ceb6a0b8e1c27c75155ab28b9283fe488ae5daca15b0cc58ebfc009200c8e824

Analysis

max time kernel
140s
max time network
51s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
30-06-2024 09:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Wave Goodbye.exe
Size

6.0MB
MD5

b67c09157b260b02037a716d28d7c34f
SHA1

a6da5549351e78fda395b5381dcf9e14240390fd
SHA256

ceb6a0b8e1c27c75155ab28b9283fe488ae5daca15b0cc58ebfc009200c8e824
SHA512

61cc65311af74f83ea950ef54661a5421df67026f7760e257ae3701b3b339f554ac1b42a63f2adafe142ad71a81c545b6749aac0a4f5c78eccd90d072fb7bbad
SSDEEP

98304:dHx3rQ9UT/cnDEuzHEAtpW1pAT0WaDMyaATQKC2witrFr9vQVN9x3gHWdFISYft4:73rpbcnDEuzkAtpWzATIaAEHVYJJmN/P

Score

9^/10

evasion themida trojan

Malware Config

Signatures

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497

Processes:

Wave Goodbye.exe

description ioc process

Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ Wave Goodbye.exe
Drops file in Drivers directory 1 IoCs

Processes:

Wave Goodbye.exe

description ioc process

File opened for modification C:\Windows\system32\drivers\etc\hosts Wave Goodbye.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Wave Goodbye.exe

description	ioc	process
File opened for modification	C:\Windows\system32\drivers\etc\hosts	Wave Goodbye.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

Wave Goodbye.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Wave Goodbye.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	Wave Goodbye.exe

Themida packer 21 IoCs

Detects Themida, an advanced Windows software protection system.

themida

Processes:

resource	yara_rule
behavioral2/memory/4884-0-0x0000000140000000-0x0000000140F65000-memory.dmp	themida
behavioral2/memory/4884-2-0x0000000140000000-0x0000000140F65000-memory.dmp	themida
behavioral2/memory/4884-3-0x0000000140000000-0x0000000140F65000-memory.dmp	themida
behavioral2/memory/4884-6-0x0000000140000000-0x0000000140F65000-memory.dmp	themida
behavioral2/memory/4884-5-0x0000000140000000-0x0000000140F65000-memory.dmp	themida
behavioral2/memory/4884-4-0x0000000140000000-0x0000000140F65000-memory.dmp	themida
behavioral2/memory/4884-47-0x0000000140000000-0x0000000140F65000-memory.dmp	themida
behavioral2/memory/4884-100-0x0000000140000000-0x0000000140F65000-memory.dmp	themida
behavioral2/memory/4884-101-0x0000000140000000-0x0000000140F65000-memory.dmp	themida
behavioral2/memory/4884-102-0x0000000140000000-0x0000000140F65000-memory.dmp	themida
behavioral2/memory/4884-103-0x0000000140000000-0x0000000140F65000-memory.dmp	themida
behavioral2/memory/4884-104-0x0000000140000000-0x0000000140F65000-memory.dmp	themida
behavioral2/memory/4884-105-0x0000000140000000-0x0000000140F65000-memory.dmp	themida
behavioral2/memory/4884-106-0x0000000140000000-0x0000000140F65000-memory.dmp	themida
behavioral2/memory/4884-107-0x0000000140000000-0x0000000140F65000-memory.dmp	themida
behavioral2/memory/4884-108-0x0000000140000000-0x0000000140F65000-memory.dmp	themida
behavioral2/memory/4884-109-0x0000000140000000-0x0000000140F65000-memory.dmp	themida
behavioral2/memory/4884-110-0x0000000140000000-0x0000000140F65000-memory.dmp	themida
behavioral2/memory/4884-111-0x0000000140000000-0x0000000140F65000-memory.dmp	themida
behavioral2/memory/4884-112-0x0000000140000000-0x0000000140F65000-memory.dmp	themida
behavioral2/memory/4884-113-0x0000000140000000-0x0000000140F65000-memory.dmp	themida

Checks whether UAC is enabled 1 TTPs 1 IoCs
evasion trojan

System Information Discovery
T1082

Processes:

Wave Goodbye.exe

description ioc process

Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA Wave Goodbye.exe
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

Processes:

Wave Goodbye.exe

pid process

4884 Wave Goodbye.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Wave Goodbye.exe

pid	process
4884	Wave Goodbye.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies system certificate store 2 TTPs 2 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

Processes:

Wave Goodbye.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\144E3687B1ABF2C93D845118485A9E9E4407C93A	Wave Goodbye.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\144E3687B1ABF2C93D845118485A9E9E4407C93A\Blob = 030000000100000014000000144e3687b1abf2c93d845118485a9e9e4407c93a2000000001000000b9050000308205b53082039da00302010202140c1f3dced2c83786458b8b3d31fdbfb6558aa8d3300d06092a864886f70d01010b0500306a310b30090603550406130255533113301106035504080c0a43616c69666f726e696131223020060355040a0c19476f6f676c65205472757374205365727669636573204c4c433122302006035504030c19476f6f676c65205472757374205365727669636573204c4c43301e170d3234303630343132313431385a170d3239303630343132313431385a306a310b30090603550406130255533113301106035504080c0a43616c69666f726e696131223020060355040a0c19476f6f676c65205472757374205365727669636573204c4c433122302006035504030c19476f6f676c65205472757374205365727669636573204c4c4330820222300d06092a864886f70d01010105000382020f003082020a0282020100d6b1e4c30f439b224fdad6d7f0686d1d2c05e728c325f8c1da9513002a40a83424bb47b782467f3077d13bb2f3b254f573d17b7817e595888c548b02e845f8a34c2dd1b385675a87ab87e8428b3c6c0bdd16a24ea10495480af3582e55316f9c0731ef7f3c4fd15015899655f5a2a45cc9fee0a92200c073d48f1e437190720766f19bffa8d59fffadd3525f523e31a6cfdd633708c2a195b61ec910b8c302c99ac42baee759e1be9def6b01b02accef28aa13a9335e5d05e03cfb97c4c5efc7cce1d0854fb0085dd191acd9445bd193a6768131c336da2ebff5fd1508e7b93db45c54ea495f6486ef7539f614b9ba8b51877e23f3ee35c7b3cf9eac34bdbb89c2851671a19ab19111dbe647b206e0a014d7a8dc8acfb4115ad5c1b949d033d328d68e3280d6b7da552e7913f76378f18bbd2ad97ba05d42f80626515b47eac6d9613768113a31462d6ce41eef081aa359e83f0d4f4648352fda4f31d0ff8d5072152fbbaa6f51839d215c482f7e14fc7c6d52430fc1c2922ec081ce64534318e0764ede4f3f619e6cecc68b97ebb2dba85d47250181d4c649f34540ebe60ab64d3eabae9001dc3fcd15d9027f4b3babe6efcc012821ba49da004cdb4d367f77faec3ef44dad14f36ca7847381dba54468bdb3797dbdb30ce9b1f2b3ea39a7c1985f3ae3f3ee4e1d699dc60b70ab3559d360b752ffe5867efa6025fa022f825d0203010001a3533051301d0603551d0e04160414259f70a24e8b332df0f8d98bd36ce93fabc894ab301f0603551d23041830168014259f70a24e8b332df0f8d98bd36ce93fabc894ab300f0603551d130101ff040530030101ff300d06092a864886f70d01010b0500038202010020e5f289742cba5c4627793a8a2f0d14d59acbf92bb4f97cbdeaf80208fc6027fecb3f1e4bca7dddfabf486f12d0098816361eccb47f037001dc7c5d16124c0025fad0ab4d35dccb3a624dbe5c0e38fe60658abad9f572ecca5df3f774d5a5eb5dbb56406ece7bbce47fa74d40ff0ba3309a9f95e791f980cec44b9da29604835db786bbdf714ab712c6287fc4940ef7f0449f3029e940fe61b290c2cea73b783fbaa21ea4a8b3f6cfdcc63b9dbd6a8731964aab6383ec01eea8fbf142778eddf538b022aaa4ac101e33a196aaa6d11aeeeaa37dd4d8f5d6bfa42c8fb58cc7adb08f38502592084a51f2d1ebd356991c837072879b1240993bf4ad01adcb998860f8c4680d6d76f2c5c68afe5de757deab7877bb287eb60fc46392a8113cd45a094b88101ec0d0c5d34dc4d3b4870567188aeb1f8df2c26fd5d12667575c71ea1bf272e424af711170b617ec3a5ce1a0db9a208b31b3b1048b61267b16d5287ee575d5b293988879775eee5d4392aa8f8eb3b39f91203a40990fd4d84c9965acd373bea5e44fa38491c08ac7c0bf6daa246b2b618b12a1756ff12ef401b7d38cdc6bfb0b5ecb7c89f113bf13c827a854492f65e4ee6c9e70fae22dcce01aec83294ba3ed620ab9ca681d6bb71bb4d397ba744d22912bca79aee83287e49593914e0001d4006acc74cdc83da2160f1deb7ac0fe5046c557771eefb82a4758929d	Wave Goodbye.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

msedge.exemsedge.exe

pid process

3532 msedge.exe
3532 msedge.exe
100 msedge.exe
100 msedge.exe
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

Processes:

msedge.exe

pid process

100 msedge.exe
100 msedge.exe

pid	process
3532	msedge.exe
3532	msedge.exe
100	msedge.exe
100	msedge.exe

Suspicious use of FindShellTrayWindow 26 IoCs

Processes:

msedge.exe

pid	process
100	msedge.exe
100	msedge.exe
100	msedge.exe
100	msedge.exe
100	msedge.exe
100	msedge.exe
100	msedge.exe
100	msedge.exe
100	msedge.exe
100	msedge.exe
100	msedge.exe
100	msedge.exe
100	msedge.exe
100	msedge.exe
100	msedge.exe
100	msedge.exe
100	msedge.exe
100	msedge.exe
100	msedge.exe
100	msedge.exe
100	msedge.exe
100	msedge.exe
100	msedge.exe
100	msedge.exe
100	msedge.exe
100	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
100	msedge.exe
100	msedge.exe
100	msedge.exe
100	msedge.exe
100	msedge.exe
100	msedge.exe
100	msedge.exe
100	msedge.exe
100	msedge.exe
100	msedge.exe
100	msedge.exe
100	msedge.exe
100	msedge.exe
100	msedge.exe
100	msedge.exe
100	msedge.exe
100	msedge.exe
100	msedge.exe
100	msedge.exe
100	msedge.exe
100	msedge.exe
100	msedge.exe
100	msedge.exe
100	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

Wave Goodbye.exemsedge.exe

description	pid	process	target process
PID 4884 wrote to memory of 100	4884	Wave Goodbye.exe	msedge.exe
PID 4884 wrote to memory of 100	4884	Wave Goodbye.exe	msedge.exe
PID 100 wrote to memory of 116	100	msedge.exe	msedge.exe
PID 100 wrote to memory of 116	100	msedge.exe	msedge.exe
PID 100 wrote to memory of 948	100	msedge.exe	msedge.exe
PID 100 wrote to memory of 948	100	msedge.exe	msedge.exe
PID 100 wrote to memory of 948	100	msedge.exe	msedge.exe
PID 100 wrote to memory of 948	100	msedge.exe	msedge.exe
PID 100 wrote to memory of 948	100	msedge.exe	msedge.exe
PID 100 wrote to memory of 948	100	msedge.exe	msedge.exe
PID 100 wrote to memory of 948	100	msedge.exe	msedge.exe
PID 100 wrote to memory of 948	100	msedge.exe	msedge.exe
PID 100 wrote to memory of 948	100	msedge.exe	msedge.exe
PID 100 wrote to memory of 948	100	msedge.exe	msedge.exe
PID 100 wrote to memory of 948	100	msedge.exe	msedge.exe
PID 100 wrote to memory of 948	100	msedge.exe	msedge.exe
PID 100 wrote to memory of 948	100	msedge.exe	msedge.exe
PID 100 wrote to memory of 948	100	msedge.exe	msedge.exe
PID 100 wrote to memory of 948	100	msedge.exe	msedge.exe
PID 100 wrote to memory of 948	100	msedge.exe	msedge.exe
PID 100 wrote to memory of 948	100	msedge.exe	msedge.exe
PID 100 wrote to memory of 948	100	msedge.exe	msedge.exe
PID 100 wrote to memory of 948	100	msedge.exe	msedge.exe
PID 100 wrote to memory of 948	100	msedge.exe	msedge.exe
PID 100 wrote to memory of 948	100	msedge.exe	msedge.exe
PID 100 wrote to memory of 948	100	msedge.exe	msedge.exe
PID 100 wrote to memory of 948	100	msedge.exe	msedge.exe
PID 100 wrote to memory of 948	100	msedge.exe	msedge.exe
PID 100 wrote to memory of 948	100	msedge.exe	msedge.exe
PID 100 wrote to memory of 948	100	msedge.exe	msedge.exe
PID 100 wrote to memory of 948	100	msedge.exe	msedge.exe
PID 100 wrote to memory of 948	100	msedge.exe	msedge.exe
PID 100 wrote to memory of 948	100	msedge.exe	msedge.exe
PID 100 wrote to memory of 948	100	msedge.exe	msedge.exe
PID 100 wrote to memory of 948	100	msedge.exe	msedge.exe
PID 100 wrote to memory of 948	100	msedge.exe	msedge.exe
PID 100 wrote to memory of 948	100	msedge.exe	msedge.exe
PID 100 wrote to memory of 948	100	msedge.exe	msedge.exe
PID 100 wrote to memory of 948	100	msedge.exe	msedge.exe
PID 100 wrote to memory of 948	100	msedge.exe	msedge.exe
PID 100 wrote to memory of 948	100	msedge.exe	msedge.exe
PID 100 wrote to memory of 948	100	msedge.exe	msedge.exe
PID 100 wrote to memory of 948	100	msedge.exe	msedge.exe
PID 100 wrote to memory of 948	100	msedge.exe	msedge.exe
PID 100 wrote to memory of 3532	100	msedge.exe	msedge.exe
PID 100 wrote to memory of 3532	100	msedge.exe	msedge.exe
PID 100 wrote to memory of 2064	100	msedge.exe	msedge.exe
PID 100 wrote to memory of 2064	100	msedge.exe	msedge.exe
PID 100 wrote to memory of 2064	100	msedge.exe	msedge.exe
PID 100 wrote to memory of 2064	100	msedge.exe	msedge.exe
PID 100 wrote to memory of 2064	100	msedge.exe	msedge.exe
PID 100 wrote to memory of 2064	100	msedge.exe	msedge.exe
PID 100 wrote to memory of 2064	100	msedge.exe	msedge.exe
PID 100 wrote to memory of 2064	100	msedge.exe	msedge.exe
PID 100 wrote to memory of 2064	100	msedge.exe	msedge.exe
PID 100 wrote to memory of 2064	100	msedge.exe	msedge.exe
PID 100 wrote to memory of 2064	100	msedge.exe	msedge.exe
PID 100 wrote to memory of 2064	100	msedge.exe	msedge.exe
PID 100 wrote to memory of 2064	100	msedge.exe	msedge.exe
PID 100 wrote to memory of 2064	100	msedge.exe	msedge.exe
PID 100 wrote to memory of 2064	100	msedge.exe	msedge.exe
PID 100 wrote to memory of 2064	100	msedge.exe	msedge.exe
PID 100 wrote to memory of 2064	100	msedge.exe	msedge.exe
PID 100 wrote to memory of 2064	100	msedge.exe	msedge.exe

C:\Users\Admin\AppData\Local\Temp\Wave Goodbye.exe
"C:\Users\Admin\AppData\Local\Temp\Wave Goodbye.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Drops file in Drivers directory
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies system certificate store
- Suspicious use of WriteProcessMemory
PID:4884

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://discord.gg/6NNYUEXAR2
2⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:100

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa3b1046f8,0x7ffa3b104708,0x7ffa3b104718
3⤵
PID:116

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2152,8178855197204245962,568361212419817147,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2164 /prefetch:2
3⤵
PID:948

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2152,8178855197204245962,568361212419817147,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2216 /prefetch:3
3⤵
- Suspicious behavior: EnumeratesProcesses
PID:3532

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2152,8178855197204245962,568361212419817147,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2760 /prefetch:8
3⤵
PID:2064

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,8178855197204245962,568361212419817147,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3276 /prefetch:1
3⤵
PID:3144

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,8178855197204245962,568361212419817147,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:1
3⤵
PID:3440

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2304

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2892

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
4158365912175436289496136e7912c2

SHA1
813d11f772b1cfe9ceac2bf37f4f741e5e8fbe59

SHA256
354de4b033ba6e4d85f94d91230cb8501f62e0a4e302cd4076c7e0ad73bedbd1

SHA512
74b4f7b24ad4ea395f3a4cd8dbfae54f112a7c87bce3d286ee5161f6b63d62dfa19bb0d96bb7ed1c6d925f5697a2580c25023d5052c6a09992e6fd9dd49ea82b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
ce4c898f8fc7601e2fbc252fdadb5115

SHA1
01bf06badc5da353e539c7c07527d30dccc55a91

SHA256
bce2dfaa91f0d44e977e0f79c60e64954a7b9dc828b0e30fbaa67dbe82f750aa

SHA512
80fff4c722c8d3e69ec4f09510779b7e3518ae60725d2d36903e606a27ec1eaedbdbfac5b662bf2c19194c572ccf0125445f22a907b329ad256e6c00b9cf032c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
5KB

MD5
a770ed3086b92024f7715d1155730677

SHA1
909fea314a98994d250b08cd8c864229ea05adc9

SHA256
389eccd47ed29ba7510af3a1571688cd6c4a377c77f3a837b1f78a6089565144

SHA512
8d5f07cc291feda5695412b6bdcee0156fc64bbeac6fee947e29b8d842d85c1edc8ceff51df8b78c5eedecd0b94fdf73fcdf90a9f675e9da1b5080dc557513f6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
8KB

MD5
cf66fa915445a15434fcc579c7b89c59

SHA1
ce1da35b26aef603e009e5e28f03f4f1671bb72b

SHA256
22bc47222ad2c64cef9c82cad4f5a963ed419eb3422e121f3ba8fdff294fd3d3

SHA512
27a70514dd6a90e9c656294233e0fc4f453b7ebac5a608a816dd80f2f6c040704f2ab2d8c88435f2c529f827a6c6095699b73c8fd15936139bb23db318a3f11c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\GPUCache\data_1
Filesize
264KB

MD5
f50f89a0a91564d0b8a211f8921aa7de

SHA1
112403a17dd69d5b9018b8cede023cb3b54eab7d

SHA256
b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

SHA512
bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

Download Submit
C:\Windows\system32\drivers\etc\hosts
Filesize
1KB

MD5
deca688b3a2d7e1224e65a13c66b405d

SHA1
5d088d911e53b05860d2294f081b7a56614c1b1b

SHA256
efe68251dcfee5e61bce15c9028f4e237c45e24f23f66d0c9acf5355ba709341

SHA512
8ed11f7e130d1d0d5f554849e9ad181f60d242d21aa6019307df20833e7646705716f591b13c9db0ba8643e8800816dd6b691572c80973f540fba14cc84d47be

Download Submit
\??\pipe\LOCAL\crashpad_100_OCAPMZQZIUTDUXQK
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/4884-102-0x0000000140000000-0x0000000140F65000-memory.dmp

Filesize
15.4MB

Download
memory/4884-3-0x0000000140000000-0x0000000140F65000-memory.dmp

Filesize
15.4MB

Download
memory/4884-103-0x0000000140000000-0x0000000140F65000-memory.dmp

Filesize
15.4MB

Download
memory/4884-2-0x0000000140000000-0x0000000140F65000-memory.dmp

Filesize
15.4MB

Download
memory/4884-1-0x00007FFA492B0000-0x00007FFA492B2000-memory.dmp

Filesize
8KB

Download
memory/4884-4-0x0000000140000000-0x0000000140F65000-memory.dmp

Filesize
15.4MB

Download
memory/4884-47-0x0000000140000000-0x0000000140F65000-memory.dmp

Filesize
15.4MB

Download
memory/4884-0-0x0000000140000000-0x0000000140F65000-memory.dmp

Filesize
15.4MB

Download
memory/4884-104-0x0000000140000000-0x0000000140F65000-memory.dmp

Filesize
15.4MB

Download
memory/4884-101-0x0000000140000000-0x0000000140F65000-memory.dmp

Filesize
15.4MB

Download
memory/4884-113-0x0000000140000000-0x0000000140F65000-memory.dmp

Filesize
15.4MB

Download
memory/4884-6-0x0000000140000000-0x0000000140F65000-memory.dmp

Filesize
15.4MB

Download
memory/4884-100-0x0000000140000000-0x0000000140F65000-memory.dmp

Filesize
15.4MB

Download
memory/4884-105-0x0000000140000000-0x0000000140F65000-memory.dmp

Filesize
15.4MB

Download
memory/4884-106-0x0000000140000000-0x0000000140F65000-memory.dmp

Filesize
15.4MB

Download
memory/4884-107-0x0000000140000000-0x0000000140F65000-memory.dmp

Filesize
15.4MB

Download
memory/4884-108-0x0000000140000000-0x0000000140F65000-memory.dmp

Filesize
15.4MB

Download
memory/4884-109-0x0000000140000000-0x0000000140F65000-memory.dmp

Filesize
15.4MB

Download
memory/4884-110-0x0000000140000000-0x0000000140F65000-memory.dmp

Filesize
15.4MB

Download
memory/4884-111-0x0000000140000000-0x0000000140F65000-memory.dmp

Filesize
15.4MB

Download
memory/4884-112-0x0000000140000000-0x0000000140F65000-memory.dmp

Filesize
15.4MB

Download
memory/4884-5-0x0000000140000000-0x0000000140F65000-memory.dmp

Filesize
15.4MB

Download