80f6adeff8ff98ba5a79e03d03858124102cb2f684913f966792a18882b1fd4e

Analysis

max time kernel
145s
max time network
128s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
28/03/2024, 20:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0f97b58c7db709747d0b13b81ba6a59a_JaffaCakes118.exe
Size

389KB
MD5

0f97b58c7db709747d0b13b81ba6a59a
SHA1

5904dffcaf53f9731ddbd46a2632485b1d83b4ff
SHA256

80f6adeff8ff98ba5a79e03d03858124102cb2f684913f966792a18882b1fd4e
SHA512

7bb099dc5f5b846a01ab35e47b4a39fe9da1506baf33ad5b52a8d33159e669a7b8c194eec85e473a34b1420791f03708c63a6b44eb9726ce3931e3036424ee0f
SSDEEP

1536:txft5uxft5jxft5uxft5lxft5GwtP5N8g4iFEYDRwZk8jc:v15a15115a15n15Gwhag4iE4oI

Score

8^/10

upx

Malware Config

Signatures

Drops file in Drivers directory 6 IoCs

description	ioc	Process
File created	C:\WINDOWS\SysWOW64\drivers\gm.dls	exc.exe
File created	C:\WINDOWS\SysWOW64\drivers\gmreadme.txt	0f97b58c7db709747d0b13b81ba6a59a_JaffaCakes118.exe
File created	C:\WINDOWS\SysWOW64\drivers\gmreadme.txt	exc.exe
File created	C:\WINDOWS\SysWOW64\drivers\afunix.sys	exc.exe
File created	C:\WINDOWS\SysWOW64\drivers\afunix.sys	0f97b58c7db709747d0b13b81ba6a59a_JaffaCakes118.exe
File created	C:\WINDOWS\SysWOW64\drivers\gm.dls	0f97b58c7db709747d0b13b81ba6a59a_JaffaCakes118.exe

Manipulates Digital Signatures 2 IoCs

Attackers can apply techniques such as modifying certain DLL exports to make their binary seem valid.

description	ioc	Process
File created	C:\WINDOWS\SysWOW64\wintrust.dll	exc.exe
File created	C:\WINDOWS\SysWOW64\wintrust.dll	0f97b58c7db709747d0b13b81ba6a59a_JaffaCakes118.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\Control Panel\International\Geo\Nation	0f97b58c7db709747d0b13b81ba6a59a_JaffaCakes118.exe

Executes dropped EXE 1 IoCs

pid	Process
1008	exc.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/5092-0-0x0000000000400000-0x000000000040A000-memory.dmp	upx
behavioral2/files/0x000700000002301d-5.dat	upx
behavioral2/memory/5092-9-0x0000000000400000-0x000000000040A000-memory.dmp	upx
behavioral2/memory/1008-10-0x0000000000400000-0x000000000040A000-memory.dmp	upx
behavioral2/files/0x0001000000009e5e-21.dat	upx
behavioral2/files/0x000300000001d8b9-23.dat	upx
behavioral2/files/0x000100000001db15-29.dat	upx
behavioral2/files/0x000100000001db16-31.dat	upx
behavioral2/files/0x0001000000009e66-37.dat	upx
behavioral2/files/0x000300000001db4e-39.dat	upx
behavioral2/files/0x0001000000009e63-35.dat	upx
behavioral2/files/0x00050000000006bd-33.dat	upx
behavioral2/files/0x0003000000016214-25.dat	upx
behavioral2/files/0x000100000000aee7-27.dat	upx
behavioral2/files/0x000300000001e7bf-41.dat	upx
behavioral2/files/0x000700000001e600-45.dat	upx
behavioral2/files/0x000300000001e8d7-48.dat	upx
behavioral2/files/0x000100000000c0ba-50.dat	upx
behavioral2/files/0x000300000001e7c0-58.dat	upx
behavioral2/files/0x000300000001e7c5-72.dat	upx
behavioral2/files/0x000300000001e7c4-69.dat	upx
behavioral2/files/0x000300000001e7c3-67.dat	upx
behavioral2/files/0x000300000001e7c6-76.dat	upx
behavioral2/files/0x000300000001e7cb-90.dat	upx
behavioral2/files/0x000300000001e7ca-88.dat	upx
behavioral2/files/0x000300000001e7c9-86.dat	upx
behavioral2/files/0x000300000001e7c8-82.dat	upx
behavioral2/files/0x000300000001e7c7-79.dat	upx
behavioral2/files/0x000300000001e7c2-64.dat	upx
behavioral2/files/0x000300000001e7c1-62.dat	upx
behavioral2/files/0x000500000001e6e9-128.dat	upx
behavioral2/files/0x000800000001e865-141.dat	upx
behavioral2/files/0x000300000001e899-162.dat	upx
behavioral2/files/0x000300000001e89a-166.dat	upx
behavioral2/files/0x000300000001e8ef-204.dat	upx
behavioral2/files/0x000300000001e8ee-201.dat	upx
behavioral2/files/0x000300000001e8ed-199.dat	upx
behavioral2/files/0x000300000001e8ec-196.dat	upx
behavioral2/files/0x000300000001e8eb-193.dat	upx
behavioral2/files/0x000300000001e8ea-190.dat	upx
behavioral2/files/0x000300000001e8e9-186.dat	upx
behavioral2/files/0x000300000001e8e8-184.dat	upx
behavioral2/files/0x000300000001e8e7-179.dat	upx
behavioral2/files/0x000300000001e8e6-177.dat	upx
behavioral2/files/0x000300000001e8e5-175.dat	upx
behavioral2/files/0x000300000001e8e4-173.dat	upx
behavioral2/files/0x000500000001e898-160.dat	upx
behavioral2/files/0x000600000001e86e-158.dat	upx
behavioral2/files/0x000600000001e86d-156.dat	upx
behavioral2/files/0x000700000001e86c-154.dat	upx
behavioral2/files/0x000400000001e86b-150.dat	upx
behavioral2/files/0x000400000001e869-147.dat	upx
behavioral2/files/0x000700000001e866-143.dat	upx
behavioral2/files/0x000800000001e864-138.dat	upx
behavioral2/files/0x000800000001e862-132.dat	upx
behavioral2/files/0x000500000001e6e8-126.dat	upx
behavioral2/files/0x000600000001e6dc-123.dat	upx
behavioral2/files/0x000500000001e6db-121.dat	upx
behavioral2/files/0x000500000001e6d9-119.dat	upx
behavioral2/files/0x000500000001e6d8-116.dat	upx
behavioral2/files/0x000500000001e6d7-112.dat	upx
behavioral2/files/0x000500000001e6d6-109.dat	upx
behavioral2/files/0x000600000001e6d5-106.dat	upx
behavioral2/files/0x000600000001e6d4-103.dat	upx

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\WINDOWS\SysWOW64\KBDRU1.DLL	exc.exe
File opened for modification	C:\WINDOWS\SysWOW64\mfc140esn.dll	0f97b58c7db709747d0b13b81ba6a59a_JaffaCakes118.exe
File created	C:\WINDOWS\SysWOW64\tquery.dll	0f97b58c7db709747d0b13b81ba6a59a_JaffaCakes118.exe
File created	C:\WINDOWS\SysWOW64\Windows.System.Diagnostics.Telemetry.PlatformTelemetryClient.dll	exc.exe
File created	C:\WINDOWS\SysWOW64\AcGenral.dll	exc.exe
File created	C:\WINDOWS\SysWOW64\hh.exe	exc.exe
File created	C:\WINDOWS\SysWOW64\dxtrans.dll	0f97b58c7db709747d0b13b81ba6a59a_JaffaCakes118.exe
File created	C:\WINDOWS\SysWOW64\eapputil.dll	exc.exe
File created	C:\WINDOWS\SysWOW64\FWPUCLNT.DLL	0f97b58c7db709747d0b13b81ba6a59a_JaffaCakes118.exe
File created	C:\WINDOWS\SysWOW64\ole2.dll	exc.exe
File created	C:\WINDOWS\SysWOW64\onex.dll	exc.exe
File created	C:\WINDOWS\SysWOW64\rtutils.dll	0f97b58c7db709747d0b13b81ba6a59a_JaffaCakes118.exe
File created	C:\WINDOWS\SysWOW64\AppLockerCSP.dll	exc.exe
File created	C:\WINDOWS\SysWOW64\catsrvps.dll	0f97b58c7db709747d0b13b81ba6a59a_JaffaCakes118.exe
File created	C:\WINDOWS\SysWOW64\tasklist.exe	0f97b58c7db709747d0b13b81ba6a59a_JaffaCakes118.exe
File created	C:\WINDOWS\SysWOW64\winusb.dll	exc.exe
File created	C:\WINDOWS\SysWOW64\KBDGN.DLL	exc.exe
File created	C:\WINDOWS\SysWOW64\NcdProp.dll	exc.exe
File created	C:\WINDOWS\SysWOW64\certlm.msc	0f97b58c7db709747d0b13b81ba6a59a_JaffaCakes118.exe
File created	C:\WINDOWS\SysWOW64\gdi32.dll	0f97b58c7db709747d0b13b81ba6a59a_JaffaCakes118.exe
File created	C:\WINDOWS\SysWOW64\provplatformdesktop.dll	exc.exe
File created	C:\WINDOWS\SysWOW64\Windows.Management.Workplace.WorkplaceSettings.dll	exc.exe
File created	C:\WINDOWS\SysWOW64\AuthFWWizFwk.dll	0f97b58c7db709747d0b13b81ba6a59a_JaffaCakes118.exe
File created	C:\WINDOWS\SysWOW64\InkObjCore.dll	0f97b58c7db709747d0b13b81ba6a59a_JaffaCakes118.exe
File created	C:\WINDOWS\SysWOW64\iac25_32.ax	exc.exe
File created	C:\WINDOWS\SysWOW64\msisip.dll	0f97b58c7db709747d0b13b81ba6a59a_JaffaCakes118.exe
File created	C:\WINDOWS\SysWOW64\msxml6r.dll	0f97b58c7db709747d0b13b81ba6a59a_JaffaCakes118.exe
File created	C:\WINDOWS\SysWOW64\mtxoci.dll	0f97b58c7db709747d0b13b81ba6a59a_JaffaCakes118.exe
File created	C:\WINDOWS\SysWOW64\framedynos.dll	exc.exe
File created	C:\WINDOWS\SysWOW64\hlink.dll	0f97b58c7db709747d0b13b81ba6a59a_JaffaCakes118.exe
File created	C:\WINDOWS\SysWOW64\InstallService.dll	exc.exe
File created	C:\WINDOWS\SysWOW64\main.cpl	0f97b58c7db709747d0b13b81ba6a59a_JaffaCakes118.exe
File created	C:\WINDOWS\SysWOW64\msasn1.dll	0f97b58c7db709747d0b13b81ba6a59a_JaffaCakes118.exe
File created	C:\WINDOWS\SysWOW64\ngcksp.dll	exc.exe
File created	C:\WINDOWS\SysWOW64\onexui.dll	exc.exe
File created	C:\WINDOWS\SysWOW64\TapiUnattend.exe	exc.exe
File created	C:\WINDOWS\SysWOW64\feclient.dll	exc.exe
File created	C:\WINDOWS\SysWOW64\fwpolicyiomgr.dll	0f97b58c7db709747d0b13b81ba6a59a_JaffaCakes118.exe
File created	C:\WINDOWS\SysWOW64\useractivitybroker.dll	0f97b58c7db709747d0b13b81ba6a59a_JaffaCakes118.exe
File created	C:\WINDOWS\SysWOW64\WMADMOD.DLL	exc.exe
File created	C:\WINDOWS\SysWOW64\ActiveSyncProvider.dll	0f97b58c7db709747d0b13b81ba6a59a_JaffaCakes118.exe
File created	C:\WINDOWS\SysWOW64\ncpa.cpl	0f97b58c7db709747d0b13b81ba6a59a_JaffaCakes118.exe
File created	C:\WINDOWS\SysWOW64\comdlg32.dll	0f97b58c7db709747d0b13b81ba6a59a_JaffaCakes118.exe
File created	C:\WINDOWS\SysWOW64\CloudExperienceHostUser.dll	exc.exe
File created	C:\WINDOWS\SysWOW64\dispex.dll	exc.exe
File created	C:\WINDOWS\SysWOW64\gptext.dll	0f97b58c7db709747d0b13b81ba6a59a_JaffaCakes118.exe
File created	C:\WINDOWS\SysWOW64\rekeywiz.exe	0f97b58c7db709747d0b13b81ba6a59a_JaffaCakes118.exe
File created	C:\WINDOWS\SysWOW64\Windows.Security.Integrity.dll	exc.exe
File created	C:\WINDOWS\SysWOW64\boot.sdi	0f97b58c7db709747d0b13b81ba6a59a_JaffaCakes118.exe
File created	C:\WINDOWS\SysWOW64\certmgr.dll	exc.exe
File created	C:\WINDOWS\SysWOW64\hcproviders.dll	exc.exe
File created	C:\WINDOWS\SysWOW64\InstallService.dll	0f97b58c7db709747d0b13b81ba6a59a_JaffaCakes118.exe
File created	C:\WINDOWS\SysWOW64\KBDDA.DLL	0f97b58c7db709747d0b13b81ba6a59a_JaffaCakes118.exe
File created	C:\WINDOWS\SysWOW64\MSHEIF.dll	exc.exe
File created	C:\WINDOWS\SysWOW64\msvproc.dll	0f97b58c7db709747d0b13b81ba6a59a_JaffaCakes118.exe
File created	C:\WINDOWS\SysWOW64\srm_ps.dll	0f97b58c7db709747d0b13b81ba6a59a_JaffaCakes118.exe
File created	C:\WINDOWS\SysWOW64\findnetprinters.dll	exc.exe
File created	C:\WINDOWS\SysWOW64\gamingtcui.dll	exc.exe
File created	C:\WINDOWS\SysWOW64\kerberos.dll	0f97b58c7db709747d0b13b81ba6a59a_JaffaCakes118.exe
File created	C:\WINDOWS\SysWOW64\LockAppBroker.dll	0f97b58c7db709747d0b13b81ba6a59a_JaffaCakes118.exe
File created	C:\WINDOWS\SysWOW64\mprdim.dll	exc.exe
File created	C:\WINDOWS\SysWOW64\rtmcodecs.dll	0f97b58c7db709747d0b13b81ba6a59a_JaffaCakes118.exe
File created	C:\WINDOWS\SysWOW64\setx.exe	0f97b58c7db709747d0b13b81ba6a59a_JaffaCakes118.exe
File created	C:\WINDOWS\SysWOW64\weretw.dll	0f97b58c7db709747d0b13b81ba6a59a_JaffaCakes118.exe

Drops file in Windows directory 44 IoCs

description	ioc	Process
File created	C:\WINDOWS\mib.bin	0f97b58c7db709747d0b13b81ba6a59a_JaffaCakes118.exe
File opened for modification	C:\WINDOWS\setuperr.log	0f97b58c7db709747d0b13b81ba6a59a_JaffaCakes118.exe
File created	C:\WINDOWS\write.exe	0f97b58c7db709747d0b13b81ba6a59a_JaffaCakes118.exe
File created	C:\WINDOWS\notepad.exe	exc.exe
File opened for modification	C:\WINDOWS\PFRO.log	exc.exe
File opened for modification	C:\WINDOWS\setupact.log	exc.exe
File opened for modification	C:\WINDOWS\WindowsUpdate.log	exc.exe
File created	C:\WINDOWS\bfsvc.exe	0f97b58c7db709747d0b13b81ba6a59a_JaffaCakes118.exe
File created	C:\WINDOWS\HelpPane.exe	0f97b58c7db709747d0b13b81ba6a59a_JaffaCakes118.exe
File opened for modification	C:\WINDOWS\PFRO.log	0f97b58c7db709747d0b13b81ba6a59a_JaffaCakes118.exe
File opened for modification	C:\WINDOWS\system.ini	0f97b58c7db709747d0b13b81ba6a59a_JaffaCakes118.exe
File opened for modification	C:\WINDOWS\DtcInstall.log	exc.exe
File created	C:\WINDOWS\explorer.exe	exc.exe
File opened for modification	C:\WINDOWS\Professional.xml	0f97b58c7db709747d0b13b81ba6a59a_JaffaCakes118.exe
File opened for modification	C:\WINDOWS\SysmonDrv.sys	0f97b58c7db709747d0b13b81ba6a59a_JaffaCakes118.exe
File created	C:\WINDOWS\hh.exe	exc.exe
File opened for modification	C:\WINDOWS\setuperr.log	exc.exe
File created	C:\WINDOWS\twain_32.dll	exc.exe
File opened for modification	C:\WINDOWS\system.ini	exc.exe
File created	C:\WINDOWS\explorer.exe	0f97b58c7db709747d0b13b81ba6a59a_JaffaCakes118.exe
File created	C:\WINDOWS\hh.exe	0f97b58c7db709747d0b13b81ba6a59a_JaffaCakes118.exe
File created	C:\WINDOWS\twain_32.dll	0f97b58c7db709747d0b13b81ba6a59a_JaffaCakes118.exe
File opened for modification	C:\WINDOWS\lsasetup.log	exc.exe
File created	C:\WINDOWS\splwow64.exe	exc.exe
File created	C:\WINDOWS\sysmon.exe	exc.exe
File created	C:\WINDOWS\notepad.exe	0f97b58c7db709747d0b13b81ba6a59a_JaffaCakes118.exe
File opened for modification	C:\WINDOWS\setupact.log	0f97b58c7db709747d0b13b81ba6a59a_JaffaCakes118.exe
File created	C:\WINDOWS\winhlp32.exe	0f97b58c7db709747d0b13b81ba6a59a_JaffaCakes118.exe
File created	C:\WINDOWS\bfsvc.exe	exc.exe
File opened for modification	C:\WINDOWS\Professional.xml	exc.exe
File created	C:\WINDOWS\winhlp32.exe	exc.exe
File created	C:\WINDOWS\sysmon.exe	0f97b58c7db709747d0b13b81ba6a59a_JaffaCakes118.exe
File created	C:\WINDOWS\WMSysPr9.prx	0f97b58c7db709747d0b13b81ba6a59a_JaffaCakes118.exe
File created	C:\WINDOWS\mib.bin	exc.exe
File opened for modification	C:\WINDOWS\SysmonDrv.sys	exc.exe
File opened for modification	C:\WINDOWS\DtcInstall.log	0f97b58c7db709747d0b13b81ba6a59a_JaffaCakes118.exe
File opened for modification	C:\WINDOWS\WindowsUpdate.log	0f97b58c7db709747d0b13b81ba6a59a_JaffaCakes118.exe
File created	C:\WINDOWS\HelpPane.exe	exc.exe
File opened for modification	C:\WINDOWS\win.ini	exc.exe
File opened for modification	C:\WINDOWS\lsasetup.log	0f97b58c7db709747d0b13b81ba6a59a_JaffaCakes118.exe
File created	C:\WINDOWS\splwow64.exe	0f97b58c7db709747d0b13b81ba6a59a_JaffaCakes118.exe
File opened for modification	C:\WINDOWS\win.ini	0f97b58c7db709747d0b13b81ba6a59a_JaffaCakes118.exe
File created	C:\WINDOWS\WMSysPr9.prx	exc.exe
File created	C:\WINDOWS\write.exe	exc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 9 IoCs

pid	Process
512	msedge.exe
512	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
872	msedge.exe
872	msedge.exe
2540	identity_helper.exe
2540	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 13 IoCs

pid	Process
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5092 wrote to memory of 1008	5092	0f97b58c7db709747d0b13b81ba6a59a_JaffaCakes118.exe	86
PID 5092 wrote to memory of 1008	5092	0f97b58c7db709747d0b13b81ba6a59a_JaffaCakes118.exe	86
PID 5092 wrote to memory of 1008	5092	0f97b58c7db709747d0b13b81ba6a59a_JaffaCakes118.exe	86
PID 5092 wrote to memory of 4376	5092	0f97b58c7db709747d0b13b81ba6a59a_JaffaCakes118.exe	98
PID 5092 wrote to memory of 4376	5092	0f97b58c7db709747d0b13b81ba6a59a_JaffaCakes118.exe	98
PID 4376 wrote to memory of 4372	4376	msedge.exe	99
PID 4376 wrote to memory of 4372	4376	msedge.exe	99
PID 1008 wrote to memory of 892	1008	exc.exe	100
PID 1008 wrote to memory of 892	1008	exc.exe	100
PID 892 wrote to memory of 408	892	msedge.exe	101
PID 892 wrote to memory of 408	892	msedge.exe	101
PID 4376 wrote to memory of 4852	4376	msedge.exe	102
PID 4376 wrote to memory of 4852	4376	msedge.exe	102
PID 4376 wrote to memory of 4852	4376	msedge.exe	102
PID 4376 wrote to memory of 4852	4376	msedge.exe	102
PID 4376 wrote to memory of 4852	4376	msedge.exe	102
PID 4376 wrote to memory of 4852	4376	msedge.exe	102
PID 4376 wrote to memory of 4852	4376	msedge.exe	102
PID 4376 wrote to memory of 4852	4376	msedge.exe	102
PID 4376 wrote to memory of 4852	4376	msedge.exe	102
PID 4376 wrote to memory of 4852	4376	msedge.exe	102
PID 4376 wrote to memory of 4852	4376	msedge.exe	102
PID 4376 wrote to memory of 4852	4376	msedge.exe	102
PID 4376 wrote to memory of 4852	4376	msedge.exe	102
PID 4376 wrote to memory of 4852	4376	msedge.exe	102
PID 4376 wrote to memory of 4852	4376	msedge.exe	102
PID 4376 wrote to memory of 4852	4376	msedge.exe	102
PID 4376 wrote to memory of 4852	4376	msedge.exe	102
PID 4376 wrote to memory of 4852	4376	msedge.exe	102
PID 4376 wrote to memory of 4852	4376	msedge.exe	102
PID 4376 wrote to memory of 4852	4376	msedge.exe	102
PID 4376 wrote to memory of 4852	4376	msedge.exe	102
PID 4376 wrote to memory of 4852	4376	msedge.exe	102
PID 4376 wrote to memory of 4852	4376	msedge.exe	102
PID 4376 wrote to memory of 4852	4376	msedge.exe	102
PID 4376 wrote to memory of 4852	4376	msedge.exe	102
PID 4376 wrote to memory of 4852	4376	msedge.exe	102
PID 4376 wrote to memory of 4852	4376	msedge.exe	102
PID 4376 wrote to memory of 4852	4376	msedge.exe	102
PID 4376 wrote to memory of 4852	4376	msedge.exe	102
PID 4376 wrote to memory of 4852	4376	msedge.exe	102
PID 4376 wrote to memory of 4852	4376	msedge.exe	102
PID 4376 wrote to memory of 4852	4376	msedge.exe	102
PID 4376 wrote to memory of 4852	4376	msedge.exe	102
PID 4376 wrote to memory of 4852	4376	msedge.exe	102
PID 4376 wrote to memory of 4852	4376	msedge.exe	102
PID 4376 wrote to memory of 4852	4376	msedge.exe	102
PID 4376 wrote to memory of 4852	4376	msedge.exe	102
PID 4376 wrote to memory of 4852	4376	msedge.exe	102
PID 4376 wrote to memory of 4852	4376	msedge.exe	102
PID 4376 wrote to memory of 4852	4376	msedge.exe	102
PID 4376 wrote to memory of 512	4376	msedge.exe	103
PID 4376 wrote to memory of 512	4376	msedge.exe	103
PID 4376 wrote to memory of 3696	4376	msedge.exe	104
PID 4376 wrote to memory of 3696	4376	msedge.exe	104
PID 4376 wrote to memory of 3696	4376	msedge.exe	104
PID 4376 wrote to memory of 3696	4376	msedge.exe	104
PID 4376 wrote to memory of 3696	4376	msedge.exe	104
PID 4376 wrote to memory of 3696	4376	msedge.exe	104
PID 4376 wrote to memory of 3696	4376	msedge.exe	104
PID 4376 wrote to memory of 3696	4376	msedge.exe	104
PID 4376 wrote to memory of 3696	4376	msedge.exe	104
PID 4376 wrote to memory of 3696	4376	msedge.exe	104
PID 4376 wrote to memory of 3696	4376	msedge.exe	104

C:\Users\Admin\AppData\Local\Temp\0f97b58c7db709747d0b13b81ba6a59a_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\0f97b58c7db709747d0b13b81ba6a59a_JaffaCakes118.exe"
1⤵
- Drops file in Drivers directory
- Manipulates Digital Signatures
- Checks computer location settings
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:5092
- C:\exc.exe
  "C:\exc.exe"
  2⤵
  - Drops file in Drivers directory
  - Manipulates Digital Signatures
  - Executes dropped EXE
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Suspicious use of WriteProcessMemory
  PID:1008
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.freeav.com/
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:892
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8bd3746f8,0x7ff8bd374708,0x7ff8bd374718
      4⤵
      PID:408
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2088,13070181718639047158,7251800891145749868,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2100 /prefetch:2
      4⤵
      PID:3404
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2088,13070181718639047158,7251800891145749868,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2152 /prefetch:3
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:872
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.antispyware.com/
    3⤵
    PID:4520
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8bd3746f8,0x7ff8bd374708,0x7ff8bd374718
      4⤵
      PID:2996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.freeav.com/
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:4376
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xe0,0x108,0x7ff8bd3746f8,0x7ff8bd374708,0x7ff8bd374718
    3⤵
    PID:4372
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2036,16714846227629878492,3342348996538694000,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2052 /prefetch:2
    3⤵
    PID:4852
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2036,16714846227629878492,3342348996538694000,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2128 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:512
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2036,16714846227629878492,3342348996538694000,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2912 /prefetch:8
    3⤵
    PID:3696
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,16714846227629878492,3342348996538694000,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3264 /prefetch:1
    3⤵
    PID:888
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,16714846227629878492,3342348996538694000,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3276 /prefetch:1
    3⤵
    PID:1460
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,16714846227629878492,3342348996538694000,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3928 /prefetch:1
    3⤵
    PID:8
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,16714846227629878492,3342348996538694000,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5244 /prefetch:1
    3⤵
    PID:4660
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,16714846227629878492,3342348996538694000,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5436 /prefetch:1
    3⤵
    PID:2972
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2036,16714846227629878492,3342348996538694000,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5568 /prefetch:8
    3⤵
    PID:3280
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2036,16714846227629878492,3342348996538694000,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5756 /prefetch:8
    3⤵
    PID:3864
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2036,16714846227629878492,3342348996538694000,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5756 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2540
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,16714846227629878492,3342348996538694000,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5752 /prefetch:1
    3⤵
    PID:3332
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,16714846227629878492,3342348996538694000,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5888 /prefetch:1
    3⤵
    PID:1524
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,16714846227629878492,3342348996538694000,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5424 /prefetch:1
    3⤵
    PID:888
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,16714846227629878492,3342348996538694000,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6128 /prefetch:1
    3⤵
    PID:4984
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,16714846227629878492,3342348996538694000,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=220 /prefetch:1
    3⤵
    PID:3944
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,16714846227629878492,3342348996538694000,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5440 /prefetch:1
    3⤵
    PID:3480
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,16714846227629878492,3342348996538694000,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6540 /prefetch:1
    3⤵
    PID:1696
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,16714846227629878492,3342348996538694000,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6552 /prefetch:1
    3⤵
    PID:4308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.antispyware.com/
  2⤵
  PID:4448
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8bd3746f8,0x7ff8bd374708,0x7ff8bd374718
    3⤵
    PID:2284

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3884

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2036

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4196

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x4a0 0x4a4
1⤵
PID:1328

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e1b45169ebca0dceadb0f45697799d62

SHA1
803604277318898e6f5c6fb92270ca83b5609cd5

SHA256
4c0224fb7cc26ccf74f5be586f18401db57cce935c767a446659b828a7b5ee60

SHA512
357965b8d5cfaf773dbd9b371d7e308d1c86a6c428e542adbfe6bac34a7d2061d0a2f59e84e5b42768930e9b109e9e9f2a87e95cf26b3a69cbff05654ee42b4e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
9ffb5f81e8eccd0963c46cbfea1abc20

SHA1
a02a610afd3543de215565bc488a4343bb5c1a59

SHA256
3a654b499247e59e34040f3b192a0069e8f3904e2398cbed90e86d981378e8bc

SHA512
2d21e18ef3f800e6e43b8cf03639d04510433c04215923f5a96432a8aa361fdda282cd444210150d9dbf8f028825d5bc8a451fd53bd3e0c9528eeb80d6e86597

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
456B

MD5
8bcdb1f137b3890a1f895c0b443653ab

SHA1
09c86e99ab727a14f0a03830d3a3150c2b864b03

SHA256
a9d3751fff1daf0f799c3d0295674d9d0de2dc89dcbc709125e3a58f42b42708

SHA512
25ea9ba102f176aa90af12f22a581eca93a6c542d3633a389747624d8849361587006b95bb8b52d37b187f5ed48edc489c70510212016dbb5240cd4862b6f30c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
336B

MD5
07c9f847e37045b008921b2401a14942

SHA1
abf80462487f7a4238e398b5489450187cdf7955

SHA256
a47eded3565af13f9fd3e2cae5ff38797c00e79e7f96e35624b649261e330df7

SHA512
67576ee873795d1c47575d9669a322732f7749b1010bcdd4eaa7ae02d80c5a1fe7805f463293a557c4549f12fa1c8f7cc5e4acb068f74d4ff7a9551dffa9a0c5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
473db74e3691a9af873825d42df17b59

SHA1
58ee97f4212075b7529fb7fb672fbc11986d48dd

SHA256
922f9c9b985170670dc7fbe0232c084f119de3f690c66ac79963fab6e44ac737

SHA512
d7d00c39a27d727942fda0022a2e1f969d04b197c3743151221d257db21924440347cccbc088dacd2028409c2edd1ed3db523b4ef4ef7e354d3d14c8658dad8d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
2129aa83691b793f0d9f2252d26f5e8a

SHA1
0bdd6b851763c46be7a6a774a994f02b35823548

SHA256
8f2e7aa3e13e006effe106e12651b0d388259825847dc3c8974cc5c1ca5a6358

SHA512
ed2c3d80b8b2a4f770915f1c2410132f25339725ea21fa646ed3d918d90a88757caf520d28b4c45ee8dc31d7bb1eecc1d36077cd8ddaca19eb37e69f4411bfeb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
813ea8eef5ce74787e24ac3c1e1b78c1

SHA1
dea57955c253a8ed7419a2739649b6f0074cfafd

SHA256
23aa342fed6a69aa008e5343b0ba2caca6d1cbf4c4c2603fad0ab351c8862a1d

SHA512
3b645404af83f66e091a858d33be97f729c95a7d574153425de843f52cb743dd54669c969d86a3157ea47fe107218e8df67f239a8fe5523c314fb95c43f381ae

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
66a5fdb38b4d698ababdcf64ea9bbadd

SHA1
cd8daf4da9b0060dca730532f09afffab4c35f83

SHA256
a84ccceaf393954d3e045799714fd38dcc428338afcc700665c53d55fbcc6e62

SHA512
26f6ffdd2df60e47bd8ae51dd96ce31ee79a657a2ab77fcbf7766b4b6b0f1a5306500c79595fdeb41ea11cb7c4e34432c3a6e5ffeae19c930e51ae67a2cc6053

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
e70d97b720c3f7c88a7de93ef2edd7ec

SHA1
860b1d146e7a79c88cce2728f5529f05d23b4e2f

SHA256
53b1317254282c57b7a3f51dd8f696908e0b1d74a3a02eefd6a357388190f45d

SHA512
c3fa5f969cd4f3daf061241ade94775fb8b7478b2e5b3949a1757829389fd852a72bfb795df2a54f1054d0ff8885a5af28ffa8491f7e1808f966f9e207fa0785

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5937ee.TMP

Filesize
871B

MD5
84698e5d10949fbdd6dd260cb3319ec0

SHA1
b20d5974c8926df72e2db08aeb9bce8eb9887b5e

SHA256
8d5916873c2f520ecaa3afef08b1852ada4b825e60b4b55c5e3d094e47a7cc1e

SHA512
1d3c62728fdc7874d584c96389b5bafe185d08a28c25c5ff871a371c921ccfb27073a04a10c422de092397b96364897b130c080d86a2b8f39909b33098d64a43

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
3bf60c38975e675fdd1c0bee1ef38452

SHA1
d6b128025d4d2626ae874ab7c0ee19816cb0b654

SHA256
fe4dba16c08fcc6c613ee8f330190acd6bf59f1ca5ed12fb4d22fa2a6a80376c

SHA512
d048595c6c60af426f4124844c3acb6835e9cadeca4e83677f40f5d70e567120b0cd9e4f5b91727e2eea0c654b3558b3e7ecda1fce79410bd7b0166cd40dfcaf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
8KB

MD5
bc86f69d16cc6dec95345dca0d2efe53

SHA1
f18ef0f61f771532fd1f18fed232769b12fdf40b

SHA256
4c1873affefb6cefb627c480634e527ee4c211156db6718e3941effc2f437a1e

SHA512
81778161dceafc33945a66abe66a3e59f79d66d56db9504d632d4223584face98c637be4da0eafa9f2e22b1e5d6f617100a822920cc658fd087a02a20201d9e0

Download Submit
C:\WINDOWS\DtcInstall.log

Filesize
57KB

MD5
e6222c27c9c5f988fa1f9fe7fc2ca0c8

SHA1
be70c8b3b8f9a9ebfd5cf53156d655a2c9ab9b86

SHA256
7d5537b5ef3dcd82386ba7b5f4138b771b513829e56181cb96ac9ee1a549b794

SHA512
fe4c62cc69aaec188319860e94dc0e117394365a1e43982e8765352864267af7722e338b378b01e643eb3e6316db4e0a6162d381f0fac7d797047c21bef8bce7

Download Submit
C:\WINDOWS\PFRO.log

Filesize
56KB

MD5
5d2a00923feb193228b4c6f62f1f2cb5

SHA1
5450d1aa8a933c1f3375f9ae3ef3c348cda2ea21

SHA256
2627cc8f5f5f00fc9146ebee773113b87381e440cf4d636b25ec8516b08f4d46

SHA512
eaafea1fc12ddfa74f62ecfb446b484b4a08d7b18d3e88c08a3f09d41366de4252266849236726e5e34116440917e0f866849afcce218592fa4060c520843fda

Download Submit
C:\WINDOWS\Professional.xml

Filesize
85KB

MD5
14dd5a7024b1d7b32402754cdf8719db

SHA1
e0c45b31bf94027b659f6f531d99094027716ff1

SHA256
1c9731da1bc06c439cec06f063d031ee9fb154c1376dc6d003f99ac64c07b33a

SHA512
d9a1cc6a3ae413b3247b2851345eb3f22455907afcfe910ad412dec82c78c89c206cfb08ab2a72123a5695109cca952ce4351d8bbc48808cf467a47194502bab

Download Submit
C:\WINDOWS\SysWOW64\atl100.dll

Filesize
162KB

MD5
9f843d6cd2c761dfe974e3e5562066e5

SHA1
f610b63919183db78bac9f6915b3ed50c6675fc4

SHA256
68991de9f98d502be95e77eff21e038af872d3227dce783c9bd8427bd8c289bf

SHA512
004822d75cd87e9d29c0abc54b5364f682233a73763f8c7f530e6604dca21184f91f02eee71999b329826e24308a87bd94ed3e7241febd1907fe06ce20a54b83

Download Submit
C:\WINDOWS\SysWOW64\atl110.dll

Filesize
188KB

MD5
dbd573500427cef90a00f1e568bbf72a

SHA1
a14a230250fe44f4c8d925f2c342c443b0a5dc0f

SHA256
1a027861d76ae15fc61818300143e462fa5407d6695c39bff14f63e757fa616b

SHA512
1a962bf4b12e7f1fcb85e18927c0a3fb78479aeabd6501ca4c366a3075e26d1f9b997f49ea8669df182917dd92700b3e291d0eb46b0594a6cfdb7a4245caa52d

Download Submit
C:\WINDOWS\SysWOW64\concrt140.dll

Filesize
269KB

MD5
0a9e7b5d09fc1ae2c2333ca76079c5ee

SHA1
9befe95ff8dda8669c10526d325eda06f87638b5

SHA256
c8e65cc8772ad89932857876aec4a55bc4dce2ae6cfa9818ff94d5f43e263e04

SHA512
72cacb784b996a326a4c61c59fec072e629dbddf22405ce5b257a8e6506039aa94546eaf77587540f980be7d9986a1e48bcb183fa2e5a2bc40a4d77dd908cfd6

Download Submit
C:\WINDOWS\SysWOW64\dssec.dat

Filesize
238KB

MD5
0b3d364b1a16318312d6172eb15431d5

SHA1
94848b2feec0b0467d8f0fa2c7cdcd5c217104b4

SHA256
5e71ea34ddbf8e4bd068bc34ea5528f869aaae98e2e1f59cde2f143f1a26d1ff

SHA512
7c0f340bda7efc21ed6add3a363ed942cc6744310859107a0ca233933f72ac79dda26d16af1f6f2fa7c7a214144daaccd3da8aaf9ac88238dd8273297f5c3307

Download Submit
C:\WINDOWS\SysWOW64\mfc100.dll

Filesize
4.2MB

MD5
a750cff58e9575a2cd3300f00844d7d7

SHA1
1c237204c136b12ec037ea86674b154b0c3e7506

SHA256
8e7aa56a737ee5603b2d28dfcdad679f8c08db82da2f3a1fd81b823a9d04b15d

SHA512
8c85b9492953b97870c2e4b67889f9bc17bc01bc437070a5507295fcdcdcae4a72333614124e2485b4da79cc422242cadc682c2b89821b82162524d0badc1ef4

Download Submit
C:\WINDOWS\SysWOW64\mfc100chs.dll

Filesize
90KB

MD5
96f363584657cbfcaa199dc3db8ad76a

SHA1
113612fa596e5b16d88342d0d9446200e97641ab

SHA256
cde10212116c89cf3f063eb43ba0ae4e18b4e7bf7077a99f41ba269a2ebda47d

SHA512
943893f473a84ee9ab5c412f712fe676476eda5705a11a8eb60b3360bf9dda45a5455707db1a8e914d18e5d61fcbf17a19fbe29e44575e7a01f56427128adc26

Download Submit
C:\WINDOWS\SysWOW64\mfc100cht.dll

Filesize
90KB

MD5
b753a5ff9fa218254ede8a51331dfb59

SHA1
6ce4d8523fbb4f82ae10cbfa8d421adad1eccc3b

SHA256
0b0d758ee6a0d6364981b268f22c1a8a9fe8f9ff95dfc372852c1e91caf7fc0b

SHA512
aac94e2bf38185706f75e75454a8ed79322c7f35347f91eaf3642a003a89a35c44008f78a6275fc6e16b97c3daf7ad861b7c424c9db6aae95f8e73b09a6c3d0a

Download Submit
C:\WINDOWS\SysWOW64\mfc100deu.dll

Filesize
118KB

MD5
3de208461555b971099b24c23174fd2a

SHA1
164302984158b431776d99bce0cd20af41b0088d

SHA256
0c3ddeb02c5150e3ccf08f2249c05eb7e14399018b52be58f3df96c7e946b4f0

SHA512
9decb48f80f28d668c0b44c64d60d876180ab51245f47c94d41e8dfde8201c2bb0a77b2d0efb7c8317696863ffe077f1050bcaaad368e773122e827b9c7426a3

Download Submit
C:\WINDOWS\SysWOW64\mfc100enu.dll

Filesize
109KB

MD5
295efb410b79dd112ca9a9f99c57120e

SHA1
71cf8c381bbb86b3940d78087d4e50362e669727

SHA256
eda81c7b43bb2a8af1204af458316cce736bd5fccd92d63a219063e9461a7cb6

SHA512
2bbda83746db3cb48371cd616b3edcf1ad297b3ea03a9c22ff7bc9a0a61ce98149c035efc917c6b455899256b4dfcbe792e9227982ecfa738b714d38d81f1c91

Download Submit
C:\WINDOWS\SysWOW64\mfc100esn.dll

Filesize
117KB

MD5
3cc9e3affe7d8dff5372fb1d68c348e2

SHA1
8a10998d6f8a222412fe09cf130fb344b8b3cadf

SHA256
118cff6b0c98c9e30cfd0fba350b1a6bab1f5ada8894aa95c079d711a00a9174

SHA512
0dcc95a51d89003085b78b0541781db4dce002ff36b2dabcbe244b34a0673fa0c94e3d06aee020c8083541958d2b70beffa4dd848a43f5ded7a90e0eae79cfea

Download Submit
C:\WINDOWS\SysWOW64\mfc100fra.dll

Filesize
90KB

MD5
3d51f2874635f82f857a084e5127a94d

SHA1
8677107dd3b5986fb93210b433b760e7cd44f50c

SHA256
538791dfe60719fc20dd8be9c2890b1d5d67bfe1825662d42859e6181f65e2a8

SHA512
64f42cdcfd0c9b7ce08fe4485fa94ec5698e9c0c5b68007b10c62e2159ad19d50196419e13d1a7a7408d1c999bc58663b179815b1d1839ae01099cc7cd1de27c

Download Submit
C:\WINDOWS\SysWOW64\mfc100ita.dll

Filesize
88KB

MD5
9b81610aa461adc58fccef482d6aec63

SHA1
8ae430a16a6efda6b4f887323381df57127c994c

SHA256
3372d362d4e846b2b36aae047cfdbbdb9e78bc42560c70ed1008f34a8bf19bb0

SHA512
a3b2dc1b199bb5421732a093f8f6c33c4e4bb56ffa44594d4f06b30212383818bcc7b25b1f726eda69d646d0d4ed82e4b4446354cbccba0e9779c3a25c9af80d

Download Submit
C:\WINDOWS\SysWOW64\mfc100jpn.dll

Filesize
98KB

MD5
d2845785e9c9be775e2793333c3bc864

SHA1
5177df7c95d29b259c4de4e6f749cfbf814cd345

SHA256
240305d371d4bc039169247a048c141a70c4cbed2b7e7f973947cc644ee87bb0

SHA512
f09b75be36def01e25de7295ae0237c62a926f2a901eec4efb6f0cd9b718783dc71cdeedc238d8ecbe23cf2d9f755403908e1b2a4f48316c07ca99e44c1fe3b2

Download Submit
C:\WINDOWS\SysWOW64\mfc100kor.dll

Filesize
97KB

MD5
41e9a44a837016f611ffdc50f8595b1a

SHA1
5ee87d61962a13e6be5d785acfd7155e7e47bff6

SHA256
e8de28892868cefa8e9149f83a80a9e2371ad48faf73b1f2346f1caa3e0e4fb4

SHA512
e0034123f83399d98330bca6e356570fb8e7483a81cf1c9ece2d38c66e8a9216f0533dd742576adce360d1be7c0246db01ce788bb27c01ddf1b97c151521d4b4

Download Submit
C:\WINDOWS\SysWOW64\mfc100rus.dll

Filesize
114KB

MD5
bf2c6b22c6f4f66af20a2ae9331775e9

SHA1
70aabed280c3a1da50d15005985dd71cf4e5f88d

SHA256
3f76b7a090961c0b46270f8050bac4073e06457a7a79b6099323aa68acc3dbff

SHA512
c593944a1fb6b30d6919b936f8d46ce4108c6aa67eeab2b8706c8babd03eed711bd7c372059e9a35a19e25cdcb1079afa50439e4e3322518a492788793a0f3bd

Download Submit
C:\WINDOWS\SysWOW64\mfc100u.dll

Filesize
4.3MB

MD5
f136e7a96e0e6d92ddf0e16c60335bbb

SHA1
f8dca194b0fac32c2d8ae145aafff41b1dd544e6

SHA256
b86e56dcc6bdfbb9f0f4273ab23dc7f340db910032fcf984dc909e0ab67e9ba8

SHA512
a7332f1daf4375e769a3ffa69f909ff0f79c039ca30c39205d7b26901e93888e33781f49240791293f49a33aa48f0b4b1c65cd8e9a6f963b96785a7a58902af0

Download Submit
C:\WINDOWS\SysWOW64\mfc110.dll

Filesize
4.2MB

MD5
ffe152fd861bf9c18d48858916f25831

SHA1
72a7c0f76af11c3d647d0bff4936baea109b4410

SHA256
4c86a64b7c74a2390c449199144519ccc630aa29558d49fd1554de293ab201dc

SHA512
5cee68203d288de6d58d21945427d9753173b15481538baf0a2685fb849b9bfcf928e99c62a636827fa014cd626041e8f44989b981323909b7c29f9144a0a887

Download Submit
C:\WINDOWS\SysWOW64\mfc110chs.dll

Filesize
100KB

MD5
f10c611fa012a463c611a336b1a2c435

SHA1
4227edc9310b35c185ee1f9bef0c82d50204dea7

SHA256
1e440ebd6f920183d16010fef2a4a277378a610d4a002991aed2b581bae0127f

SHA512
b03ea134b7d691e53fc362fa790a7d30527d23bf264bf29e313899d958439be34e6351cbf2df8c071f96a5ea57ae5caa9542471d6d48434dd7144a4728119485

Download Submit
C:\WINDOWS\SysWOW64\mfc110cht.dll

Filesize
100KB

MD5
71b17ef73c73344b01b804a47562626d

SHA1
0aa5db6ccd6d95ff7aa43905f42ec3a0d2004a76

SHA256
4f8ab0f1b47d8b402f96804b0789f2e15c07695c1197f68279b22cbfaba0b946

SHA512
931e701b2c7dfa8881f5006caf55ea6c6016bdbcd9de0831e86450e59c48a83844bea6b7b3777c8126d80ef28cf5335237f6ac4fc0920f3c37313f0129c81887

Download Submit
C:\WINDOWS\SysWOW64\mfc110deu.dll

Filesize
128KB

MD5
4538f2e33173882382526b51a1d69a52

SHA1
f5bb14ce7fa68805f3bab0d144aa79a1238c2186

SHA256
81e1d9d80277378255edeb52aab5a6496924c7c427a2d22047d2ca82e23bc900

SHA512
fda61dafd21859ea88eb476cb1b602fbe547106e5cad3cbaf25dac0201c8cd7a780f4a3cbd6f13748311501320ff353bd60eef568cc7151aff7e2a5af9ac60ce

Download Submit
C:\WINDOWS\SysWOW64\mfc110enu.dll

Filesize
118KB

MD5
6940040d16c290566bb1549fc02da923

SHA1
9c2242db377cc9dcfa77be345c64ab58b6f388c7

SHA256
2f3acfdf4120cc69ff0908dd0114d8ad72fd55f4bc57a8f5a7b5262a516b090f

SHA512
d8f0882506a7150706afda497c5071d14f3c433b3ca3d607434d542bbf5905395ee853fda8679104c3ab8de2eb96be1eddc02c4c932544cebdc5454ce41c488f

Download Submit
C:\WINDOWS\SysWOW64\mfc110esn.dll

Filesize
127KB

MD5
a0e145c01c676ed90bc62b952b1f5b87

SHA1
d3b868c1d351be334b24a05669ff1ae483cada6b

SHA256
41425e9801eaf6ed5e5eeb5a356db94d67d9ba4eb579d9d1f8d3dd452911d016

SHA512
996552a5af199d49c49d211afb956ce93cb45f1e01fb60aabd4a24a4c0baaa0a12f026ecf5bd41a4cf34b1d36c0fe3ba6ba4c802aaf5ab3dc3abb1a8ce6009b9

Download Submit
C:\WINDOWS\SysWOW64\mfc110fra.dll

Filesize
128KB

MD5
93bbef401eb5c7353881e976ab695ea3

SHA1
99eada30668f453e651eaa3d98dc80fd584beb3d

SHA256
0b918a12ba32b216a2db4cc6de2242a7ab36da3a25194e124d4d6bbc41c2da5f

SHA512
3f9cb682c518649387ec66ede7fa21df972caefa51ca75c3f038e4474d1348ab8b9a4e0ceda8e4fc7beee5caaa68442fa3fae271b11f7d62fb286db9088b1ad3

Download Submit
C:\WINDOWS\SysWOW64\mfc110ita.dll

Filesize
126KB

MD5
de207fb32bdd73701f5f3bec5b240be5

SHA1
ad3846b0491dec1fb99fa35f292f981e6e0abbc0

SHA256
495b9aecd9ab63b00bb13af98d656f32228a05932f8e837c34436c8fe8835f48

SHA512
13e0a4039f0555d725eaeb6577a07e34ae3e46bf89f633fda38cdb277b3522284f9b2aad486b0c700c6f59974c74482ac8d966e00d2d025528ba4cb7e2d05616

Download Submit
C:\WINDOWS\SysWOW64\mfc110jpn.dll

Filesize
107KB

MD5
8522e77e58717c4898daade3ac43cd84

SHA1
183a11be41f025a2c12e7e2b3e5a0c369277aca2

SHA256
49cd2f282462bfac9ed27bdb0431016bf923518938ccd219683cfb82d9a637a6

SHA512
3b7b11885d88a2966903e132e823f408261ba90f0362aa9e8a6c9fd2cf48f863953e81c2968f5dc137b4c38a370117b8c85d6470ea2b3bf2b63533cfe3a75289

Download Submit
C:\WINDOWS\SysWOW64\mfc110kor.dll

Filesize
107KB

MD5
1e624226d457244a77d33680e5fd7120

SHA1
d11931778ad8ae0f12c68757b72dfecefa75039a

SHA256
63d8bec4e0d92c477d685f3c05696a15cf366ff8fd387a0137cd89a32402c8b4

SHA512
037c031a1abe20d2efe18499e80049bd7cfbfb3930a7611e6d917f899175ea897c26e13c109609ff15027f946110a47a8094da0b27cf650ff3f8909957d90b63

Download Submit
C:\WINDOWS\SysWOW64\mfc110rus.dll

Filesize
124KB

MD5
9e053913941331ce320974ff6df0b814

SHA1
8f93cbe32d1a7c288d5c5171c5ecd844cc1dc22e

SHA256
c4d610fd4a462e7a9b1c898330689b1f09a3eabfc9163cff7fa6f3f7661cbea0

SHA512
7d555d304f17257167dbe235e7260483a6becab3df6ae5e447a000006b52a00b3a6af29084d0748c6479534ade174ee68851ba4d949c3da511646f4eaf071278

Download Submit
C:\WINDOWS\SysWOW64\mfc110u.dll

Filesize
4.3MB

MD5
245d8c871dc258918cd036aaa1bfc778

SHA1
0def24aa60579e7ded057e25db8ac9c3c36cf93e

SHA256
2aaab832f81bd24bf4638e358b8b3cfdb4f13fe3d4eb914a6cfd8c952fe19030

SHA512
d3a15b750983a1138b0923238dea94ec8b2f46c39bb5a1edf6b56f5bd747c67ccf7f2d1d336f4bf6f7c9842cec42cc47a9b2175552cb64a087c0e7e392ad1681

Download Submit
C:\WINDOWS\SysWOW64\mfc120.dll

Filesize
4.2MB

MD5
cd3e405b6b2d1b8620cffb7cc25e336a

SHA1
e266d2ccf772909c2e6f0af848270a39cbbad171

SHA256
53df2feaa565650d1d2fee9f71843d48bbf465d7aae7cb9e7731a47e9f18fc1f

SHA512
50160467de29c597f0484434c0ad63cc1bc96b5fff4024437728163c0c65bab6153b1c4b08927085489154f54df86277f0f7356975b50da0f0176c0de2a37507

Download Submit
C:\WINDOWS\SysWOW64\mfc120chs.dll

Filesize
100KB

MD5
49b585476a2a90042dc5d68557c333aa

SHA1
41df15f3b394aaa012f5daaf006b2fcb1634d307

SHA256
7aad54cb5a311e5c76d9a00caf8afa4ce47e843aab2c17433890af9b2defe13a

SHA512
0b0875f36dfb53749a57e51806263dfd00e988af2ec4478e6ab85355df33919e1dd27d12131f23d433f22ac2534de18b100d19cbe3df9af3d6f904cf9416fcb5

Download Submit
C:\WINDOWS\SysWOW64\mfc120cht.dll

Filesize
100KB

MD5
0e333101fa250a0ed90a8e1546c9c642

SHA1
e0c6fe5222e78178e5f4ecaed3ae57573741aa90

SHA256
1a9ddab24869579d187e3defc1ea56da29cdc8759fd5d5b4c5bed84c52464156

SHA512
eda3e72c23127cfaed071151bd2defcbcc988127f336e9a31009abb80c3c61766596812a9f3eef99e6919471ac17fbfdcad87b7da1bceee3bfb42ade6c3616dc

Download Submit
C:\WINDOWS\SysWOW64\mfc120deu.dll

Filesize
128KB

MD5
484a462bde78b348b192e9e933d4a068

SHA1
b544bb51f915e37337e460f99699dd7e16679e31

SHA256
3c15ceb9a3210adfc36ba48cd75584ff95f16260769b97e61805648ebf11a9d9

SHA512
7856b7a747a26590417afa7e15921f3d47e5e85bd73b07756c88822ff75b724d5a18a3dbc115c9d16ba9c414d6fc996d70c13d94329087fddb4675d9285180de

Download Submit
C:\WINDOWS\SysWOW64\mfc120enu.dll

Filesize
118KB

MD5
16444f4a6d11bbf1eeb58b309d5f92b5

SHA1
52826f93a7b2b7a5f1847574609373085dfbbdbb

SHA256
aec470d36349c3fa6fac4aff2acc9f6c2f11b2b56a898a89b2f42dbba118fe3d

SHA512
455413ed2ff6703318dfe7eae2c56622fa4266696f4ab626ab8a1c4b4910189676a5a19b8599ee8e2ed58dec3fa9b7d5ed4369ea463910783859d2cc407e5040

Download Submit
C:\WINDOWS\SysWOW64\mfc120esn.dll

Filesize
127KB

MD5
c76cbb68a665a053bd8f0fd53e3432d2

SHA1
e4969c3bf5ff2645524442619a7a3742fabcd66a

SHA256
fd11e518b420c26377977b66f5427250cf867c662e46bc335fc9804f3fb261c4

SHA512
bc7839ca116053365c60d22a489ad8767694186fce61abb3775d5c5c83ddfc8aa50cafb7c51f277dcfad15164e3a25d4ca9c02b05be7932545e995ad16b5276b

Download Submit
C:\WINDOWS\SysWOW64\mfc120fra.dll

Filesize
128KB

MD5
3f8bcac6d5e144651251fd6a892bf8e5

SHA1
68baf7fbb2bcee9e3df93c816c600692ade4ce11

SHA256
47cb4d5f77cc0e27d2c14a77f784bdb679c9df3e410c22424348d54fcce1201c

SHA512
94a2d4a728d5dff7372008f93afdc7923338a743553c9d0bb4e9524cd583316ad281bfc7fae39aa30fe75704d5c3d2b22a2087235772df40319e9c98dbeb06b1

Download Submit
C:\WINDOWS\SysWOW64\mfc120ita.dll

Filesize
126KB

MD5
b5dbe4f6c9fc9f2bb49ec40471f54e69

SHA1
bfe2fb838ea9b156a09e73bbda5636f641b03166

SHA256
a3b0c11684928e9b02f0d56fc76a99e1ed88f33fe7214a06f70ccee41dd952ef

SHA512
9c1616627f174237b426e137df0dd02c41e340cfebac8bd921302ceaddfb0ef2bb7b516a1e3c6af8651ac8ef09f5c5424a32f87d10cc1946752b508468990d3b

Download Submit
C:\WINDOWS\SysWOW64\mfc120jpn.dll

Filesize
107KB

MD5
3ca4c9d0a9dae4588730ba0cc3841a58

SHA1
34614f32e99d60124bd45a5ca00b3680d8f2c39a

SHA256
005e793d3b827213047f3659a9047145e85fd86a1974ababd99daca35fc3fe64

SHA512
531f9f1cde1a2841ddd3c730dd39cb7a1e139683272b461c953acf758aa19d45b11ed82d9b9c26768c58a3a503ec22a99c869ae393dadf3c36de1027f6fa2893

Download Submit
C:\WINDOWS\SysWOW64\mfc120kor.dll

Filesize
107KB

MD5
f8b24a7479fb26f73db47feab74274c4

SHA1
ceceebf8744a54a50c772bb3e09289d179ba39c1

SHA256
b66ad5653428d361a06442900e07b46565575fc48c4db2ddf22b09c90fb86f35

SHA512
38ec2208daa27b03128ab2cdc9965f4bd57201c54dc1af7955b477c94c5e31ba3d550ac810e46b77ed547fe6b958ba8a9db604c228b129530256b938f8186a54

Download Submit
C:\WINDOWS\SysWOW64\mfc120rus.dll

Filesize
124KB

MD5
d08857ade26021cae053c890ab73324d

SHA1
8c71125b482553364897328d5fc9d9c398b74f2f

SHA256
30af63ee00f146a137b0e46c4855b4737b5f6915b2f027fecfda478743fc78e6

SHA512
108526f882e3dc38d208155d3ba56c1dc4a90889cf4ad6867b1db5cb450b2cdf4e0462e89ea4aab4b6fe08a635666ef902ee2ecbb083647cee29adc508e88756

Download Submit
C:\WINDOWS\SysWOW64\mfc120u.dll

Filesize
4.3MB

MD5
09dd084a4ebffd47f5407af06fc0b5dd

SHA1
0126e32a353fbcaed7ca977f2767b2304a44f2a6

SHA256
1a01aacdaf870620a318fc3c32ff76a096d53ea3cf8fb7ec2c6e50bdd40afabc

SHA512
702b25977a82d968325c98d782a05caf55f24a2a19a7e174002564d66d618c854d0fb7d13bf395dde57a45ea7b222fce3ef814f94466b7fe169e59875d5b1a77

Download Submit
C:\WINDOWS\SysWOW64\mfc140.dll

Filesize
4.6MB

MD5
335baf5692c8aaf41570f884ae9a0b48

SHA1
ce465efc5c327bd7901ec820b2fb47a45d22d97c

SHA256
85a8217c3398aec0200f137a57c296a9fecb2c6810ac2d8543eb1ca73ebf6bbc

SHA512
01d8f5a58d57510b1fa58781d6d25c2149266e0ad3667ec5ae2516fd320d0368a33789146e0b20a59cf3f34e9e61cfecd3c0bbdb651b05bf617adb511f7791bb

Download Submit
C:\WINDOWS\SysWOW64\mfc140chs.dll

Filesize
94KB

MD5
f4f184225beb3b38f6b3c18abc70a08e

SHA1
6e0268ceaf64638df7928f53116ece23a296c34d

SHA256
f1ae5b2bc9611b229caba0b83e8cd416121e5de80d6bf755c8493dc47d4591e3

SHA512
f82efdf076f95b4ab284099b5da4b5fe57cf382804dbe69370f34d51e2c4e96269bbd3e5e945b0ab0161c4caff8c0d39deade099abd3530baefa2553e857c001

Download Submit
C:\WINDOWS\SysWOW64\mfc140cht.dll

Filesize
94KB

MD5
04f617d0ae3fc87da46c1b99ff996a97

SHA1
77c53ffc217b7409151082323cd540c8759d8daa

SHA256
0d710d7fa745516fe6f4c4e0b55cab3ba7e8d3a8eee7dc8bedf12109dea4a7ab

SHA512
d4da0be0216df7d031b87734aa9e2a6459efdaf462b0ea76c1b0d52476e391358cb09c6a32e53d1528da43e9905ef5db90344c1d6eb3789d822fb0eca4456286

Download Submit
C:\WINDOWS\SysWOW64\mfc140deu.dll

Filesize
122KB

MD5
ae0e05993e03d419941650873b8f38ae

SHA1
1b480feff126d216c42a4eded9130dc83c4e74f5

SHA256
f35aa0fde167f3a6d3918abdeebf706484043b7129deae50edc9778c36d9b1dd

SHA512
60ba0ae6c56b4146d62e2b72be20b22bd12b9fb108c5e2c87615d2bb313b785002df3221326add1197a02cbbe33e618f9df0ea59850d3ea3ec98390a62b3b1fc

Download Submit
C:\WINDOWS\SysWOW64\mfc140enu.dll

Filesize
85KB

MD5
9f09e8c0f1c2f79dd87e235bbccfa479

SHA1
bf030157c787dd261c031e5c1f8e0f6e2fe85adf

SHA256
a761332c4fb23fcc72d49003238c69fbc7ac477e1259e8f74b456025d605d7e8

SHA512
f7ff88d74fe51a84c9b355e7d60cc79b918ebf61432691b652facc6829c01e202d668df7c4482e43ef71b1119769e808664519e7b78a9c9bf28f4c19febd900b

Download Submit
C:\WINDOWS\SysWOW64\mfc140esn.dll

Filesize
121KB

MD5
78db050e5060035d4edd706e9da72586

SHA1
730a1b26f6a219d16b3041a7b428cc4328ab6116

SHA256
d69475d8074fa6d9e5bc4229d26151d8dc34160015ecd68b5045bdfcb8d5d713

SHA512
2d78702ede1511950800ac89c2d40498b06e3cf0218989d7fc2fa5723c2c1db5f93348555d14493c34f4be6367e522ca74cea3f0689b2647da6820b13b30ca23

Download Submit
C:\WINDOWS\SysWOW64\mfc140fra.dll

Filesize
122KB

MD5
884e629e3d7a9a5e5662c50ebd2ec84e

SHA1
8d08037aa57b96b010ea474e61d4f01e3d6f8ed9

SHA256
0d5989ffb54f539ad71e48df433cf4e83e62472eef13ec0436cfed461793748d

SHA512
5a3f298cdfa3c1a607b175163d4c1f9f30a68825d1db3b71ad2eb012e8fdf3f1c8d1896d1f6015850c463151b178b83d1aa26768e6cb60d53d4c1d661e94bc67

Download Submit
C:\WINDOWS\SysWOW64\mfc140ita.dll

Filesize
120KB

MD5
c18bd0528006e09867806ef51ab91e2b

SHA1
24da4937847298b7579cd7f4149ab3496c8e491e

SHA256
6f7fe7c6a2032ec15c204a5c04045165c870eebbe89316fd1428e10e39911e12

SHA512
32bc5559d8a6517d477de423679f6c94b45384826a82e7c61337284431c4a34338f3a785bb702db9bceb63e31691dad7c8b4a35d6b921ade1d43b630e57b4327

Download Submit
C:\WINDOWS\SysWOW64\mfc140jpn.dll

Filesize
102KB

MD5
776467c7529457c86d3959286b89fec0

SHA1
8961d90b009d2389b6b366e6d311505b0cf8466b

SHA256
dcb8702e4ab12ed666beb01e13d9c10a1ee6ff79897f64022130b3f10e04ab22

SHA512
d08fa7b42a0efd136f10955ebfd64dd7e65d7eee074ac31edd6b437aef4bec25d8395306bb2f42512f1d54e32d7772639660027d1f4a5b9f04a44f70729fa9df

Download Submit
C:\WINDOWS\SysWOW64\mfc140kor.dll

Filesize
101KB

MD5
d2ebefd4dc8ae7652414055df4e90ad9

SHA1
f91c603f55db7bd49909d938f149831d3372cbeb

SHA256
c75e6282d4aee9afdeeb1dfe131f09d28a440d1918d832b439a229f1f47a6606

SHA512
92f8fa731abc33c18cc44cef618c0b4d6118210a459c1172f63ae4f08f428388d6e36d4c87b12c3314042e9737b8c283c27140d1f2cfc7b1bd22c2d2b4a80557

Download Submit
C:\WINDOWS\SysWOW64\mfc140rus.dll

Filesize
118KB

MD5
20649967e1044553296693db36418969

SHA1
2669d5805fdc5ab99b5b41267edeb5c623fbd285

SHA256
d5aaecb22f66c62c30df13f0b7eff56f97ee3ae7ac35d1f8cd5cf6772daabf26

SHA512
1aa0357fafd5c0fff3648e7e77538678248187b393fbf4f68878a839d5b852a44647174b0d63d1fd3f81a0509ed62c37f8ec7e6c659fa7882207fc6fd0621397

Download Submit
C:\WINDOWS\SysWOW64\mfc140u.dll

Filesize
4.7MB

MD5
8a8dd35ffa140242ad8d370cccc8703e

SHA1
9d65e681989f2a8674775411134c9bc18ccd29bf

SHA256
2d87e9b4968e942b7e17231d12f32f2e6c7d3149fe351698d5f3728166f9f5e1

SHA512
93502db972d38676ef6dedc85d15286aea70c5fabeb6168cc04c57a642ada3b1ad5f6b658c4c5c3226b0b026117b5088954730adb0d91c35b73665ddfbdf5ba1

Download Submit
C:\WINDOWS\SysmonDrv.sys

Filesize
221KB

MD5
ad45af75c97c2066e28741ea006c1a54

SHA1
10b1d342216bd666f1cd5b0e6c5d05475a9edbc2

SHA256
d15b27412ecf512f8e1b1339c826a5880762a7091b5650073aeb8dbc54a64c08

SHA512
67a971d3251bea2a54faf69f0d0c06e266843ca6c2224e9bbe8afc80d3ecad6bd0b040310e9f44637dfa2cd6479287cc49d7ba75643dca46ad64050a6ef5e8d0

Download Submit
C:\WINDOWS\WindowsUpdate.log

Filesize
55KB

MD5
ab75d83a60e5b897678e9c153e46d4a0

SHA1
0445a9a21e39b8d417e6275dd9640642c6bcdf9e

SHA256
c343b974502114d89f7506b28fb404ee71ed9d7342884e165d3bb411a485da00

SHA512
6d23abc65e2455352174aa811c7a24d648e3321c64f28a7f752ee4f6f036ef5a5077beb5b8097339c129f52293fa8ed5625fe06fe748e57b7480beeb396a6afb

Download Submit
C:\WINDOWS\lsasetup.log

Filesize
56KB

MD5
ad4252cc983ceea15b0437c1b96ed4a8

SHA1
34d32a22ba4fc47f18305a73a15438def8a34320

SHA256
e71ed239de654ca069e6c20c208350fb94683e6d076a9bb0164962af339c541c

SHA512
68a873e6f715f4fdccd20b2f9fcefc16e60b6d510ffc3764098f59a5ecc69fd7391bb1d0383b23b7ffd5a8bc0540e8e39c0d5c6849f68020a56a1191597108d5

Download Submit
C:\WINDOWS\setupact.log

Filesize
56KB

MD5
1e377072c30cd86d8e3a9b9235275b7f

SHA1
03618eda6a168965c294a164ccaccdeb5a3fe0ad

SHA256
91ba7b7d2e3d10b9621d1dda233df33aeac52002238e8686a45bea8b0e8d1b1d

SHA512
86199601520b12b0e1dc19999092c16e798701de8bfbf4204e5c26efcb1f0ae925200504ed5f85c85521d8dd76ccaef64eacfe8712348c03758547a1018dd410

Download Submit
C:\WINDOWS\setuperr.log

Filesize
55KB

MD5
1682c7efb9c7dbfaa885e5db9f402a1d

SHA1
76b37d4e87146f3c3de5c67922a443ab57895fe6

SHA256
f96322b57679c352ae7ce781bcd11a91c643ff0fbe2cba1b2a0755037c0d994f

SHA512
88a969900b58805e0d966a22a558c6075a431d001e8f3313efa5c0fe9d883b6dd2bde02a5694e3ec7dd1180ab651390f08791d322cd6954431ed13e2e39ccbda

Download Submit
C:\WINDOWS\system.ini

Filesize
55KB

MD5
c9dd39127a827c7a677898b398f78324

SHA1
fe459964c91dd41bbff3f28ca8b0662187947d3e

SHA256
ded992db028921a82ae5ef5a36c9aef694e4528f65728993a4b56ac35e356e6f

SHA512
a137a965dac85453fb1ebf01ff32b3a7b7c3440b237cb38eb278fc494dae1cce0cffe4ca2c81ec260db7e12c077f55cc72dfc5cceb43ca2a01a2a75833e9c13b

Download Submit
C:\WINDOWS\win.ini

Filesize
55KB

MD5
ebbfa485e61fddda9df678f915629445

SHA1
7663f1969a9d85003bd1522557e7f69f664a2155

SHA256
cd841c470e1f877b1f86589f7d66b73dc5b1cacab0632fae1b84159e43411096

SHA512
0dfb089f3dbc429281aee7aa7e6bb1f67b8cc5b2c4356ec032cc95ad9e534161fe747b25d541fb3e23d1db81d3298026f1976b4eb83fe3786d6284526a465e0b

Download Submit
C:\exc.exe

Filesize
362KB

MD5
87c7648ab8055aef9dfb2f8394abc082

SHA1
bff966aa1a44fe4e11220078b40721a1243ba507

SHA256
97a5bcbbca1175c377bee9d10a623be0ec5f7bcf29fe3548ecec0693988afd9f

SHA512
fa04b1011764daa357b189f80e397e665e5b6574b791a5f1ee313cded6a7d73046fb5458cd37dadf6ce28d068b41f11ac7fb42b13ed3c9719e34fb6e5a96a59f

Download Submit
memory/1008-1596-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/1008-10-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/1008-277-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/1008-1129-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/1008-1344-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/1008-699-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/5092-1343-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/5092-0-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/5092-1595-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/5092-276-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/5092-515-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/5092-1105-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/5092-9-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/5092-698-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download