dee48103bca140695217f9916ad161934dd4e15ac5351a4f69f19894971f8a0d

Analysis

user interaction
yes
max time kernel
56s
max time network
47s
platform
windows11-21h2_x64
resource
win11-20260911-en
resource tags

arch:x64arch:x86image:win11-20260911-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
30/09/2026, 21:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
OG Synthwave/OG Synthwave 2.0.exe
Size 98.1MB
Sample260930-1k6z4syses
SHA256 dee48103bca140695217f9916ad161934dd4e15ac5351a4f69f19894971f8a0d
MD5 359f0c4b77f53b1d8b734d4a822516f2
SHA1 5d4bbfe2202eb50621ea95c7468826a608dfefe9
SHA512 020922910cea8bbf70121480041a5d44504d4e8caaf754537a62b5a114365b69637f882ac70cf0bea2dda715987afe736bc119a5d0e8e85d9093ede326864efe
SSDEEP 3145728:otyBxstzHYmf6voT3b++7i4jCvxDlMpuuE:ogWtz4YTLli4jCGD
TLSH
T126383311AC7B54AAFA628DB903794B8A63727437079337EECF5E2E3019C4F852F15429
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2816	~$0e58a6ab.tmp

Contacts third-party web service commonly abused for C2 1 TTPs 6 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
3	discord.com
4	discord.com
15	discord.com
21	discord.com
25	discord.com
38	discord.com

Suspicious use of NtSetInformationThreadHideFromDebugger 1 TTPs 6 IoCs

defense_evasion

Debugger Evasion

T1622

pid	Process
3212	OG Synthwave 2.0.exe
3212	OG Synthwave 2.0.exe
3212	OG Synthwave 2.0.exe
3212	OG Synthwave 2.0.exe
3212	OG Synthwave 2.0.exe
3212	OG Synthwave 2.0.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	OG Synthwave 2.0.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	OG Synthwave 2.0.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4808	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1826067017-2692080558-3687773357-1000\{190C0A66-C719-43A3-B048-E0B826909B3E}	msedge.exe

Suspicious behavior: LoadsDriver 6 IoCs

pid	Process
676	Process not Found
676	Process not Found
676	Process not Found
676	Process not Found
676	Process not Found
676	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
3796	msedge.exe
3796	msedge.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3796	msedge.exe

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 3212 wrote to memory of 2816	3212	OG Synthwave 2.0.exe	80
PID 2816 wrote to memory of 3796	2816	~$0e58a6ab.tmp	81
PID 3796 wrote to memory of 4608	3796	msedge.exe	82
PID 3796 wrote to memory of 4808	3796	msedge.exe	83
PID 3796 wrote to memory of 5248	3796	msedge.exe	84
PID 3796 wrote to memory of 3560	3796	msedge.exe	85
PID 3796 wrote to memory of 5248	3796	msedge.exe	84
PID 3796 wrote to memory of 5248	3796	msedge.exe	84
PID 3796 wrote to memory of 3560	3796	msedge.exe	85
PID 3796 wrote to memory of 6108	3796	msedge.exe	86
PID 3796 wrote to memory of 5908	3796	msedge.exe	87
PID 3796 wrote to memory of 6108	3796	msedge.exe	86
PID 3796 wrote to memory of 6108	3796	msedge.exe	86
PID 3796 wrote to memory of 5908	3796	msedge.exe	87
PID 3796 wrote to memory of 5908	3796	msedge.exe	87
PID 3796 wrote to memory of 5252	3796	msedge.exe	90
PID 3796 wrote to memory of 5252	3796	msedge.exe	90
PID 3796 wrote to memory of 5556	3796	msedge.exe	91
PID 3796 wrote to memory of 5556	3796	msedge.exe	91
PID 3796 wrote to memory of 4860	3796	msedge.exe	93
PID 3796 wrote to memory of 1712	3796	msedge.exe	94
PID 1712 wrote to memory of 3012	1712	msedge.exe	96
PID 3796 wrote to memory of 4980	3796	msedge.exe	100
PID 3796 wrote to memory of 4692	3796	msedge.exe	101
PID 3796 wrote to memory of 5400	3796	msedge.exe	102

C:\Users\Admin\AppData\Local\Temp\OG Synthwave\OG Synthwave 2.0.exe
"C:\Users\Admin\AppData\Local\Temp\OG Synthwave\OG Synthwave 2.0.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of WriteProcessMemory
PID:3212
- C:\Users\Admin\AppData\Local\Temp\~$0e58a6ab.tmp
  C:\Users\Admin\AppData\Local\Temp\~$0e58a6ab.tmp
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:2816
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://discord.com/api/oauth2/authorize?client_id=1529961440667238471&redirect_uri=http%3A%2F%2Flocalhost%3A3000%2F&response_type=code&scope=identify%20guilds.members.read&code_challenge=pOyyOz6cmgPVhYiZHJEc5OHoMZ49DyUDEzELqrxbxn0&code_challenge_method=S256&state=bk4FQy1sEZpxoGPKI9lv-w&prompt=consent
    3⤵
    - Enumerates system info in registry
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:3796
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2e0,0x2e4,0x2e8,0x2dc,0x368,0x7ffe57cfc188,0x7ffe57cfc194,0x7ffe57cfc1a0
      4⤵
      PID:4608
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1816,i,11365240802413859129,5057565186682287950,524288 --field-trial-handle=2588,i,8085258037951556418,10980359086734954827,262144 --variations-seed-version --mojo-platform-channel-handle=2692 /prefetch:11
      4⤵
      System Time Discovery
      PID:4808
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1528,i,3527460842172597051,1522183219674115758,262144 --field-trial-handle=2588,i,8085258037951556418,10980359086734954827,262144 --variations-seed-version --mojo-platform-channel-handle=2584 /prefetch:2
      4⤵
      PID:5248
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2148,i,9968230790681003526,1876363635174239904,524288 --field-trial-handle=2588,i,8085258037951556418,10980359086734954827,262144 --variations-seed-version --mojo-platform-channel-handle=2700 /prefetch:13
      4⤵
      PID:3560
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3496,i,16928426561356457081,7733328993569434544,2097152 --field-trial-handle=2588,i,8085258037951556418,10980359086734954827,262144 --variations-seed-version --mojo-platform-channel-handle=3528 /prefetch:1
      4⤵
      PID:6108
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3500,i,8153883829854132978,16844111348691646967,2097152 --field-trial-handle=2588,i,8085258037951556418,10980359086734954827,262144 --variations-seed-version --mojo-platform-channel-handle=3396 /prefetch:1
      4⤵
      PID:5908
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5112,i,7834965998388672198,3039797230761286878,524288 --field-trial-handle=2588,i,8085258037951556418,10980359086734954827,262144 --variations-seed-version --mojo-platform-channel-handle=5184 /prefetch:14
      4⤵
      PID:5252
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5096,i,2400126325119237870,17226552183918595010,524288 --field-trial-handle=2588,i,8085258037951556418,10980359086734954827,262144 --variations-seed-version --mojo-platform-channel-handle=5204 /prefetch:14
      4⤵
      PID:5556
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5952,i,12740993930021976536,13213176130994594126,524288 --field-trial-handle=2588,i,8085258037951556418,10980359086734954827,262144 --variations-seed-version --mojo-platform-channel-handle=6060 /prefetch:14
      4⤵
      PID:3184
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5952,i,12740993930021976536,13213176130994594126,524288 --field-trial-handle=2588,i,8085258037951556418,10980359086734954827,262144 --variations-seed-version --mojo-platform-channel-handle=6060 /prefetch:14
      4⤵
      PID:4860
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6160,i,1638283662125984070,16062611756461905858,524288 --field-trial-handle=2588,i,8085258037951556418,10980359086734954827,262144 --variations-seed-version --mojo-platform-channel-handle=6168 /prefetch:14
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1712
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
        
        cookie_exporter.exe --cookie-json=1132
        5⤵
        
        PID:3012
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6072,i,17602066398853873202,4933911176041895045,524288 --field-trial-handle=2588,i,8085258037951556418,10980359086734954827,262144 --variations-seed-version --mojo-platform-channel-handle=6312 /prefetch:14
      4⤵
      PID:4980
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5952,i,4418220438594600867,14988470110950768037,524288 --field-trial-handle=2588,i,8085258037951556418,10980359086734954827,262144 --variations-seed-version --mojo-platform-channel-handle=6008 /prefetch:14
      4⤵
      PID:4692
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6132,i,7626369681517642752,9266451669070897114,524288 --field-trial-handle=2588,i,8085258037951556418,10980359086734954827,262144 --variations-seed-version --mojo-platform-channel-handle=5984 /prefetch:14
      4⤵
      PID:5400

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4512

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:568

C:\Users\Admin\AppData\Local\Temp\OG Synthwave\WinDivert64.sys
"C:\Users\Admin\AppData\Local\Temp\OG Synthwave\WinDivert64.sys"
1⤵
PID:1684

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Debugger Evasion

T1622

Credential Access

Discovery

Browser Information Discovery

T1217

Debugger Evasion

T1622

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

2c57302e-29b7-4aff-b440-43db91abddb9.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\2c57302e-29b7-4aff-b440-43db91abddb9.tmp
Size 27KB
SHA256 944de11a33a2a1378126eee643df156444f3c99eab0ac5e24d00c463d10ee8fb
MD5 b3cff7b4437885dfb8bf7bd1148ff4b6
SHA1 e575fd8f56d7d53afd504c2f13bc70f67f54d919
SHA512 467cd8676e568adeffb50e7a81af0ed4d61072900818b8c12cb4201b106313309f6f19ac3b1bf4ff6c7cb7144ac174e70538abf454763f63f2fd9ac8fc37f48f
SSDEEP 384:noViFGZcIy38NO8TUNTUlIReCC7MyExzyfoBjM6TaBpravBVZh6DKhH/8gL/7Izf:pFUy3pwgfCb+dBQwEpr4BfYGH/6f
TLSH
T1A4C26B36ECA4CDB7ECEA8FCAA74A7A03DEE40163959C9AC4E5C95D1D008319D1307C2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ef8e0a91cc3656fe639527b7c461215de3584a9b32168d8efc58c800c3fcf45a
MD5 7611be076e62556d26aa1ad65d6c21ee
SHA1 3b62033283275e165c1cdb998b2b174841695892
SHA512 949a38fce52f98059e4356f1465fa0cb57397b5b5a79c468fea50c81a884f46ee37ab38ecf492df88f7280e9e041eedad365f8eab019be95f1d7b37d95794929
TLSH
T110D02B58EFD58290D432343A4075428532CFA504D1035200E0D0011319C11410061865
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 00fd53d4e341ca585361bfbe699a2c8a3fdbc255133db935051b0958a30a7abf
MD5 e720824e80db33ac2843bf1ebb30faec
SHA1 f511d38f1de46ab026d3c6963050a3f1f512b92d
SHA512 09eb559f6018245581b30678d5f9952fcadb0adcee197127c7448f39c53ff841dddd8b077678d837d33d8e01126c7d80b7ec77764938cb5368f955ce628ed81c
TLSH
T1E3D02B5CEFD99290D436343A4035428531CFA904D1035200E090010319811410061865
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 649B
SHA256 dcafa8e05efa1d5255473cc94c79035f107cbc129d03121f32631793091ec188
MD5 4d22f46999597769b5ce8f99c9002af8
SHA1 1bd42d6d83f0d61e6eae2697f8af79431f729cc4
SHA512 703efc7a425aeb9ac0729891309814829d545709e5976c4c9246d64310c1a39b797eec0a1886eca621ade1e2b396bf4494f136659a2215366bba74d3fcc714da
TLSH
T1E3F0F4B9C821AC3B18FD1B2D20944B4AEB5413672B50985B3B3D820C8FB163B8A85C5C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 e99b6cd32b0dcb4c8cda0293ad254d6165084267e2d6822777548f3286c2613c
MD5 1647542733a264fc00c6d2201c017153
SHA1 8c560b466f572c524f1ba5e3e471a61e9c135bcf
SHA512 d62761fe38b498e12e0791d411f2f25372b8e7e83652b465f1cba7ab1b01eecec944d35409a05e3df9cf6c44809b0084301be8a7e3596b3c53f9b3afec394a4d
TLSH
T19971E4B415EB80FDDB8A4CB0D1C16D873A351980F5B3AD2380A8C6F87CBA7A741740A7
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 f6606a55aa561cb566e047c5ad615c1a7ad723e1b5bebc1085f03b2941653d01
MD5 49189d11eea9823b7dcb4364a36e6dc4
SHA1 d408dc618f07b9fd9a068d9d41dcb97732dc1177
SHA512 da8748cb2e47c22bbd931c1415e4d0bda5582815d5a2198337aecdd8f1a6e8ada4954fe3281a7400f07b9da70748a2cccfcd7fa3d42541ec96ba886219a5e221
TLSH
T18C31D1F3C3E4866E8A0156F0A618AE2BDE2D0914432C3D5AC5E4AF2B93F3471D14195F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 a21eac85289874a717bcf38fbce2baec69961cc79bfef8d495e37bb7d070c789
MD5 2ec099aa1a875fc1b9744ec08f3bb27e
SHA1 dbf6249557e26bc6b36503c79b9bbc95152e091a
SHA512 9c8853a91793ea3cd1bc18a8a5731bb6b9e5217cebd292521737569f831e41625d4ede52bd64a3428e1cfc59a496ef82baebd8e3464e39730ceb66352a737ed7
SSDEEP 192:sxZ8RocI/fls/5I1ZqMqO+/IwXzodpxL/W6+WNzam/Y0gB1RuROJIg5tYWVJ:sxZ89I/fls27q++/ch/bv/5cL4OgW/
TLSH
T11252E755AD24A97B8CC7E219BA557F53E7FD103291911E48EAFCCA2C01EB6DD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 299cfa69470f28429552f6fc8aaa945c1b9822d051f173fea0ab46996b0dc645
MD5 56d2e0c94b3762662c995478870e23ca
SHA1 b49b560409fcc9c8f778bbd3747b8558361c0f10
SHA512 e70916117bfc6c8668b165356534ffc309a2e9f16470010923eaa33b784cbdf3fef3c83dfb11d6e7ac246e4176dda5bb17b57080e633083b16f2ddd7bbe6502c
SSDEEP 192:sxZ8RocI/fls/0I1ZqMqO+/IwXzodpxL/W6+WNzam/Y0gBsRuROJIg5bXgJ:sxZ89I/flsp7q++/ch/bv/5cg4ONXE
TLSH
T17B52E715AD24A97B8CC7E219BA557F52E3FD103291911E48EAFCCA2C01EB6DD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 c8526c1a3de8fa4e4a2998ee8eec8db1ff4ecdf0d094c9bb57c3268fb0b75ac4
MD5 b129f8faa73de31589fc0b4370d9fd07
SHA1 cea28e2d8d6d895958d05ddc72d265641e18a5bd
SHA512 540092f813790539d8242a4463d45827af6d7d60d0acb9fe579779f53342e551c4091ed0b4fcca131dc1bb060e89ea4b41e76fb90a719a5493f35e343fe7c093
SSDEEP 192:sxZ8RocI/fls+0I1ZqMqO+/IwXzodpxL/W6+WNzam/Y0gBsRuROJIgjXgJ:sxZ89I/fls07q++/ch/bv/5cg4OjXE
TLSH
T14742D815AD24A93B8CC7E619BA557F53E3FD103251911E48E6FCCA2C11EB6DD220781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 33KB
SHA256 1a67366ebc381d609d12b6fa0806136137f56742308f3482db3cf0401c0c2fb0
MD5 5269360dd0e58380098a5604a0acb09e
SHA1 ec858208bd8341af5edcb7cd2a4e5c92b5bd6e79
SHA512 14d118a04ec2d2b8cdc2aee664e17d7bf08533f2e56edb5234954b8b20d952b8ddf264064dc4f61fab7b11a125e5c913a6f6ddf6b8a353d1613134617058f763
SSDEEP 768:AvmgC8Ba2P67pLuLbdtWRmpbQHL8F1+UoAYDCx9Tuqh0VfUC9xbog/OV3aHRgLlz:AvmgC8Ba2PSEbdtWRmpbQHLu1jaKaHRY
TLSH
T115F20A7B680CCA7E4FC04E9DDD267F9A6DA802CB9A98CD4447F9845C02C77EE51160DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 25KB
SHA256 780da7de7dbc7e68b9886645edf022cf3a1407c02bd1078d97540713843fb56c
MD5 1f1ac8fc3d038f77732676e01473110c
SHA1 9e482cb9706c68cf714c260356e62a9c4131a93f
SHA512 2f8de718ad01c29c95400fc73550dea44105617ce06b004c9d873b8ac0dc93e058b4aac18fa03ec339be415a66705d85ade9eb5f433c71d847c28080d6eae609
SSDEEP 96:K4JaKygi+ZSKiIX6cKTKE+9eKOUV9eKukoWtGKEgrhOKKQk6QgKFKWDCK4AiyAgQ:ohdNdBzXXFPXgRbKvtp0JlznCHV7PHg
TLSH
T153C2471070BA12953CBE390894B59B2F52813573711DE62B7FBE00B68E6BE481DFD9C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 339774087da0ef1f9196e4b1489bde9195e213db82fc3a6d0ccabe7a2d28150b
MD5 5bfdbfda71a6ad8173275a9d3c26b117
SHA1 f1b99678cba44128c2960aee97c4cd4e609cdb8b
SHA512 8dd206e3f4521e572323dd5957c47c46c0eb303817ee28cfb0af479aa318b9b7afb3059f81626829ce021fc530625176c07ac097845063e6f36cc48adeaba8d2
SSDEEP 384:noViFiZcIy38NO8TUNTUlIR6CC7MyExzyfoBjM6TaBprKvBXm1gL/7IzsoZ:pFQy3pwgfCb+dBQwEproBXmKm
TLSH
T1D1C24B31ECA4CDB7EDEA8F9AA74A7A03DEE40163959C9AD4E9D95D1D008319D030BC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 9a47d033ea0c46df2c37f843dbee3ee602ac7054b30e177bf713287a2b0deae8
MD5 fa99f0a81a67a01bade85d7f146e2fa5
SHA1 a2c146c4d90fd395e4f37fee833ee266bc1fbbd9
SHA512 9c4a14a7edc36a412a808071fedf224db4cd40f613198df06d2637fd0ed9504a6123eda50dbe54d04d14b3c2c39b003c6ceac05094b007370502db9a8f80e64a
SSDEEP 384:nsiFiZcI638N08TUNTUlIxBCC7JIvcxzyfoBjM6TaBphQIsa+VY5d7UbgL/7IzQ3:XFQ63zwgCCOvWdBQwEpiIhgkP3
TLSH
T10FC24B35ECA4C9BBEDEB8FDAA74A7A03DEE01163959C9AD4D9C85D1D008719D0307C2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 c17f5671af42582df364a41e1927ec11bf38e30e501acbd72603c08674d557a5
MD5 d24aadddb9d5f2da5fd9cc4e0cfc5010
SHA1 55252a47273c1a56adf807db70034a53d3f0522a
SHA512 55adc892dcc42256fcd95e24665dc33daad8d275c7978e59b013b518d407c0ac6da3123a238b6c62cb45ea4fa076e683351f244157655d1afe5e7f9a35f51556
SSDEEP 384:nDViFGZcIy38NO8TUNTUlIReCC7MyExzyfoBjM6TaBpravBVZh6DKhH/8gL/7Izf:gFUy3pwgfCb+dBQwEpr4BfYGH/6f
TLSH
T18AC26B36ECA4CDB7EDEA8FCAA74A7A03DEE40163959C9AC4E5C95D1D008319D1307C2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ui_settings.ini

Path C:\Users\Admin\AppData\Local\Temp\ui_settings.ini
Size 19B
SHA256 596710f1acc736c6f563ddd54c173c087ce711bbb80372d3844429ce25c6ded1
MD5 0aff6fc44e1e59f46711d0203d67c992
SHA1 feaa46bd242858b23153248f7eb9383e23880330
SHA512 d2c6a8b375e7782d1d5afeac2c7fec504f79562d4cb4f753f65df7bb4068f76e7d970e135abadfe23512e904a6c79a2b98b5306f1cef1ff62ad1e0794283a245
MD5 SHA1 SHA512

Submit Download

memory/2816-178-0x0000000062800000-0x0000000062813000-memory.dmp

Download

memory/4860-205-0x0000013E11700000-0x0000013E12700000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads