2cc47dd7e1c115f117dc188dbb0a85e1e88151699e01b4b9e42e9f2f84460576

Analysis

max time kernel
145s
max time network
128s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
15/01/2024, 05:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

5c3dded3966e7002c14e002c254e00a6.exe
Size

444KB
MD5

5c3dded3966e7002c14e002c254e00a6
SHA1

440104d40f127ae8fc9c1ebe35c4d0edc7322417
SHA256

2cc47dd7e1c115f117dc188dbb0a85e1e88151699e01b4b9e42e9f2f84460576
SHA512

0f54216d6c422697ffb4409d8646218cb2aa65226d635e63d3121952a1b5f7bf6a04ace78a39fa3cdc53f6d7980f9f195e6e5da227717580162b610d837256cb
SSDEEP

3072:v15q15n15q15n15q15n15q15q15n15q15q15/whag4iE4oI:t5g515g515g515g5g515g5g5Pg

Score

8^/10

upx

Malware Config

Signatures

Drops file in Drivers directory 6 IoCs

description	ioc	Process
File created	C:\WINDOWS\SysWOW64\drivers\afunix.sys	5c3dded3966e7002c14e002c254e00a6.exe
File created	C:\WINDOWS\SysWOW64\drivers\afunix.sys	exc.exe
File created	C:\WINDOWS\SysWOW64\drivers\gm.dls	exc.exe
File created	C:\WINDOWS\SysWOW64\drivers\gm.dls	5c3dded3966e7002c14e002c254e00a6.exe
File created	C:\WINDOWS\SysWOW64\drivers\gmreadme.txt	exc.exe
File created	C:\WINDOWS\SysWOW64\drivers\gmreadme.txt	5c3dded3966e7002c14e002c254e00a6.exe

Manipulates Digital Signatures 2 IoCs

Attackers can apply techniques such as modifying certain DLL exports to make their binary seem valid.

description	ioc	Process
File created	C:\WINDOWS\SysWOW64\wintrust.dll	5c3dded3966e7002c14e002c254e00a6.exe
File created	C:\WINDOWS\SysWOW64\wintrust.dll	exc.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\Control Panel\International\Geo\Nation	5c3dded3966e7002c14e002c254e00a6.exe

Executes dropped EXE 1 IoCs

pid	Process
3112	exc.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2308-0-0x0000000000400000-0x000000000040A000-memory.dmp	upx
behavioral2/files/0x000600000001e5df-5.dat	upx
behavioral2/memory/2308-9-0x0000000000400000-0x000000000040A000-memory.dmp	upx
behavioral2/memory/3112-10-0x0000000000400000-0x000000000040A000-memory.dmp	upx
behavioral2/files/0x000100000000aeeb-18.dat	upx
behavioral2/files/0x000100000001dad2-23.dat	upx
behavioral2/files/0x0001000000009e68-34.dat	upx
behavioral2/files/0x00050000000006bd-31.dat	upx
behavioral2/files/0x000100000001dad1-20.dat	upx
behavioral2/files/0x0001000000009e6b-36.dat	upx
behavioral2/files/0x000500000001db0e-38.dat	upx
behavioral2/files/0x000600000001e642-42.dat	upx
behavioral2/files/0x000300000001e957-45.dat	upx
behavioral2/files/0x000100000000c0bc-48.dat	upx
behavioral2/files/0x000300000001e803-63.dat	upx
behavioral2/files/0x000300000001e802-60.dat	upx
behavioral2/files/0x000300000001e801-57.dat	upx
behavioral2/files/0x000300000001e82c-84.dat	upx
behavioral2/files/0x000300000001e82d-88.dat	upx
behavioral2/files/0x000600000001e6eb-101.dat	upx
behavioral2/files/0x000600000001e6ea-99.dat	upx
behavioral2/files/0x000600000001e6e9-97.dat	upx
behavioral2/files/0x000700000001e6e7-92.dat	upx
behavioral2/files/0x000300000001e82b-81.dat	upx
behavioral2/files/0x000600000001e8e6-130.dat	upx
behavioral2/files/0x000300000001e919-155.dat	upx
behavioral2/files/0x000500000001e918-152.dat	upx
behavioral2/files/0x000600000001e8ed-149.dat	upx
behavioral2/files/0x000600000001e8ec-146.dat	upx
behavioral2/files/0x000700000001e8eb-143.dat	upx
behavioral2/files/0x000400000001e8ea-139.dat	upx
behavioral2/files/0x000400000001e8e8-137.dat	upx
behavioral2/files/0x000500000001e8e7-134.dat	upx
behavioral2/files/0x000600000001e8e3-125.dat	upx
behavioral2/files/0x000300000001e964-163.dat	upx
behavioral2/files/0x000300000001e96f-196.dat	upx
behavioral2/files/0x000300000001e971-220.dat	upx
behavioral2/files/0x000300000001e970-218.dat	upx
behavioral2/files/0x000300000001e91c-213.dat	upx
behavioral2/files/0x000300000001e91b-210.dat	upx
behavioral2/files/0x000600000001e7d1-206.dat	upx
behavioral2/files/0x000400000001e723-203.dat	upx
behavioral2/files/0x000200000001e839-198.dat	upx
behavioral2/files/0x000300000001e96e-193.dat	upx
behavioral2/files/0x000300000001e96d-190.dat	upx
behavioral2/files/0x000300000001e96c-187.dat	upx
behavioral2/files/0x000300000001e96b-184.dat	upx
behavioral2/files/0x000300000001e96a-181.dat	upx
behavioral2/files/0x000300000001e969-178.dat	upx
behavioral2/files/0x000300000001e968-175.dat	upx
behavioral2/files/0x000300000001e967-172.dat	upx
behavioral2/files/0x000300000001e966-168.dat	upx
behavioral2/files/0x000300000001e965-166.dat	upx
behavioral2/files/0x000300000001e91a-159.dat	upx
behavioral2/files/0x000600000001e6f1-119.dat	upx
behavioral2/files/0x000500000001e6f0-116.dat	upx
behavioral2/files/0x000500000001e6ef-113.dat	upx
behavioral2/files/0x000500000001e6ed-108.dat	upx
behavioral2/files/0x000500000001e6ec-104.dat	upx
behavioral2/files/0x000300000001e82a-78.dat	upx
behavioral2/files/0x000300000001e808-75.dat	upx
behavioral2/files/0x000300000001e807-72.dat	upx
behavioral2/files/0x000300000001e805-69.dat	upx
behavioral2/files/0x000300000001e804-66.dat	upx

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\WINDOWS\SysWOW64\basecsp.dll	5c3dded3966e7002c14e002c254e00a6.exe
File created	C:\WINDOWS\SysWOW64\dsuiext.dll	5c3dded3966e7002c14e002c254e00a6.exe
File created	C:\WINDOWS\SysWOW64\sspicli.dll	5c3dded3966e7002c14e002c254e00a6.exe
File created	C:\WINDOWS\SysWOW64\Windows.Web.Http.dll	5c3dded3966e7002c14e002c254e00a6.exe
File created	C:\WINDOWS\SysWOW64\rastapi.dll	exc.exe
File created	C:\WINDOWS\SysWOW64\TtlsCfg.dll	exc.exe
File created	C:\WINDOWS\SysWOW64\WMSPDMOD.DLL	5c3dded3966e7002c14e002c254e00a6.exe
File created	C:\WINDOWS\SysWOW64\cscapi.dll	5c3dded3966e7002c14e002c254e00a6.exe
File created	C:\WINDOWS\SysWOW64\devmgr.dll	exc.exe
File created	C:\WINDOWS\SysWOW64\MiracastReceiverExt.dll	5c3dded3966e7002c14e002c254e00a6.exe
File created	C:\WINDOWS\SysWOW64\networkitemfactory.dll	exc.exe
File created	C:\WINDOWS\SysWOW64\FontGlyphAnimator.dll	exc.exe
File created	C:\WINDOWS\SysWOW64\KBDBENE.DLL	5c3dded3966e7002c14e002c254e00a6.exe
File created	C:\WINDOWS\SysWOW64\pidgenx.dll	exc.exe
File created	C:\WINDOWS\SysWOW64\WpcWebFilter.dll	exc.exe
File created	C:\WINDOWS\SysWOW64\msvcp140_clr0400.dll	exc.exe
File created	C:\WINDOWS\SysWOW64\mswsock.dll	exc.exe
File created	C:\WINDOWS\SysWOW64\BitLockerCsp.dll	exc.exe
File created	C:\WINDOWS\SysWOW64\CameraCaptureUI.dll	5c3dded3966e7002c14e002c254e00a6.exe
File created	C:\WINDOWS\SysWOW64\FXSRESM.dll	5c3dded3966e7002c14e002c254e00a6.exe
File created	C:\WINDOWS\SysWOW64\KBDINHIN.DLL	exc.exe
File opened for modification	C:\WINDOWS\SysWOW64\mfc110u.dll	5c3dded3966e7002c14e002c254e00a6.exe
File created	C:\WINDOWS\SysWOW64\RMActivate_ssp.exe	exc.exe
File created	C:\WINDOWS\SysWOW64\WMVXENCD.DLL	exc.exe
File created	C:\WINDOWS\SysWOW64\C_IS2022.DLL	5c3dded3966e7002c14e002c254e00a6.exe
File created	C:\WINDOWS\SysWOW64\dfscli.dll	exc.exe
File created	C:\WINDOWS\SysWOW64\HelpPaneProxy.dll	5c3dded3966e7002c14e002c254e00a6.exe
File created	C:\WINDOWS\SysWOW64\KBDCZ.DLL	5c3dded3966e7002c14e002c254e00a6.exe
File created	C:\WINDOWS\SysWOW64\odbcjt32.dll	5c3dded3966e7002c14e002c254e00a6.exe
File created	C:\WINDOWS\SysWOW64\RestartManagerUninstall.mof	5c3dded3966e7002c14e002c254e00a6.exe
File created	C:\WINDOWS\SysWOW64\UserDataPlatformHelperUtil.dll	5c3dded3966e7002c14e002c254e00a6.exe
File created	C:\WINDOWS\SysWOW64\WF.msc	exc.exe
File created	C:\WINDOWS\SysWOW64\DXCore.dll	5c3dded3966e7002c14e002c254e00a6.exe
File opened for modification	C:\WINDOWS\SysWOW64\mfc140deu.dll	exc.exe
File created	C:\WINDOWS\SysWOW64\msihnd.dll	5c3dded3966e7002c14e002c254e00a6.exe
File created	C:\WINDOWS\SysWOW64\netshell.dll	5c3dded3966e7002c14e002c254e00a6.exe
File created	C:\WINDOWS\SysWOW64\imgutil.dll	5c3dded3966e7002c14e002c254e00a6.exe
File created	C:\WINDOWS\SysWOW64\KBDADLM.DLL	5c3dded3966e7002c14e002c254e00a6.exe
File created	C:\WINDOWS\SysWOW64\mdmlocalmanagement.dll	exc.exe
File created	C:\WINDOWS\SysWOW64\Windows.Networking.BackgroundTransfer.BackgroundManagerPolicy.dll	5c3dded3966e7002c14e002c254e00a6.exe
File created	C:\WINDOWS\SysWOW64\mimofcodec.dll	exc.exe
File created	C:\WINDOWS\SysWOW64\mrt_map.dll	5c3dded3966e7002c14e002c254e00a6.exe
File created	C:\WINDOWS\SysWOW64\tcpipcfg.dll	5c3dded3966e7002c14e002c254e00a6.exe
File created	C:\WINDOWS\SysWOW64\termmgr.dll	exc.exe
File created	C:\WINDOWS\SysWOW64\wvc.dll	exc.exe
File created	C:\WINDOWS\SysWOW64\adtschema.dll	5c3dded3966e7002c14e002c254e00a6.exe
File created	C:\WINDOWS\SysWOW64\catsrvut.dll	5c3dded3966e7002c14e002c254e00a6.exe
File created	C:\WINDOWS\SysWOW64\InkObjCore.dll	exc.exe
File created	C:\WINDOWS\SysWOW64\KBDINMAR.DLL	5c3dded3966e7002c14e002c254e00a6.exe
File created	C:\WINDOWS\SysWOW64\mscoree.dll	5c3dded3966e7002c14e002c254e00a6.exe
File created	C:\WINDOWS\SysWOW64\SystemSettings.DataModel.dll	5c3dded3966e7002c14e002c254e00a6.exe
File created	C:\WINDOWS\SysWOW64\takeown.exe	exc.exe
File created	C:\WINDOWS\SysWOW64\aepic.dll	5c3dded3966e7002c14e002c254e00a6.exe
File created	C:\WINDOWS\SysWOW64\comp.exe	5c3dded3966e7002c14e002c254e00a6.exe
File created	C:\WINDOWS\SysWOW64\crypttpmeksvc.dll	5c3dded3966e7002c14e002c254e00a6.exe
File opened for modification	C:\WINDOWS\SysWOW64\mfc100fra.dll	5c3dded3966e7002c14e002c254e00a6.exe
File created	C:\WINDOWS\SysWOW64\KBDMYAN.DLL	exc.exe
File created	C:\WINDOWS\SysWOW64\PresentationNative_v0300.dll	5c3dded3966e7002c14e002c254e00a6.exe
File created	C:\WINDOWS\SysWOW64\sdohlp.dll	5c3dded3966e7002c14e002c254e00a6.exe
File created	C:\WINDOWS\SysWOW64\SMBHelperClass.dll	exc.exe
File created	C:\WINDOWS\SysWOW64\AppVTerminator.dll	5c3dded3966e7002c14e002c254e00a6.exe
File created	C:\WINDOWS\SysWOW64\msisip.dll	exc.exe
File created	C:\WINDOWS\SysWOW64\Windows.Graphics.Display.BrightnessOverride.dll	5c3dded3966e7002c14e002c254e00a6.exe
File created	C:\WINDOWS\SysWOW64\WsmSvc.dll	exc.exe

Drops file in Windows directory 44 IoCs

description	ioc	Process
File created	C:\WINDOWS\twain_32.dll	5c3dded3966e7002c14e002c254e00a6.exe
File created	C:\WINDOWS\WMSysPr9.prx	exc.exe
File opened for modification	C:\WINDOWS\DtcInstall.log	exc.exe
File opened for modification	C:\WINDOWS\lsasetup.log	5c3dded3966e7002c14e002c254e00a6.exe
File created	C:\WINDOWS\mib.bin	exc.exe
File opened for modification	C:\WINDOWS\Professional.xml	exc.exe
File opened for modification	C:\WINDOWS\WindowsUpdate.log	exc.exe
File opened for modification	C:\WINDOWS\WindowsUpdate.log	5c3dded3966e7002c14e002c254e00a6.exe
File created	C:\WINDOWS\write.exe	exc.exe
File opened for modification	C:\WINDOWS\setupact.log	5c3dded3966e7002c14e002c254e00a6.exe
File created	C:\WINDOWS\sysmon.exe	exc.exe
File opened for modification	C:\WINDOWS\system.ini	exc.exe
File created	C:\WINDOWS\splwow64.exe	5c3dded3966e7002c14e002c254e00a6.exe
File opened for modification	C:\WINDOWS\PFRO.log	5c3dded3966e7002c14e002c254e00a6.exe
File opened for modification	C:\WINDOWS\Professional.xml	5c3dded3966e7002c14e002c254e00a6.exe
File opened for modification	C:\WINDOWS\SysmonDrv.sys	exc.exe
File opened for modification	C:\WINDOWS\setuperr.log	5c3dded3966e7002c14e002c254e00a6.exe
File opened for modification	C:\WINDOWS\DtcInstall.log	5c3dded3966e7002c14e002c254e00a6.exe
File created	C:\WINDOWS\explorer.exe	5c3dded3966e7002c14e002c254e00a6.exe
File created	C:\WINDOWS\hh.exe	5c3dded3966e7002c14e002c254e00a6.exe
File opened for modification	C:\WINDOWS\PFRO.log	exc.exe
File opened for modification	C:\WINDOWS\SysmonDrv.sys	5c3dded3966e7002c14e002c254e00a6.exe
File opened for modification	C:\WINDOWS\system.ini	5c3dded3966e7002c14e002c254e00a6.exe
File opened for modification	C:\WINDOWS\lsasetup.log	exc.exe
File opened for modification	C:\WINDOWS\setuperr.log	exc.exe
File created	C:\WINDOWS\splwow64.exe	exc.exe
File created	C:\WINDOWS\write.exe	5c3dded3966e7002c14e002c254e00a6.exe
File created	C:\WINDOWS\mib.bin	5c3dded3966e7002c14e002c254e00a6.exe
File opened for modification	C:\WINDOWS\setupact.log	exc.exe
File created	C:\WINDOWS\twain_32.dll	exc.exe
File created	C:\WINDOWS\bfsvc.exe	exc.exe
File created	C:\WINDOWS\hh.exe	exc.exe
File created	C:\WINDOWS\WMSysPr9.prx	5c3dded3966e7002c14e002c254e00a6.exe
File created	C:\WINDOWS\sysmon.exe	5c3dded3966e7002c14e002c254e00a6.exe
File created	C:\WINDOWS\winhlp32.exe	exc.exe
File created	C:\WINDOWS\notepad.exe	exc.exe
File created	C:\WINDOWS\notepad.exe	5c3dded3966e7002c14e002c254e00a6.exe
File opened for modification	C:\WINDOWS\win.ini	exc.exe
File opened for modification	C:\WINDOWS\win.ini	5c3dded3966e7002c14e002c254e00a6.exe
File created	C:\WINDOWS\bfsvc.exe	5c3dded3966e7002c14e002c254e00a6.exe
File created	C:\WINDOWS\explorer.exe	exc.exe
File created	C:\WINDOWS\HelpPane.exe	exc.exe
File created	C:\WINDOWS\HelpPane.exe	5c3dded3966e7002c14e002c254e00a6.exe
File created	C:\WINDOWS\winhlp32.exe	5c3dded3966e7002c14e002c254e00a6.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
1588	msedge.exe
1588	msedge.exe
4980	msedge.exe
4980	msedge.exe
5232	msedge.exe
5232	msedge.exe
5480	identity_helper.exe
5480	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 14 IoCs

pid	Process
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeManageVolumePrivilege	2304	svchost.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2308 wrote to memory of 3112	2308	5c3dded3966e7002c14e002c254e00a6.exe	89
PID 2308 wrote to memory of 3112	2308	5c3dded3966e7002c14e002c254e00a6.exe	89
PID 2308 wrote to memory of 3112	2308	5c3dded3966e7002c14e002c254e00a6.exe	89
PID 2308 wrote to memory of 4980	2308	5c3dded3966e7002c14e002c254e00a6.exe	103
PID 2308 wrote to memory of 4980	2308	5c3dded3966e7002c14e002c254e00a6.exe	103
PID 3112 wrote to memory of 3756	3112	exc.exe	104
PID 3112 wrote to memory of 3756	3112	exc.exe	104
PID 4980 wrote to memory of 2316	4980	msedge.exe	106
PID 4980 wrote to memory of 2316	4980	msedge.exe	106
PID 3756 wrote to memory of 1560	3756	msedge.exe	105
PID 3756 wrote to memory of 1560	3756	msedge.exe	105
PID 4980 wrote to memory of 4536	4980	msedge.exe	109
PID 4980 wrote to memory of 4536	4980	msedge.exe	109
PID 4980 wrote to memory of 4536	4980	msedge.exe	109
PID 4980 wrote to memory of 4536	4980	msedge.exe	109
PID 4980 wrote to memory of 4536	4980	msedge.exe	109
PID 4980 wrote to memory of 4536	4980	msedge.exe	109
PID 4980 wrote to memory of 4536	4980	msedge.exe	109
PID 4980 wrote to memory of 4536	4980	msedge.exe	109
PID 4980 wrote to memory of 4536	4980	msedge.exe	109
PID 4980 wrote to memory of 4536	4980	msedge.exe	109
PID 4980 wrote to memory of 4536	4980	msedge.exe	109
PID 4980 wrote to memory of 4536	4980	msedge.exe	109
PID 4980 wrote to memory of 4536	4980	msedge.exe	109
PID 4980 wrote to memory of 4536	4980	msedge.exe	109
PID 4980 wrote to memory of 4536	4980	msedge.exe	109
PID 4980 wrote to memory of 4536	4980	msedge.exe	109
PID 4980 wrote to memory of 4536	4980	msedge.exe	109
PID 4980 wrote to memory of 4536	4980	msedge.exe	109
PID 4980 wrote to memory of 4536	4980	msedge.exe	109
PID 4980 wrote to memory of 4536	4980	msedge.exe	109
PID 4980 wrote to memory of 4536	4980	msedge.exe	109
PID 4980 wrote to memory of 4536	4980	msedge.exe	109
PID 4980 wrote to memory of 4536	4980	msedge.exe	109
PID 4980 wrote to memory of 4536	4980	msedge.exe	109
PID 4980 wrote to memory of 4536	4980	msedge.exe	109
PID 4980 wrote to memory of 4536	4980	msedge.exe	109
PID 4980 wrote to memory of 4536	4980	msedge.exe	109
PID 4980 wrote to memory of 4536	4980	msedge.exe	109
PID 4980 wrote to memory of 4536	4980	msedge.exe	109
PID 4980 wrote to memory of 4536	4980	msedge.exe	109
PID 4980 wrote to memory of 4536	4980	msedge.exe	109
PID 4980 wrote to memory of 4536	4980	msedge.exe	109
PID 4980 wrote to memory of 4536	4980	msedge.exe	109
PID 4980 wrote to memory of 4536	4980	msedge.exe	109
PID 4980 wrote to memory of 4536	4980	msedge.exe	109
PID 4980 wrote to memory of 4536	4980	msedge.exe	109
PID 4980 wrote to memory of 4536	4980	msedge.exe	109
PID 4980 wrote to memory of 4536	4980	msedge.exe	109
PID 4980 wrote to memory of 4536	4980	msedge.exe	109
PID 4980 wrote to memory of 4536	4980	msedge.exe	109
PID 4980 wrote to memory of 1588	4980	msedge.exe	108
PID 4980 wrote to memory of 1588	4980	msedge.exe	108
PID 4980 wrote to memory of 4680	4980	msedge.exe	107
PID 4980 wrote to memory of 4680	4980	msedge.exe	107
PID 4980 wrote to memory of 4680	4980	msedge.exe	107
PID 4980 wrote to memory of 4680	4980	msedge.exe	107
PID 4980 wrote to memory of 4680	4980	msedge.exe	107
PID 4980 wrote to memory of 4680	4980	msedge.exe	107
PID 4980 wrote to memory of 4680	4980	msedge.exe	107
PID 4980 wrote to memory of 4680	4980	msedge.exe	107
PID 4980 wrote to memory of 4680	4980	msedge.exe	107
PID 4980 wrote to memory of 4680	4980	msedge.exe	107
PID 4980 wrote to memory of 4680	4980	msedge.exe	107

C:\Users\Admin\AppData\Local\Temp\5c3dded3966e7002c14e002c254e00a6.exe
"C:\Users\Admin\AppData\Local\Temp\5c3dded3966e7002c14e002c254e00a6.exe"
1⤵
- Drops file in Drivers directory
- Manipulates Digital Signatures
- Checks computer location settings
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2308
- C:\exc.exe
  "C:\exc.exe"
  2⤵
  - Drops file in Drivers directory
  - Manipulates Digital Signatures
  - Executes dropped EXE
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Suspicious use of WriteProcessMemory
  PID:3112
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.freeav.com/
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3756
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff85f5d46f8,0x7ff85f5d4708,0x7ff85f5d4718
      4⤵
      PID:1560
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2056,4515009639147339311,18266549315262395970,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2076 /prefetch:3
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:5232
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.antispyware.com/
    3⤵
    PID:4372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.freeav.com/
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:4980
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ff85f5d46f8,0x7ff85f5d4708,0x7ff85f5d4718
    3⤵
    PID:2316
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2108,10926585927065056182,3694357641360403810,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2780 /prefetch:8
    3⤵
    PID:4680
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2108,10926585927065056182,3694357641360403810,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2172 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1588
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2108,10926585927065056182,3694357641360403810,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2120 /prefetch:2
    3⤵
    PID:4536
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,10926585927065056182,3694357641360403810,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:1
    3⤵
    PID:3116
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,10926585927065056182,3694357641360403810,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3252 /prefetch:1
    3⤵
    PID:3572
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,10926585927065056182,3694357641360403810,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4076 /prefetch:1
    3⤵
    PID:5288
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,10926585927065056182,3694357641360403810,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5352 /prefetch:1
    3⤵
    PID:5760
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,10926585927065056182,3694357641360403810,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4708 /prefetch:1
    3⤵
    PID:5848
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2108,10926585927065056182,3694357641360403810,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5356 /prefetch:8
    3⤵
    PID:5452
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2108,10926585927065056182,3694357641360403810,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5892 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5480
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2108,10926585927065056182,3694357641360403810,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5892 /prefetch:8
    3⤵
    PID:5748
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,10926585927065056182,3694357641360403810,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3352 /prefetch:1
    3⤵
    PID:4448
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,10926585927065056182,3694357641360403810,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5532 /prefetch:1
    3⤵
    PID:4020
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,10926585927065056182,3694357641360403810,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6008 /prefetch:1
    3⤵
    PID:6044
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,10926585927065056182,3694357641360403810,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6112 /prefetch:1
    3⤵
    PID:6016
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,10926585927065056182,3694357641360403810,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1332 /prefetch:1
    3⤵
    PID:5520
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,10926585927065056182,3694357641360403810,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1120 /prefetch:1
    3⤵
    PID:5656
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,10926585927065056182,3694357641360403810,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6444 /prefetch:1
    3⤵
    PID:5948
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,10926585927065056182,3694357641360403810,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6112 /prefetch:1
    3⤵
    PID:2496
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,10926585927065056182,3694357641360403810,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6416 /prefetch:1
    3⤵
    PID:3904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.antispyware.com/
  2⤵
  PID:3296

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:408

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5244

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x2fc 0x324
1⤵
PID:5336

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.VCLibs.140.00_8wekyb3d8bbwe
1⤵
PID:5680

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k UnistackSvcGroup
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2304

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ff85f5d46f8,0x7ff85f5d4708,0x7ff85f5d4718
1⤵
PID:4192

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff85f5d46f8,0x7ff85f5d4708,0x7ff85f5d4718
1⤵
PID:4652

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
1386433ecc349475d39fb1e4f9e149a0

SHA1
f04f71ac77cb30f1d04fd16d42852322a8b2680f

SHA256
a7c79320a37d3516823f533e0ca73ed54fc4cdade9999b9827d06ea9f8916bbc

SHA512
fcd5449c58ead25955d01739929c42ffc89b9007bc2c8779c05271f2d053be66e05414c410738c35572ef31811aff908e7fe3dd7a9cef33c27acb308a420280e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
504B

MD5
8eee80126fddbd3755b5155409a21805

SHA1
3888c23e8b7457b1ac23a65e80cf06f2c117aac7

SHA256
24c4744104435126d97617df73eaaff928afa3b870ba389724772a6e8e80bdf5

SHA512
f9e4d6cd1364d9584c7716716f30da4d3c28c333dcd5aef6d13eea20be9b706b7c8113aac7bbff129f33082a850f695c7fad94baf386ee406aeb008b92f1f290

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
576B

MD5
4d086fee771c68b671aeba2eaca007ce

SHA1
606e2478499371776e3b4aec966bda5b73714e9b

SHA256
bbb2345b0659c33db3f544eb99ebe0987b7e94ba9e17f62ee9022a063d8331d6

SHA512
953e996644f46b51e591f0f9f7ce9b8c82432bd40b2cfc66ca53846b873d6cbecc3b98a8085a6d1ffbab1d5f1beb8d8bbf4148e47215aec7c18f433c5f6c67c3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
c7ffed31c38a9024ebf8db752d551e8e

SHA1
b0c619738aa6d489ef6761b67cc9ca87abe1f716

SHA256
2da9070035383078ebb78e77c8ea342d965c00dfd6e68cee9c3563a1b46733a3

SHA512
8cc2e9e0f6af99affe08bd2d6d5bd368d43a6d4050279fcc8482a1519ad88869755c1577900368147f16b5bd51a071e52472c8a44241c13cb017368cc00b0ce1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
cf852a5ddb857a70c6c62d756e236615

SHA1
c05528a414244e3347e0e98cc434186187358de0

SHA256
3f3bc948a2b5fc8d527aaeb748012be3ad09fa63b1340413632d09b9c6dbffc2

SHA512
13248ef6271cb1299807543ca8ec63ed60635f196828c3bc5ad528b3e8d322ca06a4ba6f29b7b30577f5a1c387b84821087543098d77930fd114e250fba92d77

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
3225008ff612c025f19dc5463e70d860

SHA1
1d503dd57b409153600828cd9470d871dcf21ac5

SHA256
5857678b3d087f6efea539d3fbfd139b08ad26c3ade42177ee3d4f87966356db

SHA512
09f3345af9409989cd359e74a13f97b0097fafd59dd04cba307808d8269bd95f3df42b2aa0249376ce7ea6c0dcdcd0d557b17512b3b2e64a6ca24ec41bb544e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
8c1bbc49abe7022b348810ab0e472751

SHA1
79c4bcbac1c2113937f21a427680a2bf4b3e7249

SHA256
a4eaa5aae7b755e23c9352faa76a10c9278ac53ab15149af494b1d2b02e25e93

SHA512
aca3a617305e540593ee62f4e3d0b59c2b46baafb6be2f04f77c5184e3c2047f0a27e29166313a71b349561b21abff8e1e9be8a4cdc8a6f185b4cf64eed9f68f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
e664066e3aa135f185ed1c194b9fa1f8

SHA1
358ff3c6ad0580b8ae1e5ef2a89a4e597c2efdc5

SHA256
86e595be48dbc768a52d7ea62116036c024093e1302aced8c29dd6a2d9935617

SHA512
58710818b5f664006a5aa418da6c8cd3f709c2265bc161f81b9dfe6cdb8304fabaa4ce9deba419fe4281623feeeaa0321f481ae5855d347c6d8cf95968ee905e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
b13c166131d2e8d8d4cdcce4dbe1c9a9

SHA1
72e33474891725ef5b8bb4735ac2af39424e6beb

SHA256
7bcb756dc4f0ee74d47c7d685f86680abcbc159bd0d23580b9a060ffa7359999

SHA512
be04e5811ffe276b01f0b8eb1b67756a3a4df4abd010bb7c0ac53954f56f0e01d0b2bbe57bd37581256943f27b6509754ebee8b746e905679596ecea10cb2535

Download Submit
C:\WINDOWS\Professional.xml

Filesize
57KB

MD5
5698feb8ddfb11f99488fbaa715ea3de

SHA1
9182922bb1b6aa8f4f96b2b8c962552f955ba4cd

SHA256
183bb45a7e050482e8ec958979ad42d92956a60f83c8d33316dbc964dcb2e982

SHA512
7363226ab06d95048cb04be12b7ca2c5692e74a092a5cd2d155e236c09782ef6ad0d86f0f7fcf7777f960a923001d96972fe146994fb6a0d2a72a6820e04587f

Download Submit
C:\WINDOWS\SysWOW64\atl110.dll

Filesize
188KB

MD5
48d9f6efff5d5f143d7deabd20189a8f

SHA1
2a9919263031c91623321fae340e78900108c030

SHA256
e0d15479c91fa4f7fbb0320dbd2b17c5da533e22f7a341a76244e80cc1d7e64a

SHA512
8220766c01c236a550ec8210a31c125d6a13c4af6bf8fc8aac2f5a5332e44e244b3d01cc5709bf846d71eb31d52b84d65b622c20c21d921d36ebd32b5deca05a

Download Submit
C:\WINDOWS\SysWOW64\concrt140.dll

Filesize
269KB

MD5
0cb2854fb4b0eaed6441f16f14d907eb

SHA1
ccde96994d288ad0936376495f1c52293c53dda4

SHA256
5e6972c5e6788233cd3a62a456f835be704a1fc09b3649b88b9b964172dbcbfe

SHA512
6793b47486902dec2010187fad25022b1236bc2766c0e6d587b49f26ccd8f627cc5df9c839ab835e213af8640039c43757924fe4b0ae25a22662a26ad1857d46

Download Submit
C:\WINDOWS\SysWOW64\dssec.dat

Filesize
238KB

MD5
6394b6a4791f0e5d1a20c5754fe6bbc1

SHA1
fe78d4409e595b3db34461765952a7082e98bde4

SHA256
4a9fe89841912bc92c210c88195508f84bcb9ed8078ede29c96c116355fb9cfa

SHA512
291e546c76d6fbb1ca0ca4e53fed8518194dedce790ec1b8c42e2942ff7e164b4cd28fedd63a2dce09380257ef420e9597ad6672badee403a917170c6b03e651

Download Submit
C:\WINDOWS\SysWOW64\mfc100.dll

Filesize
1.9MB

MD5
42ddc9fac028d675012389c8b2f633e2

SHA1
11858ff4b729ea2523a890d5ff1d180e82dd7b3a

SHA256
1d60253e5191c1be593b829de0df01571c070fa0335e1e11669521718ceec8fb

SHA512
4019572fb0ef472e8bb5019648e6547f519f7ba9ebdbd6ac07ad5105ed83be1719a9a5e29a99ecaf77976a503234ea1075c4c0218f963bb39ed748f1566d01d8

Download Submit
C:\WINDOWS\SysWOW64\mfc100chs.dll

Filesize
62KB

MD5
7327011ee13fd2cfc697e07c988a3aa0

SHA1
881ae9e6a01a2c3a33a155aa6d9f1e8805dfd85a

SHA256
6981641d922b45ed0e78abdccb8bca5646d1b52ccdce11b6c4cd48335f228f23

SHA512
4bf9ff3c7acbc04b14c5343e404e53c9660b7e17fc65d96c3a6207f6d586a32c0d8b6ff1eb5dd150c3de465b2dbe0519e7fe70aaef15a8a974def996fc349de9

Download Submit
C:\WINDOWS\SysWOW64\mfc100cht.dll

Filesize
62KB

MD5
89288a769735f905783497d3f039a6ad

SHA1
1cbffd200c62bbfd1e1c27527a3872df69882f12

SHA256
77bd028c51be9be194062fc5d4f26c68bff5204ff19883a2f8a6384e5ef83c5b

SHA512
d1ce42a59ec73e1dc45c217bdd517f6cec36a425fde1756a4cfcf6830f6c55c85963b1a3ccad4bb46e8659faaae2ed767f227cdda1a3f59ee8cbdc77e7d78e16

Download Submit
C:\WINDOWS\SysWOW64\mfc100deu.dll

Filesize
90KB

MD5
c7ee3c79b34d54fb31aafd20df954ae4

SHA1
4ea006c5238985f0cf41224de347f5cf0d4f93b9

SHA256
9303525875c0fbf742528ab1fd32a88dcccb7c0ae527a5f38ed2eb24545311f6

SHA512
f204185bf8ae22940045e9e3013629b89901f7ff8fb1e5b857dd2b7be37337010737da9e12366832559c8a86dd62ea8f4cc0da9a0a81fd312e17c081e8d937e6

Download Submit
C:\WINDOWS\SysWOW64\mfc100enu.dll

Filesize
81KB

MD5
aabfa70e17f9ae55c3c609d8c55870ac

SHA1
e697be81c7960cd7f2fb191cb54611a33d324fa0

SHA256
0cfd8ecf9227d8cc2b3bb6728085041362e630ff989680dec754f8b6fff50850

SHA512
cc8d4f97fe5fbe22b9c59acc5bdaafb1e09647a4bfb5b6ff3ff73642e760c5f4eb203ae6cc9046c789abd20d886e87b06778cd87b974e9085531c0fb768873a7

Download Submit
C:\WINDOWS\SysWOW64\mfc100esn.dll

Filesize
89KB

MD5
6478545d2526cc7da0cc7e0406a66e8e

SHA1
5c1abfd6a313569e1db978303ab367b88fa95600

SHA256
e0d1ea481fdc7977654acbe4ee8d5ce490f15c82d8cbe9861da07560c2960229

SHA512
ee19020fa69fda1f4bc7ea9ea870afefef40eee46f3bc02d04684889c9af541fe9baf92f0db7dbe17a6902357796d762318931882a781b25f2dca41e143b9232

Download Submit
C:\WINDOWS\SysWOW64\mfc100fra.dll

Filesize
90KB

MD5
51fd2b6d491a165cbcdfab0bd423f5b6

SHA1
4f214ffd779b019e91f102efd08d88d178ebc03a

SHA256
f44f95e6b40da8f0d89b43a3753187bc7dd5880cc204f4d6629b8ab6d69b9770

SHA512
4a07c7b0da65515a9c680590473af4d14507bdbf7c43f1f1487d00ce1ab7810e932e12be0b3f6e2f5f94a68b4eba8ea9885a7323f91ec41ca3ba1ec10f56e3c1

Download Submit
C:\WINDOWS\SysWOW64\mfc100ita.dll

Filesize
88KB

MD5
e666e646afeb6f239e69075b91c95abb

SHA1
d688fb5973ae3e5b856669395c1a66fc10ccd4f2

SHA256
9894138b982deaa2d1ba937d9524b322082f57710b0ad5c763bffcc4105b7d07

SHA512
07ef843cda98d17c2002f21ca7686a732c6d89841ea2e8daa881cf15793b551048b6a047f2d1bfcd03a3127e13ab861d4b1690261c7d52fda7644b7c85922f31

Download Submit
C:\WINDOWS\SysWOW64\mfc100jpn.dll

Filesize
70KB

MD5
5bbe2dc494d049d6cf33c4aad9300a20

SHA1
e6f746768fc35aabeab736dfa3c470d8ae2619ac

SHA256
60d7086aad2206d69023bb754719a3fba9f6088df6911f3956005e6239ee804f

SHA512
cfb92658fe3a4d7b72835e34b7f826b8ea329ebdc09b146fc43c99a640a363e463ee00a23a5a7607fe10e08260b6c5e853b1b180e855b563cf219675bd00c979

Download Submit
C:\WINDOWS\SysWOW64\mfc100kor.dll

Filesize
69KB

MD5
9e6686a4fb0fe770daeb773c7a19a606

SHA1
e2fdcad663e9913672468f6eb926cb3fd859f9c8

SHA256
ad1d2e7d894ecd8562d8ecea7d62ebd32c99e227749e03b285a362c64c5ecb9a

SHA512
e70ff5f6098fe74644dff283c25ffe9ff852ef22bca105531ce0a763e1d7ab70451ab08e7ef89bb92b25f1fc078efafd4255549841e745843971dd28354bf2fe

Download Submit
C:\WINDOWS\SysWOW64\mfc100rus.dll

Filesize
86KB

MD5
eebc37b221af141c65a73352005e9bc4

SHA1
ea735da1960452d40b11d2bc546f89499b8bd530

SHA256
fae85afb21e01ba17ef5b0a9a8eaf52c809350704d5651b22d13de7f8bea207d

SHA512
bcda409f027ed88972aa84931ab94f598384287028dc0b52770d74f63cd0708d912ffc9fa2b18317cad542492e51ea1ebb3dcbbb311f7fe5ed30786e6df70f36

Download Submit
C:\WINDOWS\SysWOW64\mfc100u.dll

Filesize
1.3MB

MD5
8d65dc27f78b368950ea1bbfc869fdfb

SHA1
877df6c59607d982c602a6ef8eb9cd2d56d63d1a

SHA256
458738e652a77adc83137b1e2f7455f4f91f0f55cc5e103c2dc810df50aad125

SHA512
c25672d29f38722f7aaa405688e2faf02b8b3464353cfd9ce6e76d44197aa9ed9d6f66a8c4e86b67d373abd94ff133a73ae47dd884b2ef2d76962e1cc4f3c744

Download Submit
C:\WINDOWS\SysWOW64\mfc110.dll

Filesize
1.8MB

MD5
af82d461902e02aa20af19e0f7548017

SHA1
579a67a857329deb6cf05c608b32df78f5056351

SHA256
65f9c2ed7cbdc3e0c31560f69374b6d9bfc491a56ed4e935057dbe1e03a3e22d

SHA512
36ae34932ff0e451e43812b3434ef6422b1ec4915d4d446fe376cd0fb28d70c54ac027b2047bd09350b802faabfb67e24f52d733a8d6405bd65a4f7ee502ea45

Download Submit
C:\WINDOWS\SysWOW64\mfc110chs.dll

Filesize
100KB

MD5
9abbe2e798411a79665b49c08ecd4037

SHA1
9b1e20d03963b38b054ae03381a9a4cd22402c2b

SHA256
123bbcce74cd119054f7e95721339985a9e4524d37d006eb00be387c995f2e25

SHA512
89650e513987a01aed2f46e7a237b0548b142508a4b14a9ea43d5bc3a70d098f2a955bddb7f270c5ac8777fc8b156a3e476788f2b7a5dd3929ccff80ecf29944

Download Submit
C:\WINDOWS\SysWOW64\mfc110cht.dll

Filesize
100KB

MD5
17d68af9ed0959881ed02f6b6b56c33f

SHA1
f4b6478e4dc12dd5f5c5e006b973c7456ee6fd57

SHA256
9a252e6641fdb650e832c2afd3c7a664e4f9dc2d0ffc7f921bf7a82ed238983b

SHA512
0912de7bf53c927824fdf1d381bcaf48af43888b7784af0e10c0b2f453478eb23fb59c93cfb505102106ed44837681ed57ec22115f91ddbf8d414f6c28d2d85d

Download Submit
C:\WINDOWS\SysWOW64\mfc110deu.dll

Filesize
128KB

MD5
675c0c1e1982931e08b79f773073a84b

SHA1
282800820183672379e48db8767928323ccf4ccb

SHA256
b1f4d5cecbf76b0436ce7ab4febdc8da64feb0967a8553f8cb5b6f9e6319538a

SHA512
709773ae21a4e19eec724f125afd26f0dfe5819a675bf43e15fbfe2f6d2fb028145227c8efaea2820bfdf4ddb0b3f0a58f76b50ae90336fc37f028f200a3068a

Download Submit
C:\WINDOWS\SysWOW64\mfc110enu.dll

Filesize
91KB

MD5
57cf73ec32592c089a8078a9b1005793

SHA1
416a4ceb9952dd434e49bef4c57ce66a897c8f81

SHA256
48013708417c2c79adce2382d18a621ae4a4a8e891de63953b619d1bce1a5364

SHA512
0a6528609156cd7cecb8adf70e282c88b5e037a2a31a9d87021d73dbb19bc5c6e2c874b3cddec65ef3d4383cb96fbdf3bf52a0d2984c08c364d7ad9a8f83c1e1

Download Submit
C:\WINDOWS\SysWOW64\mfc110esn.dll

Filesize
55KB

MD5
0a6cc21112fad9245b51c6f25b46ff28

SHA1
7fc717bce742f208e278255ee8fe4c2b9770633e

SHA256
c8159c0ea86a330338bbdc9268ba1619302b3bd254b15e0fbbe0f1d294c678e0

SHA512
f6bec9d98b3734783d4cc92e17d324024073d784f3b6204f492b945ff5ec72476f1d2f1e65d6286edde3188c4a049305b52905d695b82b32e704612ff823287c

Download Submit
C:\WINDOWS\SysWOW64\mfc110ita.dll

Filesize
98KB

MD5
ee2f3cfa1351fd4de65d59ea08a9229c

SHA1
cd69f9030428b21d63c8f57ca8c6e04a250650de

SHA256
d8aeb837cfd4e1ae70f8b684e842ac74834f3e91932bbb776980d50ed7223357

SHA512
1383d6b66d4aad1122aa1397ce38ca3121628a88f591f4846a7aa8de8f9555c6824aff92490e7684ef9317708989803ca9bc73e24ffa94dabf6f709ebbf1ebf8

Download Submit
C:\WINDOWS\SysWOW64\mfc110jpn.dll

Filesize
80KB

MD5
bd82fe2be6af48a62caf72f41fa2890b

SHA1
c81b531c592ca4222b4746f0d18d0d8ef4350159

SHA256
501f15c3483fdecf8354143cab66449460ab43715bf06ceed421c7f92f31f61d

SHA512
66587806c54f3709e1aac1f33075439233434669724e66d6ca16fa6f66e77306ec1b1303578799e866ce8771b33147e9b7bf40fb03d91628239ea99b6cd9d77c

Download Submit
C:\WINDOWS\SysWOW64\mfc110kor.dll

Filesize
79KB

MD5
ddb1f40348f6700ad78cccf80c2b9471

SHA1
c1c9295a1d959793c0101c42af3848d60962dbb2

SHA256
bd92e780da5363faa17956575e390618b798919a862e5bc7b70fb410ff255dc8

SHA512
9fb54590959e1204bc1053e472eed58425341a9fe6cffd050a39c660c461156eb9e363791c90f9d0cb77d88d60110d34fb5b20d655fc814aee7af770618ef2ba

Download Submit
C:\WINDOWS\SysWOW64\mfc120.dll

Filesize
2.0MB

MD5
7c55d9510505e4834e008fe665b6385a

SHA1
64f0c1e41f06ce8ec71e13eccc8e379f9017a65e

SHA256
58021460feb6e8eff8047f452992c654940373b7a0e8f2447210502dead08e6c

SHA512
2572e9495e5c05dca7081f0bb40fc6889e58e4d84bd2d81c221c0fb1946e14329b9a0595b19793880586e3279d63eccb5b7db4c7d669fb8143a22b3e798734f0

Download Submit
C:\WINDOWS\SysWOW64\mfc120cht.dll

Filesize
72KB

MD5
4a9ab788176c01fa2569b634bc554c59

SHA1
82ba0353790d7f7476e0819fd0301d825f7e7b5a

SHA256
7dd2d416c36b759b01e1b78fadaf24653b5e855158ab5f695d248e6aaf0f3dfd

SHA512
0a4d43950581bb24fae1acdea18dcbebc444ea1a6665b8ea1b6bba64413490390dba4cefe2fbb37c4c2956f5603b0248e487eb36693e7e14e7d50a4db699c5f7

Download Submit
C:\WINDOWS\SysWOW64\mfc120deu.dll

Filesize
100KB

MD5
f9c3e03d316e61b0fe23d07cca88f25c

SHA1
9a8337a128bce42e77ea84092d6ac1e0a2cedc05

SHA256
59b849c13491a92986267b3e80af1a03efb232f67162935ef30d8f16dc10bc2b

SHA512
a9282fee1d8537e8548d2cbd621306561a2e138e961460e2af33728009953739bcedabc8c9733d9e34c3881955a95634f5d4ddaaf9182803cc195b20ac481f41

Download Submit
C:\WINDOWS\SysWOW64\mfc120enu.dll

Filesize
91KB

MD5
de8a1068d3e7302707ca81461a07afe0

SHA1
7682359953f833da81edc64c1e6275be8647e336

SHA256
e660cd58800fd19bfde850cabe60b295cdbdf8c85417e410094a5c28774d2919

SHA512
9d8c75e18c6d8eabfe7f71b6f980fdbc45572724b055c554790cb08ea1461814fe3771470cde99067692aa6abe87ac89123e66f29438d0fbe4acdaa6fb8ce26c

Download Submit
C:\WINDOWS\SysWOW64\mfc120esn.dll

Filesize
99KB

MD5
1a4fe2603c5a6f93d0c6dd0c85f303b4

SHA1
33de4fe854ea55ff3633ae299b4518a32e0fb382

SHA256
0808bb93fb927df2ba634e0439aadfb37ebf84f848f1bc972cac315e8d00f321

SHA512
67f83bb24e634cdd9b0e330276b4eb9da97c9734a2db45003ed222cd6653c20b5834f092c8bea42808988a49fd81c06503bc81354f163fa97fb55fafb662a436

Download Submit
C:\WINDOWS\SysWOW64\mfc120fra.dll

Filesize
100KB

MD5
9644920b0c4844f769c08bf4d0eba180

SHA1
faafc010aa1ea7d93044b1ae762bbb04ee016190

SHA256
7c7b0021860f297559fd423408afe4f837b81e2a65a2f181cebb84910662dde5

SHA512
681983c8ff54a7472e31b81d81f2278018409c53ac28f4ce6b95759fc934f4ba9268f64cad0cf3da4cbd43bf5aa483b4088b9fc4ddee2c83fba91048764e10ab

Download Submit
C:\WINDOWS\SysWOW64\mfc120ita.dll

Filesize
98KB

MD5
454eb799c76b65f73c9977442c0914f0

SHA1
b9ecc059b38f688ef961ce29e2822f1d19e728fa

SHA256
d2f54fbfe5a3900f044c4d4aa4b35c48358532395676925b078c25fa3c9c23c5

SHA512
92e57944e03e00f081e0cebed6bbefad64335bf8b36e3f921bfc08d8152f648902fc019d05235cfd1bdd3ce8220edfa8d39d856ab447e2ae9d0e469aca253d26

Download Submit
C:\WINDOWS\SysWOW64\mfc120jpn.dll

Filesize
80KB

MD5
24b50320ca225e34da842e2e707a960f

SHA1
1bc4d5d668149fb5d33389c29e9d75d7c4aced8d

SHA256
11bd143ffa7d07358c3e030c0aadb44c4b2ac6207099bc59cf5fe7a23344aeb7

SHA512
732880dd4db3757f6cf9800afc4e3093130111e05eda61aa35ad4e93bdec4e457288262b377340b05d6775bc949706060b50ff3644c62a66107e393240e46049

Download Submit
C:\WINDOWS\SysWOW64\mfc120kor.dll

Filesize
79KB

MD5
ac217cc553ae4c09f637351b68001dc2

SHA1
d90f4ce5889e95916753583b3fe2588f48904c57

SHA256
398a8360aad6f1e7e8db8930f617c60509eb508c094c3629f9200fdb2fb0b605

SHA512
d104093a83c551885d78f9c16c5463e7c6e7455f785d22095f8e87f9249851bbe45156369a09312867095588038ce55517b2b6083264f788f9efcbe914f0958d

Download Submit
C:\WINDOWS\SysWOW64\mfc120rus.dll

Filesize
96KB

MD5
79adb5a1276eba0759656fda4f017b3b

SHA1
14dacd1f6fe09ce5780f53af00d0832894de76ac

SHA256
d86cd669615c3d2911f2b07061b2953f34775462f83c02eaa0f05d826cd5154a

SHA512
7a26a7610861078ef0997e76307fa7d6b2efb8454913dd59d47d74e28ae469396ce7c814d45112eece3e9b7d26b1e266171552e53c6b42565c0e9c153c63b35a

Download Submit
C:\WINDOWS\SysWOW64\mfc120u.dll

Filesize
4.3MB

MD5
6385eed7964ecee6436ecfef44d5f2d9

SHA1
c15ff644b5b1620ee4c35cca47ebe3c11357d43e

SHA256
dc7f825569c49f1d8074bf2de42df145e96496bb236b2ab2e7aab2e42bf3e97b

SHA512
5bc5bd9a989252b1eb8626a306ec669326218ac41685ce2f38dbf436c321de6f385a86ece9bfb81b90484b71a312bee54f7ad5b7b35b73678158997b04e8c19b

Download Submit
C:\WINDOWS\SysWOW64\mfc140.dll

Filesize
3.5MB

MD5
796c797b3d4766f216fc86406834529c

SHA1
daa573f7556cd026ae73d3c5d581f4bfc5d98b9b

SHA256
c609d8df8aa0642e47e29df619670ebaa48a374e76c62ae989f5fbbbe378c081

SHA512
c231e7331444744e623ce4059d3066658751241ffc604cf2a990ba622df963e2c11310a828a2fc2c6347f888ad2ac1e1b8afacdb0eedc194b82f3f9da43e8993

Download Submit
C:\WINDOWS\SysWOW64\mfc140chs.dll

Filesize
66KB

MD5
ba4acb21dd0e7a60e7b68df2f8b9502f

SHA1
7844d353d9aae50365bfb6855a62cf39bf61e71f

SHA256
a7e1f7f48c6cce2d22d64a17a86b943e43dc988bbf0f666f90b2977b89791330

SHA512
b73b579bbf78d36a5a56c61e4969245f765372eaedd1c24ce5bd443c11d405e68873690898685c2cc17938c0ba8639a9cd0a718b0e7a5f5fa31de7b880838d28

Download Submit
C:\WINDOWS\SysWOW64\mfc140cht.dll

Filesize
66KB

MD5
15278b19bd200c8f8cfeb6ee3afdddec

SHA1
5ccbbef307f4936a990e4bf7d6721fba8111b3d3

SHA256
3a89b21b00642012802bb377c59f046a5a84e5a4d2d30668585d05dc7509e68e

SHA512
00b5f30280702b9810546bf6cbae18070f6bf64e31a4f1d9dbadf365f1df962174689ac07e768cb3260b4ffca744896a27d06dcc55c01218857f2c484b580459

Download Submit
C:\WINDOWS\SysWOW64\mfc140deu.dll

Filesize
94KB

MD5
900fce2dc340cb273c4d14d28cd8617b

SHA1
2ee934d2ef9ea95e1566c1480aac7346646530a8

SHA256
799d1dc6da078c0eca7f2e460a38d8d3c91f0c996d24d51f4c59cfa080db59f9

SHA512
b68fdb288f2fbe3a5af77064c945e9261df690aa34d4a67647f107dfaf82a78347aade224eda1097a5a600c6b5daeacda9dfbf9385b6eb1aa6ba623041dc7c0d

Download Submit
C:\WINDOWS\SysWOW64\mfc140enu.dll

Filesize
85KB

MD5
9f09e8c0f1c2f79dd87e235bbccfa479

SHA1
bf030157c787dd261c031e5c1f8e0f6e2fe85adf

SHA256
a761332c4fb23fcc72d49003238c69fbc7ac477e1259e8f74b456025d605d7e8

SHA512
f7ff88d74fe51a84c9b355e7d60cc79b918ebf61432691b652facc6829c01e202d668df7c4482e43ef71b1119769e808664519e7b78a9c9bf28f4c19febd900b

Download Submit
C:\WINDOWS\SysWOW64\mfc140esn.dll

Filesize
93KB

MD5
f4e66f80b395f3f51c1b83a2a8dc0303

SHA1
4519fc84237a6ca1d816032c0e2450d346477277

SHA256
b81f51304990ca4bdffd5ff5e2e453ac34846604c9e6c012b2d82c5b8f8720d7

SHA512
65c9f36f0648f624327a9184dc7c00cb60a9c325ce4596561bda12b5538141d296acdab93b505a8d71ad3589ae3d960934a21239a044a1801c3dae7a720d7a37

Download Submit
C:\WINDOWS\SysWOW64\mfc140fra.dll

Filesize
94KB

MD5
0d6fb592eb39c8b4c464cbcb9f222e6b

SHA1
df3ce22ed508869cbf87d98154e49fde228fd3e0

SHA256
2d8b47e541696cf595a5ca76d2aa058bcda6e956e1f5d802a5f023e74d854764

SHA512
39cd18a31b3c812e97b8bc155388d0ca2e86580af5631bc8e02e19dc51aefdaa53a561a07bd2710e18d87f958460128cb249b62dbbc5bee347f230223d208479

Download Submit
C:\WINDOWS\SysWOW64\mfc140ita.dll

Filesize
92KB

MD5
dea5e2f8c4d483b8f6c2f47e14733ea7

SHA1
1372d36c377aed13978149c7fc94ef8493a3a00f

SHA256
8ea1b1b6f2dffb917d1028d5b03ca5fb37c3b42cb49e916d1c5a2e43cd763a2c

SHA512
0794897bb7a013fc0ff5d40d2a2834f555e1cc2b1315012b34254aaeae9ecbf67e8830095831bdcbcb77c58bcad31a7134ceae80b9e467c5c5224f314b554054

Download Submit
C:\WINDOWS\SysWOW64\mfc140jpn.dll

Filesize
74KB

MD5
dc4e91dd373f36bf8635aa5973ab8612

SHA1
61302df0d1efa29f8800676016dd7abea66510f7

SHA256
6570d167899fadc04f9bdcee2468de10942ec3fa6522b2ed75445100fb857892

SHA512
a09a6045e669c599f189c04c21c91d62d76d58cd049562e91a6bdafa9074430f81da3ce3b087d02a20ec2c45c04dd0b45a8cb3fb48cfb3fcfe2f4ac133579fca

Download Submit
C:\WINDOWS\SysWOW64\mfc140kor.dll

Filesize
73KB

MD5
84a702e9fb9a8b34ebbfe67f2a0be5cd

SHA1
7c5abb89fff48927c06b29a0cfea4dd494e2770b

SHA256
bd3af85e1c2ba2fc218ae2a4a0046d120029e5b7cb79bf0a2bc8ab89bd3e826b

SHA512
de0175f74912c06fad7ce7a49c22adeb326ecffcd9228840cb561c69cdaf75e72d128666f289dde8d6fe8a590adbdad25652129dff2bf93bc5f56b91b2242b10

Download Submit
C:\WINDOWS\SysWOW64\mfc140rus.dll

Filesize
90KB

MD5
ade4687437b55d917c1215a217823d80

SHA1
7e52892c067c9492a11295062cbb8c991680f988

SHA256
6da80675aeb3f16262c3e46203990ec00c459a2611e13cb25dc59a09aa7ec9c1

SHA512
565abffe2ab196b9aa7f1ee21ee66c20b6e176a8aa09a4b0d59ae347d5a999c31e9827ea689904ba6097c7f072c3c4d6c2801a6937977d21e271d9fa7edcd1be

Download Submit
C:\WINDOWS\SysWOW64\mfc140u.dll

Filesize
4.4MB

MD5
26a14eda8c519f22e9440dbab6a67dc5

SHA1
38371784dc5d3f7a5b74db8ba22d154f07a70bea

SHA256
8fcc96d844b0c658a05a38b60bb2b9b31300a5fbb44a254cebddb4997e72e56a

SHA512
094d371b2b40c0358ff9b68ed65d4704278d8983688ce3bc55684e3320d6025d4fc48df760f3c483a62622e4b3ba9e188cac964eb88210789b04cb546d5cc248

Download Submit
C:\WINDOWS\SysWOW64\mfcm100.dll

Filesize
107KB

MD5
8c5c941da08c921363b1ff6d9629e879

SHA1
0636de380ede0ffedc89e9de1df711fb1ed4362f

SHA256
121f08c1960b4596cb2fcba523765f840c17971e070e35e9f232d5fafe5678bd

SHA512
fd883d6edc1b919320133870bee659a475c0eb6a299458667e022d923359762cb3bf3e826dc216a9334c232b7593f173cf8dbeba53fa6e68e019d1d594befc5e

Download Submit
C:\WINDOWS\SysWOW64\mfcm110.dll

Filesize
108KB

MD5
c0bf5f1271af12313c18484478410fac

SHA1
b34f787796cef9138ee1d569d9704c587e779aa2

SHA256
f3a9b3c88a307636a57f8b97ec1d195c9c51485d621a29ee297584802e5f436f

SHA512
93e2a50ce42f3e5aec513ff43efb50907c28595a97411638730ed14b093a41ea1d218d5385395c2d30a09ee00f2ce11393b11a03e35db82ee3c39acce36af357

Download Submit
C:\WINDOWS\SysWOW64\mfcm110u.dll

Filesize
108KB

MD5
2c51492d272245c9ec5d117a7b343cfa

SHA1
49bff1a567680b9af3200abc69b0853029af2f51

SHA256
9c3ebea040cc17f3dddc0a2fcf0505dafbcdf02af2d266382c177fb3d44846f9

SHA512
954fce5b4e8d64cf97e4926204a8437ba175ed39b19bae752aaf487af71c0ac9bd36fd5fa813f1accea93f84270874954a324af4afe7fc6f64d14f392c2678ef

Download Submit
C:\WINDOWS\SysWOW64\mfcm120.dll

Filesize
108KB

MD5
a6c7132eec8113950d3100a1bd7d72ee

SHA1
be1b14353927b0d302179b202c8a9c442d507225

SHA256
eea40ae0e70f6a86a4706f2ede876e43e0e9887575fc49af2f6e1ca35d25556f

SHA512
7b4aa32901854c6a513643828df8a4774b90fda8d31c1eefbd56a66ba6a91d2bea93b578f03351539847c355236b4136fe22dc465ff5617eeae18897fd962d0f

Download Submit
C:\WINDOWS\SysWOW64\mfcm120u.dll

Filesize
108KB

MD5
b6614fe72d64a3d7700e20940ef5a13e

SHA1
532431bf46c23ee571ed900ca85792cee95473c9

SHA256
8d5586f0f755846ebed757f843e67da01579d54e0685f043d63b6ca52a075050

SHA512
3609a138b5c6600b42c327dc8dd35b5258dd63fd049346d68016bc365371c3073982411869b40cf5bb3881b233f1d55ad337c9c238602ded242cb97cb31d7b24

Download Submit
C:\WINDOWS\SysWOW64\mfcm140.dll

Filesize
100KB

MD5
d463375dd779139891b1fc480f33558a

SHA1
ff6dc87a5aff52a77ec1f3fa50ea58012a1310e0

SHA256
0b66305d0bdb736eeaa91edd99fa704761bb92487d1e0dafc35fc4dab1e97735

SHA512
9afe922a045f35cf9a5037932b3c7e491fdad70166200b8e3099c958421292ac8db047930476fe44b9739dc05c68f95c11995473b52b61ece6e2eccebd465031

Download Submit
C:\WINDOWS\SysWOW64\mfcm140u.dll

Filesize
128KB

MD5
eaec1fb8590c5e4267180589212fb400

SHA1
2cf1cf50b94c48d01bfe71e6bad8bd14fe85dec4

SHA256
f0398ac2380955a10b7d32a80ce0b10f7f7df653a24be3496690a68fd8287568

SHA512
9e64f3483e24b09dd9492f526ef4ecea817c78286bc93e3c6456a51e0de18aa8bd6f3b31a0e3ce1040ec640fdbef46148ea45c8a156510d06cb46ae3deb3edf7

Download Submit
C:\WINDOWS\SysmonDrv.sys

Filesize
221KB

MD5
f31d195f8840caa9f8c686edee7cff0b

SHA1
2e6eee9476d7e64c202acaabc4579f456dd2d416

SHA256
8ded398d6de044d5b835825a8e0f33f932ca0eb700cfb3d3bfec546cf0377acd

SHA512
d7bb3f16b4d3b8ea7821e7c477ed07283c2f3ebe522abe59799e2715c3be33801024504f03ce72cc67eb4df062282141e41b1d4a7435be3466f46625ee3106d5

Download Submit
C:\WINDOWS\WindowsUpdate.log

Filesize
55KB

MD5
d85d92f4fe345144a546ad52b121f299

SHA1
548bf57f6ca4d76e79be0b9579a9c643b46603c1

SHA256
e740bc3e00a406441e419e0bea182774a36c7aaf2be4abc42c6cc2506270dba7

SHA512
c280491c1146cb634e37f4c0c274c3e59be511d2af29c86a05e883ff5ef4c3a04d9effdc393913914d85fd754c8502170af5b0f95c6af9de18c4c5fd08270189

Download Submit
C:\WINDOWS\setupact.log

Filesize
29KB

MD5
9df3f5f00d694077e1895eb24edb3ed2

SHA1
6c85e75400bdf58dc0b51ce15d32e7778cdb1fd2

SHA256
55496f6bb15187c8c156fa11b5810c856c4c50c4c66fdcd1684d51e3db45e773

SHA512
af252ac5ac5e0555e9ca36dc5ed7d68744fd4cb2256771327db54f6920ac3510bccf66e341fdb4dc0350b5bbb36b6cbe811cad34850621e710a0b9e57c113fc0

Download Submit
C:\WINDOWS\setuperr.log

Filesize
55KB

MD5
a6f5c57fcbed2d3c20cfb547534dbae3

SHA1
97036de23d192bc05002b115f83cd64a7a9a7820

SHA256
057b74b26f06ed9760cb78b796fb3151876449f02c93484a11020401ace22f1a

SHA512
51ce24151c46211707c26c0dce9ac7b2b81c57e2eb16b217ffc103df3f541485f8eac009ffe4df4c35b965931e60b4cff406143ffc9b92e5e263ed1c19f5e2af

Download Submit
C:\WINDOWS\system.ini

Filesize
55KB

MD5
0dedd454397647f4b2cf06dbea315c75

SHA1
3024af07bde685ab90e3b08d31389457c8e112a0

SHA256
21963e21b549a620bcceabe9d238fe3c1fd1307149a71cdf53994a35a72e5b21

SHA512
495088b7f7306ea209bad18f70329b45cfee3fdbf52d52fcc7ae7db4d4ae735aaaf2deefb517d42afccd8cf4d6d96015b6fcc0030223a4fc869e4420229dfe2f

Download Submit
C:\WINDOWS\win.ini

Filesize
55KB

MD5
af403d19d6c67747b93422be55a769db

SHA1
790bebfcf7ad32669b657f92074fcb4863ea5e82

SHA256
aaac598db518557b6f22db3a7cb570ea2aae9dc482050b0bb05ba79217549ffe

SHA512
692d15ad3c9694d945fefca72af10576d7b0d7526e224c224f9f0d2ecc4017373b4184972966bc7b54835b6ab1315fb99e1d54f357fca083cad8a826fcf607ff

Download Submit
C:\exc.exe

Filesize
417KB

MD5
637dafb24eac987955a5582699bbe75c

SHA1
b6db3ada829c3992a767596ca3112f127cefee2d

SHA256
dda7f7428be4e9a148574141ed199f9b8442d47f784a941ca2a96d5c213ae8cc

SHA512
d7d65c04fc07550bfa6774d47270072f731ad8fc1320f0447023fa24fbf00e03b098a20b7883ddd6797c2b0f04e3d4c8e1f4d4346dd34c52d135f9e68c83672e

Download Submit
memory/2304-1926-0x0000029B1B4A0000-0x0000029B1B4A1000-memory.dmp

Filesize
4KB

Download
memory/2304-1925-0x0000029B1B390000-0x0000029B1B391000-memory.dmp

Filesize
4KB

Download
memory/2304-1922-0x0000029B1B360000-0x0000029B1B361000-memory.dmp

Filesize
4KB

Download
memory/2304-1890-0x0000029B12F40000-0x0000029B12F50000-memory.dmp

Filesize
64KB

Download
memory/2304-1924-0x0000029B1B390000-0x0000029B1B391000-memory.dmp

Filesize
4KB

Download
memory/2304-1906-0x0000029B13040000-0x0000029B13050000-memory.dmp

Filesize
64KB

Download
memory/2308-278-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/2308-1679-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/2308-1467-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/2308-535-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/2308-0-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/2308-9-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/2308-276-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/3112-1680-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/3112-1135-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/3112-277-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/3112-10-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/3112-2259-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download