4a1a95ffdc39bccafc52371bdb24a0e7ddc29126de35b6a2a82cb7ef1571bee8

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
19/08/2024, 14:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ab72db64012286a61a186c25e82f1479_JaffaCakes118.exe
Size

662KB
MD5

ab72db64012286a61a186c25e82f1479
SHA1

51dfa6b731ca348764283f6354ccbe7a6ce8bc7f
SHA256

4a1a95ffdc39bccafc52371bdb24a0e7ddc29126de35b6a2a82cb7ef1571bee8
SHA512

17fe1df9aff9768cb6faffd38f45c1ce176b2dc46642b1b3bf6cd1f18491476ddaaa57a8d545a703e4a40dbcf5759f99f990660cb84aada54e914bd65ff30585
SSDEEP

12288:+vcRKBn3quEXCS71DW91IZU5hUkVpmM7ehBMsPtZL1ir:48u3qcSBDnZUECpm3KsPHRM

Score

7^/10

discovery persistence

Malware Config

Signatures

Executes dropped EXE 3 IoCs

pid	Process
1568	fxinst.exe
4520	PPTV(pplive)_forll_0005.exe
464	fengxing.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fxinst.exe = "\"C:\\autofx\\fxinst.exe\""	fxinst.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\TencenQQ = "C:\\autopplv\\fengxing.exe"	fengxing.exe

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\FunshionInstall_C71031.exe.log	fxinst.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fengxing.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ab72db64012286a61a186c25e82f1479_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fxinst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PPTV(pplive)_forll_0005.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 5 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\shell\OpenHomePage\Command	fengxing.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID	fengxing.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}	fengxing.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\shell	fengxing.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\shell\OpenHomePage	fengxing.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
2072	ab72db64012286a61a186c25e82f1479_JaffaCakes118.exe
2072	ab72db64012286a61a186c25e82f1479_JaffaCakes118.exe
4080	msedge.exe
4080	msedge.exe
4244	msedge.exe
4244	msedge.exe
1692	identity_helper.exe
1692	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2072 wrote to memory of 1568	2072	ab72db64012286a61a186c25e82f1479_JaffaCakes118.exe	89
PID 2072 wrote to memory of 1568	2072	ab72db64012286a61a186c25e82f1479_JaffaCakes118.exe	89
PID 2072 wrote to memory of 1568	2072	ab72db64012286a61a186c25e82f1479_JaffaCakes118.exe	89
PID 2072 wrote to memory of 4520	2072	ab72db64012286a61a186c25e82f1479_JaffaCakes118.exe	103
PID 2072 wrote to memory of 4520	2072	ab72db64012286a61a186c25e82f1479_JaffaCakes118.exe	103
PID 2072 wrote to memory of 4520	2072	ab72db64012286a61a186c25e82f1479_JaffaCakes118.exe	103
PID 2072 wrote to memory of 464	2072	ab72db64012286a61a186c25e82f1479_JaffaCakes118.exe	105
PID 2072 wrote to memory of 464	2072	ab72db64012286a61a186c25e82f1479_JaffaCakes118.exe	105
PID 2072 wrote to memory of 464	2072	ab72db64012286a61a186c25e82f1479_JaffaCakes118.exe	105
PID 464 wrote to memory of 4244	464	fengxing.exe	114
PID 464 wrote to memory of 4244	464	fengxing.exe	114
PID 4244 wrote to memory of 4416	4244	msedge.exe	115
PID 4244 wrote to memory of 4416	4244	msedge.exe	115
PID 4244 wrote to memory of 628	4244	msedge.exe	116
PID 4244 wrote to memory of 628	4244	msedge.exe	116
PID 4244 wrote to memory of 628	4244	msedge.exe	116
PID 4244 wrote to memory of 628	4244	msedge.exe	116
PID 4244 wrote to memory of 628	4244	msedge.exe	116
PID 4244 wrote to memory of 628	4244	msedge.exe	116
PID 4244 wrote to memory of 628	4244	msedge.exe	116
PID 4244 wrote to memory of 628	4244	msedge.exe	116
PID 4244 wrote to memory of 628	4244	msedge.exe	116
PID 4244 wrote to memory of 628	4244	msedge.exe	116
PID 4244 wrote to memory of 628	4244	msedge.exe	116
PID 4244 wrote to memory of 628	4244	msedge.exe	116
PID 4244 wrote to memory of 628	4244	msedge.exe	116
PID 4244 wrote to memory of 628	4244	msedge.exe	116
PID 4244 wrote to memory of 628	4244	msedge.exe	116
PID 4244 wrote to memory of 628	4244	msedge.exe	116
PID 4244 wrote to memory of 628	4244	msedge.exe	116
PID 4244 wrote to memory of 628	4244	msedge.exe	116
PID 4244 wrote to memory of 628	4244	msedge.exe	116
PID 4244 wrote to memory of 628	4244	msedge.exe	116
PID 4244 wrote to memory of 628	4244	msedge.exe	116
PID 4244 wrote to memory of 628	4244	msedge.exe	116
PID 4244 wrote to memory of 628	4244	msedge.exe	116
PID 4244 wrote to memory of 628	4244	msedge.exe	116
PID 4244 wrote to memory of 628	4244	msedge.exe	116
PID 4244 wrote to memory of 628	4244	msedge.exe	116
PID 4244 wrote to memory of 628	4244	msedge.exe	116
PID 4244 wrote to memory of 628	4244	msedge.exe	116
PID 4244 wrote to memory of 628	4244	msedge.exe	116
PID 4244 wrote to memory of 628	4244	msedge.exe	116
PID 4244 wrote to memory of 628	4244	msedge.exe	116
PID 4244 wrote to memory of 628	4244	msedge.exe	116
PID 4244 wrote to memory of 628	4244	msedge.exe	116
PID 4244 wrote to memory of 628	4244	msedge.exe	116
PID 4244 wrote to memory of 628	4244	msedge.exe	116
PID 4244 wrote to memory of 628	4244	msedge.exe	116
PID 4244 wrote to memory of 628	4244	msedge.exe	116
PID 4244 wrote to memory of 628	4244	msedge.exe	116
PID 4244 wrote to memory of 628	4244	msedge.exe	116
PID 4244 wrote to memory of 628	4244	msedge.exe	116
PID 4244 wrote to memory of 4080	4244	msedge.exe	117
PID 4244 wrote to memory of 4080	4244	msedge.exe	117
PID 4244 wrote to memory of 1940	4244	msedge.exe	118
PID 4244 wrote to memory of 1940	4244	msedge.exe	118
PID 4244 wrote to memory of 1940	4244	msedge.exe	118
PID 4244 wrote to memory of 1940	4244	msedge.exe	118
PID 4244 wrote to memory of 1940	4244	msedge.exe	118
PID 4244 wrote to memory of 1940	4244	msedge.exe	118
PID 4244 wrote to memory of 1940	4244	msedge.exe	118
PID 4244 wrote to memory of 1940	4244	msedge.exe	118
PID 4244 wrote to memory of 1940	4244	msedge.exe	118

C:\Users\Admin\AppData\Local\Temp\ab72db64012286a61a186c25e82f1479_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\ab72db64012286a61a186c25e82f1479_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2072
- C:\autofx\fxinst.exe
  C:\autofx\fxinst.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  PID:1568
- C:\PPTV(pplive)_forll_0005.exe
  C:\PPTV(pplive)_forll_0005.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4520
- C:\autopplv\fengxing.exe
  C:\autopplv\fengxing.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:464
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://qq9338.x90.804.cn/down/accesslog.asp?action=log
    3⤵
    - Enumerates system info in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of WriteProcessMemory
    PID:4244
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xdc,0x108,0x7ffc5af346f8,0x7ffc5af34708,0x7ffc5af34718
      4⤵
      PID:4416
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1960,15387440803030942471,1903750147119653668,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2056 /prefetch:2
      4⤵
      PID:628
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1960,15387440803030942471,1903750147119653668,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2564 /prefetch:3
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:4080
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1960,15387440803030942471,1903750147119653668,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2972 /prefetch:8
      4⤵
      PID:1940
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,15387440803030942471,1903750147119653668,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3336 /prefetch:1
      4⤵
      PID:4196
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,15387440803030942471,1903750147119653668,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3380 /prefetch:1
      4⤵
      PID:3960
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1960,15387440803030942471,1903750147119653668,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5180 /prefetch:8
      4⤵
      PID:3640
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1960,15387440803030942471,1903750147119653668,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5180 /prefetch:8
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:1692
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,15387440803030942471,1903750147119653668,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4028 /prefetch:1
      4⤵
      PID:5108
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,15387440803030942471,1903750147119653668,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5280 /prefetch:1
      4⤵
      PID:2656
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,15387440803030942471,1903750147119653668,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3448 /prefetch:1
      4⤵
      PID:2844
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,15387440803030942471,1903750147119653668,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5644 /prefetch:1
      4⤵
      PID:1060
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,15387440803030942471,1903750147119653668,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6136 /prefetch:1
      4⤵
      PID:1292
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,15387440803030942471,1903750147119653668,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3644 /prefetch:1
      4⤵
      PID:1576

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4940

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3004

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\PPTV(pplive)_forll_0005.exe

Filesize
61KB

MD5
bb53abced1a2ff27caa8c40305f2c5d5

SHA1
837335d9d2330e2f2b045db8f0b750185cb7eeb5

SHA256
1618cecf3d9d5ac4d5ccadbe53768d3771d78cd83b044c44be6d800ec194c96e

SHA512
07128af5cf1337f39ec5f4f3e4a5820d4c719274b276069d771207b40479a97031b70cdbe728d79f6fde720043097ca306606939778d3c6ef24b4ad474c68504

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
b9569e123772ae290f9bac07e0d31748

SHA1
5806ed9b301d4178a959b26d7b7ccf2c0abc6741

SHA256
20ab88e23fb88186b82047cd0d6dc3cfa23422e4fd2b8f3c8437546a2a842c2b

SHA512
cfad8ce716ac815b37e8cc0e30141bfb3ca7f0d4ef101289bddcf6ed3c579bc34d369f2ec2f2dab98707843015633988eb97f1e911728031dd897750b8587795

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
eeaa8087eba2f63f31e599f6a7b46ef4

SHA1
f639519deee0766a39cfe258d2ac48e3a9d5ac03

SHA256
50fe80c9435f601c30517d10f6a8a0ca6ff8ca2add7584df377371b5a5dbe2d9

SHA512
eaabfad92c84f422267615c55a863af12823c5e791bdcb30cabe17f72025e07df7383cf6cf0f08e28aa18a31c2aac5985cf5281a403e22fbcc1fb5e61c49fc3c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
027df941faa1bd3ae0142e7267e3491e

SHA1
27691134bd5450810fa9cbfb0f6d470a34a904fd

SHA256
5ea1384d9f9a8d1949526902bdffa2a14678da575d1cac14e79be6215eb4c60d

SHA512
d8896511f7b5277bf7f01473c7cb555200ffe77e99c35d0982c415387aaa5438b42e0e7289186b1e9a8932edec699be9529a6b654bcf658c484a91cca857e121

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
428e4457974da08623844b15cb2e5c9c

SHA1
3768dbff62b65eaed08e9df584ee1b1b08cfd4b3

SHA256
ab47d397f30f1b4bd60cb7c6777ba012905c2a464346e24355029ace76f20b19

SHA512
142bc28fa752af758a8ae269d6b6aeb7ff517cf854d3f832ff23f014d42e3546f30b2d45e751c5a847a25f857d4aba200ca4c86aab974688623d7486fd4e9678

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
67332a6baf0be0ff101c0e5ad2abeff6

SHA1
36e2947b12e7bdd9b713660837039bb350eef0cf

SHA256
2d094ea70387e5ba82d97f5a37dd2c80ab5f52b9cfd18d77d5a92d67e258c92a

SHA512
83d9e6619c186a1bb09eef1ad37ef0adc8b871cca1228b2696cf046d70296ec743cba43dd3115c3d23e364020c1092cf070c15f672ae0050729077aaca5d46c8

Download Submit
C:\autofx\fxinst.exe

Filesize
83KB

MD5
d553bbcea4f67035c6ae672c95c3b798

SHA1
c3071721cc4be08f3a6206ad149ea8143293fbeb

SHA256
99cbc00570f9d7f78156fe3439045870ba3a94d87e8db3e6438bc6eea95081f2

SHA512
4327cd3b7905a638b245f7a16c38696bd4ba118ca52a1409abf965322e7508bd1af419c7cd2c1f42519551d71436f547b2689fe7644b45b7f876aa11ae442dc8

Download Submit
C:\autopplv\fengxing.exe

Filesize
41KB

MD5
45762eb6a80d43843395a6678b886057

SHA1
c94cd0fb274e41f7b8a0b8a0de0048cab9ab66ec

SHA256
0d535c210410882d16f39a2a2030e16710daf8feb18aaf12d5d1428fcefb6e94

SHA512
ed5d0e7405cabdd6c26c625827660c60adda3e1fd2e312c9ddf5e4f929019ddc0d97d9d4a73a0c5ec3c194ed606efd1044cf28c5495638270479b9caae6f34f0

Download Submit
memory/464-43-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/464-40-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/464-34-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/464-79-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/464-101-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/1568-36-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/1568-16-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/1568-78-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/1568-8-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/2072-47-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download
memory/2072-7-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download