isrstealer | 0e6b60cda28f2cd36c50a9e8d2560a68df7dc906555579aa9e2a2beb9558ab80

Analysis

max time kernel
148s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240730-en
resource tags

arch:x64arch:x86image:win10v2004-20240730-enlocale:en-usos:windows10-2004-x64system
submitted
01-08-2024 17:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8175d23d9793f4d94b56ccf99a02e1d4_JaffaCakes118.exe
Size

356KB
MD5

8175d23d9793f4d94b56ccf99a02e1d4
SHA1

59c2ec2588b74cd1dce34a75709eb0b9a28ad47e
SHA256

0e6b60cda28f2cd36c50a9e8d2560a68df7dc906555579aa9e2a2beb9558ab80
SHA512

4b589f73b153f8d927884249eb087c077b08e1ca0545fee79ac13e5e930ff59838416645a058899856da324cef911bb88f3ee2baa085b1151c361aa99a6b813f
SSDEEP

6144:f+yzrbgfQXhVQ0reKnkuHpRD+3nRUX1jlk2m4PvZRrJ0441eIMm8iCWNfukr5BxH:f+yzrbgfQXhVQ0reKnkuHp9+tjGRd04O

Score

10^/10

isrstealer credential_access discovery spyware stealer trojan upx

Malware Config

Signatures

ISR Stealer
ISR Stealer is a modified version of Hackhound Stealer written in visual basic.
trojan stealer isrstealer

ISR Stealer payload 3 IoCs

resource	yara_rule
behavioral2/memory/3652-28-0x0000000000400000-0x0000000000432000-memory.dmp	family_isrstealer
behavioral2/memory/3652-29-0x0000000000400000-0x0000000000432000-memory.dmp	family_isrstealer
behavioral2/memory/3652-69-0x0000000000400000-0x0000000000432000-memory.dmp	family_isrstealer

Credentials from Password Stores: Credentials from Web Browsers 1 TTPs
Malicious Access or copy of Web Browser Credential store.
credential_access stealer

Credentials from Web Browsers
T1555.003

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2721909339-1374969515-2476821579-1000\Control Panel\International\Geo\Nation	8175d23d9793f4d94b56ccf99a02e1d4_JaffaCakes118.exe

Executes dropped EXE 3 IoCs

pid	Process
216	Temp-.exe
3652	Temp-.exe
2144	Temp-.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2144-32-0x0000000000400000-0x0000000000453000-memory.dmp	upx
behavioral2/memory/2144-36-0x0000000000400000-0x0000000000453000-memory.dmp	upx
behavioral2/memory/2144-37-0x0000000000400000-0x0000000000453000-memory.dmp	upx
behavioral2/memory/2144-40-0x0000000000400000-0x0000000000453000-memory.dmp	upx
behavioral2/memory/2144-39-0x0000000000400000-0x0000000000453000-memory.dmp	upx

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 216 set thread context of 3652	216	Temp-.exe	89
PID 3652 set thread context of 2144	3652	Temp-.exe	90

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	8175d23d9793f4d94b56ccf99a02e1d4_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Temp-.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Temp-.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Temp-.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4536	msedge.exe
4536	msedge.exe
4360	msedge.exe
4360	msedge.exe
4612	identity_helper.exe
4612	identity_helper.exe
544	msedge.exe
544	msedge.exe
544	msedge.exe
544	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
4360	msedge.exe
4360	msedge.exe
4360	msedge.exe
4360	msedge.exe
4360	msedge.exe
4360	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4360	msedge.exe
4360	msedge.exe
4360	msedge.exe
4360	msedge.exe
4360	msedge.exe
4360	msedge.exe
4360	msedge.exe
4360	msedge.exe
4360	msedge.exe
4360	msedge.exe
4360	msedge.exe
4360	msedge.exe
4360	msedge.exe
4360	msedge.exe
4360	msedge.exe
4360	msedge.exe
4360	msedge.exe
4360	msedge.exe
4360	msedge.exe
4360	msedge.exe
4360	msedge.exe
4360	msedge.exe
4360	msedge.exe
4360	msedge.exe
4360	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4360	msedge.exe
4360	msedge.exe
4360	msedge.exe
4360	msedge.exe
4360	msedge.exe
4360	msedge.exe
4360	msedge.exe
4360	msedge.exe
4360	msedge.exe
4360	msedge.exe
4360	msedge.exe
4360	msedge.exe
4360	msedge.exe
4360	msedge.exe
4360	msedge.exe
4360	msedge.exe
4360	msedge.exe
4360	msedge.exe
4360	msedge.exe
4360	msedge.exe
4360	msedge.exe
4360	msedge.exe
4360	msedge.exe
4360	msedge.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
1120	8175d23d9793f4d94b56ccf99a02e1d4_JaffaCakes118.exe
216	Temp-.exe
3652	Temp-.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1120 wrote to memory of 216	1120	8175d23d9793f4d94b56ccf99a02e1d4_JaffaCakes118.exe	86
PID 1120 wrote to memory of 216	1120	8175d23d9793f4d94b56ccf99a02e1d4_JaffaCakes118.exe	86
PID 1120 wrote to memory of 216	1120	8175d23d9793f4d94b56ccf99a02e1d4_JaffaCakes118.exe	86
PID 1120 wrote to memory of 4360	1120	8175d23d9793f4d94b56ccf99a02e1d4_JaffaCakes118.exe	87
PID 1120 wrote to memory of 4360	1120	8175d23d9793f4d94b56ccf99a02e1d4_JaffaCakes118.exe	87
PID 4360 wrote to memory of 4884	4360	msedge.exe	88
PID 4360 wrote to memory of 4884	4360	msedge.exe	88
PID 216 wrote to memory of 3652	216	Temp-.exe	89
PID 216 wrote to memory of 3652	216	Temp-.exe	89
PID 216 wrote to memory of 3652	216	Temp-.exe	89
PID 216 wrote to memory of 3652	216	Temp-.exe	89
PID 216 wrote to memory of 3652	216	Temp-.exe	89
PID 216 wrote to memory of 3652	216	Temp-.exe	89
PID 216 wrote to memory of 3652	216	Temp-.exe	89
PID 216 wrote to memory of 3652	216	Temp-.exe	89
PID 3652 wrote to memory of 2144	3652	Temp-.exe	90
PID 3652 wrote to memory of 2144	3652	Temp-.exe	90
PID 3652 wrote to memory of 2144	3652	Temp-.exe	90
PID 3652 wrote to memory of 2144	3652	Temp-.exe	90
PID 3652 wrote to memory of 2144	3652	Temp-.exe	90
PID 3652 wrote to memory of 2144	3652	Temp-.exe	90
PID 3652 wrote to memory of 2144	3652	Temp-.exe	90
PID 3652 wrote to memory of 2144	3652	Temp-.exe	90
PID 4360 wrote to memory of 4348	4360	msedge.exe	91
PID 4360 wrote to memory of 4348	4360	msedge.exe	91
PID 4360 wrote to memory of 4348	4360	msedge.exe	91
PID 4360 wrote to memory of 4348	4360	msedge.exe	91
PID 4360 wrote to memory of 4348	4360	msedge.exe	91
PID 4360 wrote to memory of 4348	4360	msedge.exe	91
PID 4360 wrote to memory of 4348	4360	msedge.exe	91
PID 4360 wrote to memory of 4348	4360	msedge.exe	91
PID 4360 wrote to memory of 4348	4360	msedge.exe	91
PID 4360 wrote to memory of 4348	4360	msedge.exe	91
PID 4360 wrote to memory of 4348	4360	msedge.exe	91
PID 4360 wrote to memory of 4348	4360	msedge.exe	91
PID 4360 wrote to memory of 4348	4360	msedge.exe	91
PID 4360 wrote to memory of 4348	4360	msedge.exe	91
PID 4360 wrote to memory of 4348	4360	msedge.exe	91
PID 4360 wrote to memory of 4348	4360	msedge.exe	91
PID 4360 wrote to memory of 4348	4360	msedge.exe	91
PID 4360 wrote to memory of 4348	4360	msedge.exe	91
PID 4360 wrote to memory of 4348	4360	msedge.exe	91
PID 4360 wrote to memory of 4348	4360	msedge.exe	91
PID 4360 wrote to memory of 4348	4360	msedge.exe	91
PID 4360 wrote to memory of 4348	4360	msedge.exe	91
PID 4360 wrote to memory of 4348	4360	msedge.exe	91
PID 4360 wrote to memory of 4348	4360	msedge.exe	91
PID 4360 wrote to memory of 4348	4360	msedge.exe	91
PID 4360 wrote to memory of 4348	4360	msedge.exe	91
PID 4360 wrote to memory of 4348	4360	msedge.exe	91
PID 4360 wrote to memory of 4348	4360	msedge.exe	91
PID 4360 wrote to memory of 4348	4360	msedge.exe	91
PID 4360 wrote to memory of 4348	4360	msedge.exe	91
PID 4360 wrote to memory of 4348	4360	msedge.exe	91
PID 4360 wrote to memory of 4348	4360	msedge.exe	91
PID 4360 wrote to memory of 4348	4360	msedge.exe	91
PID 4360 wrote to memory of 4348	4360	msedge.exe	91
PID 4360 wrote to memory of 4348	4360	msedge.exe	91
PID 4360 wrote to memory of 4348	4360	msedge.exe	91
PID 4360 wrote to memory of 4348	4360	msedge.exe	91
PID 4360 wrote to memory of 4348	4360	msedge.exe	91
PID 4360 wrote to memory of 4348	4360	msedge.exe	91
PID 4360 wrote to memory of 4348	4360	msedge.exe	91
PID 4360 wrote to memory of 4536	4360	msedge.exe	92

C:\Users\Admin\AppData\Local\Temp\8175d23d9793f4d94b56ccf99a02e1d4_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\8175d23d9793f4d94b56ccf99a02e1d4_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1120
- C:\Users\Admin\AppData\Local\Temp-.exe
  "C:\Users\Admin\AppData\Local\Temp-.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:216
- - C:\Users\Admin\AppData\Local\Temp-.exe
    C:\Users\Admin\AppData\Local\Temp-.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3652
  - - C:\Users\Admin\AppData\Local\Temp-.exe
      /scomma "C:\Users\Admin\AppData\Local\Temp\tmp.ini"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:2144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp-.html
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:4360
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc39d246f8,0x7ffc39d24708,0x7ffc39d24718
    3⤵
    PID:4884
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1824,1187849993569606675,3877628128213540994,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2160 /prefetch:2
    3⤵
    PID:4348
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1824,1187849993569606675,3877628128213540994,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2400 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4536
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1824,1187849993569606675,3877628128213540994,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2804 /prefetch:8
    3⤵
    PID:1612
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1824,1187849993569606675,3877628128213540994,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3252 /prefetch:1
    3⤵
    PID:2432
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1824,1187849993569606675,3877628128213540994,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:1
    3⤵
    PID:4120
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1824,1187849993569606675,3877628128213540994,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5196 /prefetch:8
    3⤵
    PID:2796
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1824,1187849993569606675,3877628128213540994,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5196 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4612
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1824,1187849993569606675,3877628128213540994,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4764 /prefetch:1
    3⤵
    PID:2212
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1824,1187849993569606675,3877628128213540994,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4740 /prefetch:1
    3⤵
    PID:1536
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1824,1187849993569606675,3877628128213540994,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4140 /prefetch:1
    3⤵
    PID:5052
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1824,1187849993569606675,3877628128213540994,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5624 /prefetch:1
    3⤵
    PID:436
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1824,1187849993569606675,3877628128213540994,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1308 /prefetch:2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:544

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4940

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1708

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
94c981336abc388ca817dab46e7fc547

SHA1
2d0f8d89a31adb0aad5c599a195ff40ecf4b161f

SHA256
4d44efbb5447fedc3cb21311290fe6a9d0e5a0e682387a1a341bd214df820ef2

SHA512
f1c9c98f6642ea3b90c8667a4871d5a3b8c05eb0c50d5dc31e32704e0eeca1d33add414df485aced130523d6be824c48e37d0022b4d58db60006efe3e337fdbc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
b55d2d2ff2a4d5d7eeaff5ebb96f3b4a

SHA1
12d94b9e84142b10d6347a2ff3b634a20f692c7a

SHA256
3d249eae36cfc3837b043e4b8df670724fee5657b302c77d488f1da3d835f776

SHA512
4dc2fe1eeaca5f9c91d548c70a44ffd12b806a385e22a3c5f724b6f749a15c9ccb3ac1a752c63225bd4d1d90f2b25d8004a15d3912ca6a3cb92fcba91248626f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
ecf5b52a08565324e3fb3c23d166622b

SHA1
974aa39e5afc7d54e837a53ab3b1a863d885ee57

SHA256
06b36e0cd0970a3a8cf1658f49a4f457806a70da9a2c5c4868a81c072843e47d

SHA512
0e561936ad7b977d3880d0961588394767056c1b7b9212668f55f0b6ecd47a3ad92e1b18c72c086d55de070b2a66a757b3ac08b3f1d99ee2f8eeaa56d88a863b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
bea4f6c8a078053386df2405dec69f65

SHA1
c181cc1ddaf100b93aabfb8e3ed9e3d4e1aa80a4

SHA256
8e8ecb66e73111c3c978e3c75a58f9a96d8c0b304ab8de9f7aa47bdadee8848f

SHA512
7628dbf8301d6e80f2ce81b6d6368064373ffa80cf4f896f0596e7f8ffb18ead96c4f55120fff9292c877db65c8f95f724343ac38f76ca1d68c794218eb6bdfa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
4af23b9057c4e8b4d7df2dc7c4349e97

SHA1
a0509d726d63ead7081669e8e1a56e5acfc1e090

SHA256
64defe0775fd0204d78991fb31f50203c5ef8efff41ac87742302ea55c5eed07

SHA512
8c4d913aec5ab074249dabdf9da6ed4b32ac32d52d0772c7426fd453b6c1b40c65e70f10ccbb4adad9f34da8552a92bfa18481ef064b6cea9d8e954bc96b0d02

Download Submit
C:\Users\Admin\AppData\Local\Temp-.exe

Filesize
336KB

MD5
fc45fa3d41a14e87a9c8dadc1f8e560e

SHA1
84082505bcf16e04a1bcb9d128da26adc8559ef5

SHA256
06553b252a56506e403a4e344d28d992a9a329f9e24ff576d73992d3d397c330

SHA512
12b03003f10095eb6b9670023b53049cdc194284df0b0ddd8477e2b8c1d13f3296047627dd6dfaa1f0d0a0d08eb676201d8b6738e06c1b810ce44c92f9197a15

Download Submit
C:\Users\Admin\AppData\Local\Temp-.html

Filesize
104B

MD5
c713264e2a6e4760599627fd5bb46f4e

SHA1
129ff949bc6912173cb6535a91a3d4581f9e7e51

SHA256
ca83465c499b4150eb9a8398caaf5211fef4d3c318520aff5899db2b55baa582

SHA512
deb4f5afdf750251cc9f03cc2dce34db92956f5d91ee00fd6fe4273d876df0ef56501def96ca95222e76d3cccce0731ad12a5602af9cb62fd03cf508e07ea40f

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp.ini

Filesize
5B

MD5
d1ea279fb5559c020a1b4137dc4de237

SHA1
db6f8988af46b56216a6f0daf95ab8c9bdb57400

SHA256
fcdcc2c46896915a1c695d6231f0fee336a668531b7a3da46178c80362546dba

SHA512
720e9c284f0559015312df7fe977563e5e16f48d3506e51eb4016adf7971924d352f740b030aa3adc81b6f65fd1dba12df06d10fa6c115074e5097e7ee0f08b3

Download Submit
memory/2144-32-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/2144-39-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/2144-40-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/2144-37-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/2144-36-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/3652-28-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/3652-29-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/3652-69-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download