b4e7bc4c35bf3694533d5715f19b863db36183e93498d7b5ed015db8f3ef7a69

Analysis

max time kernel
151s
max time network
160s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
10/03/2024, 10:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

be572bfeecda13f3da54556a9cb262bb.exe
Size

334KB
MD5

be572bfeecda13f3da54556a9cb262bb
SHA1

f79d283e58536ac7b204fa0a3497394ef44582e9
SHA256

b4e7bc4c35bf3694533d5715f19b863db36183e93498d7b5ed015db8f3ef7a69
SHA512

108da6a28ad36d3619d3d4ea33e1b006475b047853f6febc509ee426a729129d9744d937042e804de1590b43245aa657f792b2cbd4727dc86bf38ff90acdc330
SSDEEP

3072:v15n15q15n15q15n15n15n152whag4iE4oT:t515g515g5151515KL

Score

8^/10

upx

Malware Config

Signatures

Drops file in Drivers directory 6 IoCs

description	ioc	Process
File created	C:\WINDOWS\SysWOW64\drivers\gm.dls	exc.exe
File created	C:\WINDOWS\SysWOW64\drivers\gm.dls	be572bfeecda13f3da54556a9cb262bb.exe
File created	C:\WINDOWS\SysWOW64\drivers\gmreadme.txt	exc.exe
File created	C:\WINDOWS\SysWOW64\drivers\gmreadme.txt	be572bfeecda13f3da54556a9cb262bb.exe
File created	C:\WINDOWS\SysWOW64\drivers\afunix.sys	exc.exe
File created	C:\WINDOWS\SysWOW64\drivers\afunix.sys	be572bfeecda13f3da54556a9cb262bb.exe

Manipulates Digital Signatures 2 IoCs

Attackers can apply techniques such as modifying certain DLL exports to make their binary seem valid.

description	ioc	Process
File created	C:\WINDOWS\SysWOW64\wintrust.dll	exc.exe
File created	C:\WINDOWS\SysWOW64\wintrust.dll	be572bfeecda13f3da54556a9cb262bb.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000\Control Panel\International\Geo\Nation	be572bfeecda13f3da54556a9cb262bb.exe

Executes dropped EXE 1 IoCs

pid	Process
4936	exc.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3140-0-0x0000000000400000-0x000000000040A000-memory.dmp	upx
behavioral2/files/0x000c0000000226fd-5.dat	upx
behavioral2/memory/3140-9-0x0000000000400000-0x000000000040A000-memory.dmp	upx
behavioral2/memory/4936-10-0x0000000000400000-0x000000000040A000-memory.dmp	upx
behavioral2/files/0x0001000000009e60-15.dat	upx
behavioral2/files/0x0003000000016739-19.dat	upx
behavioral2/files/0x000100000000aee4-21.dat	upx
behavioral2/files/0x000300000001d8b7-17.dat	upx
behavioral2/files/0x00050000000006bd-23.dat	upx
behavioral2/files/0x0001000000009e65-27.dat	upx
behavioral2/files/0x000500000001db38-33.dat	upx
behavioral2/files/0x0001000000009e68-31.dat	upx
behavioral2/files/0x000500000001e609-35.dat	upx
behavioral2/files/0x000800000001db17-39.dat	upx
behavioral2/files/0x000300000001e9c6-41.dat	upx
behavioral2/memory/3140-46-0x0000000000400000-0x000000000040A000-memory.dmp	upx
behavioral2/files/0x0002000000016926-48.dat	upx
behavioral2/files/0x000400000001e60a-50.dat	upx
behavioral2/files/0x000400000001e61a-81.dat	upx
behavioral2/files/0x000400000001e61b-84.dat	upx
behavioral2/files/0x000500000001e613-78.dat	upx
behavioral2/files/0x000500000001e612-75.dat	upx
behavioral2/files/0x000600000001e599-105.dat	upx
behavioral2/files/0x000600000001e900-129.dat	upx
behavioral2/files/0x000600000001e921-151.dat	upx
behavioral2/files/0x000600000001e920-148.dat	upx
behavioral2/files/0x000300000001e973-160.dat	upx
behavioral2/files/0x000300000001e9dd-195.dat	upx
behavioral2/files/0x000300000001e9de-199.dat	upx
behavioral2/files/0x000300000001e650-205.dat	upx
behavioral2/files/0x000500000001e63a-202.dat	upx
behavioral2/files/0x000300000001e9dc-193.dat	upx
behavioral2/files/0x000300000001e9db-191.dat	upx
behavioral2/files/0x000300000001e9da-189.dat	upx
behavioral2/files/0x000300000001e9d9-185.dat	upx
behavioral2/files/0x000300000001e9d8-180.dat	upx
behavioral2/files/0x000300000001e9d7-178.dat	upx
behavioral2/files/0x000300000001e9d6-176.dat	upx
behavioral2/files/0x000300000001e9d5-170.dat	upx
behavioral2/files/0x000300000001e9d4-167.dat	upx
behavioral2/files/0x000300000001e9d3-163.dat	upx
behavioral2/files/0x000300000001e972-157.dat	upx
behavioral2/files/0x000500000001e971-154.dat	upx
behavioral2/files/0x000700000001e91f-145.dat	upx
behavioral2/files/0x000400000001e90b-142.dat	upx
behavioral2/files/0x000300000001e903-139.dat	upx
behavioral2/files/0x000500000001e902-136.dat	upx
behavioral2/files/0x000600000001e901-133.dat	upx
behavioral2/files/0x000600000001e8fe-126.dat	upx
behavioral2/files/0x000700000001e5b1-123.dat	upx
behavioral2/files/0x000600000001e5b0-120.dat	upx
behavioral2/files/0x000700000001e5a5-118.dat	upx
behavioral2/files/0x010400000001e5a4-116.dat	upx
behavioral2/files/0x000800000001e59e-114.dat	upx
behavioral2/files/0x000700000001e59d-109.dat	upx
behavioral2/files/0x000800000001e598-102.dat	upx
behavioral2/files/0x000900000001e594-99.dat	upx
behavioral2/files/0x000900000001e585-95.dat	upx
behavioral2/files/0x000700000001e584-91.dat	upx
behavioral2/files/0x000a00000001e582-89.dat	upx
behavioral2/files/0x000400000001e611-72.dat	upx
behavioral2/files/0x000400000001e610-69.dat	upx
behavioral2/files/0x000400000001e60f-66.dat	upx
behavioral2/files/0x000400000001e60e-63.dat	upx

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\WINDOWS\SysWOW64\kbd101.DLL	exc.exe
File created	C:\WINDOWS\SysWOW64\mssign32.dll	exc.exe
File created	C:\WINDOWS\SysWOW64\PortableDeviceClassExtension.dll	exc.exe
File created	C:\WINDOWS\SysWOW64\rasplap.dll	exc.exe
File created	C:\WINDOWS\SysWOW64\diskpart.exe	exc.exe
File created	C:\WINDOWS\SysWOW64\mmcndmgr.dll	exc.exe
File created	C:\WINDOWS\SysWOW64\regapi.dll	exc.exe
File created	C:\WINDOWS\SysWOW64\smartscreenps.dll	be572bfeecda13f3da54556a9cb262bb.exe
File created	C:\WINDOWS\SysWOW64\fveapi.dll	exc.exe
File created	C:\WINDOWS\SysWOW64\kbd101b.DLL	be572bfeecda13f3da54556a9cb262bb.exe
File created	C:\WINDOWS\SysWOW64\msls31.dll	exc.exe
File created	C:\WINDOWS\SysWOW64\resmon.exe	exc.exe
File created	C:\WINDOWS\SysWOW64\RTWorkQ.dll	be572bfeecda13f3da54556a9cb262bb.exe
File created	C:\WINDOWS\SysWOW64\shimgvw.dll	exc.exe
File created	C:\WINDOWS\SysWOW64\w32topl.dll	exc.exe
File created	C:\WINDOWS\SysWOW64\winrscmd.dll	be572bfeecda13f3da54556a9cb262bb.exe
File created	C:\WINDOWS\SysWOW64\iepeers.dll	exc.exe
File created	C:\WINDOWS\SysWOW64\ttdloader.dll	be572bfeecda13f3da54556a9cb262bb.exe
File created	C:\WINDOWS\SysWOW64\wevtapi.dll	exc.exe
File created	C:\WINDOWS\SysWOW64\cero.rs	be572bfeecda13f3da54556a9cb262bb.exe
File created	C:\WINDOWS\SysWOW64\DefaultAccountTile.png	be572bfeecda13f3da54556a9cb262bb.exe
File created	C:\WINDOWS\SysWOW64\slmgr.vbs	exc.exe
File created	C:\WINDOWS\SysWOW64\cob-au.rs	be572bfeecda13f3da54556a9cb262bb.exe
File created	C:\WINDOWS\SysWOW64\KBDCZ2.DLL	exc.exe
File created	C:\WINDOWS\SysWOW64\msjetoledb40.dll	exc.exe
File created	C:\WINDOWS\SysWOW64\msxml3r.dll	be572bfeecda13f3da54556a9cb262bb.exe
File created	C:\WINDOWS\SysWOW64\itss.dll	be572bfeecda13f3da54556a9cb262bb.exe
File created	C:\WINDOWS\SysWOW64\ir50_32.dll	be572bfeecda13f3da54556a9cb262bb.exe
File created	C:\WINDOWS\SysWOW64\KBDHEB.DLL	exc.exe
File created	C:\WINDOWS\SysWOW64\kbdibm02.DLL	exc.exe
File created	C:\WINDOWS\SysWOW64\raserver.exe	be572bfeecda13f3da54556a9cb262bb.exe
File created	C:\WINDOWS\SysWOW64\tbs.dll	exc.exe
File created	C:\WINDOWS\SysWOW64\WinRTNetMUAHostServer.exe	exc.exe
File created	C:\WINDOWS\SysWOW64\dot3cfg.dll	exc.exe
File created	C:\WINDOWS\SysWOW64\AuditPolicyGPInterop.dll	exc.exe
File created	C:\WINDOWS\SysWOW64\DpiScaling.exe	be572bfeecda13f3da54556a9cb262bb.exe
File created	C:\WINDOWS\SysWOW64\HNetCfgClient.dll	be572bfeecda13f3da54556a9cb262bb.exe
File opened for modification	C:\WINDOWS\SysWOW64\msvcp140_codecvt_ids.dll	exc.exe
File created	C:\WINDOWS\SysWOW64\AppInstallerPrompt.Desktop.dll	exc.exe
File created	C:\WINDOWS\SysWOW64\lodctr.exe	be572bfeecda13f3da54556a9cb262bb.exe
File created	C:\WINDOWS\SysWOW64\rasman.dll	be572bfeecda13f3da54556a9cb262bb.exe
File created	C:\WINDOWS\SysWOW64\TileDataRepository.dll	be572bfeecda13f3da54556a9cb262bb.exe
File created	C:\WINDOWS\SysWOW64\wimgapi.dll	exc.exe
File created	C:\WINDOWS\SysWOW64\cttune.exe	exc.exe
File created	C:\WINDOWS\SysWOW64\openfiles.exe	be572bfeecda13f3da54556a9cb262bb.exe
File created	C:\WINDOWS\SysWOW64\TokenBroker.dll	exc.exe
File created	C:\WINDOWS\SysWOW64\KBDTH0.DLL	exc.exe
File created	C:\WINDOWS\SysWOW64\cmgrcspps.dll	exc.exe
File opened for modification	C:\WINDOWS\SysWOW64\mfc110cht.dll	be572bfeecda13f3da54556a9cb262bb.exe
File created	C:\WINDOWS\SysWOW64\ssdm.dll	be572bfeecda13f3da54556a9cb262bb.exe
File created	C:\WINDOWS\SysWOW64\txfw32.dll	exc.exe
File created	C:\WINDOWS\SysWOW64\vbisurf.ax	exc.exe
File created	C:\WINDOWS\SysWOW64\xwizard.dtd	exc.exe
File created	C:\WINDOWS\SysWOW64\apprepapi.dll	exc.exe
File created	C:\WINDOWS\SysWOW64\MosHostClient.dll	be572bfeecda13f3da54556a9cb262bb.exe
File created	C:\WINDOWS\SysWOW64\msvcp_win.dll	exc.exe
File created	C:\WINDOWS\SysWOW64\netprovisionsp.dll	exc.exe
File created	C:\WINDOWS\SysWOW64\WindowsCodecsRaw.txt	be572bfeecda13f3da54556a9cb262bb.exe
File created	C:\WINDOWS\SysWOW64\dsuiext.dll	exc.exe
File created	C:\WINDOWS\SysWOW64\jscript9diag.dll	exc.exe
File created	C:\WINDOWS\SysWOW64\SortWindows62.dll	be572bfeecda13f3da54556a9cb262bb.exe
File created	C:\WINDOWS\SysWOW64\DfsShlEx.dll	be572bfeecda13f3da54556a9cb262bb.exe
File created	C:\WINDOWS\SysWOW64\Windows.Globalization.dll	be572bfeecda13f3da54556a9cb262bb.exe
File opened for modification	C:\WINDOWS\SysWOW64\vccorlib120.dll	be572bfeecda13f3da54556a9cb262bb.exe

Drops file in Windows directory 40 IoCs

description	ioc	Process
File opened for modification	C:\WINDOWS\WindowsUpdate.log	exc.exe
File created	C:\WINDOWS\winhlp32.exe	be572bfeecda13f3da54556a9cb262bb.exe
File opened for modification	C:\WINDOWS\Professional.xml	be572bfeecda13f3da54556a9cb262bb.exe
File created	C:\WINDOWS\explorer.exe	exc.exe
File opened for modification	C:\WINDOWS\win.ini	exc.exe
File opened for modification	C:\WINDOWS\system.ini	be572bfeecda13f3da54556a9cb262bb.exe
File created	C:\WINDOWS\WMSysPr9.prx	be572bfeecda13f3da54556a9cb262bb.exe
File opened for modification	C:\WINDOWS\PFRO.log	be572bfeecda13f3da54556a9cb262bb.exe
File created	C:\WINDOWS\splwow64.exe	exc.exe
File opened for modification	C:\WINDOWS\SysmonDrv.sys	be572bfeecda13f3da54556a9cb262bb.exe
File created	C:\WINDOWS\WMSysPr9.prx	exc.exe
File created	C:\WINDOWS\bfsvc.exe	be572bfeecda13f3da54556a9cb262bb.exe
File created	C:\WINDOWS\notepad.exe	exc.exe
File opened for modification	C:\WINDOWS\SysmonDrv.sys	exc.exe
File opened for modification	C:\WINDOWS\lsasetup.log	exc.exe
File opened for modification	C:\WINDOWS\win.ini	be572bfeecda13f3da54556a9cb262bb.exe
File created	C:\WINDOWS\bfsvc.exe	exc.exe
File created	C:\WINDOWS\mib.bin	exc.exe
File opened for modification	C:\WINDOWS\system.ini	exc.exe
File opened for modification	C:\WINDOWS\DtcInstall.log	be572bfeecda13f3da54556a9cb262bb.exe
File created	C:\WINDOWS\explorer.exe	be572bfeecda13f3da54556a9cb262bb.exe
File opened for modification	C:\WINDOWS\lsasetup.log	be572bfeecda13f3da54556a9cb262bb.exe
File opened for modification	C:\WINDOWS\PFRO.log	exc.exe
File opened for modification	C:\WINDOWS\Professional.xml	exc.exe
File created	C:\WINDOWS\twain_32.dll	be572bfeecda13f3da54556a9cb262bb.exe
File created	C:\WINDOWS\twain_32.dll	exc.exe
File created	C:\WINDOWS\mib.bin	be572bfeecda13f3da54556a9cb262bb.exe
File created	C:\WINDOWS\notepad.exe	be572bfeecda13f3da54556a9cb262bb.exe
File created	C:\WINDOWS\HelpPane.exe	exc.exe
File created	C:\WINDOWS\winhlp32.exe	exc.exe
File created	C:\WINDOWS\write.exe	be572bfeecda13f3da54556a9cb262bb.exe
File created	C:\WINDOWS\splwow64.exe	be572bfeecda13f3da54556a9cb262bb.exe
File opened for modification	C:\WINDOWS\DtcInstall.log	exc.exe
File opened for modification	C:\WINDOWS\WindowsUpdate.log	be572bfeecda13f3da54556a9cb262bb.exe
File created	C:\WINDOWS\sysmon.exe	be572bfeecda13f3da54556a9cb262bb.exe
File created	C:\WINDOWS\sysmon.exe	exc.exe
File created	C:\WINDOWS\write.exe	exc.exe
File created	C:\WINDOWS\HelpPane.exe	be572bfeecda13f3da54556a9cb262bb.exe
File created	C:\WINDOWS\hh.exe	be572bfeecda13f3da54556a9cb262bb.exe
File created	C:\WINDOWS\hh.exe	exc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
2812	msedge.exe
2812	msedge.exe
3820	msedge.exe
3820	msedge.exe
4432	msedge.exe
4432	msedge.exe
3744	identity_helper.exe
3744	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 13 IoCs

pid	Process
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3140 wrote to memory of 4936	3140	be572bfeecda13f3da54556a9cb262bb.exe	89
PID 3140 wrote to memory of 4936	3140	be572bfeecda13f3da54556a9cb262bb.exe	89
PID 3140 wrote to memory of 4936	3140	be572bfeecda13f3da54556a9cb262bb.exe	89
PID 4936 wrote to memory of 4432	4936	exc.exe	109
PID 4936 wrote to memory of 4432	4936	exc.exe	109
PID 3140 wrote to memory of 1432	3140	be572bfeecda13f3da54556a9cb262bb.exe	110
PID 3140 wrote to memory of 1432	3140	be572bfeecda13f3da54556a9cb262bb.exe	110
PID 4432 wrote to memory of 2384	4432	msedge.exe	111
PID 4432 wrote to memory of 2384	4432	msedge.exe	111
PID 1432 wrote to memory of 2560	1432	msedge.exe	112
PID 1432 wrote to memory of 2560	1432	msedge.exe	112
PID 4432 wrote to memory of 2444	4432	msedge.exe	113
PID 4432 wrote to memory of 2444	4432	msedge.exe	113
PID 4432 wrote to memory of 2444	4432	msedge.exe	113
PID 4432 wrote to memory of 2444	4432	msedge.exe	113
PID 4432 wrote to memory of 2444	4432	msedge.exe	113
PID 4432 wrote to memory of 2444	4432	msedge.exe	113
PID 4432 wrote to memory of 2444	4432	msedge.exe	113
PID 4432 wrote to memory of 2444	4432	msedge.exe	113
PID 4432 wrote to memory of 2444	4432	msedge.exe	113
PID 4432 wrote to memory of 2444	4432	msedge.exe	113
PID 4432 wrote to memory of 2444	4432	msedge.exe	113
PID 4432 wrote to memory of 2444	4432	msedge.exe	113
PID 4432 wrote to memory of 2444	4432	msedge.exe	113
PID 4432 wrote to memory of 2444	4432	msedge.exe	113
PID 4432 wrote to memory of 2444	4432	msedge.exe	113
PID 4432 wrote to memory of 2444	4432	msedge.exe	113
PID 4432 wrote to memory of 2444	4432	msedge.exe	113
PID 4432 wrote to memory of 2444	4432	msedge.exe	113
PID 4432 wrote to memory of 2444	4432	msedge.exe	113
PID 4432 wrote to memory of 2444	4432	msedge.exe	113
PID 4432 wrote to memory of 2444	4432	msedge.exe	113
PID 4432 wrote to memory of 2444	4432	msedge.exe	113
PID 4432 wrote to memory of 2444	4432	msedge.exe	113
PID 4432 wrote to memory of 2444	4432	msedge.exe	113
PID 4432 wrote to memory of 2444	4432	msedge.exe	113
PID 4432 wrote to memory of 2444	4432	msedge.exe	113
PID 4432 wrote to memory of 2444	4432	msedge.exe	113
PID 4432 wrote to memory of 2444	4432	msedge.exe	113
PID 4432 wrote to memory of 2444	4432	msedge.exe	113
PID 4432 wrote to memory of 2444	4432	msedge.exe	113
PID 4432 wrote to memory of 2444	4432	msedge.exe	113
PID 4432 wrote to memory of 2444	4432	msedge.exe	113
PID 4432 wrote to memory of 2444	4432	msedge.exe	113
PID 4432 wrote to memory of 2444	4432	msedge.exe	113
PID 4432 wrote to memory of 2444	4432	msedge.exe	113
PID 4432 wrote to memory of 2444	4432	msedge.exe	113
PID 4432 wrote to memory of 2444	4432	msedge.exe	113
PID 4432 wrote to memory of 2444	4432	msedge.exe	113
PID 4432 wrote to memory of 2444	4432	msedge.exe	113
PID 4432 wrote to memory of 2444	4432	msedge.exe	113
PID 4432 wrote to memory of 2812	4432	msedge.exe	114
PID 4432 wrote to memory of 2812	4432	msedge.exe	114
PID 1432 wrote to memory of 1740	1432	msedge.exe	115
PID 1432 wrote to memory of 1740	1432	msedge.exe	115
PID 1432 wrote to memory of 1740	1432	msedge.exe	115
PID 1432 wrote to memory of 1740	1432	msedge.exe	115
PID 1432 wrote to memory of 1740	1432	msedge.exe	115
PID 1432 wrote to memory of 1740	1432	msedge.exe	115
PID 1432 wrote to memory of 1740	1432	msedge.exe	115
PID 1432 wrote to memory of 1740	1432	msedge.exe	115
PID 1432 wrote to memory of 1740	1432	msedge.exe	115
PID 1432 wrote to memory of 1740	1432	msedge.exe	115
PID 1432 wrote to memory of 1740	1432	msedge.exe	115

C:\Users\Admin\AppData\Local\Temp\be572bfeecda13f3da54556a9cb262bb.exe
"C:\Users\Admin\AppData\Local\Temp\be572bfeecda13f3da54556a9cb262bb.exe"
1⤵
- Drops file in Drivers directory
- Manipulates Digital Signatures
- Checks computer location settings
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:3140
- C:\exc.exe
  "C:\exc.exe"
  2⤵
  - Drops file in Drivers directory
  - Manipulates Digital Signatures
  - Executes dropped EXE
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Suspicious use of WriteProcessMemory
  PID:4936
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.freeav.com/
    3⤵
    - Enumerates system info in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of WriteProcessMemory
    PID:4432
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0xe0,0x104,0x7ffee91146f8,0x7ffee9114708,0x7ffee9114718
      4⤵
      PID:2384
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2120,18252452599683930086,10625445673893867660,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2124 /prefetch:2
      4⤵
      PID:2444
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2120,18252452599683930086,10625445673893867660,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2188 /prefetch:3
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:2812
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2120,18252452599683930086,10625445673893867660,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2908 /prefetch:8
      4⤵
      PID:2872
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,18252452599683930086,10625445673893867660,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3228 /prefetch:1
      4⤵
      PID:2400
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,18252452599683930086,10625445673893867660,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3244 /prefetch:1
      4⤵
      PID:1116
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,18252452599683930086,10625445673893867660,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3956 /prefetch:1
      4⤵
      PID:5240
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,18252452599683930086,10625445673893867660,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4348 /prefetch:1
      4⤵
      PID:5388
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,18252452599683930086,10625445673893867660,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5436 /prefetch:1
      4⤵
      PID:4848
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2120,18252452599683930086,10625445673893867660,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=3228 /prefetch:8
      4⤵
      PID:5996
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,18252452599683930086,10625445673893867660,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5336 /prefetch:1
      4⤵
      PID:5892
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,18252452599683930086,10625445673893867660,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3276 /prefetch:1
      4⤵
      PID:5980
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2120,18252452599683930086,10625445673893867660,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6380 /prefetch:8
      4⤵
      PID:4188
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2120,18252452599683930086,10625445673893867660,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6380 /prefetch:8
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:3744
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,18252452599683930086,10625445673893867660,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5464 /prefetch:1
      4⤵
      PID:5480
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,18252452599683930086,10625445673893867660,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5548 /prefetch:1
      4⤵
      PID:3572
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,18252452599683930086,10625445673893867660,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=220 /prefetch:1
      4⤵
      PID:6044
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,18252452599683930086,10625445673893867660,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1924 /prefetch:1
      4⤵
      PID:3732
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,18252452599683930086,10625445673893867660,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5280 /prefetch:1
      4⤵
      PID:3456
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,18252452599683930086,10625445673893867660,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6248 /prefetch:1
      4⤵
      PID:5872
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.antispyware.com/
    3⤵
    PID:6052
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd4,0x108,0x7ffee91146f8,0x7ffee9114708,0x7ffee9114718
      4⤵
      PID:5864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.freeav.com/
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1432
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffee91146f8,0x7ffee9114708,0x7ffee9114718
    3⤵
    PID:2560
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2136,2334116783260471795,3181062387410870521,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2148 /prefetch:2
    3⤵
    PID:1740
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2136,2334116783260471795,3181062387410870521,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2200 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.antispyware.com/
  2⤵
  PID:3724
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffee91146f8,0x7ffee9114708,0x7ffee9114718
    3⤵
    PID:4524

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5384

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5492

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x244 0x2d4
1⤵
PID:5780

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
5c6aef82e50d05ffc0cf52a6c6d69c91

SHA1
c203efe5b45b0630fee7bd364fe7d63b769e2351

SHA256
d9068cf3d04d62a9fb1cdd4c3cf7c263920159171d1b84cb49eff7cf4ed5bc32

SHA512
77ad48936e8c3ee107a121e0b2d1216723407f76872e85c36413237ca1c47b8c40038b8a6349b072bbcc6a29e27ddda77cf686fa97569f4d86531e6b2ac485ed

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
7c6136bc98a5aedca2ea3004e9fbe67d

SHA1
74318d997f4c9c351eef86d040bc9b085ce1ad4f

SHA256
50c3bd40caf7e9a82496a710f58804aa3536b44d57e2ee5e2af028cbebc6c2f2

SHA512
2d2fb839321c56e4cb80562e9a1daa4baf48924d635729dc5504a26462796919906f0097dd1fc7fd053394c0eea13c25219dec54ffe6e9abb6e8cb9afa66bada

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
552B

MD5
3a5f9ac4383304a86ac33b440d373767

SHA1
de18a348f58deb2972b96c42d71c0449b1977298

SHA256
53d5d56f7eb2b555cf0fb0dce01ef3f094f3fb719716a44b06ad95cc9486240b

SHA512
157051cea33b0c8981c1182bd72848d0db5c69ec2a6b34232e94fb1c6920bd2882a8d9b74ea031a54a92a9a8efb0e20efd877e4b7ffb009eb4cd75988c6e89f3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
672B

MD5
7d44dcfcd5db9c49f5af35f973d26e38

SHA1
11e2bf8babfce3d76ef6aa83e4be1b7a60f3331b

SHA256
185d5d08227b7715cbef1384cb73811d2bf9e18c104160b90991772d4ade8c15

SHA512
3fa8e7b7020df233c611edcd9379e89378eeabc7322f0d7b30ebe3b4b5c39f68706dfc6ccf7b09547d813b7afbbb3bd7d9181998429b8e9587a422a21556660c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
451269ff259c39ef62bfd47c751b8452

SHA1
2ec605ab064f86022be97de6f2f512abf91b8451

SHA256
2198257cb373f10ea3ebe945d7f19a7db65beda603eb3daa4de70a836021e16c

SHA512
3c82b6a09013c550a4fed30b7c5fdd1cefaa43526e7387e89b8ffd3b45a86e8b05069433fe857c64969b9abaf5d5736662aef7794301a7b545e0135cf248ab62

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
ba3210012187482f8a7202973cd92418

SHA1
1e59fc03449d3023774f5705303d6f42dac26132

SHA256
4bb7467502297b66fdc996bad3dcf82730b0116d938d6fc06316a9de42e490fd

SHA512
8e1e3d4850748048457caa3cfdbd7837355e537c3fee571d4f6a2d1836d3b264171768db25ef1ec11670f5fcf72df6df89cfe73ee85601934806622c79b3e581

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
85f54834831d771e08ce0d580c9a7bd3

SHA1
b6a55e49a35cc3f12304417f6c17381f11887e02

SHA256
8ea32c4b081b65f3f491707c452753e73115a2b29d1608cda687a4de4f29a56f

SHA512
b9d2d620f968442a60d2cee20fec016eab9522955a175dfb16f67ed2509a2611a35630ce288c0375d327f89fa08740a8494630ff55c775af459de0bd5d140eda

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
9a8510ade7c729d6bbef1ef1af9e48c3

SHA1
e4020a950e26a87568e9ca7ae2b0ad05d23a875f

SHA256
86f91696a44ee7902d47912fd05b98b95a7c8a2a9f91f0f6644ab7810720c0a0

SHA512
2bd9938a0a23519af05f4a32bde741c942ccecf9a6786b61cbab224dfce8022ddeb51737809ca13cbd404f4222d741a001812911fce02f55853b5f7b7cdb8ada

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
9ded40c1ea6344fd81a7badab2dc9c96

SHA1
400ede009e39c385f6961459f4b5a24bf179f178

SHA256
b7e7c4d607f958bf4d6a3467c8bf9032bddd0952d4caf99611281d2dcbbb7896

SHA512
2567612108d46005ec61a95549766074c04de444bc0179463c73038eeab5a5f3d50249eedd85793a71b91e5cd31bcf76af2a444b4b82d86b177bd2a2f6181d09

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
3280555b2564284da067d180dff6c3b1

SHA1
cd79799b33f80af31fda1c23b2df561e1a3c29e6

SHA256
ea68e136b6dc3603e58f19474b5566e02ec0738ed1658a3486de7918eb03ae0b

SHA512
27249ad9d5f297432e8c7fe8b1f5efd49730d634023f510b017a0e39f37fc1c28a3241c3673365bc286ffb83ff2c958faf4bf9f841eb6d8dc6b9095663d49e12

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5988ce.TMP

Filesize
871B

MD5
642596c3d77f190e1065ca1ec4061c92

SHA1
e7295acc94d86c8152379b895ce510ea5d1d0090

SHA256
60ac48532af4fdd5aa5f995b9214f62a74a3729578b1fb809356340f48d423c0

SHA512
8eadc6ad235e1334508f6d9b21f261bd1adc5f94517bca60f572f78c5aac0930e30ceef484ee75b97becc1aed85a5edb7a1c12139c485dd8a31c781cfe8dcc8d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
8KB

MD5
75bb2764ca32608a6d88b7258c14ce22

SHA1
b4e61859563bde983ce354bb68a96571fba8d702

SHA256
fc707f509a5f32a442f53a711d1af5b84defd8d8c97fc4416feec11c41d299df

SHA512
1676087e8c8970e97b6494fbaa5c85aa8ba3c2a1c27b6812dbd4d8b7ef12202b8a5ec323c71ad322e8f130ea0628c53e81fe269b0ad1ac96b20534adb7d5fcd2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
af76eb056fbf55c1dc4ebea7525e5460

SHA1
89ca775caf2cb0002a642a15556dd005817f2a88

SHA256
c4ef1614b78ae2766a3b06847c1b4f1ac1efa80fecf356ac2e5cf5cb63768ae9

SHA512
5264dbad2205987dbb6b510b91bde0bbb4bb77d2e419ef6bd79d9bb969489243fd2402d5552fcb583236a5df4911cf977638c2cc2abfba8cc1a76af7c629b50f

Download Submit
C:\WINDOWS\DtcInstall.log

Filesize
57KB

MD5
15734e01520f31c5363879da65fdb46c

SHA1
8516d358c22deb3e469d2dc74254f835f40c57d7

SHA256
f3387f575f1024819de066fe1cb76c5be229c69d09c1144f5d7923c066c2280b

SHA512
9ff00cf81ff31dce2c7244cdbeace8a113dda9b6ab1e4043ecfbe98e8723db69b1eaca7584da72dc8c9b5fa2986ed7be63f21a13540b2bd3ea17f5124af24176

Download Submit
C:\WINDOWS\PFRO.log

Filesize
56KB

MD5
ece77120331e360dbd1568db40478d45

SHA1
12040aded0a6fe002731535c4126f9a0732b553a

SHA256
471769d37643c07668e2f0440271dffecef51785506f7defc692a4713a7c89a3

SHA512
cf556a1d4e7e7b86755117260278e56a143a00aaaf3816b6311cbe371fe83e98f17536afb6788ed566e9c4dd27e9d426d42fcc3f7e4d007f3dd83caab4f6bd87

Download Submit
C:\WINDOWS\Professional.xml

Filesize
85KB

MD5
6f5d398de89207edd4c644c8b452650c

SHA1
ff9f69361f89645f6cbbdf5c4fe825231ed161ea

SHA256
c529f1604787aed5725993421e7561b8ee42779048e67ddda45b576463911ddf

SHA512
ca5ec69de5b80cb3d301a71098226397200b6c5f89752f1d6f8cf28bb2d21e7b4e579fa0a2d323bde6a1f55b736b4cc0257f3b44ef19ea002e4916947e036d4e

Download Submit
C:\WINDOWS\SysWOW64\atl100.dll

Filesize
162KB

MD5
9c248e5942f5a4fec8308f8dc678863b

SHA1
ac67473c988b99c1369847cb603a8ce7fc0fbd77

SHA256
79c6eeb2be9027630c9b22e4bb51fd6f3a2e816eb18a9168e0b973d6524be888

SHA512
98d83c519d0febc933c7cdffe948574922c2601c00bb386dde3268dcd1e11847f99a9c12feebaca328e278f11ceace3192ed6f01d31b72aaddfe7097d770b4e0

Download Submit
C:\WINDOWS\SysWOW64\atl110.dll

Filesize
188KB

MD5
f69917094c3476d4862964b3e94fea9b

SHA1
9f53c66381ec77991ff91317f4b8c0a3dfeeb9a6

SHA256
4cc929203d8be32804382296f36728e85114d7b8f17ee17acb5415b590883f89

SHA512
9e9da08d5a0053af55d515d06f9e97232a7d0545e3cba6d23ba9740954972399bc8e4ca6b2c78a4771493ad65b3028b11e5233d0434bccafd4e4b6d0adc33dc9

Download Submit
C:\WINDOWS\SysWOW64\concrt140.dll

Filesize
269KB

MD5
c1b608a63c2a185a1044372b0cf7f580

SHA1
222c7d4bd62e96acdf7fe62d695e95df81dbe913

SHA256
7529d9c85dd290abc6718f8921d98d233d6d3e0c634ec2de08f3e5ce8ccd0125

SHA512
f61df6b415a5e0c7d3fec86ddd8b39dbd73206167dd8c67e99e63429e268d69b22636608e3afbdb82f81c837b73d0cf95645c0ce2ac65f4c4e15356bd8dc9696

Download Submit
C:\WINDOWS\SysWOW64\license.rtf

Filesize
28KB

MD5
b93d24fa2a3ae0d49fdc000560e36273

SHA1
6352f68705026b10722337d815af7cfdb0083cc2

SHA256
6b3644d7075c0572f40cdd0096c15bd4199d2e0cfade83d529fc3c24c8eaad4d

SHA512
3e261db072a2e5f35b2e453434e3542b80c8a3a46dedf9f47dbadc4be5a7b8f2fe7f467b62578663c3136de93b79e12d41f58fcedd1d738fbfd59da98e6b4c03

Download Submit
C:\WINDOWS\SysWOW64\mfc100.dll

Filesize
1.6MB

MD5
035032a953d0c625591cf8bbe33f1d4a

SHA1
5e6630b8073840b55be3e8e881b9d0ed5a6e35db

SHA256
aa5f464c84f8913be80984cf5d0b288daaf831a5d31a003660011617e2315557

SHA512
98f3c7fa09965a31e8e5d660818c48f046ef679ee4818a76b7c252a16a422a606deced9e2e2ee0be4a06c486f0de25c50699b5ad854d6989b036d0a5ac0e1261

Download Submit
C:\WINDOWS\SysWOW64\mfc100chs.dll

Filesize
62KB

MD5
892f85a037bbadd59f54cc8f7ad28db2

SHA1
d5127e14e5cbbd59ee21b7a73744078498e6c889

SHA256
2e49ba61b7fa926dc0b5e7b1f2ed779f71e68e38bf59060bb644b7e4bf50966a

SHA512
4a995d1c51f036dad3cc73985d9c51b6ed63dd23f74695529093e268b6bc4ff889341cd1268765e2d638092d13d3d9030fc54b326eb620b7682e848e5e96b0b5

Download Submit
C:\WINDOWS\SysWOW64\mfc100cht.dll

Filesize
62KB

MD5
65d475a683c6413d247deb0f36b8ac3a

SHA1
8d6f4be680f5c54b97d60ec0ca77a65bf4c2a656

SHA256
8535b5db1eae82af92e7617c716b5db6a34be82db54a45e76ac1e4ee737a746b

SHA512
6de7466ad1f86c9f52bb3df0c902edd9bef7ac9b5c155f2270c0621e05bbaf81aa77e2721a52b65ef1310fb644487e88cc919b1a06652dee7dc98478fe6c5552

Download Submit
C:\WINDOWS\SysWOW64\mfc100deu.dll

Filesize
90KB

MD5
254b920590097e66484caea4ab626585

SHA1
885c7e22e0b325365e61ce3adebef10e1cfbbb76

SHA256
144ce67fd5d9254c507dad001eebe4f8aebd18c8b84e9b7824e85d8fa75ca466

SHA512
b1b64831001b85b601920cc26d113392ec0c2b796b189791305db7f5cb9ab971ca3ec28e762924e5692011ee2b6633d3c6e483f7dc21631dbdf2d61f6822355b

Download Submit
C:\WINDOWS\SysWOW64\mfc100enu.dll

Filesize
81KB

MD5
35e426293239c157bcc76aea813deb86

SHA1
36efd5645e1e49cea9a3dadcb8d941fb9894c2ee

SHA256
49261cd634eb012ffe20138e9a88b35e96359297672198639cb23f120d641007

SHA512
ca04159984783c4b09883e280a94108ecccee4875c00f499ab80296a13a85314ec436e053d4c9bc9a7dd0631d6724307cc61e3261c68b673f03deb87aac8ce58

Download Submit
C:\WINDOWS\SysWOW64\mfc100esn.dll

Filesize
89KB

MD5
945c335913429e107f6b80ac2ba1b565

SHA1
059976fa0f01393971a7befcace9e6e097b6ee75

SHA256
2889aa0ecd9759da3fbc8900c940bb76f3bab0d3b60b1b91ac6ac41c90cc50fc

SHA512
744b20a46e013c27b7e10bfe88ec26d3e43fdc2d2a4663e00bcda8a7dbfe5f20f133f3662df767f0488888f8f3a0e5f2ade2685648ec5295e81b515d13ed4c64

Download Submit
C:\WINDOWS\SysWOW64\mfc100fra.dll

Filesize
90KB

MD5
c60c43c4d929ff3e210500ec59711d2a

SHA1
a1fb3d0e78a2faed3265d9e59bfbdfc8edfb5fde

SHA256
e6d205be7c9e843a706aa8aafc363a384af6b29c520ad6e293f9c7ec4186fdba

SHA512
be33be73d0ea3203eb4a122bbe0970932f9dd1604c962e82c03b0bd96d33fd0204451b4f135a8e6688cbf739ff987706b325e383af2c475f235e66b99bb02280

Download Submit
C:\WINDOWS\SysWOW64\mfc100ita.dll

Filesize
88KB

MD5
dc19ebe08b448e792e6741ec5c818d38

SHA1
c3570bc861ff7e994440d55f653cbaa728ac0834

SHA256
d0325536cc556e1989ec5876ebdb47d0ef47215c4613ba7b9231b8d0ea3144c5

SHA512
76f2595c9edf3124046f6000bde125779c808add563c734ada4316b9efa379f0deba4f0788811b232e502f27e7f24afb5cdeb3c9f8defc98c843dded8a4bcfee

Download Submit
C:\WINDOWS\SysWOW64\mfc100jpn.dll

Filesize
70KB

MD5
68bbea7bca98439e6170e5304d70046c

SHA1
cc64288fca720566a5cf1b76c1f060b940069a32

SHA256
3ac5d08e81148bf702560f611914959c66ccdef9d3cf03eebf3890522b363817

SHA512
cd0acbc859b18b36dd73a0358391119db2558c6dcb38046402adda8c6aa551522ee680fdb3bb0fbd092961f3d7b4475a1296b0405093bd2f1aaba7263c74d997

Download Submit
C:\WINDOWS\SysWOW64\mfc100kor.dll

Filesize
69KB

MD5
ef326e30ee5ef02445ea8780f9992047

SHA1
edd09886631ec898963b84574bc84e4b63e3c553

SHA256
b25bc18c84f2b03d8b6463da2433289a70d7e3da3487cbede28ac7395e8fef5e

SHA512
f7faf6d5dd9a49a4ec8e8b7187655c8ccb40655904284cd8f41f635a2278ea86eb0876d042a9bc98441be77819868c2433f2c1f752447e59c9325fd7285c9b8d

Download Submit
C:\WINDOWS\SysWOW64\mfc100rus.dll

Filesize
86KB

MD5
326ae147131b859bad5228548e4948a5

SHA1
ff70eb83af8f306c02890f62df535c2b6a190651

SHA256
c21421ea1a3f16a16b6bef2c48921b4bfdf21df84d3e5e8d908b2f83a71101fd

SHA512
3e1f05481d3923ac31ab48fde39bb8bdd3fd9189e007234130dc68805f92facb319b6e5e333729ac9157603de3109b930aa2a4391e85ae122256b30469193860

Download Submit
C:\WINDOWS\SysWOW64\mfc100u.dll

Filesize
2.6MB

MD5
d953506a289eababc626500bd48e5d78

SHA1
611e878e49d500c1df69eed4297a9bdf9e853946

SHA256
8e8646f128f60907347591a2af177a7ccc14340bfcb020ee228fad9810dc65a5

SHA512
5d0b829b6c39a40d93f3f861d2eb7eeda31b5dc84acf5bbed13395a0971830dd46969b99327296d3545d2e131fae7a1fff62cb478a6e39fc3312349e4be1dd7c

Download Submit
C:\WINDOWS\SysWOW64\mfc110.dll

Filesize
4.1MB

MD5
7a2ab98a1af8f70e53807ebc3b3bb63e

SHA1
674ef582a90d4af4279c34dabaf3ee71a9060123

SHA256
95955d05bc1f2c66707e77cb05ebe7df1071b3f9bc36f405e3091d5c2c989d43

SHA512
551d094952002eb010d1505a8aec83ed58ca4db6926d3597c7173c78ac0bd2c51b97d09362911dfc414692ab83d4feef4e3589781f370843b2d1174198e73ac3

Download Submit
C:\WINDOWS\SysWOW64\mfc110chs.dll

Filesize
100KB

MD5
9abbe2e798411a79665b49c08ecd4037

SHA1
9b1e20d03963b38b054ae03381a9a4cd22402c2b

SHA256
123bbcce74cd119054f7e95721339985a9e4524d37d006eb00be387c995f2e25

SHA512
89650e513987a01aed2f46e7a237b0548b142508a4b14a9ea43d5bc3a70d098f2a955bddb7f270c5ac8777fc8b156a3e476788f2b7a5dd3929ccff80ecf29944

Download Submit
C:\WINDOWS\SysWOW64\mfc110cht.dll

Filesize
72KB

MD5
a337190e892eead58816ac873a8e9d37

SHA1
3bc9fffa95227d9367479cd4107d2c41318f13f1

SHA256
b5df6e4fc8727000661f80c3b2516a2d4ea6d92788f0d8e94cb14886afb1dd30

SHA512
7a9fe0d376641e48d5e6cbf87aa52012defbe3a9ded90dbf6054e9f87a8c74757d2412eaf0bb591aff86f9cb2631b72ee855d01dd609f32f8ed777e9980a9ed9

Download Submit
C:\WINDOWS\SysWOW64\mfc110deu.dll

Filesize
100KB

MD5
ecf9f282c9d20112ed0fabed79acd417

SHA1
7fa9038d4e431c78f0771af81f6964e4466469db

SHA256
27d81eef1aeeaf490e570af7c9091bbbab00545d61acfafe2fac9753dda62713

SHA512
f04b5453a5e30b20959a7a5f8ab0331eed6fb4b190169b1aa879eaf771f9002230004d2794d83622eaea9906c5a5ee633a0311f0a5539d8ee9c36f62ae2a06de

Download Submit
C:\WINDOWS\SysWOW64\mfc110enu.dll

Filesize
91KB

MD5
fb41b0e4338c75b160c8556a60d03d26

SHA1
deefbbd097a4516aecdb55571021773bc6e09439

SHA256
d7d170575e5a5b573c2a7e767c6386c5267d5f6e16adfc5293c7e59f24a2b080

SHA512
ada55fb7ac04044f419290cc49a19fd5e5ff852f958d30e2353768f5886666aa110564b877660f7971af2654e07b84842d62420bc25a735dc9462841f21b69a6

Download Submit
C:\WINDOWS\SysWOW64\mfc110esn.dll

Filesize
127KB

MD5
5962b4dae45c4e964a8db2c10b446b08

SHA1
900cc6f4b7ce79b8b0f83ed4d5cc150a30d5fec4

SHA256
f6f8b6434f0f039f628945ab1796973ecb1472ee48169c9f0b82ded8e8fe03fe

SHA512
0b208b49cddd8b302df56aec93b27603109298d6846b3b80917762153d8a52f140ba0ed0af9982d729170018fc4bc138630debf61fb9018fc3dbf4bd33bdf7b8

Download Submit
C:\WINDOWS\SysWOW64\mfc110fra.dll

Filesize
128KB

MD5
a910ff135d600794b835b3137534eaba

SHA1
2812a8b6f031fc63134d8a41776a7d639358f540

SHA256
9e1700641757e53391af9bfc47ed4c62644af429a10555f705ce0328ae4aed82

SHA512
cb1e94a96714f3ed71d94213a20994e0b355a6308ea7a0fea7b987444ae5a8db87a9beb81cf1c26768d9d04340574e473996d3b4a4825001eacbc53789dcfdf5

Download Submit
C:\WINDOWS\SysWOW64\mfc110ita.dll

Filesize
126KB

MD5
2cf16d9ed703d64ff03b0e18ce27ed5f

SHA1
6469a800e4607cd3e86ebad568f6cd1c94ee0930

SHA256
f60a0338941e2aab3980a234810e90dc8aaf0ac6910552f043f3fb711f9e51f0

SHA512
a54b82f4040f2ad43a747fdf207f481d8c627e556abb6ca6e7e87d137dd4f772810308407da1b5bc65ffefcd1fdaee5b10e9ec00003b33755bec0dad43d4a9a4

Download Submit
C:\WINDOWS\SysWOW64\mfc110jpn.dll

Filesize
107KB

MD5
fee04229f59b1e536e34322da887dd9b

SHA1
03f70af32e6774d84cfad2aa4a081a99204bbccc

SHA256
0c72c2c6685c0dfce80ee1a980f53e8a5c80265604a62d99e89a8ba8aaa93d20

SHA512
538baa476563cd42eb37c728b9c5ee5d09c672c8fd7ee0ccd33815eeff1f82ec9912a7488cd5f2c932858a84927d2b90c7fceed1070a33bd94b0af807d705711

Download Submit
C:\WINDOWS\SysWOW64\mfc110kor.dll

Filesize
107KB

MD5
2e1801499a439074bc826ff9dabbfcc4

SHA1
e8110667361179682ea6ff6f7445f57fa0ce2c5e

SHA256
11e86a3106218a3ca52dcc7fe901bd862a19743b67b0bf1334ec60e7d0c8bf58

SHA512
9f5bde775ae936652fb5dc5d1173c59e3e8d39423d17c78b50a4d41f70764b3b0a76b607cddb999a16bf12eb1828c87969aaca01cffd66ec9f8486c58ff36f3c

Download Submit
C:\WINDOWS\SysWOW64\mfc110rus.dll

Filesize
124KB

MD5
a5774a3d15b760090d0737b74f960132

SHA1
f72d7a84691a00a2e93ff4cb16be4d8166622230

SHA256
7da0895cc667e5cba16d30bdd669a4259aa6435d524f125d489dda1b4315ef04

SHA512
656551a198d74cb8d95f6e411706589a063eae252dbda58d469f5f5d6aad8ee1fe3681ae0ad4c2b8e252d40a6a1d6c18e29f843aacf7c688e9b46e4593957f3b

Download Submit
C:\WINDOWS\SysWOW64\mfc110u.dll

Filesize
3.4MB

MD5
a35426981cc8f4328676fb0eac23537b

SHA1
87d19190729819fd027719c71d2e657b3ecdf151

SHA256
b1742f0d0327f7160a8a60b7faf4b5c1ba4e3383410e2fbd1dc736e0acbdca94

SHA512
e0b92f71cf8874f841a593f9a0390c833c05de8622f9ac5b332a752f818f81658cae9eeeb3900a398a27ded941120d37b851481e2a2426d46b2b4a2cdfd8bb32

Download Submit
C:\WINDOWS\SysWOW64\mfc120.dll

Filesize
3.6MB

MD5
a968ca798400a327deddebd989d6d87b

SHA1
098e9f04b327b376ed56a8863b108e934704c7e1

SHA256
b4e29ed293b8479751261f82d0a89bf4939245f3076b6eb88df67d7ec9f000f5

SHA512
ccb470709cdf57aa090c1eeb2b92b167bab4799263c3741a6e0b9e84ee5fe4b1dff37f45e1821b61c11f346562c00b67b6a6c8af36f79d2ef6355ff8c9869898

Download Submit
C:\WINDOWS\SysWOW64\mfc120chs.dll

Filesize
100KB

MD5
f6c26b30623f3dd3b6c5cd4571cf1b2a

SHA1
e72c71860d9173338f2144725cfca98d1b32b4ef

SHA256
87f0d52fca01df2ad4d9a0968261b2621ab560a997d2da5612f0e28b352d09b3

SHA512
831bbae73b6f3160a08ae26c246a7e20b790a67a25f639d2840a20c1b14f8cd55fdde8d439070f578b4f24ea4e866741a2f3297f31802cf585655c78b805da0d

Download Submit
C:\WINDOWS\SysWOW64\mfc120cht.dll

Filesize
72KB

MD5
4a9ab788176c01fa2569b634bc554c59

SHA1
82ba0353790d7f7476e0819fd0301d825f7e7b5a

SHA256
7dd2d416c36b759b01e1b78fadaf24653b5e855158ab5f695d248e6aaf0f3dfd

SHA512
0a4d43950581bb24fae1acdea18dcbebc444ea1a6665b8ea1b6bba64413490390dba4cefe2fbb37c4c2956f5603b0248e487eb36693e7e14e7d50a4db699c5f7

Download Submit
C:\WINDOWS\SysWOW64\mfc120deu.dll

Filesize
100KB

MD5
846e6eb62cb98cc429c2c6990383a6eb

SHA1
2c826bf891ca396b0f86c10dd2443236b5e8bd16

SHA256
d464fa2a5d597729b8ec7ea554699c89e08110c373f1d48ca9813ab2078c82f3

SHA512
56a520fb4c2a61fcf4401783db0221823c41ca264cf05b86aebaf251c0635a303c409f05b3329252727a5f5191c57427bbbafd9908b1eb65742d9218548a1ba1

Download Submit
C:\WINDOWS\SysWOW64\mfc120enu.dll

Filesize
91KB

MD5
ecb1335729181b0351329305b0bf4370

SHA1
bbe8dc8348acd935b8aae6ae627b3fb6cfe3e9f0

SHA256
7d29d3420cb2eec2b88daa02887ec4e2d8616401a6755d1d2163d32cee81d87b

SHA512
bc9cfd39332414c9e2fccf94451b4529a21577e2d0812c6812eb47ce784d8b342d20ff37c91dceb04e3362bf38c7aacafd1129d5b829c6b4cc32d4a9cb66aca3

Download Submit
C:\WINDOWS\SysWOW64\mfc120esn.dll

Filesize
99KB

MD5
1a4fe2603c5a6f93d0c6dd0c85f303b4

SHA1
33de4fe854ea55ff3633ae299b4518a32e0fb382

SHA256
0808bb93fb927df2ba634e0439aadfb37ebf84f848f1bc972cac315e8d00f321

SHA512
67f83bb24e634cdd9b0e330276b4eb9da97c9734a2db45003ed222cd6653c20b5834f092c8bea42808988a49fd81c06503bc81354f163fa97fb55fafb662a436

Download Submit
C:\WINDOWS\SysWOW64\mfc120fra.dll

Filesize
100KB

MD5
8b0bab6b1d2c8cbbfc22b64bbf08b02f

SHA1
27b42f7b584831e9e31e19dff89b8f509156d1ee

SHA256
e307c6b1404d84dc28b05765f8a2eb19bd26e64ea1cb758606d0dec0197346ef

SHA512
f431306a651e3b70c18ab5924f7ab25460c17c039eb27ebcf368b32d78c507307757e512c808d364337392ab9415f5cae2562904964e684209b7edfd090bffb0

Download Submit
C:\WINDOWS\SysWOW64\mfc120ita.dll

Filesize
98KB

MD5
1795701c2c1052a46e76fe09df0cf23e

SHA1
2661d2f2f2fe28cf071c2c9085909ea956e5c759

SHA256
9b6e714499dab4a369719407d2bb4768db30abe3a0167a719000ec5728758a74

SHA512
52455360d5d19f44effd9883b81a3b74e4028b210a80a8fdb0568cb383456030caf04f569bf4f633675f7f0b4c729144580c0e2974c37f090e375f52736889fa

Download Submit
C:\WINDOWS\SysWOW64\mfc120jpn.dll

Filesize
80KB

MD5
5f6fe38b0c48a6d7c5861fcccda73144

SHA1
6372793a8ae8207383e3551567fe9ce5359ed2b7

SHA256
c73f0eaaadc651ff43bb8afe01740553683e4db71d323afbbe126182a379cc84

SHA512
7dac6beb876696797e2c001bcf9259856f8306db1e2d15107028720d56037507402ba8bb58c6ebfbc26e22a06995ec0512b5070335c4f360367d483c9166c995

Download Submit
C:\WINDOWS\SysWOW64\mfc120kor.dll

Filesize
79KB

MD5
6f99fa7211f07f39f308afea769d17b1

SHA1
4894ce8913fb79a3579976995d7b4c4ddd49fe33

SHA256
18e5513fd36026285ea9eaa4b62f0a3dc855b307be873fde15b1f39859234f81

SHA512
9081ec760f80dd75bac0c3ac821a835cee998d85632c486161078d823c16c69c4414c39b3717688eebe655f50ec6fe6a2fbc022fd8034ed6937fe42101a87fe0

Download Submit
C:\WINDOWS\SysWOW64\mfc120rus.dll

Filesize
96KB

MD5
36f63db2acca95280534f8e24f1d9e7e

SHA1
286caa6f04ca7168060a752a2e86ae201a3969dd

SHA256
18c25d0caa5ba2949825a2be233d67e66e9120445b8936fb7335f96dc5ab8489

SHA512
c961cf2d2c9e7698a6a754e92ef7eaf456e77c8690e112ab023018859104b728147129aa7be237e9cfbeffc4ba99963a5fb7f3f720d867155d5b5875b58cc6e4

Download Submit
C:\WINDOWS\SysWOW64\mfc120u.dll

Filesize
2.4MB

MD5
90d281d5ba5d4d4a4aadeefa90621c20

SHA1
8cf27e93aaa50ed8dbe635cfce1ad0cb126ab782

SHA256
cbe6ed38c9c47b0b9db2d4c92101533a1c2d3402c661a8bfa1fd04f2b12b28db

SHA512
6a8c613df79e3b22e006a80648f43c71b6fda64d57be515d2c0c3017ae44fb5aa332cc93a5a004f2e7077a9ea336c2286d8bb2f5ea1886f48d91a5db1feaf11a

Download Submit
C:\WINDOWS\SysWOW64\mfc140.dll

Filesize
3.4MB

MD5
6f3ba607edfc639aeb7b35325432073b

SHA1
a2dd2e44e7d7b89426eb09203941fa43dafd1d77

SHA256
08bfd6d9090718829addcb52e53d4978f4412561c8b0574078a42b23ab2c542d

SHA512
900b850a1e0e1e3e1afd37d2af08e8e43f47422c0d0c0fe79dc32c44f4f9bbc781f03de2d3f24a8d7a776464462c204c8309191daaed0124ec7e6e4d81c9ad6c

Download Submit
C:\WINDOWS\SysWOW64\mfc140chs.dll

Filesize
66KB

MD5
50eba27bbf38081851607dbc5cbab400

SHA1
0064127344a5561ac8cccd7de4785d7f065cc556

SHA256
ab77afbc13c4673302f87d33b39dc4437685446c2ed6c719a1992a2842e5f1aa

SHA512
de4e9aa1e18db09757ff81b95463be2a7896c96d4462e078f4bf40521fe3fdb092955dde589dc64744eb0613f6e7e3e925b326a2a693a3d5316b558f7aab4f34

Download Submit
C:\WINDOWS\SysWOW64\mfc140cht.dll

Filesize
94KB

MD5
5fcde7afca70f869e04320dd26cfa623

SHA1
ad254966c3b9ea702fd86d2deec32cb65cf3f2b8

SHA256
35edaac0e9a8e5adbd341fd53c5aa570eff1657ed8755cf18ce4bd2669a01a08

SHA512
17d765bd26d45bc3bd73bde24f314fa198a6c8f4cea378273d75cfef528e6bfcb16418b40c72cb39592dbd3db79b561b68cf675a7ae82f26cfd1b012ab6d2460

Download Submit
C:\WINDOWS\SysWOW64\mfc140deu.dll

Filesize
94KB

MD5
409564292eaf3c7da1036820ee8945e9

SHA1
e55c0331ecb75eac00454be59b894b2481e97aa4

SHA256
0866da60796233ebddf63853bbd2c3d4b3d5ac0f8a5201771d38329504786d04

SHA512
c7ada1391ee85d0a038a2616d330fce78cdb2cf7b7084e4c159c64868a1d9e966adbab99147a6038af3385a2857b35496d81b4263af3ca59397897eaba05f3de

Download Submit
C:\WINDOWS\SysWOW64\mfc140enu.dll

Filesize
112KB

MD5
5942306b7c952b61743a71c1459b6cb6

SHA1
a98dc05b9da0318af37036466117dc9c3817a42d

SHA256
ba249a7df3a93cc75450598a7ac8f3f7a5a1ab46028b5bfa88a85c6e6ba89706

SHA512
a09123a1f0f2bdfb7c0c4aa27324508b2cb5b96a9b008b81a8dfd6803c79fc6e06b6eeb1de362a33d5e936597ca5f3e536ff49f194b5afa7314426f6233d44f5

Download Submit
C:\WINDOWS\SysWOW64\mfc140esn.dll

Filesize
121KB

MD5
8fe2cb090c1e48e1b914cbd9195d89e5

SHA1
e5e5ddbf3af6c21969c227002efb597b4c2105d9

SHA256
124b97d31bc5a12819a14ec08f38bd1df9536997dccb2bd69b9b1058b2735990

SHA512
e4c6e51e75634b6c6e49cb9bd116017ba7c04001aa5e56b4d0a8a1d29faa29bf9dc70866d1c9ff1f25783a640e6e39c3fad92c928616af960213e31eb4d66209

Download Submit
C:\WINDOWS\SysWOW64\mfc140fra.dll

Filesize
122KB

MD5
8c94c50082f416c0c5c94ee601d14415

SHA1
ed8cb04c0b5e1c3d8024afa8e13fe5ba1915890f

SHA256
ab19fa072c97332e0c342bd81380577d75c516798a675ac718be55e27491aeaf

SHA512
f2571b38489860cf09c827b6265944dfe6ae3efa23389c096ef5374ea5a0259c3da77f016ea6eabb410732814002dd5d49fb54fb2554bdfb3694438587bea630

Download Submit
C:\WINDOWS\SysWOW64\mfc140ita.dll

Filesize
120KB

MD5
14efebc05c1df5028ea3b0e688349a96

SHA1
2f703810b6dd65e4570bcde9b4fdd222d69627ef

SHA256
91066d42043a0ee66c7a9169b0f910a2d872607e1ad457aa1bca32b21fd36b61

SHA512
3fbf776188f0c3469ceade0bb6336604e380454c17c8728b3567de61856651825acaf46298cba43f7b5be6bc50e881c7f7214eba6261d64ede241668a1780c5f

Download Submit
C:\WINDOWS\SysWOW64\mfc140jpn.dll

Filesize
102KB

MD5
99a851bcb778548bb4a639331abd3046

SHA1
828a1d69806fdc9883371091712ae450426e3e7b

SHA256
3e4e60080be2411e1f462b6702ed00892b98b61a54b71b1dbf49b13ab6a88059

SHA512
f571342a3cb0af84fbc3fddcf065405eea4b50826489059d1bd32e237a2a53eb33d4f02031d6e91ffe7b97aa549d2eeb28b46b82a920dc8f54241511f9bc0c2f

Download Submit
C:\WINDOWS\SysWOW64\mfc140kor.dll

Filesize
101KB

MD5
aca86a83923891ca2c693d276ad42efc

SHA1
81e1daa20eefd94d0c2cc83dbd2ff4514898dd98

SHA256
33179fed06c6ad30e58e1a68ac0f933d63b0654ea8eed5199e347b1464f4c474

SHA512
9a054b9c09613b60af9fcc3e5d05c9a544c343d0f66c850da63b10318c517847981e65a1b343062213e9520d88536931cb9562612987fbff08145d907c692bb4

Download Submit
C:\WINDOWS\SysWOW64\mfc140rus.dll

Filesize
118KB

MD5
80f7800fb6680562d5e09797f6afdbaa

SHA1
eefa703fbb7f2c35a266607471d4ba36b181f9bc

SHA256
8995b210020a1b367e396388a64bfd4ec636bbe2e470eb55e5e4c8fc53ae2551

SHA512
cf3931e7f44d334074711805d76e7eff9888b1f14c16c65e1d483ebc07c6be61544308ecef2cedbb43af2c2386e61fa3148dc12525e2d7e62afd77a2f25c0720

Download Submit
C:\WINDOWS\SysWOW64\mfc140u.dll

Filesize
2.4MB

MD5
b611723b70e684ddfd0b074bd8bac93d

SHA1
e16d9a915c4368de2e4159a31f7f24cf174ff3b6

SHA256
d8c335e55ada45aabfd26ac6347701d359a777ee69d3356d14b9e7014f5b926e

SHA512
e92720e415c2cd8a696c59bab5010178d75731521f5f3a226a290fcb8f543ea10b7e431c82c2077ec07541b3d5c3ee3847481d38ca3e42666cb1426bb9f31fe7

Download Submit
C:\WINDOWS\SysWOW64\mfcm100.dll

Filesize
107KB

MD5
c486d28e694830afd0b707e8b92b712d

SHA1
8b78c97c7145505c7451b2041e22336c4c027e27

SHA256
61f2f520625d1240cffd3867d3d0789ced6956508b7476cb93e7fc0cc01d53c9

SHA512
163edfaf7bde563d50528a6c1610226a13f0df9c4d4270a0d441b212de34ee89dd049bdeb4628078d88476e655826acbf04cab7eeb00768b66029e4f68c18308

Download Submit
C:\WINDOWS\SysWOW64\mfcm100u.dll

Filesize
107KB

MD5
dbdb7402f83e8cbf3d0683df4f703ffb

SHA1
26ff4057276979df839c5c9b56f062dc302f799c

SHA256
cca33664d662778659951c134fd1d51dd966f1982dd0eb2c6c76cf7f72f2fb8e

SHA512
8baa3227f62f986d90fd8eaaeede428aa74bbbca957414206dea3ae9605ec5cc39bbf3cd32ad0ecd47b876e940e6f0acfeaaa19c811bef742e97575512fafa17

Download Submit
C:\WINDOWS\SysmonDrv.sys

Filesize
193KB

MD5
30aab5fe06b3c0267fdcfccd1ea6c389

SHA1
73aa86b52fe921217b2951bf6e46fb4935963478

SHA256
0a9944296f8e38e20a455f5d755dbe1b3c28bb391f0ba700188f7500c2d5d095

SHA512
e8738b1b9b8a6fb0bcea1c28d6fb07e6f63e337aa1aea5c1708e7ce3172b4f720b8e461d1f24bac9bbd0388d01709a497d6eb3a7c1110b055688e82f62227f3f

Download Submit
C:\WINDOWS\WindowsUpdate.log

Filesize
55KB

MD5
d85d92f4fe345144a546ad52b121f299

SHA1
548bf57f6ca4d76e79be0b9579a9c643b46603c1

SHA256
e740bc3e00a406441e419e0bea182774a36c7aaf2be4abc42c6cc2506270dba7

SHA512
c280491c1146cb634e37f4c0c274c3e59be511d2af29c86a05e883ff5ef4c3a04d9effdc393913914d85fd754c8502170af5b0f95c6af9de18c4c5fd08270189

Download Submit
C:\WINDOWS\lsasetup.log

Filesize
56KB

MD5
3a33ad5d590e1af850e717b73703b9c6

SHA1
3a998bf98b62855fea59ec9bff86a4da765f32a7

SHA256
d2a95b6f55f8003820623be7af938bae1a1eb73006da1ce3e18594f0e2213e8e

SHA512
2686ca59790fa83afa9f853cb3fe4c52c8a1458de84a4c06fa40f70bd15df4259035734d8f0dee7f71d7782741bc4f06c2610549c7aef56ff8e93103f1d68ce1

Download Submit
C:\WINDOWS\system.ini

Filesize
55KB

MD5
0dedd454397647f4b2cf06dbea315c75

SHA1
3024af07bde685ab90e3b08d31389457c8e112a0

SHA256
21963e21b549a620bcceabe9d238fe3c1fd1307149a71cdf53994a35a72e5b21

SHA512
495088b7f7306ea209bad18f70329b45cfee3fdbf52d52fcc7ae7db4d4ae735aaaf2deefb517d42afccd8cf4d6d96015b6fcc0030223a4fc869e4420229dfe2f

Download Submit
C:\WINDOWS\win.ini

Filesize
55KB

MD5
af403d19d6c67747b93422be55a769db

SHA1
790bebfcf7ad32669b657f92074fcb4863ea5e82

SHA256
aaac598db518557b6f22db3a7cb570ea2aae9dc482050b0bb05ba79217549ffe

SHA512
692d15ad3c9694d945fefca72af10576d7b0d7526e224c224f9f0d2ecc4017373b4184972966bc7b54835b6ab1315fb99e1d54f357fca083cad8a826fcf607ff

Download Submit
C:\exc.exe

Filesize
306KB

MD5
94715fc51a6235da8b2ce0dd100f0513

SHA1
576fce77f2572c46ffedcd0fd69f7a2293ff52dd

SHA256
a761ff8d291e11d09db0d21ddb834407e42521776520f8421924d22691bea98c

SHA512
d685fca58f7670c26b8529903735266191c0c91c34d17f791093688ceb4d7aad095b2073455c3d2d2f11ffe497add00f6d7be8b010600d1e49d51f2372563053

Download Submit
memory/3140-1499-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/3140-46-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/3140-0-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/3140-1033-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/3140-275-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/3140-9-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/3140-931-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/4936-276-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/4936-1500-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/4936-582-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/4936-248-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/4936-10-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/4936-932-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/4936-1034-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download