8188 /prefetch:1
  2⤵
  PID:3508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7268,i,13342879011014769247,652536346681518928,524288 --field-trial-handle=2412,i,6711326671421287872,15129435782417602179,262144 --variations-seed-version --mojo-platform-channel-handle=6812 /prefetch:8
  2⤵
  PID:4780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7308,i,12487973393832571049,6799402988662681868,524288 --field-trial-handle=2412,i,6711326671421287872,15129435782417602179,262144 --variations-seed-version --mojo-platform-channel-handle=3976 /prefetch:8
  2⤵
  PID:3500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7288,i,17681846227365700952,17028762759232234384,524288 --field-trial-handle=2412,i,6711326671421287872,15129435782417602179,262144 --variations-seed-version --mojo-platform-channel-handle=3980 /prefetch:8
  2⤵
  PID:4316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7768,i,14547328874948218475,13035121915925739129,524288 --field-trial-handle=2412,i,6711326671421287872,15129435782417602179,262144 --variations-seed-version --mojo-platform-channel-handle=5572 /prefetch:8
  2⤵
  PID:5996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6424,i,7807393008711203324,11929179249589005957,524288 --field-trial-handle=2412,i,6711326671421287872,15129435782417602179,262144 --variations-seed-version --mojo-platform-channel-handle=6416 /prefetch:8
  2⤵
  PID:2584

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:624

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:5460
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Downloads\FF5.2 Internal States MAX setup (1).json
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:5932

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

10b0628f-4362-4572-a0fd-bbf11976b0d7.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\10b0628f-4362-4572-a0fd-bbf11976b0d7.tmp
Size 8KB
SHA256 8291ec6d063ebf4b4899d1999c788412999f3bb5d6949d1cf165774a246861dd
MD5 4df6f6b93524214782922f59a6f77166
SHA1 cc8eb90d2f27eca9cf027ea3ff49e91b90c4fd18
SHA512 eb77b06ecffdd4bec3f91b66f92e4e5ebab6330e87e09ba486a76be548d5c656ea45ae9da707108905b04c24fd409748e6c1ab0af0a847dfc2784ae3d4adb3b1
SSDEEP 192:1ON76wlDgQmiUyPbXW4X58gZs+Fdrva2DlJ8mU6:1ON76kgIW4X58EndrS+JfU6
TLSH
T13E02EA39E9787C7B8EF2AE09F4872A139FE4112BE6552F84D6E81A1D00D775C1307927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2064299d-27a8-4c48-8db1-833143f72c94.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\2064299d-27a8-4c48-8db1-833143f72c94.tmp
Size 18KB
SHA256 81ebcdc0a473dbb4298ca0a1059f6e909217bff632d7f1bfb4ea1a74c31c26a4
MD5 8b3e622bc1db0c0ff643fe012051464e
SHA1 6fbfe124b59798e207616966a3b332f54e5189a5
SHA512 5ab772399d15dceadcf2a91afe6a0337d2cc3bf04056ab996f0b8bf63da6936e1a198daeb16eb86b5b44538238aa31252f98f369ee8a5d9a3cde6e341827d74f
SSDEEP 384:gQkUSvZsNPWUZd8YHX58EndrSBMafJKH7vBEiWIIl1:IZck2aQQjJKH75EiWL7
TLSH
T18D827D36A8A86D3B4AF3E555F14A3613EFB4D12BDAC81F90D5ED9B1C01C929C230BD16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5aa49c07-f89a-49ac-9f1c-38200f870bad.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\5aa49c07-f89a-49ac-9f1c-38200f870bad.tmp
Size 26KB
SHA256 f18a44799a86eaabef7baf8e2c6e74cc44caac8cca39e788be7db59b739a07c8
MD5 7fcedcef6a20eec11d38a0c6c2517472
SHA1 adeed58b617fce184db9f99a8eb20fcdadef0d3d
SHA512 d3d9972f6f1e3d67fa421fefca0347cfbbc4ed114e121721ead7974b3a0bb49008fe83c231800480101a3ae24f78ed10d80fb25d1051aaa69f4cf0ea988a91ce
SSDEEP 384:oiFOQkUSvPKsNx8TUNTUlIlWUZds++ZYHX58EndrSBMagJKH7vBEiWIIl1:zF+yowg7E++Z2aQQ8JKH75EiWL7
TLSH
T17AC218F298D7993AD9AE9B17E37D2D039EBCC067F5845A50B389461CCC861BFD306811
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3f784286-dedc-431f-b5c5-499afc8bd881.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\3f784286-dedc-431f-b5c5-499afc8bd881.tmp
Size 105KB
SHA256 dcc5e5a44077d428b0e344ee45b3099e7eff2ebbdd8273ef1ec772721b41a5af
MD5 2b868614fa0b813f62a2463cf5176c67
SHA1 81b9a2da4d126d229190379b81cd945cd7b5b900
SHA512 34e1f30cbfede4f1f7f1c635e707b7391a5a20f0cfa6a316714dca4d73ebf5b8fc4dbe0bb321a92d46b6cfe02713df76143a1642643c1fe3dcf2ca3319f0ecb5
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7P:fwUQC5VwBIiElEd2K57P7P
TLSH
T16FB3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 98f220c14bd3d385f1dd482d8b868745c75685e4a2573b4336f235cf3bdce6c1
MD5 6ce50f5d79ab86d6489a63e08ead9ec4
SHA1 d52fb22446c08230d0edc8374b1dcaed1af585ea
SHA512 fd66aaada3f82de40a9236f167ecb23bc285a49f72374f567e078118a8bdb229e4fadc26c639553cfacaa7d7ba44e0419f17b4bb4a9a8999b51bdd037a28783a
TLSH
T189D02BF4E69455E4D441283C11130304314CC4001C033010C46141D21D8D7C2009A068
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 49ad6872da0e53fa2156de2ab29aae15d756e399214100166ee3b981776c9e71
MD5 ec47d7bcfb6fcae0bf0c2b01172a50ce
SHA1 20474467d868ddc238b4a6f05bd8c60a9a69235e
SHA512 38fc241b6dcada0c5d074fcd3a03d2786292deff2b4e86af77e745f823ab3f7a20920fec3c454838305c94f586355a5c360fd844cb107f4a9279878245548c61
TLSH
T19FD0807175273DFDD19D667C05515A405104CE53595115108A134D551E9C6C27CD3EDC
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 02cf6c2debe9573f3713554c359339f3deb6fa4abd8c14fc6d2577e42ce2d830
MD5 eec56aca3717cde66f2f4d578de1d4d9
SHA1 965ee07ac77588f49d8c4fdf547b37349747a74f
SHA512 90d05594a407bba8ca844c3df6d127aec4c8ecb87f3d2106da447965d8445c3863cdc5a376c90818be642f5dbacedbbb845f24cc640f422e049733d24470df99
TLSH
T163D02BF4A6D459E4D841283C11130304314CC4001C037111C46141D20D8E7C2009A068
MD5 SHA1 SHA512 TLSH

Submit Download

4b42ae38-1907-43c7-9ed8-dc31d0dc6e09.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\4b42ae38-1907-43c7-9ed8-dc31d0dc6e09.tmp
Size 27KB
SHA256 99aadb277a98f75a56b620c356ad6776e134d440ce0d25bf03542abff6995279
MD5 c902b9eb77eeb65cdc857f970fb116e6
SHA1 f9e9783bdde9e5e48fa86210a9cbabb3e8094d12
SHA512 9f72e826496f2b09702c4994b3f16852430841bd249934cd75c5fd8c4c7a2005cbe141328193a64958d711f3f70e3eb12cd98f08f09e68fe94597ae8a4ace27c
SSDEEP 768:tqy4J/DWvbtJh8F1+UoAYDCx9Tuqh0VfUC9xbog/OVCiLlc2TburoRjnV:tqy4J/DWvbtJhu1jajiLm0blNV
TLSH
T1A7C20B3B644CCA7E4FC00A9DED5E6FDB3E9802C79A948D4047FA994C02C77EA51264DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9bc7ad71-a5b3-46cb-af67-64dfd9598c07.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\9bc7ad71-a5b3-46cb-af67-64dfd9598c07.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 4e48c6944311e331d4c8a7982b8835dc1576c125b661616ec4cbaef18cdbfab8
MD5 a6ab63755e4589aab3abdd425838639b
SHA1 c1a985579a1535edf4f57162bd62ff8e5336cd38
SHA512 307294daf97b26971f27001b42a8491c354c2e2cfb1f54a5ab9f552e86d006f0e9880e4f338e9b8f44a2d22be2d316723b8ce471dbaa1fbc2460a4989e0c7372
TLSH
T16AE0269644C8C23EB708764B11AF538CD2A0362A93C0AD0F2B09CC847801040A2866E4
MD5 SHA1 SHA512 TLSH

Submit Download

61ce0db95edc5e0b_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\61ce0db95edc5e0b_0
Size 276B
SHA256 20762633308f789c34b3b68c27171eda56eb5a3e4148d4cc823d00e36042023d
MD5 e0a6a5423a450d73283e336a41cdb6ee
SHA1 74a103eb85b7c1d11face109550e048eccca1f29
SHA512 48ea7bc2b9efb5efaa7d6ffd3e45da4a6e8d0a4858e39a8944faa85f9a570da1133f1627c9390232b985981fcaf7044d9e2950296cc68e8d70de3401e23b98eb
TLSH
T1FCD095D394001505D33E05F5E517A557D30505D52499D7D24700F1734D510707CD1B2D
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 5KB
SHA256 f385c99f5db8736b1adad8526d1aceb34203493fd91c4ad060246dd7f2625c5f
MD5 c611d1a6b3f1480ca34f486dbfc745ee
SHA1 57cbe8ca2c1ab3d06a305a2e83823b03a1ac7662
SHA512 3e426d1a033f28b3973cd5e76eebfbb7cbd13d2da209d21d17cfcf225cabef8960e10d3add4bc70a7a887fec60a6d0e1c54bb8de63b251630d2a1682537fcf70
SSDEEP 96:xzl9AyhXnL/m7J1ux5Mth80jcftERZXyU/M992:xcSXU1GGDg0ZX1MH2
TLSH
T122B1A7828ACCC5E2D7061A7583F6388734BB8EB545A37F62E588F4B747B23906631334
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 83d4e5ed422dcc2ae65a14afe6a54e12a3ba046b7dc36b15d6f424981477fd85
MD5 bd80977823030ce37ac9792284a54b1d
SHA1 0541173578529cb578f1b6e1789c6b35b099c272
SHA512 02a18e5bb8f72937f6c797aacc3ebcf7e730902765a3e31733fb7b21d6966b1b43b0ce1e16d4975c99a31976e69d62663079f01f16057eac799d595f270283e8
TLSH
T1F0613C834BD14064D35B8EB4C7E6268739F78EB44297BE3209E4C4FB5BA73656B34208
MD5 SHA1 SHA512 TLSH

Submit Download

82a79aee-01d6-4593-8e71-3e6672e19095.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\82a79aee-01d6-4593-8e71-3e6672e19095.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

013c66b9-85e2-46ac-a235-d000a2fc228f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\013c66b9-85e2-46ac-a235-d000a2fc228f.tmp
Size 25KB
SHA256 6365871b9cccd56bbe05cdf67b0cd23abffccd54dec503dde012c7fa10f8e860
MD5 2ec6e243b3eee5595720240c9bd427f5
SHA1 25663c9ee8fb7c38917bbfc45d4ea77f15706d44
SHA512 5044bfe53442f20f7bed72a740594cee5de850ffff4b1e4e71aac9837d9a77755fc1ac1e9aa8fa2596481e0161cf7eb27c2da29f71f6c4d854ddf05253003913
SSDEEP 384:DaQlZqDBXg182fleoA2dTeXkJ137eYfLppJHkqRBFVy4ICF4r6YmYXrLAhYglx72:53L4hRv/fEKkGl/Bjdw4
TLSH
T120B2BBF383E5D56E991157F85A10AE1BCF1D1719832C3C2688D5EE87E3E2032E15A64F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9155dfb8-c1a9-4aff-a436-7042b96d8bf6.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\9155dfb8-c1a9-4aff-a436-7042b96d8bf6.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

97370c3a-3182-4f4c-b085-950432d24cc5.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\97370c3a-3182-4f4c-b085-950432d24cc5.tmp
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

c71693a918d55e64_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Shared Dictionary\cache\c71693a918d55e64_0
Size 63KB
SHA256 000b3a4fecab2c593315158d3eb228ba9408bdbdea1323db16260c0974d3af6a
MD5 ca1b1e1b130db533d19f20d81ab0cf77
SHA1 b9371c37f0123ca17f86353accbbaeb312bf721e
SHA512 5b8865966e1c8d7eba6d1d9278c28263b0f2c53595277af01de0cc47c75cb47ad460ad784230daf19081e587ab8248dd9f86878b0df73f56c3c3e639fb5bf19a
SSDEEP 768:Iv2ucYDMn9uuApMJTACnZvSkRKGE84MA/wcO+eEVWhrJTfqe5opax2bUEAgNt8yD:I36JLVSkRK8Su+Dof1mpaxQvfNKWP3i
TLSH
T10F535CDA7361B0B3427BA1F1906F1207713BF1A7F448C4E4A195DCE06E54AAA4277FAC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Shared Dictionary\cache\index-dir\temp-index
Size 72B
SHA256 52327a120970e1ab8db15266265f2cd501f50c20eb151902f309cad5291964c2
MD5 58f3c1ffcd83d1de78f6b933e1a0665a
SHA1 f95248f401fb1457bc212744199c70d59ba6ca3a
SHA512 31cc6aac6e3b4c13ba8e95031c0c36ff520298eda4369bcb3a4e93443249a5f6be104f9a02a86ab02b23db59722172bfaf9826b103649eb11e38bbaf4194a277
TLSH
T16AA0021059C47486C01003B01FE6118627509D1147115386C9D065D8EC7C1525945361
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 6b56b215d7dbb76c5b7476a7efbc65377a26da3f8f954ad8412d1b0b15f97f78
MD5 3ac0d5e37243efd1ef43b1491610e059
SHA1 f58bea85d6b89ad8ef8da243a40d61475ecc8337
SHA512 35e2b54ba8e2742697bc5130d8a2187fb590109a575f7c3eebff8ec5eb68356df1bee0c688584c9e009204344170bf5433dad3707452d032402e0c77d1084d70
SSDEEP 48:KIDI1Ks04jyL98xN/rvQbjWDISFQK9F1nQxVAYGH99yLHqTnpJZybRcBIS3yK93e:KIDCKs0+SC0KraqakAKNyd
TLSH
T1B491F15630BB064138BE3A588075D72E128236B37119EA3BFFBC80615E6BE081DFD4D9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b9ac955e-0a53-4b73-a535-b89f6712feff.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\b9ac955e-0a53-4b73-a535-b89f6712feff.tmp
Size 11KB
SHA256 1382459b95586585717b5765f4791a70b669e653bf2262dd544dc5c0c808130a
MD5 070db0c28b6d6630a8822a3ed15ced38
SHA1 96c401e19dd1f2a54e39d8dfcc074dd26d3e3f17
SHA512 63cc2d0b6a1e611136fbb9d5ea3c8acec0a19613ff67d5ef73a10ac61ae3456e62032be9fb7fb86020f5adabd7c453b860be2bcac986bd6c1f1fa54d4c426e06
SSDEEP 192:sxZpRnPU/fhsss7qIdpVdeLyMHW6+WNruBVs0kXYr642KIg5iJ:sxZpJU/fhsss7jaHbyMXY4
TLSH
T10E32A652AA74697B8CC6D21DFA15BB53E2FD503291901E44AAFCCA1C04E6ADD234780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d328296c-7658-42c8-ad1a-a0d96277c558.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\d328296c-7658-42c8-ad1a-a0d96277c558.tmp
Size 9KB
SHA256 217c9da139ef59ae4eb2c38a7b481c3820d225d96b68469560e842ccb755befe
MD5 cd71de86d27e0e4f53370bafe1c9981d
SHA1 be030ffb9f0936db89dfd66a3f33688af5cd97e5
SHA512 a5f1aa8a8579f99512a54cfea4410aa1f2eb45e664bed8abcd9a26e4b8d06970d99873e101a70bb2f48a5ee711c035777b6f763263f09f9aa463ef1bc05ab93c
SSDEEP 192:sxZeRnWU/fhsGY79Idp8uHW6+WNm7Z/a/YrkJ52KIgrJ:sxZeYU/fhsGY7+vHbwJa/D59
TLSH
T12622A7566E28A97B8CC7D219FA25BF53D6F9503291941E48AAFCC61C04E7ADD230780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dd76060a-c4c4-46e3-b586-bada07aff2ed.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\dd76060a-c4c4-46e3-b586-bada07aff2ed.tmp
Size 11KB
SHA256 8228ff4edc910d858684896f67a3026bddeccb9f8f43786f75d6cca91e76c07a
MD5 514d5a42108c8dfc966e8e4a986db07c
SHA1 0c6dcf68a326210816e64d1ee2ef4067e5c52326
SHA512 30ee40ef3edc4d68930e378a9d03a3659a0ebb24ea917b411fb4f58085fa9a4beca4fae31c060a1b4f52f0b37ea748afc873f768bfdbba565e4fe66f16412392
SSDEEP 192:sxZpRnPU/fhssY7qIdpVdeLyMHW6+WNruBVs0kXYrR72KIg5wJ:sxZpJU/fhssY7jaHbyMXKq
TLSH
T18932B652AE74697B8CC6D21DFA15BB53E2FD503191D01E88BAFC8A1C04E6ADD234780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e1be0481-7dc3-4c09-8e1e-e7fbcacb5354.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\e1be0481-7dc3-4c09-8e1e-e7fbcacb5354.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ad575501-bf15-44c7-86b2-62dd013349cc.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\ad575501-bf15-44c7-86b2-62dd013349cc.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b2a3dd6f-9d2b-44a0-a9a7-80080d7ff7dc.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\b2a3dd6f-9d2b-44a0-a9a7-80080d7ff7dc.tmp
Size 8KB
SHA256 4a9e678e4d47c63a4df17848c811c73d8152115f31cd5408cb712429378fa550
MD5 01637f4c80ef803715c1e6afa2f74abb
SHA1 05c97319a75a44fc3df591475174d5bda1b2a8fe
SHA512 d589b330e16297592a90481465f466365f64f6cafb06213eaa83f3bd55555558c13ba078b110ffef62610ce1d8ec7f6fd30bf95f3ceced97befa8a3e61549802
SSDEEP 192:iON66wlDvQmiUyXbXe4X58gZs+Fdrva+KMajveJAqz8U6:iON66kx2e4X58EndrSBMaiJKU6
TLSH
T1A7121935E8B8AC3B5DE2A849F08735139FE45127EA897F94D6EC1B1C00DE26C130AC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b2e10765-e2f2-471c-8d06-5423a703ef46.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\b2e10765-e2f2-471c-8d06-5423a703ef46.tmp
Size 18KB
SHA256 4ab8783d76a4efbee29720d64b548f2362985a927e95fd4d1fd6f4da8ce8d9c3
MD5 48601a842829ea505886a781c04e2174
SHA1 181256709a57564334466ab2823a2dc1984fae67
SHA512 d055583224ce8b5602f957132f0d2a2f4b7fbffab5210a48de66f5e8a2a9299829692317aab9cd6d3eb0a2dc8ce7006c8150390bc677ccf03bb62b9acfba2129
SSDEEP 384:YQkUSv0sNPBUZO4CHX58EndrSBMacJKH7vBEiWIIl1:Q0dhkaQQoJKH75EiWL7
TLSH
T10A828E36A8B87D3B4AF2E515F14A3603AFB4D127EAC81F90D5DD9B1C00D929C230BD16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c75652b1-6ffc-4962-bc88-7d83c2b0e021.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\c75652b1-6ffc-4962-bc88-7d83c2b0e021.tmp
Size 18KB
SHA256 9f8febcf82ef66c5cf8cb3045f8293570ba8907332fed08490afbec2124b2747
MD5 482f114b483ad3c064cb9977a4c9896b
SHA1 e2c7e5b5eec777b504d1816ac876801ae35a7415
SHA512 68555e058ca879ea40bdd936fb20a7c3d3c27677f20c4150640afb4006a298e7a1c2ba87805cd0841c5d7d1e8802ccf396ad279d69a0386c51b5f58c2c61c2e0
SSDEEP 384:YQkUSvQsNPnUZg8YHX58EndrSBMafJKH7vBEiWIIl1:QQT/2aQQjJKH75EiWL7
TLSH
T18A827E36A8B86D3B4AF2E515F14A3603EFB4D12BDAC81F90D5DD9B1C01D929C234BD16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

64a4a4ed-7947-4c80-a063-9e48d2c77aaf.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\64a4a4ed-7947-4c80-a063-9e48d2c77aaf.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 fa8cb6378046ba43fe8d05fad11c508315315cb2490ef6c968f341f9dbab7132
MD5 0b44444005394d33c4c6603176e15098
SHA1 4c4da37e035415b90ae4957476ee593c0c6b6aaa
SHA512 4ef0a188c52f535a5240e885cd487af4122305508a51b50f91c44f50d6d70a2d767548d6da83ded2a0588b11a51157b77f17f04f78e695c8ea10d07f769fc45f
TLSH
T1FE41F698B6EA1148B3B77F569BF7A96D447FB9372F06D45D00010D4E0A22A44C871737
MD5 SHA1 SHA512 TLSH

Submit Download

FF5.2 Internal States MAX setup (1).json.crdownload

Path C:\Users\Admin\Downloads\FF5.2 Internal States MAX setup (1).json.crdownload
Size 132KB
SHA256 93cdf968c919cfb7ebb9357a3deba3f19709732562fdf922c12f24a8ac6eb836
MD5 e0fb6614749943734a7e0f657bdd0a8a
SHA1 1733d08e5c7b960672ad3434a03e38fc5c6a31dd
SHA512 e3ffe20865accea5bdc628d56b19991e1363b4aece42f66196fc60e4eba1422c2ed65bc809814a6a7f61dff5a497350e85387ecf49e7b4322c7072c88ee6ba3d
SSDEEP 3072:wtz16cw6gbB4zEKny6bEdCfGiN5nmb3YrVBQMKsM/i5+:Mz16n5bB4zEKy6msjN5nmb3YrVBQMKsi
TLSH
T1C1D30826FB901A6507970265F96EA6D3B374910B1B083D14BCDC806C2F8E37E5276FE9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads