Overview

overview

9

Static

static

7

3971a17dfe...18.exe

windows7-x64

9

3971a17dfe...18.exe

windows10-2004-x64

9

Analysis

  • max time kernel
    122s
  • max time network
    123s
  • platform
    windows7_x64
  • resource
    win7-20240704-en
  • resource tags

    arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
  • submitted
    11-07-2024 14:07

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    3971a17dfe31449440d7f974e353fc55_JaffaCakes118.exe

  • Size

    3.5MB

  • MD5

    3971a17dfe31449440d7f974e353fc55

  • SHA1

    3b471ff12b6bf746624ff47169b2e63481f22be7

  • SHA256

    e184ddb99ea689aa34f6374c51b77e5bed16ef0ddf558e5ea0ff46b439fbf6cd

  • SHA512

    f0dc3b56346a9608999f7c4daa949861eb7c9a104d4fcf2a33ded5320e239c86679b5d4435f13500bfdbb3de4d06c7ed91d49bd21d966bf88d1fa914107bbe79

  • SSDEEP

    98304:BPsll0cd2I2kgozrQG1pGpl6u+dY1hfhRGeJTk:BPsbdCgz5zol63dyhO2Tk

Score
9/10
defense_evasionevasionpersistenceupx

Malware Config

Signatures

  • Detected Nirsoft tools 4 IoCs

    Free utilities often used by attackers which can steal passwords, product keys, etc.

  • Disables RegEdit via registry modification 4 IoCs
    evasion
  • Event Triggered Execution: Image File Execution Options Injection 1 TTPs 64 IoCs
    persistence
  • Executes dropped EXE 56 IoCs
  • Impair Defenses: Safe Mode Boot 1 TTPs 12 IoCs
    defense_evasion
  • Loads dropped DLL 50 IoCs
  • Modifies system executable filetype association 2 TTPs 32 IoCs
    persistence
  • UPX packed file 36 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Adds Run key to start application 2 TTPs 5 IoCs
    persistence
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 6 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • System policy modification 1 TTPs 3 IoCs
    evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\3971a17dfe31449440d7f974e353fc55_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\3971a17dfe31449440d7f974e353fc55_JaffaCakes118.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:2560
    • C:\32788R22FWJFW\iexplore.exe
      "C:\32788R22FWJFW\iexplore.exe" win close ititle " Security"
      2⤵
      • Executes dropped EXE
      PID:2192
    • C:\32788R22FWJFW\iexplore.exe
      "C:\32788R22FWJFW\iexplore.exe" win close ititle "SysInternals"
      2⤵
      • Executes dropped EXE
      PID:588
    • C:\32788R22FWJFW\iexplore.exe
      "C:\32788R22FWJFW\iexplore.exe" exec hide 32788R22FWJFW\License\iexplore.exe -k and { *sysguard.exe or ???*tssd.exe or a-fast.exe or -preg"\\[\da-f]*\d[\da-f]*\\*.exe" }
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:1180
      • C:\32788R22FWJFW\License\iexplore.exe
        32788R22FWJFW\License\iexplore.exe -k and { *sysguard.exe or ???*tssd.exe or a-fast.exe or -preg"\\[\da-f]*\d[\da-f]*\\*.exe" }
        3⤵
        • Executes dropped EXE
        PID:1552
    • C:\32788R22FWJFW\hidec.exe
      "C:\32788R22FWJFW\hidec.exe" 32788R22FWJFW\pev.exe -k * and { *Antivirus*Pro.exe or a-fast.exe or digprot.exe or *Police*Pro.exe or svch[!o]st.exe or sv[!c]host.exe or winupdate.exe or or ANTI_files.exe or dbsinit.exe or ?.exe or desot.exe or desote.exe or *sysguard.exe or aap.exe or pump.exe os svcst.exe or seres.exe or *spyware.exe or new.exe or ave.exe or -preg"\d{3,}.exe" }
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:888
      • C:\32788R22FWJFW\pev.exe
        32788R22FWJFW\pev.exe -k * and { *Antivirus*Pro.exe or a-fast.exe or digprot.exe or *Police*Pro.exe or svch[!o]st.exe or sv[!c]host.exe or winupdate.exe or or ANTI_files.exe or dbsinit.exe or ?.exe or desot.exe or desote.exe or *sysguard.exe or aap.exe or pump.exe os svcst.exe or seres.exe or *spyware.exe or new.exe or ave.exe or -preg"\d{3,}.exe" }
        3⤵
        • Executes dropped EXE
        PID:2912
    • C:\32788R22FWJFW\n.pif
      "C:\32788R22FWJFW\n.pif" shexec install 32788R22FWJFW\Prep.inf
      2⤵
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:2988
      • C:\Windows\SysWOW64\InfDefaultInstall.exe
        "C:\Windows\System32\InfDefaultInstall.exe" "C:\32788R22FWJFW\Prep.inf"
        3⤵
        • Disables RegEdit via registry modification
        • Modifies system executable filetype association
        • Adds Run key to start application
        • Drops file in Windows directory
        • Modifies registry class
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:2180
        • C:\Windows\SysWOW64\runonce.exe
          "C:\Windows\system32\runonce.exe" -r
          4⤵
          • Checks processor information in registry
          • Suspicious use of WriteProcessMemory
          PID:2228
          • C:\Windows\SysWOW64\grpconv.exe
            "C:\Windows\System32\grpconv.exe" -o
            5⤵
              PID:2728
      • C:\32788R22FWJFW\n.pif
        "C:\32788R22FWJFW\n.pif" exec hide 32788R22FWJFW\PEV.exe RIMPORT 32788R22FWJFW\EXE.reg
        2⤵
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:2624
        • C:\32788R22FWJFW\PEV.exe
          32788R22FWJFW\PEV.exe RIMPORT 32788R22FWJFW\EXE.reg
          3⤵
          • Disables RegEdit via registry modification
          • Event Triggered Execution: Image File Execution Options Injection
          • Executes dropped EXE
          • Impair Defenses: Safe Mode Boot
          • Modifies system executable filetype association
          • Adds Run key to start application
          • Modifies data under HKEY_USERS
          • Modifies registry class
          • System policy modification
          PID:3056
      • C:\32788R22FWJFW\hidec.exe
        "C:\32788R22FWJFW\hidec.exe" 32788R22FWJFW\PEV.exe RIMPORT 32788R22FWJFW\EXE.reg
        2⤵
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:2140
        • C:\32788R22FWJFW\PEV.exe
          32788R22FWJFW\PEV.exe RIMPORT 32788R22FWJFW\EXE.reg
          3⤵
          • Disables RegEdit via registry modification
          • Event Triggered Execution: Image File Execution Options Injection
          • Executes dropped EXE
          • Impair Defenses: Safe Mode Boot
          • Modifies system executable filetype association
          • Adds Run key to start application
          • Modifies data under HKEY_USERS
          • Modifies registry class
          • System policy modification
          PID:1656
      • C:\32788R22FWJFW\hidec.exe
        "C:\32788R22FWJFW\hidec.exe" 32788R22FWJFW\swreg.exe acl "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32" /da:r /q
        2⤵
        • Executes dropped EXE
        • Loads dropped DLL
        PID:1476
        • C:\32788R22FWJFW\swreg.exe
          32788R22FWJFW\swreg.exe acl "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32" /da:r /q
          3⤵
          • Executes dropped EXE
          • Suspicious use of AdjustPrivilegeToken
          PID:2360
      • C:\32788R22FWJFW\hidec.exe
        "C:\32788R22FWJFW\hidec.exe" 32788R22FWJFW\swreg.exe acl "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options" /reset /q
        2⤵
        • Executes dropped EXE
        • Loads dropped DLL
        PID:1392
        • C:\32788R22FWJFW\swreg.exe
          32788R22FWJFW\swreg.exe acl "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options" /reset /q
          3⤵
          • Executes dropped EXE
          • Suspicious use of AdjustPrivilegeToken
          PID:1660
      • C:\32788R22FWJFW\hidec.exe
        "C:\32788R22FWJFW\hidec.exe" 32788R22FWJFW\swreg.exe acl "HKLM\SOFTWARE\Microsoft\Command Processor" /reset /q
        2⤵
        • Executes dropped EXE
        • Loads dropped DLL
        PID:1976
        • C:\32788R22FWJFW\swreg.exe
          32788R22FWJFW\swreg.exe acl "HKLM\SOFTWARE\Microsoft\Command Processor" /reset /q
          3⤵
          • Executes dropped EXE
          • Suspicious use of AdjustPrivilegeToken
          PID:548
      • C:\32788R22FWJFW\hidec.exe
        "C:\32788R22FWJFW\hidec.exe" 32788R22FWJFW\SWXCACLS.cfxxe "C:\Windows\system32\cmd.exe" /P /GA:F /GS:F /GU:X /GP:X /I ENABLE /Q
        2⤵
        • Executes dropped EXE
        • Loads dropped DLL
        PID:1916
        • C:\32788R22FWJFW\SWXCACLS.cfxxe
          32788R22FWJFW\SWXCACLS.cfxxe "C:\Windows\system32\cmd.exe" /P /GA:F /GS:F /GU:X /GP:X /I ENABLE /Q
          3⤵
          • Executes dropped EXE
          • Suspicious use of AdjustPrivilegeToken
          PID:1056
      • C:\32788R22FWJFW\n.pif
        "C:\32788R22FWJFW\n.pif" exec hide 32788R22FWJFW\SWREG.exe acl "hklm\software\microsoft\windows nt\currentversion\windows" /O Guest /Q
        2⤵
        • Executes dropped EXE
        PID:748
        • C:\32788R22FWJFW\SWREG.exe
          32788R22FWJFW\SWREG.exe acl "hklm\software\microsoft\windows nt\currentversion\windows" /O Guest /Q
          3⤵
          • Executes dropped EXE
          PID:3028
      • C:\32788R22FWJFW\hidec.exe
        "C:\32788R22FWJFW\hidec.exe" 32788R22FWJFW\SWREG.exe acl "hklm\software\microsoft\windows nt\currentversion\windows" /O Guest /Q
        2⤵
        • Executes dropped EXE
        PID:440
        • C:\32788R22FWJFW\SWREG.exe
          32788R22FWJFW\SWREG.exe acl "hklm\software\microsoft\windows nt\currentversion\windows" /O Guest /Q
          3⤵
          • Executes dropped EXE
          PID:2940
      • C:\32788R22FWJFW\n.pif
        "C:\32788R22FWJFW\n.pif" cmdwait 150 exec hide 32788R22FWJFW\SWREG.exe acl "hklm\software\microsoft\windows nt\currentversion\windows" /DE:F /Q
        2⤵
        • Executes dropped EXE
        PID:2788
        • C:\32788R22FWJFW\SWREG.exe
          32788R22FWJFW\SWREG.exe acl "hklm\software\microsoft\windows nt\currentversion\windows" /DE:F /Q
          3⤵
          • Executes dropped EXE
          PID:324
      • C:\32788R22FWJFW\hidec.exe
        "C:\32788R22FWJFW\hidec.exe" 32788R22FWJFW\SWREG.exe acl "hklm\software\microsoft\windows nt\currentversion\windows" /DE:F /Q
        2⤵
        • Executes dropped EXE
        PID:2892
        • C:\32788R22FWJFW\SWREG.exe
          32788R22FWJFW\SWREG.exe acl "hklm\software\microsoft\windows nt\currentversion\windows" /DE:F /Q
          3⤵
          • Executes dropped EXE
          PID:1668
      • C:\32788R22FWJFW\n.pif
        "C:\32788R22FWJFW\n.pif" cmdwait 3000 exec hide 32788R22FWJFW\swreg.exe acl "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32" /reset /q
        2⤵
        • Executes dropped EXE
        PID:1720
        • C:\32788R22FWJFW\swreg.exe
          32788R22FWJFW\swreg.exe acl "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32" /reset /q
          3⤵
          • Executes dropped EXE
          PID:1684
      • C:\32788R22FWJFW\n.pif
        "C:\32788R22FWJFW\n.pif" shellcopy C:\Windows\system32\en-us\cmd.exe.mui 32788R22FWJFW\EN-US\cmd.cfxxe.mui yestoall noerrorui silent nosecattr
        2⤵
        • Executes dropped EXE
        PID:1764
      • C:\32788R22FWJFW\nircmd.cfxxe
        "C:\32788R22FWJFW\nircmd.cfxxe" shellcopy C:\Windows\system32\en-us\cmd.exe.mui 32788R22FWJFW\EN-US\cmd.cfxxe.mui yestoall noerrorui silent nosecattr
        2⤵
        • Executes dropped EXE
        PID:1864
      • C:\32788R22FWJFW\n.pif
        "C:\32788R22FWJFW\n.pif" exec hide 32788R22FWJFW\GSAR.cfxxe -if -s\:000M:000i:000c:000r:000o -r\:001M:000i:000c:000r:000o "C:\Windows\system32\cmd.exe" "32788R22FWJFW\cmd.cfxxe"
        2⤵
        • Executes dropped EXE
        • Loads dropped DLL
        PID:2088
        • C:\32788R22FWJFW\GSAR.cfxxe
          32788R22FWJFW\GSAR.cfxxe -if -s\:000M:000i:000c:000r:000o -r\:001M:000i:000c:000r:000o "C:\Windows\system32\cmd.exe" "32788R22FWJFW\cmd.cfxxe"
          3⤵
          • Executes dropped EXE
          PID:1836
      • C:\32788R22FWJFW\nircmd.cfxxe
        "C:\32788R22FWJFW\nircmd.cfxxe" exec hide 32788R22FWJFW\GSAR.cfxxe -if -s\:000M:000i:000c:000r:000o -r\:001M:000i:000c:000r:000o "C:\Windows\system32\cmd.exe" "32788R22FWJFW\cmd.cfxxe"
        2⤵
        • Executes dropped EXE
        • Loads dropped DLL
        PID:3036
        • C:\32788R22FWJFW\GSAR.cfxxe
          32788R22FWJFW\GSAR.cfxxe -if -s\:000M:000i:000c:000r:000o -r\:001M:000i:000c:000r:000o "C:\Windows\system32\cmd.exe" "32788R22FWJFW\cmd.cfxxe"
          3⤵
          • Executes dropped EXE
          PID:2968
      • C:\32788R22FWJFW\n.pif
        "C:\32788R22FWJFW\n.pif" cmdwait 1000 exec hide "32788R22FWJFW\cmd.cfxxe" /c 32788R22FWJFW\p.cmd
        2⤵
        • Executes dropped EXE
        • Loads dropped DLL
        PID:2920
        • C:\32788R22FWJFW\cmd.cfxxe
          "32788R22FWJFW\cmd.cfxxe" /c 32788R22FWJFW\p.cmd
          3⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:2988
          • C:\32788R22FWJFW\pev.exe
            32788R22FWJFW\PEV.exe RIMPORT 32788R22FWJFW\EXE.reg
            4⤵
            • Disables RegEdit via registry modification
            • Event Triggered Execution: Image File Execution Options Injection
            • Executes dropped EXE
            • Impair Defenses: Safe Mode Boot
            • Modifies system executable filetype association
            • Adds Run key to start application
            • Modifies data under HKEY_USERS
            • Modifies registry class
            • System policy modification
            PID:2160
          • C:\32788R22FWJFW\grep.cfxxe
            GREP.cfxxe -F "5.1.2" OsVer
            4⤵
            • Executes dropped EXE
            PID:2096
          • C:\32788R22FWJFW\grep.cfxxe
            GREP.cfxxe -F "6.0.6" OsVer
            4⤵
            • Executes dropped EXE
            PID:348
          • C:\32788R22FWJFW\grep.cfxxe
            GREP.cfxxe -F "6.1.7600" OsVer
            4⤵
            • Executes dropped EXE
            PID:2708
          • C:\32788R22FWJFW\swreg.exe
            SWREG.exe QUERY "hklm\software\microsoft\windows nt\currentversion" /v currentversion
            4⤵
            • Executes dropped EXE
            PID:2816
          • C:\32788R22FWJFW\grep.cfxxe
            GREP.cfxxe -is "currentversion.* 6.[01]" OsVer00
            4⤵
            • Executes dropped EXE
            PID:2604
          • C:\32788R22FWJFW\swreg.exe
            SWREG.exe QUERY "HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_{79007602-0CDB-4405-9DBF-1257BB3226ED}\0000\Control" /v ActiveService
            4⤵
            • Executes dropped EXE
            PID:2672
          • C:\32788R22FWJFW\NirCmd.cfxxe
            NIRCMD.cfxxe WIN CLOSE CLASS "#32770"
            4⤵
            • Executes dropped EXE
            PID:2764
          • C:\32788R22FWJFW\swreg.exe
            SWREG QUERY "HKLM\System\Currentcontrolset\Control\ProductOptions" /v ProductType
            4⤵
            • Executes dropped EXE
            PID:3004
          • C:\32788R22FWJFW\grep.cfxxe
            GREP.cfxxe -isq "ProductType.*WinNT" WinNT00
            4⤵
            • Executes dropped EXE
            PID:3012
          • C:\32788R22FWJFW\pev.exe
            PEV PLIST
            4⤵
            • Executes dropped EXE
            • Suspicious behavior: EnumeratesProcesses
            PID:864
          • C:\32788R22FWJFW\grep.cfxxe
            GREP -Fis "C:\Windows\system32\csrss.exe"
            4⤵
            • Executes dropped EXE
            PID:2044
          • C:\32788R22FWJFW\SWREG.cfxxe
            SWREG ACL "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Windows" /RESET /Q
            4⤵
            • Executes dropped EXE
            PID:1224
          • C:\32788R22FWJFW\SWREG.cfxxe
            SWREG ACL "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Windows" /RO:F /RA:F /Q
            4⤵
            • Executes dropped EXE
            PID:1476
          • C:\Windows\SysWOW64\chcp.com
            CHCP 1252
            4⤵
              PID:2424
            • C:\32788R22FWJFW\NirCmd.cfxxe
              Nircmd.cfxxe infobox "Incompatible OS. ComboFix only works for workstations with Windows 2000 and XP~n~nOS incompatible. ComboFix ne fonctionne que pour Windows 2000 et XP~n~nOS niet compatibel. ComboFix kan enkel gebruikt worden voor Windows 2000 en XP~n~nInkompatibles Betriebssystem. ComboFix läuft nur unter Windows 2000 und XP~n~nKäyttöjärjestelmä ei ole yhteensopiva. ComboFix toimii vain Windows 2000- ja XP-käyttöjärjestelmissä.~n~nSistema Operativo Incompat¡vel. ComboFix apenas funciona em Windows 2000 e XP~n~nSO. Incompatible. ComboFix funciona únicamente en Windows 2000 y XP~n~nOS Incompatibile. Combofix funziona solo su windows 2000 e XP" "Error - Win32 only"
              4⤵
              • Executes dropped EXE
              PID:1060
        • C:\32788R22FWJFW\nircmd.cfxxe
          "C:\32788R22FWJFW\nircmd.cfxxe" cmdwait 1700 exec hide "32788R22FWJFW\cmd.cfxxe" /c 32788R22FWJFW\p.cmd
          2⤵
          • Executes dropped EXE
          PID:3024
          • C:\32788R22FWJFW\cmd.cfxxe
            "32788R22FWJFW\cmd.cfxxe" /c 32788R22FWJFW\p.cmd
            3⤵
            • Executes dropped EXE
            PID:1620
        • C:\32788R22FWJFW\n.pif
          "C:\32788R22FWJFW\n.pif" cmdwait 2500 exec hide "32788R22FWJFW\cmd.cfxxe" /c 32788R22FWJFW\p.cmd
          2⤵
          • Executes dropped EXE
          PID:1480
          • C:\32788R22FWJFW\cmd.cfxxe
            "32788R22FWJFW\cmd.cfxxe" /c 32788R22FWJFW\p.cmd
            3⤵
            • Executes dropped EXE
            PID:1452

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\32788R22FWJFW\Prep.inf
        Filesize

        2KB

        MD5

        1aa16d0f74468cf739427c823e44f693

        SHA1

        ea83e02989f1427fb0f2f1f5eb23e1e125cd5c78

        SHA256

        8419a839e8e106403e2dc8ae73ef9a627bb894b91a5b39e2ad88e62c9d66dc56

        SHA512

        0a403c320ce88bd7b0dcbfcf71e552d08e070fafefeada050c330f01e50cc542726812026d18b14216be49ca608197630b65f23fc32b89268b8bb86de7c35782

        Download Submit

      • C:\32788R22FWJFW\hidec.exe
        Filesize

        1KB

        MD5

        abc6379205de2618851c4fcbf72112eb

        SHA1

        1ed7b1e965eab56f55efda975f9f7ade95337267

        SHA256

        22e7528e56dffaa26cfe722994655686c90824b13eb51184abfe44d4e95d473f

        SHA512

        180c7f400dd13092b470e3a91bf02e98ef6247c1193bf349e3710e8d1e9003f3bc9b792bb776eacb746e9c67b3041f2333cc07f28c5f046d59274742230fb7c1

        Download Submit

      • C:\32788R22FWJFW\n.pif
        Filesize

        30KB

        MD5

        ae72e8619cb31d84da25e2435e55003c

        SHA1

        2ed893a9aa82da248b5f4344819fcf6ad2d28240

        SHA256

        eccf9f7bb602e25cf9383be7856318c1fa679c0c4a354966b0ed723da17e8d24

        SHA512

        1013c5f0a25b3dfc3daa3d7dec9f16c0fc89e9672a7f400145973e4427db331cf8be6ea42a0d6cd225eccb2b88f05bf0237342a35276c8689f320121e386c982

        Download Submit

      • C:\32788R22FWJFW\swreg.exe
        Filesize

        158KB

        MD5

        01d95a1f8cf13d07cc564aabb36bcc0b

        SHA1

        be229bde90b82d21fe94c67e2b096334e93d78c2

        SHA256

        1eed7a2498943b7303de1f085820edbabae4a414db6125862c1ba2db269ee3e3

        SHA512

        342c92b9e6d6870a43c973dd2b52549f8925eec9b153056db336184243f08eb932aa1e433e7d950bbb0d4e46faa95d04f0283b48d4361653d9b81311ab2b3a48

        Download Submit

      • C:\\32788R22FWJFW\EXE.reg
        Filesize

        13KB

        MD5

        3c76471e2e02fb0a60fce98120ac607d

        SHA1

        4c3f336111cb4223e6e011033af85edf7fc13fb2

        SHA256

        3421abc6b631a78fe18152dc7391154224097e62944cc93b801d76a2e7f308f2

        SHA512

        59c20586e655cd0180c017b1000b38879b477040c923642730cabc3941b8da70d5e82274e46ca626f4c859deb15d03183bda9173a006e105805668eba1979ef0

        Download Submit

      • \32788R22FWJFW\License\iexplore.exe
        Filesize

        250KB

        MD5

        f1fba6185a6a2bc6456970914875078e

        SHA1

        a3a0da9b072ad4ceab9aec41af71a730d9b44744

        SHA256

        deaaab3b825ebadb6395e0be7671f96fd30ca8f76159b53c2d11da5c2ca7b7d0

        SHA512

        45cd68a2465d5aa24a693f5bdec9999fee1117e4329d4ae2e1d51a923d42d717e1d09eff9f9e11f3282ebc32422640028d64bf108f9d3d9c49bcd1df6b14212a

        Download Submit

      • \32788R22FWJFW\swxcacls.cfxxe
        Filesize

        207KB

        MD5

        b1a9cf0b6f80611d31987c247ec630b4

        SHA1

        7299b3c370254e1e4bade26dc5fec818989d836a

        SHA256

        933756962d8a3530c50072e03af9e0eb0bede3c7af58feda3518240e851071ef

        SHA512

        152e24b5490c3e15ec7cf6db0e6573cd75846be6b1472165d055255a9b74a22d929bf8bef1c3f8e31333577d806d600239dde2dfbb463cc62987bac62706b9e1

        Download Submit

      • memory/324-490-0x0000000000400000-0x000000000048B000-memory.dmp

        Filesize

        556KB

        Download

      • memory/348-559-0x0000000000400000-0x0000000000417000-memory.dmp

        Filesize

        92KB

        Download

      • memory/548-470-0x0000000000400000-0x000000000048B000-memory.dmp

        Filesize

        556KB

        Download

      • memory/588-346-0x0000000000400000-0x0000000000414000-memory.dmp

        Filesize

        80KB

        Download

      • memory/588-354-0x0000000000400000-0x0000000000414000-memory.dmp

        Filesize

        80KB

        Download

      • memory/864-586-0x0000000000ED0000-0x0000000000FA1000-memory.dmp

        Filesize

        836KB

        Download

      • memory/864-584-0x0000000000ED0000-0x0000000000FA1000-memory.dmp

        Filesize

        836KB

        Download

      • memory/888-356-0x0000000000400000-0x0000000000402000-memory.dmp

        Filesize

        8KB

        Download

      • memory/1056-468-0x0000000000400000-0x000000000043E000-memory.dmp

        Filesize

        248KB

        Download

      • memory/1224-590-0x0000000000400000-0x000000000048B000-memory.dmp

        Filesize

        556KB

        Download

      • memory/1224-591-0x0000000000400000-0x000000000048B000-memory.dmp

        Filesize

        556KB

        Download

      • memory/1392-451-0x0000000001B90000-0x0000000001C1B000-memory.dmp

        Filesize

        556KB

        Download

      • memory/1476-594-0x0000000000400000-0x000000000048B000-memory.dmp

        Filesize

        556KB

        Download

      • memory/1476-415-0x0000000000400000-0x0000000000402000-memory.dmp

        Filesize

        8KB

        Download

      • memory/1476-595-0x0000000000400000-0x000000000048B000-memory.dmp

        Filesize

        556KB

        Download

      • memory/1552-363-0x0000000000280000-0x0000000000351000-memory.dmp

        Filesize

        836KB

        Download

      • memory/1552-377-0x0000000000280000-0x0000000000351000-memory.dmp

        Filesize

        836KB

        Download

      • memory/1656-431-0x0000000000E80000-0x0000000000F51000-memory.dmp

        Filesize

        836KB

        Download

      • memory/1656-463-0x0000000000E80000-0x0000000000F51000-memory.dmp

        Filesize

        836KB

        Download

      • memory/1660-458-0x0000000000400000-0x000000000048B000-memory.dmp

        Filesize

        556KB

        Download

      • memory/1660-471-0x0000000000400000-0x000000000048B000-memory.dmp

        Filesize

        556KB

        Download

      • memory/1668-506-0x0000000000400000-0x000000000048B000-memory.dmp

        Filesize

        556KB

        Download

      • memory/1684-526-0x0000000000400000-0x000000000048B000-memory.dmp

        Filesize

        556KB

        Download

      • memory/1684-528-0x0000000000400000-0x000000000048B000-memory.dmp

        Filesize

        556KB

        Download

      • memory/1976-436-0x0000000000400000-0x0000000000402000-memory.dmp

        Filesize

        8KB

        Download

      • memory/2044-585-0x0000000000400000-0x0000000000417000-memory.dmp

        Filesize

        92KB

        Download

      • memory/2088-534-0x0000000000400000-0x0000000000414000-memory.dmp

        Filesize

        80KB

        Download

      • memory/2096-558-0x0000000000400000-0x0000000000417000-memory.dmp

        Filesize

        92KB

        Download

      • memory/2160-556-0x0000000000ED0000-0x0000000000FA1000-memory.dmp

        Filesize

        836KB

        Download

      • memory/2160-555-0x0000000000ED0000-0x0000000000FA1000-memory.dmp

        Filesize

        836KB

        Download

      • memory/2192-332-0x0000000000400000-0x0000000000414000-memory.dmp

        Filesize

        80KB

        Download

      • memory/2192-337-0x0000000000400000-0x0000000000414000-memory.dmp

        Filesize

        80KB

        Download

      • memory/2360-467-0x0000000000400000-0x000000000048B000-memory.dmp

        Filesize

        556KB

        Download

      • memory/2560-547-0x0000000003610000-0x0000000003624000-memory.dmp

        Filesize

        80KB

        Download

      • memory/2560-394-0x0000000003400000-0x0000000003414000-memory.dmp

        Filesize

        80KB

        Download

      • memory/2560-460-0x0000000003610000-0x0000000003624000-memory.dmp

        Filesize

        80KB

        Download

      • memory/2560-435-0x0000000003610000-0x0000000003612000-memory.dmp

        Filesize

        8KB

        Download

      • memory/2560-452-0x0000000003610000-0x0000000003624000-memory.dmp

        Filesize

        80KB

        Download

      • memory/2560-461-0x0000000003610000-0x0000000003624000-memory.dmp

        Filesize

        80KB

        Download

      • memory/2560-437-0x0000000003610000-0x0000000003612000-memory.dmp

        Filesize

        8KB

        Download

      • memory/2560-414-0x0000000003610000-0x0000000003612000-memory.dmp

        Filesize

        8KB

        Download

      • memory/2560-413-0x0000000003610000-0x0000000003612000-memory.dmp

        Filesize

        8KB

        Download

      • memory/2560-603-0x0000000000400000-0x0000000000428000-memory.dmp

        Filesize

        160KB

        Download

      • memory/2560-486-0x0000000003610000-0x0000000003624000-memory.dmp

        Filesize

        80KB

        Download

      • memory/2560-596-0x0000000003760000-0x0000000003774000-memory.dmp

        Filesize

        80KB

        Download

      • memory/2560-459-0x0000000003610000-0x0000000003624000-memory.dmp

        Filesize

        80KB

        Download

      • memory/2560-505-0x0000000003610000-0x0000000003624000-memory.dmp

        Filesize

        80KB

        Download

      • memory/2560-338-0x0000000003410000-0x0000000003424000-memory.dmp

        Filesize

        80KB

        Download

      • memory/2560-513-0x0000000003610000-0x0000000003624000-memory.dmp

        Filesize

        80KB

        Download

      • memory/2560-521-0x0000000003760000-0x0000000003774000-memory.dmp

        Filesize

        80KB

        Download

      • memory/2560-588-0x0000000003610000-0x0000000003624000-memory.dmp

        Filesize

        80KB

        Download

      • memory/2560-393-0x0000000003610000-0x0000000003624000-memory.dmp

        Filesize

        80KB

        Download

      • memory/2560-358-0x0000000003410000-0x0000000003412000-memory.dmp

        Filesize

        8KB

        Download

      • memory/2560-533-0x0000000003610000-0x0000000003624000-memory.dmp

        Filesize

        80KB

        Download

      • memory/2560-357-0x0000000003410000-0x0000000003412000-memory.dmp

        Filesize

        8KB

        Download

      • memory/2560-0-0x0000000000400000-0x0000000000428000-memory.dmp

        Filesize

        160KB

        Download

      • memory/2560-391-0x0000000000400000-0x0000000000428000-memory.dmp

        Filesize

        160KB

        Download

      • memory/2560-554-0x0000000003610000-0x0000000003624000-memory.dmp

        Filesize

        80KB

        Download

      • memory/2560-327-0x0000000003400000-0x0000000003414000-memory.dmp

        Filesize

        80KB

        Download

      • memory/2560-380-0x0000000003610000-0x0000000003624000-memory.dmp

        Filesize

        80KB

        Download

      • memory/2560-378-0x0000000003610000-0x0000000003624000-memory.dmp

        Filesize

        80KB

        Download

      • memory/2560-326-0x0000000003400000-0x0000000003414000-memory.dmp

        Filesize

        80KB

        Download

      • memory/2560-593-0x0000000003610000-0x0000000003624000-memory.dmp

        Filesize

        80KB

        Download

      • memory/2560-568-0x0000000003610000-0x0000000003624000-memory.dmp

        Filesize

        80KB

        Download

      • memory/2604-565-0x0000000000400000-0x0000000000417000-memory.dmp

        Filesize

        92KB

        Download

      • memory/2624-397-0x0000000000400000-0x0000000000414000-memory.dmp

        Filesize

        80KB

        Download

      • memory/2672-567-0x0000000000400000-0x000000000048B000-memory.dmp

        Filesize

        556KB

        Download

      • memory/2708-560-0x0000000000400000-0x0000000000417000-memory.dmp

        Filesize

        92KB

        Download

      • memory/2816-562-0x0000000000400000-0x000000000048B000-memory.dmp

        Filesize

        556KB

        Download

      • memory/2816-561-0x0000000000400000-0x000000000048B000-memory.dmp

        Filesize

        556KB

        Download

      • memory/2912-383-0x00000000001C0000-0x0000000000291000-memory.dmp

        Filesize

        836KB

        Download

      • memory/2912-367-0x00000000001C0000-0x0000000000291000-memory.dmp

        Filesize

        836KB

        Download

      • memory/2920-548-0x0000000000400000-0x0000000000414000-memory.dmp

        Filesize

        80KB

        Download

      • memory/2940-491-0x0000000000400000-0x000000000048B000-memory.dmp

        Filesize

        556KB

        Download

      • memory/2988-382-0x0000000000400000-0x0000000000414000-memory.dmp

        Filesize

        80KB

        Download

      • memory/3004-574-0x0000000000400000-0x000000000048B000-memory.dmp

        Filesize

        556KB

        Download

      • memory/3012-575-0x0000000000400000-0x0000000000417000-memory.dmp

        Filesize

        92KB

        Download

      • memory/3028-472-0x0000000000400000-0x000000000048B000-memory.dmp

        Filesize

        556KB

        Download

      • memory/3056-398-0x00000000002F0000-0x00000000003C1000-memory.dmp

        Filesize

        836KB

        Download

      • memory/3056-400-0x00000000002F0000-0x00000000003C1000-memory.dmp

        Filesize

        836KB

        Download