hxxps://www[.]mediafire[.]com/file/vd4v8najbodr5nt/NWR6V2[.]zip/file

Analysis

user interaction
yes
max time kernel
149s
max time network
150s
platform
windows11-21h2_x64
resource
win11-20260911-en
resource tags

arch:x64arch:x86image:win11-20260911-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
22/09/2026, 16:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://www.mediafire.com/file/vd4v8najbodr5nt/NWR6V2.zip/file
Sample260922-tfstcss14m

Score

7^/10

defense_evasion discovery execution persistence ransomware

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002
Stops running service(s) 4 TTPs
defense_evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Launches sc.exe 6 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
5068	sc.exe
3088	sc.exe
5560	sc.exe
5636	sc.exe
5680	sc.exe
5048	sc.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1300	cmd.exe
2604	cmd.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3916	msedge.exe

Delays execution with timeout.exe 1 IoCs

defense_evasion

pid	Process
4864	timeout.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134345664414939002"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2293636880-3790684622-1477845016-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2293636880-3790684622-1477845016-1000\{86FBC899-9CD0-47DE-B6BF-DBBBE002D410}	msedge.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\NWR6V2.zip:Zone.Identifier	msedge.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
4780	NOTEPAD.EXE

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2396	msedge.exe
2396	msedge.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
684	Process not Found
684	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 15 IoCs

pid	Process
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe

Suspicious use of FindShellTrayWindow 49 IoCs

pid	Process
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2312 wrote to memory of 5152	2312	msedge.exe	80
PID 2312 wrote to memory of 5856	2312	msedge.exe	81
PID 2312 wrote to memory of 3916	2312	msedge.exe	82
PID 2312 wrote to memory of 5856	2312	msedge.exe	81
PID 2312 wrote to memory of 5856	2312	msedge.exe	81
PID 2312 wrote to memory of 3608	2312	msedge.exe	83
PID 2312 wrote to memory of 3608	2312	msedge.exe	83
PID 2312 wrote to memory of 5572	2312	msedge.exe	85
PID 2312 wrote to memory of 5572	2312	msedge.exe	85
PID 2312 wrote to memory of 5572	2312	msedge.exe	85
PID 2312 wrote to memory of 3240	2312	msedge.exe	86
PID 2312 wrote to memory of 3240	2312	msedge.exe	86
PID 2312 wrote to memory of 3240	2312	msedge.exe	86
PID 2312 wrote to memory of 3640	2312	msedge.exe	88
PID 2312 wrote to memory of 3640	2312	msedge.exe	88
PID 2312 wrote to memory of 3640	2312	msedge.exe	88
PID 2312 wrote to memory of 3324	2312	msedge.exe	89
PID 2312 wrote to memory of 3324	2312	msedge.exe	89
PID 2312 wrote to memory of 3324	2312	msedge.exe	89
PID 2312 wrote to memory of 1472	2312	msedge.exe	90
PID 2312 wrote to memory of 1472	2312	msedge.exe	90
PID 2312 wrote to memory of 1472	2312	msedge.exe	90
PID 2312 wrote to memory of 2728	2312	msedge.exe	91
PID 2312 wrote to memory of 2120	2312	msedge.exe	92
PID 2312 wrote to memory of 2728	2312	msedge.exe	91
PID 2312 wrote to memory of 2120	2312	msedge.exe	92
PID 2312 wrote to memory of 4788	2312	msedge.exe	93
PID 2312 wrote to memory of 4788	2312	msedge.exe	93
PID 2312 wrote to memory of 4788	2312	msedge.exe	93
PID 2312 wrote to memory of 4676	2312	msedge.exe	94
PID 2312 wrote to memory of 4676	2312	msedge.exe	94
PID 2312 wrote to memory of 4676	2312	msedge.exe	94
PID 2312 wrote to memory of 4072	2312	msedge.exe	95
PID 2312 wrote to memory of 4072	2312	msedge.exe	95
PID 2312 wrote to memory of 4072	2312	msedge.exe	95
PID 2312 wrote to memory of 3380	2312	msedge.exe	96
PID 2312 wrote to memory of 3380	2312	msedge.exe	96
PID 2312 wrote to memory of 3380	2312	msedge.exe	96
PID 2312 wrote to memory of 416	2312	msedge.exe	97
PID 2312 wrote to memory of 2148	2312	msedge.exe	98
PID 2312 wrote to memory of 416	2312	msedge.exe	97
PID 2312 wrote to memory of 416	2312	msedge.exe	97
PID 2312 wrote to memory of 2148	2312	msedge.exe	98
PID 2312 wrote to memory of 2148	2312	msedge.exe	98
PID 2312 wrote to memory of 1140	2312	msedge.exe	99
PID 2312 wrote to memory of 3944	2312	msedge.exe	100
PID 2312 wrote to memory of 3944	2312	msedge.exe	100
PID 2312 wrote to memory of 3944	2312	msedge.exe	100
PID 2312 wrote to memory of 4704	2312	msedge.exe	102
PID 1140 wrote to memory of 6112	1140	msedge.exe	103
PID 2312 wrote to memory of 1048	2312	msedge.exe	104
PID 2312 wrote to memory of 5412	2312	msedge.exe	105
PID 2312 wrote to memory of 1048	2312	msedge.exe	104
PID 2312 wrote to memory of 5412	2312	msedge.exe	105
PID 2312 wrote to memory of 5412	2312	msedge.exe	105
PID 2312 wrote to memory of 5444	2312	msedge.exe	106
PID 2312 wrote to memory of 5444	2312	msedge.exe	106
PID 2312 wrote to memory of 5444	2312	msedge.exe	106
PID 2312 wrote to memory of 3628	2312	msedge.exe	107
PID 2312 wrote to memory of 4516	2312	msedge.exe	113
PID 2312 wrote to memory of 5656	2312	msedge.exe	114
PID 2312 wrote to memory of 2420	2312	msedge.exe	115
PID 1300 wrote to memory of 5068	1300	cmd.exe	119
PID 1300 wrote to memory of 3088	1300	cmd.exe	120

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://www.mediafire.com/file/vd4v8najbodr5nt/NWR6V2.zip/file
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x2f0,0x7ff9713fc188,0x7ff9713fc194,0x7ff9713fc1a0
  2⤵
  PID:5152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1588,i,32480986893992360,13201997688036852543,262144 --field-trial-handle=2140,i,17154869738553413963,2361725734405955309,262144 --variations-seed-version --mojo-platform-channel-handle=2136 /prefetch:2
  2⤵
  PID:5856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1828,i,15852568616277738503,5460431634894659192,524288 --field-trial-handle=2140,i,17154869738553413963,2361725734405955309,262144 --variations-seed-version --mojo-platform-channel-handle=2216 /prefetch:11
  2⤵
  - System Time Discovery
  PID:3916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2416,i,11021624583073512184,15915709697343677080,524288 --field-trial-handle=2140,i,17154869738553413963,2361725734405955309,262144 --variations-seed-version --mojo-platform-channel-handle=280 /prefetch:13
  2⤵
  PID:3608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3520,i,16585507972202569935,2144245891350842931,2097152 --field-trial-handle=2140,i,17154869738553413963,2361725734405955309,262144 --variations-seed-version --mojo-platform-channel-handle=3560 /prefetch:1
  2⤵
  PID:5572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3548,i,14670836107986119261,3568075872078823904,2097152 --field-trial-handle=2140,i,17154869738553413963,2361725734405955309,262144 --variations-seed-version --mojo-platform-channel-handle=3616 /prefetch:1
  2⤵
  PID:3240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4952,i,17695359192034758371,6097198592095224769,2097152 --field-trial-handle=2140,i,17154869738553413963,2361725734405955309,262144 --variations-seed-version --mojo-platform-channel-handle=4968 /prefetch:1
  2⤵
  PID:3640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=5060,i,15080433792411377880,6221639699319213926,2097152 --field-trial-handle=2140,i,17154869738553413963,2361725734405955309,262144 --variations-seed-version --mojo-platform-channel-handle=5096 /prefetch:1
  2⤵
  PID:3324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5356,i,14632549522892991721,16713610926485504492,2097152 --field-trial-handle=2140,i,17154869738553413963,2361725734405955309,262144 --variations-seed-version --mojo-platform-channel-handle=5376 /prefetch:1
  2⤵
  PID:1472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4860,i,3418525006474229859,3618210427851165300,524288 --field-trial-handle=2140,i,17154869738553413963,2361725734405955309,262144 --variations-seed-version --mojo-platform-channel-handle=4996 /prefetch:14
  2⤵
  PID:2728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3500,i,9312501539794948273,6263141735692249061,524288 --field-trial-handle=2140,i,17154869738553413963,2361725734405955309,262144 --variations-seed-version --mojo-platform-channel-handle=5032 /prefetch:14
  2⤵
  PID:2120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=5756,i,9765547695126682629,6047664830408574855,2097152 --field-trial-handle=2140,i,17154869738553413963,2361725734405955309,262144 --variations-seed-version --mojo-platform-channel-handle=5392 /prefetch:1
  2⤵
  PID:4788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=5780,i,5245023381288422558,13372709679078895791,2097152 --field-trial-handle=2140,i,17154869738553413963,2361725734405955309,262144 --variations-seed-version --mojo-platform-channel-handle=5928 /prefetch:1
  2⤵
  PID:4676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=6100,i,15736138282061025630,7899404973953269004,2097152 --field-trial-handle=2140,i,17154869738553413963,2361725734405955309,262144 --variations-seed-version --mojo-platform-channel-handle=6120 /prefetch:1
  2⤵
  PID:4072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=6628,i,10921753033217088593,2435512603518014423,2097152 --field-trial-handle=2140,i,17154869738553413963,2361725734405955309,262144 --variations-seed-version --mojo-platform-channel-handle=6664 /prefetch:1
  2⤵
  PID:3380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=6788,i,10228244144115538339,3755568008085940405,2097152 --field-trial-handle=2140,i,17154869738553413963,2361725734405955309,262144 --variations-seed-version --mojo-platform-channel-handle=6824 /prefetch:1
  2⤵
  PID:416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=6804,i,17364692070857094789,2414393356817282087,2097152 --field-trial-handle=2140,i,17154869738553413963,2361725734405955309,262144 --variations-seed-version --mojo-platform-channel-handle=6828 /prefetch:1
  2⤵
  PID:2148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7308,i,8262625529984214168,2197431089651580690,524288 --field-trial-handle=2140,i,17154869738553413963,2361725734405955309,262144 --variations-seed-version --mojo-platform-channel-handle=7312 /prefetch:14
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1140
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
    cookie_exporter.exe --cookie-json=1100
    3⤵
    PID:6112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=7384,i,12331115569183623261,359317185270627485,2097152 --field-trial-handle=2140,i,17154869738553413963,2361725734405955309,262144 --variations-seed-version --mojo-platform-channel-handle=7396 /prefetch:1
  2⤵
  PID:3944
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7556,i,9076489488073621402,14858151577259441510,524288 --field-trial-handle=2140,i,17154869738553413963,2361725734405955309,262144 --variations-seed-version --mojo-platform-channel-handle=7572 /prefetch:14
  2⤵
  PID:1620
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7556,i,9076489488073621402,14858151577259441510,524288 --field-trial-handle=2140,i,17154869738553413963,2361725734405955309,262144 --variations-seed-version --mojo-platform-channel-handle=7572 /prefetch:14
  2⤵
  PID:4704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7704,i,17502831868967113991,1741834123246621295,524288 --field-trial-handle=2140,i,17154869738553413963,2361725734405955309,262144 --variations-seed-version --mojo-platform-channel-handle=7768 /prefetch:14
  2⤵
  PID:1048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=7724,i,10789985209295685043,5422989250014522117,2097152 --field-trial-handle=2140,i,17154869738553413963,2361725734405955309,262144 --variations-seed-version --mojo-platform-channel-handle=7812 /prefetch:1
  2⤵
  PID:5412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=7584,i,436066509147326679,4079626240139470263,2097152 --field-trial-handle=2140,i,17154869738553413963,2361725734405955309,262144 --variations-seed-version --mojo-platform-channel-handle=5112 /prefetch:1
  2⤵
  PID:5444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7344,i,13304795835972531933,7140504603468310642,524288 --field-trial-handle=2140,i,17154869738553413963,2361725734405955309,262144 --variations-seed-version --mojo-platform-channel-handle=5084 /prefetch:14
  2⤵
  - NTFS ADS
  PID:3628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7632,i,13881758934665525851,3189173119069266495,524288 --field-trial-handle=2140,i,17154869738553413963,2361725734405955309,262144 --variations-seed-version --mojo-platform-channel-handle=748 /prefetch:14
  2⤵
  PID:4516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7416,i,17411700061086945489,15971938412457244045,524288 --field-trial-handle=2140,i,17154869738553413963,2361725734405955309,262144 --variations-seed-version --mojo-platform-channel-handle=6724 /prefetch:14
  2⤵
  PID:5656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5752,i,12404466546268462292,8556417732391927191,524288 --field-trial-handle=2140,i,17154869738553413963,2361725734405955309,262144 --variations-seed-version --mojo-platform-channel-handle=6672 /prefetch:14
  2⤵
  PID:2420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5744,i,3149926648663278758,4921029013776511859,524288 --field-trial-handle=2140,i,17154869738553413963,2361725734405955309,262144 --variations-seed-version --mojo-platform-channel-handle=5736 /prefetch:14
  2⤵
  PID:2712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5688,i,12362003943739797909,9854854798373836814,262144 --field-trial-handle=2140,i,17154869738553413963,2361725734405955309,262144 --variations-seed-version --mojo-platform-channel-handle=8008 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2396

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1412

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5648

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4868

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Downloads\NWR6V2\NWR6V2\ReadMe.txt
1⤵
- Opens file in notepad (likely ransom note)
PID:4780

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\NWR6V2\NWR6V2\load_and_run.bat" "
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1300
- C:\Windows\system32\sc.exe
  sc create WinDrvMgr type= kernel start= demand binPath= "C:\Users\Admin\Downloads\NWR6V2\NWR6V2\Build\Release\SebwettKM.sys"
  2⤵
  - Launches sc.exe
  PID:5068
- C:\Windows\system32\sc.exe
  sc start WinDrvMgr
  2⤵
  - Launches sc.exe
  PID:3088

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\Downloads\NWR6V2\NWR6V2\load_and_run.bat"
1⤵
- Executes a command shell one-liner
PID:2604
- C:\Windows\system32\sc.exe
  sc create WinDrvMgr type= kernel start= demand binPath= "C:\Users\Admin\Downloads\NWR6V2\NWR6V2\Build\Release\SebwettKM.sys"
  2⤵
  - Launches sc.exe
  PID:5560
- C:\Windows\system32\sc.exe
  sc delete WinDrvMgr
  2⤵
  - Launches sc.exe
  PID:5636
- C:\Windows\system32\timeout.exe
  timeout /t 2 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:4864
- C:\Windows\system32\sc.exe
  sc create WinDrvMgr type= kernel start= demand binPath= "C:\Users\Admin\Downloads\NWR6V2\NWR6V2\Build\Release\SebwettKM.sys"
  2⤵
  - Launches sc.exe
  PID:5680
- C:\Windows\system32\sc.exe
  sc start WinDrvMgr
  2⤵
  - Launches sc.exe
  PID:5048

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

System Services

T1569

Service Execution

T1569.002

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 7331d61b72578f10058ae20f1a7351dc99070a754006884c0b775bb57bffd9cc
MD5 df1098b0a62fea8609e624a81ae2865a
SHA1 eb148addd613d8dae155058eacdf967eae295b15
SHA512 0ec5916b4d090394f668a1ee0ca76c2125146f8b8507c9e7dd1bb90a8aed21e61551b85c2a32b975aea241df7bda238c513a58ebe378cd3af3d77e71803ef6d8
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7s:fwUQC5VwBIiElEd2K57P7s
TLSH
T1D2B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 23c0c8725265dc38d2585d79464cd2555edaf25d784e2ab6029faf34bdea2dea
MD5 113ce15722a691d6f3892a26aa5a3c3b
SHA1 8d04ac93654e4ce7e89abe2dcbcdf9f598574f17
SHA512 5f9956e906191837370644e431878c6ea7d621d81fa8aed8db6c53cfcda126665a3c6bbf6905a967717159798ffde26df324c7de763b82b79a14f118e03c4ea0
TLSH
T1A3D0C0005CF976E4D032103F013010003FCC544307026106E080003E0D941C306918F3
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 83eeb6fb69147b86d59db93f6bef3b9700e1a01b1e16b7737138a14705b925ec
MD5 1261625a6979743cb430cc1e4a6c87ca
SHA1 3447cdabba89527c05d21de5b837debaa8dddd5d
SHA512 81eea7d5abc59ff723b0b7dcf56140c4ca4b98afc852eb03d6c02eb17e7ee2a4ed4c221a99cd4babf2c7e6721d787537a34f58357037ab616e168d5434558f41
TLSH
T13DD02B80ACD56104C0031437006161103F9894440906E012D0C0027E09C5AD30755062
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 d06c655b2480a29ad334636f95a35c5bdce83a66295adea08a8856dcd298e39e
MD5 5dab4062f87d6ffd5dbc44ebf48fd8c6
SHA1 bffdeffc524afddf1ff9a0fbcfae676c4de6a3ac
SHA512 df19db1241309a372c6eeb5a332eb1a5cf13caf28f98f4b9727e26379c541aea8e4d6c5acea40f3adbe049e1527b086f83b2d59149638912f8c9f6d02fd77d74
TLSH
T15ED02B84A8D97104C0131437002161103F8898440906E012D0C0027E0985AD30355062
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 649B
SHA256 f9361b28beb45cd0a1d0b149816086048ac63dee80a51f5c5a91b8b08faa991f
MD5 d337163f1c9434b35fbf0ee5d2df4b51
SHA1 c89409d7b76f70171266c594c2bf1932ca5aa405
SHA512 b6a8d5c138c9071f61c6b13134245c8d29a853b13f80a67fb65b7857496f15568cf59911a1df2a9412c5b2a9ab3d087cff743970f6943c1d9f20c8f48d4cddff
TLSH
T1FAF0F4B9CD21AC2B2CFD0B1920650B4AF750136B3781955F3A3D420D8FB4A3B468A82C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 6632a7edb5bb0680a3d10bfc80267daa4b8f8299c83b5dc1aa4338a1d2596666
MD5 8b27833c4e768762f43c9a433a5d9cef
SHA1 9c85c538dce47ff01f80b6ba40dcdf40491eecc5
SHA512 1dae800e49354e8145d8e8dd4c0c5ca07119cda71cb904d855c27bc91e5dca421b594194c6e7f965f6af4207a9682d9c74cd380c707c65cb57197b830eabc470
SSDEEP 96:+VjQBusUVNikdlc7JUXUT7/mNhoQJQNgDhMWD:+VjQUsUzd+CUf/m1QeDO+
TLSH
T154A1A600C8A51051FF093B73E9EEDD86F239518CBDD3EE6E109AED3A7832B4655808C2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 e318df09501f152c601765547c4a137a03305c3c4555c59d7e65ec14b03ce10e
MD5 075d7d0c812fdeb880fafbd2ca68e12d
SHA1 6e9bfddc20bd637be3df236fbf2fe68102a88725
SHA512 fdc5e9516da650536b0486af051b933493648d995226e11ff307def1f31428d4cbedd4af393fdb9ad9bda6c3dde8cb828ecb6c9fb4b99d2f6b5d1a8347a5cba2
SSDEEP 96:KVcQBusUVN/dlc7JUXUT7/mNhoQ+QNgDhMWu:KVcQUsUjd+CUf/myQeDOD
TLSH
T199A1A800C8951091FF093B73E9EEDD86F239408DBDD3EE6E109ADD3A7832B5656948C2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe591ec9.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe591ec9.TMP
Size 2KB
SHA256 cc4d777459bec40a85985435f3c70847a1bb7a26c268ccbc086757a0ccbdda31
MD5 1be67dbd6d62dcc324bafd104cc683dc
SHA1 66d600c556500ecdcdd0bed311cbbff5d4bb5ddb
SHA512 d5d73c37c66e8ca27470bb92d3a5ca6090e1c4b9b27d9326163986984414b2b0df5186e1a77e7f264929f2d922ea08b6abcf073c26a97f78cc2ace0b696ca111
TLSH
T1AA515085CD524496FF985C73ED9E5D83333299853AC71DA201A8ED7BBC01F1765181C7
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 26KB
SHA256 97590e56fae2af9f43b0868104b4b608de3f3eea400365cec33ff9540e43e2f1
MD5 8c503360376b998b9fab4dd9b0c6c370
SHA1 12560a948a238ec85a217bac08dee0594e5ceb3b
SHA512 2be8564934ac8bfc1ff76f4ac8dfba44f9d074fc59d02ea6e26576098f031a66236e668e1b8badb37bee7010a57e4e03c32552694f9932c3f1137093bb872ef2
SSDEEP 384:DW1+lyohXQb5Q5loLezOXeMAJLsVAIOZ6J7pdaZGepoay14dy8H6YTYH4frhL7s8:FIsZsYhzNe89GIlynKH7
TLSH
T14AC29AF383E5DA2E89015BF856146E1BCF1D0719432C3D1688D5EE87E3E2472E16AA4F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 5d50edc14b3e5e02ab4047e75e518717402b8273d5113902a41da6d8e6a20d14
MD5 de0857971f08a51cb99e1c167d9741e1
SHA1 613e2626217624201708ade9ee006e080efb00c9
SHA512 dcb8070d553dd53aa8283aebd5019b9d293d178e4f6ee5a4ca8eb6da65d14fcdbb97c536ae3e831a372d7773fc50bf420d0a57429c3af0e7a395765725543844
SSDEEP 192:sxZkR2Yj/fwsrQ705FsfZzodpaGWSyg/W6+WNJSQAI/Y0REwP+mIgjwJ:sxZkpj/fwsr35xP/b1/5rrjU
TLSH
T1E442C956AD34A93B5CD7D219FA55BF63D2F9503291D11F48A6FC8A1C10EB6DD220380F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 3619a02b6612fae01e742ef3242a3875d2c0dff8b5667659cd7b2d0cc21e34a6
MD5 d58ca799c9ef84534a3790b860ee37c0
SHA1 aba08466b1e2db59ab5cf315053ba38d3f921f29
SHA512 58dac2f1538ac315084fe45f7d159805df05cef7971f581911d394287968da2fa9a9f1145b17a16fcf75023700d9399eafd8f99e5cfb51ddaf7e44e4e46f9154
SSDEEP 192:sxZkR2Yj/fwsDQ705FsfZzodpaGWSyg/W6+WNJx9FrRQAI/Y0R7wP+mIg50wJ:sxZkpj/fwsD35xP/bBtq/5yrmU
TLSH
T1A452D856AE34593B9CD7D21AFA55BF63D2F9503291D11F48AAFC8B1C10EB6DD220380B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 d58dc7cfdf30b6ee95c852e6d2e7eb90eb98c0dc9e5b6814b1c379be1d04d3a1
MD5 9f5ce3b2caa762a3f22a5e553ea63d43
SHA1 6acb332ce6353f906298730957d076984e2f7426
SHA512 e79077acafcc2906131d3e1daaee66bcd7e053aac726a94f69b7a4f98ef305a63c69786eac8e6c1e3d389bb1087198aba9a576e51ffed784ea0ce8645eb980ca
SSDEEP 192:sxZkR2Yj/fwsZQ705FsfZzodpaGWSyg/W6+WNJx9FrRQAI/Y0RTwP+mIg50wJ:sxZkpj/fwsZ35xP/bBtq/5irmU
TLSH
T1EC52C856AD34593F9CD7D21AFA55BF63D2F9503291D11F48AAFC8A1C10EB6DD220380B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 28KB
SHA256 104925db88c67e3324a48e6666baa4f383f12061e8d814f625e70f21ca34aed6
MD5 b5c7c91318bec14e6931515e58d504d0
SHA1 3f28ce332078fd4307e871addf39ce09717eddc9
SHA512 26a3ea0903e2b0ae743b9454f31d6b48d565bc7231056c5a68c444f90e515844e8ac85a56965d34a437170a6eb532d7b8247443ffc941d99e4ac3f334904c849
SSDEEP 768:WJ6E28xO215WRmp3Qf/8F1+UoAYDCx9Tuqh0VfUC9xbog/OV3fsLl/LN0Y3Zroyz:WJ6E28xO215WRmp3Qf/u1jaKfsLpLKYR
TLSH
T164D20B2B740CCB7E4FC05AADDD666F976E9802C7A6688D4047FE894C02C77EA51164CF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6a4af46c165921a8_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Shared Dictionary\cache\6a4af46c165921a8_0
Size 63KB
SHA256 5072ef5dc2dfa1de8329915c644e53177563b9c59adaf29203ac0e9b617a67f7
MD5 0f633b932a29180bcc389002a84c3218
SHA1 d6534b73e4cae98e7eff3c4da340e037e746d03b
SHA512 3067dea7a5d1f7b4808faa93e552393404bb440bae2108e994c6fa54f4a1f6d944f517239b360f9d3bc6d8aa289efb1b4ad0a097091ed005bec8f8ea49133366
SSDEEP 1536:ouzXhviJCDMyTViF3WOli5rZxYZD3i+d0TVqCkq:bjhbMoiF35iFoVdp
TLSH
T1E3536C993331B4B743BB61F1906F160A713AE5A7F404C4E4B198DCE05A54EA642BBFBC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 72B
SHA256 a704c30d53cba32e6db90dd2b57dbddf6f4177c3556068efc67cc4664da13b9d
MD5 7fabcf8f73ec9166bafa0672213ea001
SHA1 82beb6b914389656b1d055867dafd7f93022a58c
SHA512 aebc85ee400c60cecfc70b6db72f458883e4c1b7f51fb52428096c960e22961af5ab4fff2ef8028d3f2e977f6713ba1db5a0804af17657505ccebd4dafd6f318
TLSH
T121A002550F954001C8150F75749793A67370CAA89602530B44E200499D652F14D11254
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 67957a13ba36560c8c904e6d0807aed6e58c598c28f3e78c262156678d418009
MD5 03a47fcfa0f3a525c9f80de022573311
SHA1 1a2962605270d023629429f9d1befa51c20ce43e
SHA512 a6c3328b46b2de847b7e5e95aa9614ddbcd332820e4e1f1310c2bead22e30f112afdead0260be1874a313be341bfb37ea75e8641d1e2cb465312f69744f5e450
SSDEEP 96:KYlWKmcrGr2KosTUwK5e6SmIKT64ygKHK2qOcKjKIrSK4oiOHCKIUzj+fzptB0BD:80Z/jH0TnaJxzh/Mrzcp3wHbijFe
TLSH
T16DB2111171BA12053CBE290D81B49B2F564232B37159EA3B7FBD00B68E6BE445DFD8C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 36c5fc2c610d1da628ea353c374291331cd38214d14c6dbb26fcaa03ae0e87ec
MD5 dcf137df95e1c41553e1e3af8296ad78
SHA1 19da38c7cdb5fb914b2b1cbfd192502b4bc394f2
SHA512 34fb92893bcdceae7d81fdb15429846ea0308764ff051e2053a4eb1ac9b087249416af308045e0bac824612f277829db7e46c75c3e64a1567e4de062553689fa
SSDEEP 384:n7iFiZcIR38N28TUNTUlIRxQnhxwOI8qtzTfoBFITk9WJVX/GZjgL/7Iz0coR:WFQR3pwg+ho3UBSg9I/Gac+
TLSH
T114C24A32E8A9CDB7FCEA8E99A74A7A03DEF05163D89C8AC4E5C84D5D00875DE1707C16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 cb5e87c1b0d197957df3edba28d562f5ff1209b8488c1e307a889a0eb6b5df44
MD5 96f935bbab91cf1a0d54db0fb8c68347
SHA1 b443d214b8234c6a9d4ee5f8a467395c5a55773b
SHA512 11dd89bb18144f884813da5210227ab2e7c0bd4068c4e28bce1dabbb890584ffbba9bd82aa1702579e3833ce7e5bae1d4f71df7262edfb3f8644b63d433bac60
SSDEEP 384:n7iF4ZcIB38N28TUNTUlIR4QnhxwEL8qtzTfoBFITk9WJVA/GxuvzxV+MhdpbDgy:WFGB3pwgxhd3UBSg91/G4184pbLcA
TLSH
T1D8C25B31E8A9CDB7FCEE9A89A74A7613DEF05063D98C8AC4E5D44D5C00871DE1B0BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 ed1d538cc20c251bc7fc7d39892572e723459b920ce7c43a5192c235892013e5
MD5 86d4e853f591c1fb0a57e0f271adde05
SHA1 cc50fc6695ed161c39c32263f0f0e5d4311090d6
SHA512 9af677472140ce50bfee4a2dd06e690fca74525212b0ba392ddabc6fe8d0797fbe19dc566cb756645e0caf28546bbe7768049892b4ab6d5ddc8b3a3157bf94a7
SSDEEP 384:noiF4ZcIB38N28TUNTUlIR4QnhxwEL8qtzTfoBFITk9WJVA/GxuvzxV+MhdpbDgy:zFGB3pwgxhd3UBSg91/G4184pbLcA
TLSH
T19CC25B31E8A9CDB7FCEE9A89A74A7613DEF05063D98C8AC4E5D44D5C00871DE1B0BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 c902e624ea53006091954cdc04810f2e2c79fd428561cdca7bc70b58d281f8d2
MD5 85fe027a8ac8a0272a02e87b2b3d4c84
SHA1 b086b823638e48048b0b53c15d39a4300c2a7e4b
SHA512 d57b490b072fc112992ba446e771a4f8d347f06b297639d0660c3d80bcf38f170aa22f4417f1e414299ea71c164e3f6509ed8089c652a48acfcb385e120d061c
SSDEEP 384:zgiFiZcI638NC8TUNTUlIxBQnhxqIcitzTfoBFITks/Sv4EW1XoU1euygL/7IzsU:XFQ635wg2h/c8UBSgs/SIoUs/
TLSH
T1B6C25B36ECA8C9BBF8EA8ED5A34A7603DEF04163D59C9AC4E5D85C1D009B1DD1707C2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 4f58472a0cb83c5a74cbeecc308866fa13352451c792318b2f1707956a074791
MD5 390283cd0972afa22b258184b7205fdf
SHA1 97dc287d29be6377f598931b69c57e1cde495b61
SHA512 87b30dcaa4419560229a948799a1d375165bd2de8399279706a935bd9630fb8ae4629f3f935de0613190c9c5037342f41753f8c1d797e43e9c5d082232f93209
SSDEEP 384:nPiF4ZcI938N28TUNTUlIR4QnhxwEL8qtzTfoBFITk9WJVM/GxuvzxV+MhdpbDgy:aFG93pwgxhd3UBSg9d/G4184pbLcA
TLSH
T1DCC25B31E8A9CDB7FCEE9A85A74A7A13DEF05063D98C8AD4E5D44D5C00871DD1B0BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NWR6V2.zip:Zone.Identifier

Path C:\Users\Admin\Downloads\NWR6V2.zip:Zone.Identifier
Size 309B
SHA256 c6a70445975216e768f0d101f45c0a32fc97928c0bdcc9d67912040696da19ca
MD5 44ba8584a9df13f0975d7c724c8848e1
SHA1 fcd8f2a93ad1c30411741181c4625b2e24c08c1d
SHA512 63b556e78fc33f05ef29fe955ce9c53946aa48c69d3a01c78427c71e439be85105d593cd38dd84a95ef7b75d771556a0cfad08661d056745e3365728e0f36a5c
TLSH
T16BE07D6B8C804114486B78C01479B15D276FFA880C90D1825CB984A69E004A887E0D23
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4704-433-0x0000021429C60000-0x000002142AC60000-memory.dmp

Download