dee48103bca140695217f9916ad161934dd4e15ac5351a4f69f19894971f8a0d

Analysis

max time kernel
149s
max time network
147s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260911-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260911-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
30/09/2026, 21:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
OG Synthwave/OG Synthwave 2.0.exe
Size 98.1MB
Sample260930-1k6z4syses
SHA256 dee48103bca140695217f9916ad161934dd4e15ac5351a4f69f19894971f8a0d
MD5 359f0c4b77f53b1d8b734d4a822516f2
SHA1 5d4bbfe2202eb50621ea95c7468826a608dfefe9
SHA512 020922910cea8bbf70121480041a5d44504d4e8caaf754537a62b5a114365b69637f882ac70cf0bea2dda715987afe736bc119a5d0e8e85d9093ede326864efe
SSDEEP 3145728:otyBxstzHYmf6voT3b++7i4jCvxDlMpuuE:ogWtz4YTLli4jCGD
TLSH
T126383311AC7B54AAFA628DB903794B8A63727437079337EECF5E2E3019C4F852F15429
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
5068	~$0e58c32c.tmp

Contacts third-party web service commonly abused for C2 1 TTPs 5 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
9	discord.com
10	discord.com
25	discord.com
32	discord.com
49	discord.com

Suspicious use of NtSetInformationThreadHideFromDebugger 1 TTPs 6 IoCs

defense_evasion

Debugger Evasion

T1622

pid	Process
5088	OG Synthwave 2.0.exe
5088	OG Synthwave 2.0.exe
5088	OG Synthwave 2.0.exe
5088	OG Synthwave 2.0.exe
5088	OG Synthwave 2.0.exe
5088	OG Synthwave 2.0.exe

Drops file in Windows directory 8 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5608_2068862600\deny_etld1_domains.list	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5608_2068862600\deny_full_domains.list	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5608_2068862600\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5608_78968800\data.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5608_78968800\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5608_708577301\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5608_708577301\typosquatting_list.pb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5608_2068862600\deny_domains.list	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	OG Synthwave 2.0.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	OG Synthwave 2.0.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1244	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-4095433250-3121633380-635025574-1000\{AEF3C24D-D774-4FD6-AC88-8116AA7B097A}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3180	msedge.exe
3180	msedge.exe

Suspicious behavior: LoadsDriver 22 IoCs

pid	Process
668	Process not Found
668	Process not Found
668	Process not Found
668	Process not Found
668	Process not Found
668	Process not Found
668	Process not Found
668	Process not Found
668	Process not Found
668	Process not Found
668	Process not Found
668	Process not Found
668	Process not Found
668	Process not Found
668	Process not Found
668	Process not Found
668	Process not Found
668	Process not Found
668	Process not Found
668	Process not Found
668	Process not Found
668	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
5608	msedge.exe
5608	msedge.exe
5608	msedge.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
5608	msedge.exe

Suspicious use of WriteProcessMemory 32 IoCs

description	pid	Process	procid_target
PID 5088 wrote to memory of 5068	5088	OG Synthwave 2.0.exe	82
PID 5068 wrote to memory of 5608	5068	~$0e58c32c.tmp	87
PID 5608 wrote to memory of 5508	5608	msedge.exe	88
PID 5608 wrote to memory of 1244	5608	msedge.exe	89
PID 5608 wrote to memory of 3608	5608	msedge.exe	90
PID 5608 wrote to memory of 5700	5608	msedge.exe	91
PID 5608 wrote to memory of 3608	5608	msedge.exe	90
PID 5608 wrote to memory of 3608	5608	msedge.exe	90
PID 5608 wrote to memory of 5700	5608	msedge.exe	91
PID 5608 wrote to memory of 1032	5608	msedge.exe	92
PID 5608 wrote to memory of 1032	5608	msedge.exe	92
PID 5608 wrote to memory of 1032	5608	msedge.exe	92
PID 5608 wrote to memory of 5856	5608	msedge.exe	93
PID 5608 wrote to memory of 5856	5608	msedge.exe	93
PID 5608 wrote to memory of 5856	5608	msedge.exe	93
PID 5608 wrote to memory of 4016	5608	msedge.exe	101
PID 5608 wrote to memory of 4156	5608	msedge.exe	102
PID 5608 wrote to memory of 4016	5608	msedge.exe	101
PID 5608 wrote to memory of 4156	5608	msedge.exe	102
PID 5608 wrote to memory of 2232	5608	msedge.exe	104
PID 5608 wrote to memory of 5544	5608	msedge.exe	109
PID 5608 wrote to memory of 4508	5608	msedge.exe	110
PID 5608 wrote to memory of 3624	5608	msedge.exe	111
PID 5608 wrote to memory of 1292	5608	msedge.exe	112
PID 5608 wrote to memory of 1292	5608	msedge.exe	112
PID 5608 wrote to memory of 976	5608	msedge.exe	114
PID 5608 wrote to memory of 976	5608	msedge.exe	114
PID 5608 wrote to memory of 5520	5608	msedge.exe	115
PID 5608 wrote to memory of 5520	5608	msedge.exe	115
PID 5608 wrote to memory of 3180	5608	msedge.exe	116
PID 5608 wrote to memory of 5476	5608	msedge.exe	117
PID 5608 wrote to memory of 5476	5608	msedge.exe	117

C:\Users\Admin\AppData\Local\Temp\OG Synthwave\OG Synthwave 2.0.exe
"C:\Users\Admin\AppData\Local\Temp\OG Synthwave\OG Synthwave 2.0.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of WriteProcessMemory
PID:5088
- C:\Users\Admin\AppData\Local\Temp\~$0e58c32c.tmp
  C:\Users\Admin\AppData\Local\Temp\~$0e58c32c.tmp
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:5068
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://discord.com/api/oauth2/authorize?client_id=1529961440667238471&redirect_uri=http%3A%2F%2Flocalhost%3A3000%2F&response_type=code&scope=identify%20guilds.members.read&code_challenge=deBj2l8Bw_kE4AcIMmmVx9MUuHEcEFjwqeigZkkeyXg&code_challenge_method=S256&state=YeN6zC9cX1FGF9vK_1VdTQ&prompt=consent
    3⤵
    - Drops file in Windows directory
    - Checks processor information in registry
    - Enumerates system info in registry
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:5608
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f4,0x2f8,0x2fc,0x2f0,0x31c,0x7ffa2c2dc188,0x7ffa2c2dc194,0x7ffa2c2dc1a0
      4⤵
      PID:5508
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1804,i,10548500441167422402,40726773295240195,524288 --field-trial-handle=2372,i,2009157113370088446,2090038474992206940,262144 --variations-seed-version --mojo-platform-channel-handle=2508 /prefetch:3
      4⤵
      System Time Discovery
      PID:1244
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1652,i,3491800440497692910,8062969246767044810,262144 --field-trial-handle=2372,i,2009157113370088446,2090038474992206940,262144 --variations-seed-version --mojo-platform-channel-handle=2368 /prefetch:2
      4⤵
      PID:3608
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2096,i,1513010593186092504,11227951880622392237,524288 --field-trial-handle=2372,i,2009157113370088446,2090038474992206940,262144 --variations-seed-version --mojo-platform-channel-handle=1412 /prefetch:8
      4⤵
      PID:5700
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3432,i,2972781995343664721,8286548116248907046,2097152 --field-trial-handle=2372,i,2009157113370088446,2090038474992206940,262144 --variations-seed-version --mojo-platform-channel-handle=3512 /prefetch:1
      4⤵
      PID:1032
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3428,i,11665211006279143635,16000003998814218677,2097152 --field-trial-handle=2372,i,2009157113370088446,2090038474992206940,262144 --variations-seed-version --mojo-platform-channel-handle=3460 /prefetch:1
      4⤵
      PID:5856
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5304,i,14862947706528706399,3080856595508243111,524288 --field-trial-handle=2372,i,2009157113370088446,2090038474992206940,262144 --variations-seed-version --mojo-platform-channel-handle=5208 /prefetch:8
      4⤵
      PID:4016
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5312,i,7799573653154872495,13773900295884389300,524288 --field-trial-handle=2372,i,2009157113370088446,2090038474992206940,262144 --variations-seed-version --mojo-platform-channel-handle=5308 /prefetch:8
      4⤵
      PID:4156
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5816,i,1029894889782017145,7981349518907498042,524288 --field-trial-handle=2372,i,2009157113370088446,2090038474992206940,262144 --variations-seed-version --mojo-platform-channel-handle=5668 /prefetch:8
      4⤵
      PID:3328
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5816,i,1029894889782017145,7981349518907498042,524288 --field-trial-handle=2372,i,2009157113370088446,2090038474992206940,262144 --variations-seed-version --mojo-platform-channel-handle=5668 /prefetch:8
      4⤵
      PID:2232
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=136,i,15112908370967435034,16352693268836105406,524288 --field-trial-handle=2372,i,2009157113370088446,2090038474992206940,262144 --variations-seed-version --mojo-platform-channel-handle=5832 /prefetch:8
      4⤵
      PID:5544
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5816,i,1753858151446764946,15069880060483932732,524288 --field-trial-handle=2372,i,2009157113370088446,2090038474992206940,262144 --variations-seed-version --mojo-platform-channel-handle=6304 /prefetch:8
      4⤵
      PID:4508
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5884,i,15163244864747278394,3070129288691122065,524288 --field-trial-handle=2372,i,2009157113370088446,2090038474992206940,262144 --variations-seed-version --mojo-platform-channel-handle=6340 /prefetch:8
      4⤵
      PID:3624
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5188,i,8543267805031123512,2363366600903970034,524288 --field-trial-handle=2372,i,2009157113370088446,2090038474992206940,262144 --variations-seed-version --mojo-platform-channel-handle=5204 /prefetch:8
      4⤵
      PID:1292
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6320,i,16536823591438654527,11818516246740307428,524288 --field-trial-handle=2372,i,2009157113370088446,2090038474992206940,262144 --variations-seed-version --mojo-platform-channel-handle=5924 /prefetch:8
      4⤵
      PID:976
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6328,i,14442304207362830106,9686741443034121992,524288 --field-trial-handle=2372,i,2009157113370088446,2090038474992206940,262144 --variations-seed-version --mojo-platform-channel-handle=6316 /prefetch:8
      4⤵
      PID:5520
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.4355 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5876,i,2258474787803591379,5624318614790206699,262144 --field-trial-handle=2372,i,2009157113370088446,2090038474992206940,262144 --variations-seed-version --mojo-platform-channel-handle=6296 /prefetch:8
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:3180
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6316,i,12148589599767200381,14822064868663263299,524288 --field-trial-handle=2372,i,2009157113370088446,2090038474992206940,262144 --variations-seed-version --mojo-platform-channel-handle=1228 /prefetch:8
      4⤵
      PID:5476

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1484

C:\Users\Admin\AppData\Local\Temp\OG Synthwave\WinDivert64.sys
"C:\Users\Admin\AppData\Local\Temp\OG Synthwave\WinDivert64.sys"
1⤵
PID:692

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:1708

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Debugger Evasion

T1622

Credential Access

Discovery

Browser Information Discovery

T1217

Debugger Evasion

T1622

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 27341f426aa0efd6c484bc21b43d92cf90ca72c2333c8e492f256c83fd880a23
MD5 5e7e3b8030681bdf6022439fe49f75f8
SHA1 0ff916bc55fa603e71947fca76af181bf6a176af
SHA512 f028e8f02a0deeb001818c82b1b058d78b877b08dfffccd53e7636c6b399cea4a3f75d2e7d48b81a7bd267b29da417e86f7b980e8764b264d26bc3942cb86bac
TLSH
T192D02BA49AC8C8C0C84120361358420831C8D23448A3404244E00254CED126216A70E0
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 35bfe8411fef5cfb5e836a009d986a443cea8a767a24a62c88b76fff1445d4fe
MD5 7a1868737ff3b37a41fb1012d04e5317
SHA1 68663bf5d3a6b7b5ec10929aab80449de703c46a
SHA512 aab22617c95c8283d6909703835f5f8c127f54c6ca8c76ca1dca713266b8bbbd7738adc47493793e9dfab0c295fe255b678ea1be77229fadf2f3ae7ffbb01d31
TLSH
T143D02BA896CCD8C0C85520361318420830C8D63448A3404244E00244CE9126212A70E0
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 649B
SHA256 da12496c399b4c72bec3ff8977c6624cc147dee337b74d6505bb156298a1f059
MD5 b4d2902b78b4e61ddce0be8eba13369c
SHA1 73f380b1c3c51abb3793b453d2722b9c1586c0cb
SHA512 22402d0deb8dfe97c1107d33374292e1cfeb891a7565f68030dd96230cc15a42e4d13ff1061a485f6596d138b55f3b2ee10f1f4d375ebb63dfd18e5b68eb2bf7
TLSH
T184F0F9B9CD21BC2B18FC072820A54786E751135B3B50484F3B3C810C8FB463B8686C6C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 37bdc00c054bd41f5cf989e94bae3e606b58aa5e1bf4bb32175d8d81ae50b24e
MD5 d9bb4d15340a5df16cc265d3b02cc862
SHA1 307470b3b22e555ab888e2bd8eb762f1e03f125a
SHA512 9442826a45fc6c39deb56129514eb9b39fc2e50efe401d63cd10bce782613914503a3fec87c514b4560280b00391f8482adf002bb087def23c2d6dc419073e88
TLSH
T105814E2291EF4E63D744E47C81F4628E3530C1C0984B3D3E30ADD5B1ABAA79E48A9F47
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe593270.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe593270.TMP
Size 3KB
SHA256 6022f1be173ffc504b13811c5940c1a9a0f5c89c9adf15b7ef8fa58f757d624b
MD5 1a76da057a112c0ea2cd8760c120b21a
SHA1 80a364b3c0c359f4c456482eb5fa29c82dd7eb4b
SHA512 a2009bcc998ffb03d33c382a90ad0dd6383014bc892ef9dc1136514d8f53be299aed0093b0c402f1028ca8d91a083ad63386f8525d17be07294d28ba1077d321
TLSH
T127614C0252FF4CA3DB94A07C96B0308F3670C1C1A4833E2E34ADE8748B467AE49A9C13
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 9b21a3a4a2dd3c8cbb98cf5dec3c29a1a6087d0d858a16ca2f2f558e47dd60ed
MD5 fdd37807077e298b41f0814c2f3aba81
SHA1 cd1215c86788eea6d662ac8837ecdd2a898983ed
SHA512 ca3f566329c2930d44ff19b5b222d443168966d215c03061627e281d27141d0338ed5c756ee3876ab171083f9036bc440e00cd3405ceb5e981d5be1847575b1e
TLSH
T11E417BF3C3E4866E890156F0A718AE2BDE2D0954832C3D5AC9D4AF6BD3E3471E14165F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 33ab7d691666a449d6079f3518dca602c91b62d41f8722f9572b8a4f70cca70d
MD5 27827f02cb1d39f179e3998e412b9317
SHA1 e2c8b91d6ae1caa22d0ef41b8bea73ec47d80e0c
SHA512 bf4a1b9f04a51fff621aad19ea34fe37bc0b10de5418ca2d14c9abd0cbff72847d9643c9110ffaaf404c7a5b99e087ccd668fc8c2c75edbec352425e883ba95d
TLSH
T1AC619BB3C7E8862DC90156F0AB187E2BCE2D0954432C3D5AC8E4AF5B93E2471E18169F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 5f07382185ec9256827d57cac13128de61ca5140897e60b5b90bbfb52c0d3b35
MD5 8ac7f0b52d6bdb78e5e1a973be288faa
SHA1 6c988412ad0255006a5327f8d7fe685a42b18bf7
SHA512 e174983f0a0ceb49e82fb616382e72f15e041b1ffddaa0dcb7040f54396c920e61d62f5b4c055c6c14bf59ff767d8e7f35125390409b3b7108f863995905ab9d
SSDEEP 192:sxZwRZjp/fusHXf77Zj3Emtozodp+VHW6+WNzLY/YC3OHvJIg52OJ:sxZwTp/fusHXvZj3E2mHbg/aNga
TLSH
T102420915AE68A97F4CC7E219BA15BF53D7F91133A0D01E48A6FC8A1C15EB6CD220781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 fbe5b42830a77c741246493b10e65ab5207c5a02e095de9163a412b3cdfbdd0c
MD5 f1c8fbfec5fb670e9c6e2cf821344fc6
SHA1 68ed6b6c2242283f2b3044cc8929bbe3ec6acaab
SHA512 42b4d8d3c8d0f27d1fd73ece479640a72081547fcc77a43dcab09c55dd9995f77306ac0f1898de2e1c9b1fe90dcace0fef538fa3c679b1c3de31204bb5b7d5ed
SSDEEP 192:sxZwRZjp/fustXf77Zj3Emtozodp+VHW6+WNzLY/YC3m5HvJIg5yn7J:sxZwTp/fustXvZj3E2mHbg/eN0N
TLSH
T1C342F915AE28997F4CC7E219AA15BF53E7F9503260D01E48AAFC8E1C15EB6CD220781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 ddc5715d572335a03e6d366df5532cec4c32a3c32b88009a46063ea3b437d2cb
MD5 b6109f4ec33571b360c65dbf0383f684
SHA1 092bb8297e8945759db5bd5760f3843b9422116d
SHA512 e0cf04614007a48edae0b5888710fe5272c48bc6522a684ac1e55c0ebef0605e9986cead7cc2adcf2da607736458c8d5d48f83a8074ec5e382fd57446b5e36eb
SSDEEP 192:sxZwRZjp/fusSXf77Zj3Emtozodp+VHW6+WNzLY/YC3OHvJIgjOJ:sxZwTp/fusSXvZj3E2mHbg/aNja
TLSH
T1D142F915AE28A97F4CC7E219BA15BF53D7F91133A1D01E48A6FC8A1C15EB6CD220781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 cf8cd3b59bc78e95fabdf8d19834b8faac4b204c3caaca07fcc3b698354e5ab2
MD5 b664564191986e61118048a4b21d13f3
SHA1 e23cf97b9ca5d309cd69a697b2d4582356b993b7
SHA512 2b9a16eb7f6c7357c6da2db1ef2bf64c2568382777d7f5b5a2f4deeb62ba213ce3c8545adce7b628e80fcaf1f5cae2619a7e7b03583f1537f46056a6fa71243b
SSDEEP 768:d8+S3Ni7pLuLbV9WvhL3b8F1+UoAYDCx9Tuqh0VfUC9xbog/OVbHpwLle4ZvWroc:d8+S3N6EbV9WvhL3bu1jaaHpwLQ8vtKP
TLSH
T18EE2DA7B7C0CCA7E4FC00EDDDC1A7E8A6DA802CBA698C94047F9945C03D67EA51264DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 c2db26ee8600d7f1f4e7d9fe87f4e9bd6a77f9453e420ede0de5e410c24b793d
MD5 915cb39f93c58a302f8eb9c270882e4f
SHA1 69425d008f41c0aad45cadf4c3bcf755ad439e11
SHA512 f397fa1f3e610b578b524e7de138403e752b38f3693523a1b9eeb0a193b628b5008610caf2e09acbf724fc4d65f75df18a1c4bb49df7a493c1ca1dc2e4039e75
SSDEEP 96:K0UwKZ+6mZ6KawN8AKNeGq28KfKkFiKOoyS8YKBWmLCKI4C2VSKGIRggK9myqcQL:yjNB/XORbkJNlzjk517HNRZhZVvT
TLSH
T139B2015571BB1200387E2D0885B4976F964271A33068EA7B7FBC04A6CE6BE095DFDCC9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 e44766028f160141704cb49f54b2f2aa5a190b5ce271f24bf37c24e5606aeb50
MD5 11bb5199994d633da735c95b2c4af0af
SHA1 80c5c0a8cf051116207c5341f4b00a9496cb131b
SHA512 70a11c25c3cf12e413cb988f5e8ce2208b0426a56a257ae3dc0d3eb41e03f4e7878a714c519992ee12f1836e5c31019d17e940844dc1ea859d9bd30d04ffd48d
SSDEEP 384:nqiFiZcI7t3sNv8TUNTUlI4kHjh+cTOthfPAERb5DJzXi+j0EtgOIwZOyBo5gL/Q:hFQh30wgHpIA4NDliM0EXsDJv
TLSH
T146C23932ECA4DEB7BCEB9B85B74A7643DEE41163869C9AC4D9D84E1D00831DE170BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 89ccf6cc6028ca6bf1614b9b558f208bd68618e107b31c608f6fd6d0b34da932
MD5 4c78730e4e19b45ed6f264f1158c10fd
SHA1 a2311eaa2254c70ba4e1d722bbd166b9447c95f7
SHA512 b8362cae283bc58cd8d27c18a4705078dbae79ac8065f44601163aacb1aee62ffbe524d166180830ff869f9efec3e3cc3c383b4e23fa24a1e83c552fddb43bfa
SSDEEP 384:nziFiZcIf3sNv8TUNTUlI4kHjh+eTOthfPAERb5DJzXi+jaEXngL/7IzVoe:eFQf30wgHvIA4NDliMaEX9x
TLSH
T1D9C23A72ECA5DDB7BCEB9B85B74A7A43DEF01163858C9AC4D9D84E1D008319E170BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 2d31237345f7892fe06a6dbc64f4e24f84920f5507559dddb28a16ad42796f3c
MD5 7aa5d5a34d680b359a52c0901499e6e4
SHA1 86a94679758f853a1445f7d4050c72bffef07b0b
SHA512 fc3b5bbe0fc3e77604de79b18d2ad8e97f9be036e5b2cbac199ae33cf0809343e8aa6d38f07f8cfd2b161c1939fc84de5660403386ca533bdf585926c42b874a
SSDEEP 384:nciFiZcIf3sNv8TUNTUlI4kHjh+cTOthfPAERb5DJzXi+jCEtgOIwZOyBo5gL/7U:HFQf30wgHpIA4NDliMCEXsDJv
TLSH
T1F1C23A32ECA9DEB7BCEB9B85B74A7643DEE41163859C9AC4D9D84E1D00831DE070BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 c739c3c618d8578dac70ebcc4f77f9f13fe2ae107e9cacf953a64e9f890b24cb
MD5 e44c8f66d30eb62cc2f8ecf967d5ee24
SHA1 61fc64e691da5e9bd871665383232643696a7f3a
SHA512 9c6d9771654ca70c6f95b022dab8a3a0e55dcd12c58780f562397166e2b501103e293ba984f16f9231512afea29cc0bdb85fa254ca08c4b8393398c92caddc58
SSDEEP 384:niiFiZcI63sNE8TUNTUlImkrjh+mQAthfPAERb5DJdYsa+VYkFgL/7Iz5oS:pFQ63Twg5giA4NDDYhgtV
TLSH
T196C23932EC94DABBE8EB8FD5A74A7A13DEF01163959C69C4D9D85D1D108319D0307C2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 331f8bf8555a681c53347a96255d09bc5b1d569980e231896e054f228ea3bf4b
MD5 e04ac339c8affd8f23c495e9be2f9f7a
SHA1 bbf45138e2511ce031f838e527c3fc8ec63bcec1
SHA512 5d5d4d78e5df91096c09e00d591c35ddf887f8ecff2560d552bde4ed1ec83eff7d6ad1de0a7a43956d70ee23064b4eb08921d3ead05ac2ddafdae024bdf02c8d
TLSH
T1C6410FD04C3C5AC1D1BD0E7EB49B75EC90EC9721B9A4347E6858D998897AA1E204483F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 c73c71a823dadd0134aef12ea271b4ac06198e7003ac0a5f3c5a1cec0a4e62d7
MD5 5aabb11b89d02f9f111537fe8149fd06
SHA1 3a090c2b06b9013c6f886f1465533355bd411bef
SHA512 ca1dd2377e898f78c057add63759d58029de23224e7915ebaf94eeb86f55da9b9e17e8f814ee63cef84e7f6d5e6debc946309c2e45d00c4f6e433d061a699308
TLSH
T1D84110D04C385AC1E1FD0E7EB09B35FC91EDD721B8A4347E6C59E9984A7A61D608483F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 b671cc9b06b6280c38a41888c48696c0dbcf688367883624db811713340b7e68
MD5 cbae869a0806420abad2403b34826f6b
SHA1 b883b9f54d777c3e8aa5c6259546dcb68a82bade
SHA512 ab3dfc5a5fbf06049309fc95d5122ca350ff7bc3726de8ba67ac4696425bf516ad8526795fe0c7e181a58b2204b832dc97ddba4cb0071f86ef176a5615d41558
TLSH
T1654110D04C385AC1D1BD0E7EB09B39FCC0ED9721B8A4347E6C59E998497A61E204483F
MD5 SHA1 SHA512 TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 563924293ee61b249b504a0acbc58233e68a36548e8fe670a9cf196c550a61ed
MD5 72f86770abc46b6c5c6c75e8ca16be09
SHA1 2070bf181d0ff85e1d6df99fcf6ca01596def527
SHA512 254928cb0f0db6582267848fe5c660d45f14aa2d5a19f1bf53db78b912fc00256570b372f60251cb3b9c92229140d46873e36109c62fc5d97ad858d8a27c301a
TLSH
T1FA411658A6F91148B3B3BE56ABF6A86E487FB9772E07D49D00010E4E0A22B40CC71737
MD5 SHA1 SHA512 TLSH

Submit Download

ui_settings.ini

Path C:\Users\Admin\AppData\Local\Temp\ui_settings.ini
Size 19B
SHA256 596710f1acc736c6f563ddd54c173c087ce711bbb80372d3844429ce25c6ded1
MD5 0aff6fc44e1e59f46711d0203d67c992
SHA1 feaa46bd242858b23153248f7eb9383e23880330
SHA512 d2c6a8b375e7782d1d5afeac2c7fec504f79562d4cb4f753f65df7bb4068f76e7d970e135abadfe23512e904a6c79a2b98b5306f1cef1ff62ad1e0794283a245
MD5 SHA1 SHA512

Submit Download

memory/5068-148-0x0000000062800000-0x0000000062813000-memory.dmp

Download