380a67eb089437d2adae635c034d90782b114daee41ee40cc24c1efd3bc7bc9a

Analysis

max time kernel
150s
max time network
124s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
01-07-2024 04:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Undertale_v1.08c/Undertale_v1.08c_setup.exe
Size

118.9MB
MD5

e1e154b4199750eceb00748e9d866d75
SHA1

dd4daa7eddbedaa595c660a395b4c7a5d1b2adb2
SHA256

96e274b11eaeec810977e9274c32b68f7aad586fe7b0555e3e9dd6505b3d7f40
SHA512

09ae7654d5fe0a92f0fd84e812f0187f6d1e15ec0d10589f02ad198e7454f17ef52a87221b0bb0be9a688366fbac8e32baed885a1d80799910ac4c2e271ac1b2
SSDEEP

3145728:unbUhqe2SsDAvqZCc0VpuRd2akoazYXsdc/V6/mS+A2Svqf0tKhygA:gUhDVKAvqgcFPkDzY8dc/V6ZPifEshA

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 2 IoCs

Processes:

Undertale_v1.08c_setup.tmpUNDERTALE.exe

pid process

1060 Undertale_v1.08c_setup.tmp
3884 UNDERTALE.exe
Loads dropped DLL 5 IoCs

Processes:

Undertale_v1.08c_setup.tmpUNDERTALE.exe

pid process

1060 Undertale_v1.08c_setup.tmp
1060 Undertale_v1.08c_setup.tmp
1060 Undertale_v1.08c_setup.tmp
3884 UNDERTALE.exe
3884 UNDERTALE.exe
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Drops desktop.ini file(s) 1 IoCs

Processes:

svchost.exe

description ioc process

File opened for modification C:\Users\Admin\Videos\Captures\desktop.ini svchost.exe
Drops file in Windows directory 1 IoCs

Processes:

Undertale_v1.08c_setup.tmp

description ioc process

File opened for modification C:\Windows\WrpYGF74DrEm.ini Undertale_v1.08c_setup.tmp
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

description	ioc	process
File opened for modification	C:\Users\Admin\Videos\Captures\desktop.ini	svchost.exe

description	ioc	process
File opened for modification	C:\Windows\WrpYGF74DrEm.ini	Undertale_v1.08c_setup.tmp

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

svchost.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	svchost.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

Processes:

svchost.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2539840389-1261165778-1087677076-1000\{9F9CF0E2-DE68-4726-8FA1-CA5D5AED427C}	svchost.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes:

Undertale_v1.08c_setup.tmpmsedge.exemsedge.exe

pid process

1060 Undertale_v1.08c_setup.tmp
1060 Undertale_v1.08c_setup.tmp
2640 msedge.exe
2640 msedge.exe
4924 msedge.exe
4924 msedge.exe
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

Processes:

msedge.exe

pid process

4924 msedge.exe
4924 msedge.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

AUDIODG.EXE

description pid process

Token: 33 4316 AUDIODG.EXE
Token: SeIncBasePriorityPrivilege 4316 AUDIODG.EXE

description	pid	process
Token: 33	4316	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	4316	AUDIODG.EXE

Suspicious use of FindShellTrayWindow 27 IoCs

Processes:

Undertale_v1.08c_setup.tmpmsedge.exe

pid	process
1060	Undertale_v1.08c_setup.tmp
4924	msedge.exe
4924	msedge.exe
4924	msedge.exe
4924	msedge.exe
4924	msedge.exe
4924	msedge.exe
4924	msedge.exe
4924	msedge.exe
4924	msedge.exe
4924	msedge.exe
4924	msedge.exe
4924	msedge.exe
4924	msedge.exe
4924	msedge.exe
4924	msedge.exe
4924	msedge.exe
4924	msedge.exe
4924	msedge.exe
4924	msedge.exe
4924	msedge.exe
4924	msedge.exe
4924	msedge.exe
4924	msedge.exe
4924	msedge.exe
4924	msedge.exe
4924	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
4924	msedge.exe
4924	msedge.exe
4924	msedge.exe
4924	msedge.exe
4924	msedge.exe
4924	msedge.exe
4924	msedge.exe
4924	msedge.exe
4924	msedge.exe
4924	msedge.exe
4924	msedge.exe
4924	msedge.exe
4924	msedge.exe
4924	msedge.exe
4924	msedge.exe
4924	msedge.exe
4924	msedge.exe
4924	msedge.exe
4924	msedge.exe
4924	msedge.exe
4924	msedge.exe
4924	msedge.exe
4924	msedge.exe
4924	msedge.exe

Suspicious use of SetWindowsHookEx 3 IoCs

Processes:

UNDERTALE.exeOpenWith.exe

pid process

3884 UNDERTALE.exe
2708 OpenWith.exe
3884 UNDERTALE.exe

pid	process
3884	UNDERTALE.exe
2708	OpenWith.exe
3884	UNDERTALE.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

Undertale_v1.08c_setup.exeUndertale_v1.08c_setup.tmpmsedge.exe

description	pid	process	target process
PID 2976 wrote to memory of 1060	2976	Undertale_v1.08c_setup.exe	Undertale_v1.08c_setup.tmp
PID 2976 wrote to memory of 1060	2976	Undertale_v1.08c_setup.exe	Undertale_v1.08c_setup.tmp
PID 2976 wrote to memory of 1060	2976	Undertale_v1.08c_setup.exe	Undertale_v1.08c_setup.tmp
PID 1060 wrote to memory of 4924	1060	Undertale_v1.08c_setup.tmp	msedge.exe
PID 1060 wrote to memory of 4924	1060	Undertale_v1.08c_setup.tmp	msedge.exe
PID 4924 wrote to memory of 3856	4924	msedge.exe	msedge.exe
PID 4924 wrote to memory of 3856	4924	msedge.exe	msedge.exe
PID 4924 wrote to memory of 4884	4924	msedge.exe	msedge.exe
PID 4924 wrote to memory of 4884	4924	msedge.exe	msedge.exe
PID 4924 wrote to memory of 4884	4924	msedge.exe	msedge.exe
PID 4924 wrote to memory of 4884	4924	msedge.exe	msedge.exe
PID 4924 wrote to memory of 4884	4924	msedge.exe	msedge.exe
PID 4924 wrote to memory of 4884	4924	msedge.exe	msedge.exe
PID 4924 wrote to memory of 4884	4924	msedge.exe	msedge.exe
PID 4924 wrote to memory of 4884	4924	msedge.exe	msedge.exe
PID 4924 wrote to memory of 4884	4924	msedge.exe	msedge.exe
PID 4924 wrote to memory of 4884	4924	msedge.exe	msedge.exe
PID 4924 wrote to memory of 4884	4924	msedge.exe	msedge.exe
PID 4924 wrote to memory of 4884	4924	msedge.exe	msedge.exe
PID 4924 wrote to memory of 4884	4924	msedge.exe	msedge.exe
PID 4924 wrote to memory of 4884	4924	msedge.exe	msedge.exe
PID 4924 wrote to memory of 4884	4924	msedge.exe	msedge.exe
PID 4924 wrote to memory of 4884	4924	msedge.exe	msedge.exe
PID 4924 wrote to memory of 4884	4924	msedge.exe	msedge.exe
PID 4924 wrote to memory of 4884	4924	msedge.exe	msedge.exe
PID 4924 wrote to memory of 4884	4924	msedge.exe	msedge.exe
PID 4924 wrote to memory of 4884	4924	msedge.exe	msedge.exe
PID 4924 wrote to memory of 4884	4924	msedge.exe	msedge.exe
PID 4924 wrote to memory of 4884	4924	msedge.exe	msedge.exe
PID 4924 wrote to memory of 4884	4924	msedge.exe	msedge.exe
PID 4924 wrote to memory of 4884	4924	msedge.exe	msedge.exe
PID 4924 wrote to memory of 4884	4924	msedge.exe	msedge.exe
PID 4924 wrote to memory of 4884	4924	msedge.exe	msedge.exe
PID 4924 wrote to memory of 4884	4924	msedge.exe	msedge.exe
PID 4924 wrote to memory of 4884	4924	msedge.exe	msedge.exe
PID 4924 wrote to memory of 4884	4924	msedge.exe	msedge.exe
PID 4924 wrote to memory of 4884	4924	msedge.exe	msedge.exe
PID 4924 wrote to memory of 4884	4924	msedge.exe	msedge.exe
PID 4924 wrote to memory of 4884	4924	msedge.exe	msedge.exe
PID 4924 wrote to memory of 4884	4924	msedge.exe	msedge.exe
PID 4924 wrote to memory of 4884	4924	msedge.exe	msedge.exe
PID 4924 wrote to memory of 4884	4924	msedge.exe	msedge.exe
PID 4924 wrote to memory of 4884	4924	msedge.exe	msedge.exe
PID 4924 wrote to memory of 4884	4924	msedge.exe	msedge.exe
PID 4924 wrote to memory of 4884	4924	msedge.exe	msedge.exe
PID 4924 wrote to memory of 4884	4924	msedge.exe	msedge.exe
PID 4924 wrote to memory of 4884	4924	msedge.exe	msedge.exe
PID 4924 wrote to memory of 2640	4924	msedge.exe	msedge.exe
PID 4924 wrote to memory of 2640	4924	msedge.exe	msedge.exe
PID 4924 wrote to memory of 688	4924	msedge.exe	msedge.exe
PID 4924 wrote to memory of 688	4924	msedge.exe	msedge.exe
PID 4924 wrote to memory of 688	4924	msedge.exe	msedge.exe
PID 4924 wrote to memory of 688	4924	msedge.exe	msedge.exe
PID 4924 wrote to memory of 688	4924	msedge.exe	msedge.exe
PID 4924 wrote to memory of 688	4924	msedge.exe	msedge.exe
PID 4924 wrote to memory of 688	4924	msedge.exe	msedge.exe
PID 4924 wrote to memory of 688	4924	msedge.exe	msedge.exe
PID 4924 wrote to memory of 688	4924	msedge.exe	msedge.exe
PID 4924 wrote to memory of 688	4924	msedge.exe	msedge.exe
PID 4924 wrote to memory of 688	4924	msedge.exe	msedge.exe
PID 4924 wrote to memory of 688	4924	msedge.exe	msedge.exe
PID 4924 wrote to memory of 688	4924	msedge.exe	msedge.exe
PID 4924 wrote to memory of 688	4924	msedge.exe	msedge.exe
PID 4924 wrote to memory of 688	4924	msedge.exe	msedge.exe

C:\Users\Admin\AppData\Local\Temp\Undertale_v1.08c\Undertale_v1.08c_setup.exe
"C:\Users\Admin\AppData\Local\Temp\Undertale_v1.08c\Undertale_v1.08c_setup.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2976

C:\Users\Admin\AppData\Local\Temp\is-KA1FV.tmp\Undertale_v1.08c_setup.tmp
"C:\Users\Admin\AppData\Local\Temp\is-KA1FV.tmp\Undertale_v1.08c_setup.tmp" /SL5="$60056,124152676,116736,C:\Users\Admin\AppData\Local\Temp\Undertale_v1.08c\Undertale_v1.08c_setup.exe"
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1060

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://tuttop.com/
3⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4924

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffdcf4e46f8,0x7ffdcf4e4708,0x7ffdcf4e4718
4⤵
PID:3856

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2108,5200833850591805067,7223320032481392012,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2128 /prefetch:2
4⤵
PID:4884

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2108,5200833850591805067,7223320032481392012,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2200 /prefetch:3
4⤵
- Suspicious behavior: EnumeratesProcesses
PID:2640

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2108,5200833850591805067,7223320032481392012,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2676 /prefetch:8
4⤵
PID:688

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,5200833850591805067,7223320032481392012,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3340 /prefetch:1
4⤵
PID:2804

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,5200833850591805067,7223320032481392012,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3364 /prefetch:1
4⤵
PID:2912

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2760

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2504

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2668

C:\Games\Undertale v1.08c\UNDERTALE.exe
"C:\Games\Undertale v1.08c\UNDERTALE.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:3884

C:\Windows\System32\GameBarPresenceWriter.exe
"C:\Windows\System32\GameBarPresenceWriter.exe" -ServerName:Windows.Gaming.GameBar.Internal.PresenceWriterServer
1⤵
PID:4440

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:2708

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k BcastDVRUserService -s BcastDVRUserService
1⤵
- Drops desktop.ini file(s)
- Checks processor information in registry
- Modifies registry class
PID:4320

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x46c 0x300
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4316

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Games\Undertale v1.08c\UNDERTALE.exe
Filesize
3.9MB

MD5
8741fe2075cfbb8070ff1ccb7468981a

SHA1
9ff96c296cc555a6a000133e07fb3f4ab92811c4

SHA256
c8c4191026bf5587a6fad120855b8b82ffb4fa0c3eaf10515be472ad84248e58

SHA512
c5e424cece81a4dad5f4e66e6e00b19d0ce014853f4dcd1a45d16e8d4321ba33f6333e2ebaf2dba3152e0fb22f942749664f231e6df5982e4511788a30d7e655

Download Submit
C:\Games\Undertale v1.08c\d3dx9_43.dll
Filesize
1.9MB

MD5
86e39e9161c3d930d93822f1563c280d

SHA1
f5944df4142983714a6d9955e6e393d9876c1e11

SHA256
0b28546be22c71834501f7d7185ede5d79742457331c7ee09efc14490dd64f5f

SHA512
0a3e311c4fd5c2194a8807469e47156af35502e10aeb8a3f64a01ff802cd8669c7e668cc87b593b182fd830a126d002b5d5d7b6c77991158bffdb0b5b997f6b3

Download Submit
C:\Games\Undertale v1.08c\mus_story.ogg
Filesize
648KB

MD5
3eb22f63fd2c3327c539f002605426b3

SHA1
49b3299becda167b22f4daacb009157c21c38485

SHA256
eb5e5463710acba3a2da93ace616cf4a4a42a93ccbc93d8815b08c038fc66463

SHA512
a196c21813f97a96c9f56fdb922d6f61ef254b2f8fff029112aa671cec0aa7e0fc8ec49c70285cc7dd2d60aea907096f8bdefb8f17e5922dfd4f65cc4af53225

Download Submit
C:\Games\Undertale v1.08c\options.ini
Filesize
97B

MD5
40ede613879f6406fd90c4bad9ba08cb

SHA1
234d1a88ecb5eb2f945f0f8959df69bc154a4677

SHA256
52a59e5417778aac32756ac0617d5b00fd47a9015e54b3865fdc17a867b58cf9

SHA512
c42b738b58298bdd8866b6f053df12a13b9eee3917e86846a7fa3d00248a7dc1c7658878c06f51d6b9e0450a4eee940c61d56ad11fe32656bd64f9341abdcaab

Download Submit
C:\Games\Undertale v1.08c\splash.png
Filesize
1KB

MD5
5a886add3e5fe341d635aa98639bb76b

SHA1
b1fa811638510e5758952f95ae1119eb6a9acd8b

SHA256
4d61c1a05b596720523f442bed39d04067d19f7c306073e2306f282e1198c554

SHA512
40e11231ec53b18ef132ea76ff37872a0885322948cd489c3076af40bdbed262a710783068b448d5e026fe4493d0ff40239fabc50c94dacf825e61fa3b939171

Download Submit
C:\Games\Undertale v1.08c\steam_api.dll
Filesize
153KB

MD5
a334e0bcc92d0a2c05a02a9e60cc7f8f

SHA1
09c6762a2ce37ff8d4efea803257180be7560e39

SHA256
4d9be799eec60fbca3aa210753eb96cf05ca5fdada5c14e734fa967ae17c5f8d

SHA512
c2af0137af58833d090c2aa39e0ffcb687cf1e83d266f803d9a161bf8a58972c0c514b27f9e31749e1253aaf149f916670ab2dfa1dd94da1e6681bfb2362ca95

Download Submit
C:\Games\Undertale v1.08c\steam_api.ini
Filesize
176B

MD5
584bff4a11e84a7f50788215c20eb54d

SHA1
9b50c8ace8e62f6c71a3171e6840b4301011c0e8

SHA256
275ea9e605c7a87c8f4f64b7488e16f0806c9a1b0dd5025388ccc29f028b381c

SHA512
77d13b5389e7600e1e0e095c137f3b092e5cab5d976cd79dbd952fd00e6a724be56f6c8a53a6048eac8bb040dcce6f42d32380eb497451fecec5fd066f578a79

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
612a6c4247ef652299b376221c984213

SHA1
d306f3b16bde39708aa862aee372345feb559750

SHA256
9d8e24c91cff338e56b518a533cb2e49a2803356bbf6e04892fb168a7ce2844a

SHA512
34a14d63abb1e3fe0f9927a94393043d458fe0624843e108d290266f554018e6379cba924cb5388735abdd6c5f1e2e318478a673f3f9b762815a758866d10973

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
56641592f6e69f5f5fb06f2319384490

SHA1
6a86be42e2c6d26b7830ad9f4e2627995fd91069

SHA256
02d4984e590e947265474d592e64edde840fdca7eb881eebde3e220a1d883455

SHA512
c75e689b2bbbe07ebf72baf75c56f19c39f45d5593cf47535eb722f95002b3ee418027047c0ee8d63800f499038db5e2c24aff9705d830c7b6eaa290d9adc868

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
5KB

MD5
8669d59a3d909263f5ff8f8babe1cea7

SHA1
e4eeb836ad310ec3be50412d61864c216db339a6

SHA256
9eb4add94aebcaeca7279008a5bd2864999b506d51aacb9f6f49805c3f73f3e0

SHA512
47bca4fc6f4d7ff5fd6c9c27eb898f93b4af6e5eb79f5fb12e0d254527a3dbf3ff7339e8e5adf988f2e498309533f97e707bbe78f005c8f0bf5c84718f797fcc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
8KB

MD5
816bdfba4fb0b65577f81742c1417d47

SHA1
5c01c093f8c375e9685802c86850fbe09ffea4eb

SHA256
2aeb6eb5a5402a366dd2acbd5e0f649c8c608b38bbd6556fafdfd0b6967e06ce

SHA512
2f62c3c98282ac8df45ace4237ea708c2882cd191685ca026fdf88efa977e8c5b2857ee0bfa72d5f968f5c936fe33c918d402b440ba285da7470aeb3bf7d4918

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\GPUCache\data_1
Filesize
264KB

MD5
f50f89a0a91564d0b8a211f8921aa7de

SHA1
112403a17dd69d5b9018b8cede023cb3b54eab7d

SHA256
b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

SHA512
bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-4ODV7.tmp\botva2.dll
Filesize
41KB

MD5
ef899fa243c07b7b82b3a45f6ec36771

SHA1
4a86313cc8766dcad1c2b00c2b8f9bbe0cf8bbbe

SHA256
da7d0368712ee419952eb2640a65a7f24e39fb7872442ed4d2ee847ec4cfde77

SHA512
3f98b5ad9adfad2111ebd1d8cbab9ae423d624d1668cc64c0bfcdbfedf30c1ce3ea6bc6bcf70f7dd1b01172a4349e7c84fb75d395ee5af73866574c1d734c6e8

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-4ODV7.tmp\idp.dll
Filesize
232KB

MD5
55c310c0319260d798757557ab3bf636

SHA1
0892eb7ed31d8bb20a56c6835990749011a2d8de

SHA256
54e7e0ad32a22b775131a6288f083ed3286a9a436941377fc20f85dd9ad983ed

SHA512
e0082109737097658677d7963cbf28d412dca3fa8f5812c2567e53849336ce45ebae2c0430df74bfe16c0f3eebb46961bc1a10f32ca7947692a900162128ae57

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-KA1FV.tmp\Undertale_v1.08c_setup.tmp
Filesize
1.1MB

MD5
569a7f855c49d3a2f8922179f3dda3b7

SHA1
f5c232197cdb470f9f67d1784d19177beea72c4e

SHA256
f3f3a74ea5d386c473998c44d0a6f79ca1bc76c01fbb46ce3100fc397ac73b07

SHA512
d499be32234355f0f7dbc07a5bddef7c8ee6d041a024c83f8df4ee73f89c93799c5e4051985477c03762f47a9f05600f0e85a4574bb4d033f1b289b7d3dfa126

Download Submit
C:\Users\Admin\Videos\Captures\desktop.ini
Filesize
190B

MD5
b0d27eaec71f1cd73b015f5ceeb15f9d

SHA1
62264f8b5c2f5034a1e4143df6e8c787165fbc2f

SHA256
86d9f822aeb989755fac82929e8db369b3f5f04117ef96fd76e3d5f920a501d2

SHA512
7b5c9783a0a14b600b156825639d24cbbc000f5066c48ce9fecc195255603fc55129aaaca336d7ce6ad4e941d5492b756562f2c7a1d151fcfc2dabac76f3946c

Download Submit
\??\pipe\LOCAL\crashpad_4924_UPAGBSGCZUJTRYIV
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/1060-30-0x0000000007DF0000-0x0000000007DFF000-memory.dmp

Filesize
60KB

Download
memory/1060-562-0x0000000000400000-0x000000000052D000-memory.dmp

Filesize
1.2MB

Download
memory/1060-26-0x0000000007DF0000-0x0000000007DFF000-memory.dmp

Filesize
60KB

Download
memory/1060-18-0x0000000000400000-0x000000000052D000-memory.dmp

Filesize
1.2MB

Download
memory/1060-15-0x0000000000400000-0x000000000052D000-memory.dmp

Filesize
1.2MB

Download
memory/1060-38-0x0000000000400000-0x000000000052D000-memory.dmp

Filesize
1.2MB

Download
memory/1060-6-0x0000000000400000-0x000000000052D000-memory.dmp

Filesize
1.2MB

Download
memory/1060-29-0x0000000000400000-0x000000000052D000-memory.dmp

Filesize
1.2MB

Download
memory/1060-518-0x0000000000400000-0x000000000052D000-memory.dmp

Filesize
1.2MB

Download
memory/2976-563-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/2976-2-0x0000000000401000-0x0000000000412000-memory.dmp

Filesize
68KB

Download
memory/2976-14-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/2976-1-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download