hawkeye_reborn | 81dc465b443d6207c3c3371bdffb7ccab9ab8991404f60b3f8b0f2dd34d124f7

Resubmissions

08-10-2024 04:49

241008-ff3fxatcmd 10

25-08-2024 10:08

240825-l58l4sycqg 10

Analysis

max time kernel
37s
max time network
35s
platform
windows11-21h2_x64
resource
win11-20241007-en
resource tags

arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
submitted
08-10-2024 04:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c08140b86fcf9923dc47dbb44726a0a7_JaffaCakes118.exe
Size

1.1MB
MD5

c08140b86fcf9923dc47dbb44726a0a7
SHA1

d7d3957ad7f745c12df312a0dace7ae701b5fdf4
SHA256

81dc465b443d6207c3c3371bdffb7ccab9ab8991404f60b3f8b0f2dd34d124f7
SHA512

5c4fa93e506906ff41a6ce6a28d5309976c56a6fea91d87001447d137c3db3b0c07d8b29863168573cf8c9ba2a3be4149fe52132ae76433456bc86579f167b3a
SSDEEP

24576:02TgBtmRfOV3HtmRkNQEFOxt/pogktu/mTst50GaWcrbESFhahWtP:JBOFYRkNQKI/pogktu/mwt50G0EIUI

Score

10^/10

hawkeye_reborn m00nd3v_logger discovery infostealer keylogger spyware stealer trojan upx

Malware Config

Extracted

Family

hawkeye_reborn

Version

10.1.0.0

Credentials

Protocol: ftp
Host:
ftp.zzv.ro
Port:
21
Username:
[email protected]
Password:
^36f4OT-q^-?

Mutex

68a8e7d3-0361-4556-8999-3035430b0044

Attributes

fields
map[_AntiDebugger:false _AntiVirusKiller:false _BotKiller:false _ClipboardLogger:false _Delivery:2 _DisableCommandPrompt:false _DisableRegEdit:false _DisableTaskManager:false _Disablers:false _EmailPort:0 _EmailSSL:false _ExecutionDelay:10 _FTPPassword:^36f4OT-q^-? _FTPPort:21 _FTPSFTP:true _FTPServer:ftp.zzv.ro _FTPUsername:[email protected] _FakeMessageIcon:0 _FakeMessageShow:false _FileBinder:false _HideFile:false _HistoryCleaner:false _Install:false _InstallLocation:0 _InstallStartup:false _InstallStartupPersistance:false _KeyStrokeLogger:false _LogInterval:570000 _MeltFile:false _Mutex:68a8e7d3-0361-4556-8999-3035430b0044 _PasswordStealer:true _ProcessElevation:false _ProcessProtection:false _ScreenshotLogger:false _SystemInfo:false _Version:10.1.0.0 _WebCamLogger:false _WebsiteBlocker:false _WebsiteVisitor:false _WebsiteVisitorVisible:false _ZoneID:false]
name
HawkEye Keylogger - RebornX, Version=10.1.0.0, Culture=neutral, PublicKeyToken=null

Signatures

HawkEye Reborn
HawkEye Reborn is an enhanced version of the HawkEye malware kit.
keylogger trojan stealer spyware hawkeye_reborn
M00nd3v_Logger
M00nd3v Logger is a .NET stealer/logger targeting passwords from browsers and email clients.
stealer spyware m00nd3v_logger

Detected Nirsoft tools 4 IoCs

Free utilities often used by attackers which can steal passwords, product keys, etc.

resource	yara_rule
behavioral1/memory/2736-27-0x0000000000400000-0x0000000000477000-memory.dmp	Nirsoft
behavioral1/memory/2736-29-0x0000000000400000-0x0000000000477000-memory.dmp	Nirsoft
behavioral1/memory/2736-30-0x0000000000400000-0x0000000000477000-memory.dmp	Nirsoft
behavioral1/memory/2736-35-0x0000000000400000-0x0000000000477000-memory.dmp	Nirsoft

M00nD3v Logger payload 7 IoCs

Detects M00nD3v Logger payload in memory.

infostealer

resource	yara_rule
behavioral1/memory/2504-9-0x0000000000B90000-0x0000000000C3A000-memory.dmp	m00nd3v_logger
behavioral1/memory/2504-11-0x0000000000400000-0x0000000000561000-memory.dmp	m00nd3v_logger
behavioral1/memory/2504-10-0x0000000000400000-0x0000000000561000-memory.dmp	m00nd3v_logger
behavioral1/memory/2504-8-0x0000000000B90000-0x0000000000C3A000-memory.dmp	m00nd3v_logger
behavioral1/memory/2504-6-0x0000000000400000-0x0000000000561000-memory.dmp	m00nd3v_logger
behavioral1/memory/2504-23-0x0000000000400000-0x0000000000561000-memory.dmp	m00nd3v_logger
behavioral1/memory/2504-24-0x0000000000400000-0x0000000000561000-memory.dmp	m00nd3v_logger

NirSoft WebBrowserPassView 4 IoCs

Password recovery tool for various web browsers

resource	yara_rule
behavioral1/memory/2736-27-0x0000000000400000-0x0000000000477000-memory.dmp	WebBrowserPassView
behavioral1/memory/2736-29-0x0000000000400000-0x0000000000477000-memory.dmp	WebBrowserPassView
behavioral1/memory/2736-30-0x0000000000400000-0x0000000000477000-memory.dmp	WebBrowserPassView
behavioral1/memory/2736-35-0x0000000000400000-0x0000000000477000-memory.dmp	WebBrowserPassView

Uses the VBS compiler for execution 1 TTPs

Command and Scripting Interpreter
T1059

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 2252 set thread context of 2504	2252	c08140b86fcf9923dc47dbb44726a0a7_JaffaCakes118.exe	79
PID 2504 set thread context of 2736	2504	c08140b86fcf9923dc47dbb44726a0a7_JaffaCakes118.exe	81

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2504-3-0x0000000000400000-0x0000000000561000-memory.dmp	upx
behavioral1/memory/2504-11-0x0000000000400000-0x0000000000561000-memory.dmp	upx
behavioral1/memory/2504-10-0x0000000000400000-0x0000000000561000-memory.dmp	upx
behavioral1/memory/2504-6-0x0000000000400000-0x0000000000561000-memory.dmp	upx
behavioral1/memory/2504-5-0x0000000000400000-0x0000000000561000-memory.dmp	upx

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	c08140b86fcf9923dc47dbb44726a0a7_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	c08140b86fcf9923dc47dbb44726a0a7_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vbc.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
5088	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
2252	c08140b86fcf9923dc47dbb44726a0a7_JaffaCakes118.exe
2252	c08140b86fcf9923dc47dbb44726a0a7_JaffaCakes118.exe
2736	vbc.exe
2736	vbc.exe
2736	vbc.exe
2736	vbc.exe
1540	msedge.exe
1540	msedge.exe
5088	msedge.exe
5088	msedge.exe
2328	identity_helper.exe
2328	identity_helper.exe
4128	msedge.exe
4128	msedge.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
2252	c08140b86fcf9923dc47dbb44726a0a7_JaffaCakes118.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
5088	msedge.exe
5088	msedge.exe

Suspicious use of FindShellTrayWindow 26 IoCs

pid	Process
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2252 wrote to memory of 2504	2252	c08140b86fcf9923dc47dbb44726a0a7_JaffaCakes118.exe	79
PID 2252 wrote to memory of 2504	2252	c08140b86fcf9923dc47dbb44726a0a7_JaffaCakes118.exe	79
PID 2252 wrote to memory of 2504	2252	c08140b86fcf9923dc47dbb44726a0a7_JaffaCakes118.exe	79
PID 2504 wrote to memory of 2736	2504	c08140b86fcf9923dc47dbb44726a0a7_JaffaCakes118.exe	81
PID 2504 wrote to memory of 2736	2504	c08140b86fcf9923dc47dbb44726a0a7_JaffaCakes118.exe	81
PID 2504 wrote to memory of 2736	2504	c08140b86fcf9923dc47dbb44726a0a7_JaffaCakes118.exe	81
PID 2504 wrote to memory of 2736	2504	c08140b86fcf9923dc47dbb44726a0a7_JaffaCakes118.exe	81
PID 2504 wrote to memory of 2736	2504	c08140b86fcf9923dc47dbb44726a0a7_JaffaCakes118.exe	81
PID 2504 wrote to memory of 2736	2504	c08140b86fcf9923dc47dbb44726a0a7_JaffaCakes118.exe	81
PID 2504 wrote to memory of 2736	2504	c08140b86fcf9923dc47dbb44726a0a7_JaffaCakes118.exe	81
PID 2504 wrote to memory of 2736	2504	c08140b86fcf9923dc47dbb44726a0a7_JaffaCakes118.exe	81
PID 2504 wrote to memory of 2736	2504	c08140b86fcf9923dc47dbb44726a0a7_JaffaCakes118.exe	81
PID 5088 wrote to memory of 2772	5088	msedge.exe	85
PID 5088 wrote to memory of 2772	5088	msedge.exe	85
PID 5088 wrote to memory of 1232	5088	msedge.exe	86
PID 5088 wrote to memory of 1232	5088	msedge.exe	86
PID 5088 wrote to memory of 1232	5088	msedge.exe	86
PID 5088 wrote to memory of 1232	5088	msedge.exe	86
PID 5088 wrote to memory of 1232	5088	msedge.exe	86
PID 5088 wrote to memory of 1232	5088	msedge.exe	86
PID 5088 wrote to memory of 1232	5088	msedge.exe	86
PID 5088 wrote to memory of 1232	5088	msedge.exe	86
PID 5088 wrote to memory of 1232	5088	msedge.exe	86
PID 5088 wrote to memory of 1232	5088	msedge.exe	86
PID 5088 wrote to memory of 1232	5088	msedge.exe	86
PID 5088 wrote to memory of 1232	5088	msedge.exe	86
PID 5088 wrote to memory of 1232	5088	msedge.exe	86
PID 5088 wrote to memory of 1232	5088	msedge.exe	86
PID 5088 wrote to memory of 1232	5088	msedge.exe	86
PID 5088 wrote to memory of 1232	5088	msedge.exe	86
PID 5088 wrote to memory of 1232	5088	msedge.exe	86
PID 5088 wrote to memory of 1232	5088	msedge.exe	86
PID 5088 wrote to memory of 1232	5088	msedge.exe	86
PID 5088 wrote to memory of 1232	5088	msedge.exe	86
PID 5088 wrote to memory of 1232	5088	msedge.exe	86
PID 5088 wrote to memory of 1232	5088	msedge.exe	86
PID 5088 wrote to memory of 1232	5088	msedge.exe	86
PID 5088 wrote to memory of 1232	5088	msedge.exe	86
PID 5088 wrote to memory of 1232	5088	msedge.exe	86
PID 5088 wrote to memory of 1232	5088	msedge.exe	86
PID 5088 wrote to memory of 1232	5088	msedge.exe	86
PID 5088 wrote to memory of 1232	5088	msedge.exe	86
PID 5088 wrote to memory of 1232	5088	msedge.exe	86
PID 5088 wrote to memory of 1232	5088	msedge.exe	86
PID 5088 wrote to memory of 1232	5088	msedge.exe	86
PID 5088 wrote to memory of 1232	5088	msedge.exe	86
PID 5088 wrote to memory of 1232	5088	msedge.exe	86
PID 5088 wrote to memory of 1232	5088	msedge.exe	86
PID 5088 wrote to memory of 1232	5088	msedge.exe	86
PID 5088 wrote to memory of 1232	5088	msedge.exe	86
PID 5088 wrote to memory of 1232	5088	msedge.exe	86
PID 5088 wrote to memory of 1232	5088	msedge.exe	86
PID 5088 wrote to memory of 1232	5088	msedge.exe	86
PID 5088 wrote to memory of 1232	5088	msedge.exe	86
PID 5088 wrote to memory of 1540	5088	msedge.exe	87
PID 5088 wrote to memory of 1540	5088	msedge.exe	87
PID 5088 wrote to memory of 4820	5088	msedge.exe	88
PID 5088 wrote to memory of 4820	5088	msedge.exe	88
PID 5088 wrote to memory of 4820	5088	msedge.exe	88
PID 5088 wrote to memory of 4820	5088	msedge.exe	88
PID 5088 wrote to memory of 4820	5088	msedge.exe	88
PID 5088 wrote to memory of 4820	5088	msedge.exe	88
PID 5088 wrote to memory of 4820	5088	msedge.exe	88
PID 5088 wrote to memory of 4820	5088	msedge.exe	88

C:\Users\Admin\AppData\Local\Temp\c08140b86fcf9923dc47dbb44726a0a7_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\c08140b86fcf9923dc47dbb44726a0a7_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2252
- C:\Users\Admin\AppData\Local\Temp\c08140b86fcf9923dc47dbb44726a0a7_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\c08140b86fcf9923dc47dbb44726a0a7_JaffaCakes118.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2504
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
    "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /stext "C:\Users\Admin\AppData\Local\Temp\tmpB737.tmp"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:2736

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\Desktop\PingStop.htm
1⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffc28333cb8,0x7ffc28333cc8,0x7ffc28333cd8
  2⤵
  PID:2772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1892,12245879918954693934,6464298237386879543,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1912 /prefetch:2
  2⤵
  PID:1232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1892,12245879918954693934,6464298237386879543,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2284 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1892,12245879918954693934,6464298237386879543,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2544 /prefetch:8
  2⤵
  PID:4820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,12245879918954693934,6464298237386879543,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3228 /prefetch:1
  2⤵
  PID:400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,12245879918954693934,6464298237386879543,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:1
  2⤵
  PID:4480
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1892,12245879918954693934,6464298237386879543,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4836 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1892,12245879918954693934,6464298237386879543,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5172 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4128

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4348

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3424

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
c03d23a8155753f5a936bd7195e475bc

SHA1
cdf47f410a3ec000e84be83a3216b54331679d63

SHA256
6f5f7996d9b0e131dc2fec84859b7a8597c11a67dd41bdb5a5ef21a46e1ae0ca

SHA512
6ea9a631b454d7e795ec6161e08dbe388699012dbbc9c8cfdf73175a0ecd51204d45cf28a6f1706c8d5f1780666d95e46e4bc27752da9a9d289304f1d97c2f41

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
3d68c7edc2a288ee58e6629398bb9f7c

SHA1
6c1909dea9321c55cae38b8f16bd9d67822e2e51

SHA256
dfd733ed3cf4fb59f2041f82fdf676973783ffa75b9acca095609c7d4f73587b

SHA512
0eda66a07ec4cdb46b0f27d6c8cc157415d803af610b7430adac19547e121f380b9c6a2840f90fe49eaea9b48fa16079d93833c2bcf4b85e3c401d90d464ad2f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\1d61776d-59a8-442c-8aee-43753043aa6e.tmp

Filesize
5KB

MD5
912b170b044845e6d9a01166a06660a2

SHA1
5103e8a2edde65690103cbb5ce2163e5fc966eef

SHA256
6022fb9b2b944b4c3aed21ac1d793b867754d1ba62782626884f43830548ecd2

SHA512
40f7a269583f12891f9ea2736c25b678f11b7d26b29965e3ea1306a6c95e9b6905346bb9ca26ada77a5248e9c6eeaa8dbba72d8254ea7339cfc10e99e73a26aa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
ab905608a2afe4c3a7bb45e5f3968a33

SHA1
1e7718c9a7bb9475328067cc406c95fae24a57a6

SHA256
93369d7350e6a0607bf784cf2502191ca48d273eff8fc42255fd49dc0cbfc854

SHA512
ec09914939315ba83cc337134a5ed67cb6598b768b23109f0f82a45be20849092fe6c20a09330f407db20c701584bba17d26ff8e72ae45c6f91a8f23b12f92e3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
115606af68736d9d414795f1984b97d9

SHA1
a5a960e021c665382a54e9ca38e1f2cf1a724fda

SHA256
6d2e85f805c8332c7d42a42f35e02d35c9c57d23a5d7267f41fd5b897fa622b9

SHA512
657a772b135fb9b69dc4e66a6e9a488ab951ba99fb9112106ebb5a19fba803638200e32fca6fef6db798c1a87d40e0667fe136c909d936bc1ec6db6268c5aaed

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
f1291e0ebe4cb9f192a6b9e7c5733939

SHA1
74a78fb1954b1c7e26ca9ce7bc59738f83bfab80

SHA256
45ad1ad8a2ed2c45258a07c3f399f2602ce90757e7be192d6d14cc4e855b4aba

SHA512
166adb2b6e67e207261ebf61f4f86902f245330a864074298396ebf2fb07cc9fc8749804aca30d8a86fd2e1a44ee96063c8e6c72ed7616b64ee4637bfe06b44d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
d46855985b888227db5fb96806054576

SHA1
1891284680f7e83a99946cede2a53037b46f2bc4

SHA256
991dbf11bf690c390923ba8c60621548063abdbd470800a8a369c116ab7937c2

SHA512
3646fc31f787c3590b1edf65b170cabaef36900aa3ba5f76d56f8dda141942617ea7ada4d3f58496e9b9d4e3f90ecf0f26dca30616b686e322c475046e743988

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\GPUCache\data_1

Filesize
264KB

MD5
f50f89a0a91564d0b8a211f8921aa7de

SHA1
112403a17dd69d5b9018b8cede023cb3b54eab7d

SHA256
b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

SHA512
bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpB737.tmp

Filesize
2B

MD5
f3b25701fe362ec84616a93a45ce9998

SHA1
d62636d8caec13f04e28442a0a6fa1afeb024bbb

SHA256
b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

SHA512
98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

Download Submit
memory/2252-0-0x00000000023B0000-0x00000000023B1000-memory.dmp

Filesize
4KB

Download
memory/2252-12-0x0000000000400000-0x0000000000525000-memory.dmp

Filesize
1.1MB

Download
memory/2252-2-0x0000000002450000-0x0000000002451000-memory.dmp

Filesize
4KB

Download
memory/2252-1-0x0000000002430000-0x0000000002443000-memory.dmp

Filesize
76KB

Download
memory/2504-8-0x0000000000B90000-0x0000000000C3A000-memory.dmp

Filesize
680KB

Download
memory/2504-24-0x0000000000400000-0x0000000000561000-memory.dmp

Filesize
1.4MB

Download
memory/2504-23-0x0000000000400000-0x0000000000561000-memory.dmp

Filesize
1.4MB

Download
memory/2504-5-0x0000000000400000-0x0000000000561000-memory.dmp

Filesize
1.4MB

Download
memory/2504-6-0x0000000000400000-0x0000000000561000-memory.dmp

Filesize
1.4MB

Download
memory/2504-10-0x0000000000400000-0x0000000000561000-memory.dmp

Filesize
1.4MB

Download
memory/2504-11-0x0000000000400000-0x0000000000561000-memory.dmp

Filesize
1.4MB

Download
memory/2504-9-0x0000000000B90000-0x0000000000C3A000-memory.dmp

Filesize
680KB

Download
memory/2504-3-0x0000000000400000-0x0000000000561000-memory.dmp

Filesize
1.4MB

Download
memory/2736-35-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/2736-30-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/2736-29-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/2736-27-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download