Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    179s
  • max time network
    181s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    23/08/2024, 18:51

General

  • Target

    Retrac.Launcher_1.0.11_x64_en-US.msi

  • Size

    6.5MB

  • MD5

    4eb0f591d4635eef867eba6b30519482

  • SHA1

    ffbdf0b4e300686d4c637ec9ae1e93f5fe31d1e1

  • SHA256

    d1861ff47ec977e9ce72cbeab98d2838f5981adb6ee8800ef41c59ab2bcda26b

  • SHA512

    4f9d7827508e8491af2df7e3adcc9da47871546284381e9873283c00a81a98a0aa4cc60cfc3a2e61247ec13f1de08c72818096b56613be569b83fb1e6d56b4ee

  • SSDEEP

    196608:Ky/Pz3ZHXtF+An59GSwXYUNtJo47IE4xLwe:KAbJtlu71jJo/Lwe

Malware Config

Signatures

  • Blocklisted process makes network request 3 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

    Run Powershell and hide display window.

  • Checks whether UAC is enabled 1 TTPs 1 IoCs
  • Downloads MZ/PE file
  • Enumerates connected drives 3 TTPs 46 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Event Triggered Execution: Image File Execution Options Injection 1 TTPs 2 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 6 IoCs
  • Network Share Discovery 1 TTPs

    Attempt to gather information on host network.

  • Checks computer location settings 2 TTPs 3 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Event Triggered Execution: Component Object Model Hijacking 1 TTPs

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Checks system information in the registry 2 TTPs 12 IoCs

    System information is often read in order to detect sandboxing environments.

  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 10 IoCs
  • Executes dropped EXE 22 IoCs
  • Loads dropped DLL 38 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 10 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 5 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

  • Checks SCSI registry key(s) 3 TTPs 5 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 6 IoCs
  • Kills process with taskkill 6 IoCs
  • Modifies data under HKEY_USERS 46 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 31 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • System policy modification 1 TTPs 1 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

Processes

  • C:\Windows\system32\msiexec.exe
    msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\Retrac.Launcher_1.0.11_x64_en-US.msi
    1⤵
    • Enumerates connected drives
    • Event Triggered Execution: Installer Packages
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    PID:4228
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Enumerates connected drives
    • Drops file in Windows directory
    • Modifies data under HKEY_USERS
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2864
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding B9CE96ECFC40077582D0D5B1E2959F28 C
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:3436
      • C:\Program Files\Retrac Launcher\Retrac Launcher.exe
        "C:\Program Files\Retrac Launcher\Retrac Launcher.exe"
        3⤵
        • Checks whether UAC is enabled
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of WriteProcessMemory
        PID:2824
        • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\128.0.2739.42\msedgewebview2.exe
          "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\128.0.2739.42\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name="Retrac Launcher.exe" --webview-exe-version=1.0.11 --user-data-dir="C:\Users\Admin\AppData\Local\site.retrac\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --enable-features=MojoIpcz --lang=en-US --mojo-named-platform-channel-pipe=2824.3064.14921732663332028076
          4⤵
          • Checks computer location settings
          • Checks system information in the registry
          • Executes dropped EXE
          • Loads dropped DLL
          • Enumerates system info in registry
          • Modifies data under HKEY_USERS
          • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
          • Suspicious use of WriteProcessMemory
          • System policy modification
          PID:736
          • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\128.0.2739.42\msedgewebview2.exe
            "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\128.0.2739.42\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\site.retrac\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\site.retrac\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=128.0.6613.85 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\128.0.2739.42\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=128.0.2739.42 --initial-client-data=0x15c,0x160,0x164,0x138,0x198,0x7ffaa7fa9fd8,0x7ffaa7fa9fe4,0x7ffaa7fa9ff0
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            PID:1192
          • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\128.0.2739.42\msedgewebview2.exe
            "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\128.0.2739.42\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\site.retrac\EBWebView" --webview-exe-name="Retrac Launcher.exe" --webview-exe-version=1.0.11 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=1848,i,2008121115238167912,9004531084044623169,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=1844 /prefetch:2
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            PID:2544
          • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\128.0.2739.42\msedgewebview2.exe
            "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\128.0.2739.42\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\site.retrac\EBWebView" --webview-exe-name="Retrac Launcher.exe" --webview-exe-version=1.0.11 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --field-trial-handle=1900,i,2008121115238167912,9004531084044623169,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=2224 /prefetch:3
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            PID:1852
          • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\128.0.2739.42\msedgewebview2.exe
            "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\128.0.2739.42\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\site.retrac\EBWebView" --webview-exe-name="Retrac Launcher.exe" --webview-exe-version=1.0.11 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --field-trial-handle=2260,i,2008121115238167912,9004531084044623169,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=2380 /prefetch:8
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            PID:2816
          • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\128.0.2739.42\msedgewebview2.exe
            "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\128.0.2739.42\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\site.retrac\EBWebView" --webview-exe-name="Retrac Launcher.exe" --webview-exe-version=1.0.11 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --field-trial-handle=3396,i,2008121115238167912,9004531084044623169,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=3408 /prefetch:1
            5⤵
            • Checks computer location settings
            • Executes dropped EXE
            • Loads dropped DLL
            PID:4476
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://discord.com/oauth2/authorize?client_id=1212184991732080700&redirect_uri=https%3A%2F%2Fretrac.site%2Fretrac%2Fdiscord&response_type=code&scope=identify
          4⤵
          • Enumerates system info in registry
          • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SendNotifyMessage
          PID:560
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffaa9ab46f8,0x7ffaa9ab4708,0x7ffaa9ab4718
            5⤵
              PID:3220
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2156,16042722612993806430,11010636736404419201,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2172 /prefetch:2
              5⤵
                PID:4576
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2156,16042722612993806430,11010636736404419201,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2452 /prefetch:3
                5⤵
                  PID:4060
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2156,16042722612993806430,11010636736404419201,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2824 /prefetch:8
                  5⤵
                    PID:3576
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,16042722612993806430,11010636736404419201,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3368 /prefetch:1
                    5⤵
                      PID:5132
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,16042722612993806430,11010636736404419201,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3376 /prefetch:1
                      5⤵
                        PID:5164
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2156,16042722612993806430,11010636736404419201,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=4752 /prefetch:8
                        5⤵
                          PID:5596
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2156,16042722612993806430,11010636736404419201,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=4112 /prefetch:8
                          5⤵
                            PID:5604
                        • C:\Windows\system32\cmd.exe
                          "cmd" /C "taskkill /F /IM" EpicGamesLauncher.exe
                          4⤵
                            PID:4928
                            • C:\Windows\system32\taskkill.exe
                              taskkill /F /IM EpicGamesLauncher.exe
                              5⤵
                              • Kills process with taskkill
                              PID:5656
                          • C:\Windows\system32\cmd.exe
                            "cmd" /C "taskkill /F /IM" FortniteLauncher.exe
                            4⤵
                              PID:1576
                              • C:\Windows\system32\taskkill.exe
                                taskkill /F /IM FortniteLauncher.exe
                                5⤵
                                • Kills process with taskkill
                                PID:5708
                            • C:\Windows\system32\cmd.exe
                              "cmd" /C "taskkill /F /IM" FortniteClient-Win64-Shipping_EAC.exe
                              4⤵
                              • System Network Configuration Discovery: Internet Connection Discovery
                              PID:5936
                              • C:\Windows\system32\taskkill.exe
                                taskkill /F /IM FortniteClient-Win64-Shipping_EAC.exe
                                5⤵
                                • Kills process with taskkill
                                PID:5316
                            • C:\Windows\system32\cmd.exe
                              "cmd" /C "taskkill /F /IM" FortniteClient-Win64-Shipping.exe
                              4⤵
                              • System Network Configuration Discovery: Internet Connection Discovery
                              PID:5712
                              • C:\Windows\system32\taskkill.exe
                                taskkill /F /IM FortniteClient-Win64-Shipping.exe
                                5⤵
                                • Kills process with taskkill
                                PID:5664
                            • C:\Windows\system32\cmd.exe
                              "cmd" /C "taskkill /F /IM" EasyAntiCheat_EOS.exe
                              4⤵
                                PID:2620
                                • C:\Windows\system32\taskkill.exe
                                  taskkill /F /IM EasyAntiCheat_EOS.exe
                                  5⤵
                                  • Kills process with taskkill
                                  PID:5700
                              • C:\Windows\system32\cmd.exe
                                "cmd" /C "taskkill /F /IM" EpicWebHelper.exe
                                4⤵
                                  PID:5608
                                  • C:\Windows\system32\taskkill.exe
                                    taskkill /F /IM EpicWebHelper.exe
                                    5⤵
                                    • Kills process with taskkill
                                    PID:5668
                            • C:\Windows\system32\srtasks.exe
                              C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
                              2⤵
                                PID:1500
                              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                powershell.exe -NoProfile -windowstyle hidden try { [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12 } catch {}; Invoke-WebRequest -Uri "https://go.microsoft.com/fwlink/p/?LinkId=2124703" -OutFile "$env:TEMP\MicrosoftEdgeWebview2Setup.exe" ; Start-Process -FilePath "$env:TEMP\MicrosoftEdgeWebview2Setup.exe" -ArgumentList ('/silent', '/install') -Wait
                                2⤵
                                • Blocklisted process makes network request
                                • Command and Scripting Interpreter: PowerShell
                                • Suspicious behavior: EnumeratesProcesses
                                • Suspicious use of WriteProcessMemory
                                PID:2544
                                • C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeWebview2Setup.exe
                                  "C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeWebview2Setup.exe" /silent /install
                                  3⤵
                                  • Drops file in Program Files directory
                                  • Executes dropped EXE
                                  • System Location Discovery: System Language Discovery
                                  • Suspicious use of WriteProcessMemory
                                  PID:1116
                                  • C:\Program Files (x86)\Microsoft\Temp\EU21FA.tmp\MicrosoftEdgeUpdate.exe
                                    "C:\Program Files (x86)\Microsoft\Temp\EU21FA.tmp\MicrosoftEdgeUpdate.exe" /silent /install "appguid={F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}&appname=Microsoft%20Edge%20Webview2%20Runtime&needsadmin=prefers"
                                    4⤵
                                    • Event Triggered Execution: Image File Execution Options Injection
                                    • Checks computer location settings
                                    • Checks system information in the registry
                                    • Executes dropped EXE
                                    • Loads dropped DLL
                                    • System Location Discovery: System Language Discovery
                                    • Suspicious behavior: EnumeratesProcesses
                                    • Suspicious use of WriteProcessMemory
                                    PID:4504
                                    • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
                                      "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regsvc
                                      5⤵
                                      • Executes dropped EXE
                                      • Loads dropped DLL
                                      • System Location Discovery: System Language Discovery
                                      • Modifies registry class
                                      PID:3356
                                    • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
                                      "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regserver
                                      5⤵
                                      • Executes dropped EXE
                                      • Loads dropped DLL
                                      • System Location Discovery: System Language Discovery
                                      • Modifies registry class
                                      • Suspicious use of WriteProcessMemory
                                      PID:2160
                                      • C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.195.15\MicrosoftEdgeUpdateComRegisterShell64.exe
                                        "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.195.15\MicrosoftEdgeUpdateComRegisterShell64.exe"
                                        6⤵
                                        • Executes dropped EXE
                                        • Loads dropped DLL
                                        • Modifies registry class
                                        PID:4536
                                      • C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.195.15\MicrosoftEdgeUpdateComRegisterShell64.exe
                                        "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.195.15\MicrosoftEdgeUpdateComRegisterShell64.exe"
                                        6⤵
                                        • Executes dropped EXE
                                        • Loads dropped DLL
                                        • Modifies registry class
                                        PID:3940
                                      • C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.195.15\MicrosoftEdgeUpdateComRegisterShell64.exe
                                        "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.195.15\MicrosoftEdgeUpdateComRegisterShell64.exe"
                                        6⤵
                                        • Executes dropped EXE
                                        • Loads dropped DLL
                                        • Modifies registry class
                                        PID:2780
                                    • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
                                      "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xOTUuMTUiIHNoZWxsX3ZlcnNpb249IjEuMy4xOTUuMTUiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7OEY2REMxMTAtRjJDNC00QUQ5LTk3QUYtQjJDNURBMUM3QzQxfSIgdXNlcmlkPSJ7NzkxN0VDREYtM0FFNi00REM1LUE5NkMtNzg5QjhDQTM1NzU5fSIgaW5zdGFsbHNvdXJjZT0ib3RoZXJpbnN0YWxsY21kIiByZXF1ZXN0aWQ9Ins3RTZGOEU3OS1GNjkxLTQ5QUItODVGNS1CQUVDQ0Y0MzlFRTF9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iOCIgcGh5c21lbW9yeT0iOCIgZGlza190eXBlPSIyIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjE5MDQxLjEyODgiIHNwPSIiIGFyY2g9Ing2NCIgcHJvZHVjdF90eXBlPSI0OCIgaXNfd2lwPSIwIiBpc19pbl9sb2NrZG93bl9tb2RlPSIwIi8-PG9lbSBwcm9kdWN0X21hbnVmYWN0dXJlcj0iIiBwcm9kdWN0X25hbWU9IiIvPjxleHAgZXRhZz0iJnF1b3Q7VlBRb1AxRitmcTE1d1J6aDFrUEw0UE1wV2g4T1JNQjVpenZyT0MvY2hqUT0mcXVvdDsiLz48YXBwIGFwcGlkPSJ7RjNDNEZFMDAtRUZENS00MDNCLTk1NjktMzk4QTIwRjFCQTRBfSIgdmVyc2lvbj0iMS4zLjE5NS4xNSIgbmV4dHZlcnNpb249IjEuMy4xOTUuMTUiIGxhbmc9IiIgYnJhbmQ9IiIgY2xpZW50PSIiPjxldmVudCBldmVudHR5cGU9IjIiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjUxMzQ3NzA4ODIiIGluc3RhbGxfdGltZV9tcz0iNTYyIi8-PC9hcHA-PC9yZXF1ZXN0Pg
                                      5⤵
                                      • Checks system information in the registry
                                      • Executes dropped EXE
                                      • Loads dropped DLL
                                      • System Location Discovery: System Language Discovery
                                      • System Network Configuration Discovery: Internet Connection Discovery
                                      PID:5052
                                    • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
                                      "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /handoff "appguid={F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}&appname=Microsoft%20Edge%20Webview2%20Runtime&needsadmin=prefers" /installsource otherinstallcmd /sessionid "{8F6DC110-F2C4-4AD9-97AF-B2C5DA1C7C41}" /silent
                                      5⤵
                                      • Executes dropped EXE
                                      • Loads dropped DLL
                                      • System Location Discovery: System Language Discovery
                                      PID:3156
                            • C:\Windows\system32\vssvc.exe
                              C:\Windows\system32\vssvc.exe
                              1⤵
                              • Checks SCSI registry key(s)
                              PID:2888
                            • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
                              "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /svc
                              1⤵
                              • Checks system information in the registry
                              • Drops file in Program Files directory
                              • Executes dropped EXE
                              • Loads dropped DLL
                              • System Location Discovery: System Language Discovery
                              • Modifies data under HKEY_USERS
                              • Suspicious use of WriteProcessMemory
                              PID:544
                              • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
                                "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xOTUuMTUiIHNoZWxsX3ZlcnNpb249IjEuMy4xOTUuMTUiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7OEY2REMxMTAtRjJDNC00QUQ5LTk3QUYtQjJDNURBMUM3QzQxfSIgdXNlcmlkPSJ7NzkxN0VDREYtM0FFNi00REM1LUE5NkMtNzg5QjhDQTM1NzU5fSIgaW5zdGFsbHNvdXJjZT0ibGltaXRlZCIgcmVxdWVzdGlkPSJ7OTM1QkZBMEQtQTkzOC00QzZFLUE4MTQtQTZBQTJFMTI1NDI5fSIgZGVkdXA9ImNyIiBkb21haW5qb2luZWQ9IjAiPjxodyBsb2dpY2FsX2NwdXM9IjgiIHBoeXNtZW1vcnk9IjgiIGRpc2tfdHlwZT0iMiIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iMTAuMC4xOTA0MS4xMjg4IiBzcD0iIiBhcmNoPSJ4NjQiIHByb2R1Y3RfdHlwZT0iNDgiIGlzX3dpcD0iMCIgaXNfaW5fbG9ja2Rvd25fbW9kZT0iMCIvPjxvZW0gcHJvZHVjdF9tYW51ZmFjdHVyZXI9IiIgcHJvZHVjdF9uYW1lPSIiLz48ZXhwIGV0YWc9IiZxdW90O1ZQUW9QMUYrZnExNXdSemgxa1BMNFBNcFdoOE9STUI1aXp2ck9DL2NoalE9JnF1b3Q7Ii8-PGFwcCBhcHBpZD0iezhBNjlEMzQ1LUQ1NjQtNDYzYy1BRkYxLUE2OUQ5RTUzMEY5Nn0iIHZlcnNpb249IjEyMy4wLjYzMTIuMTIzIiBuZXh0dmVyc2lvbj0iIiBsYW5nPSJlbiIgYnJhbmQ9IkdHTFMiIGNsaWVudD0iIiBpbnN0YWxsYWdlPSIyMSIgaW5zdGFsbGRhdGV0aW1lPSIxNzIyNjAyNjYyIiBvb2JlX2luc3RhbGxfdGltZT0iMTMzNjcwNzUyODYxNDQyNzM1Ij48ZXZlbnQgZXZlbnR0eXBlPSIzMSIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMjExNDMyNSIgc3lzdGVtX3VwdGltZV90aWNrcz0iNTE0MTE3NzE0MiIvPjwvYXBwPjwvcmVxdWVzdD4
                                2⤵
                                • Checks system information in the registry
                                • Executes dropped EXE
                                • Loads dropped DLL
                                • System Location Discovery: System Language Discovery
                                • System Network Configuration Discovery: Internet Connection Discovery
                                PID:4572
                              • C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{2BDCF765-60E3-462C-B74B-0E211304B16E}\MicrosoftEdge_X64_128.0.2739.42.exe
                                "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{2BDCF765-60E3-462C-B74B-0E211304B16E}\MicrosoftEdge_X64_128.0.2739.42.exe" --msedgewebview --verbose-logging --do-not-launch-msedge --system-level
                                2⤵
                                • Executes dropped EXE
                                • Suspicious use of WriteProcessMemory
                                PID:4860
                                • C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{2BDCF765-60E3-462C-B74B-0E211304B16E}\EDGEMITMP_CEB6D.tmp\setup.exe
                                  "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{2BDCF765-60E3-462C-B74B-0E211304B16E}\EDGEMITMP_CEB6D.tmp\setup.exe" --install-archive="C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{2BDCF765-60E3-462C-B74B-0E211304B16E}\MicrosoftEdge_X64_128.0.2739.42.exe" --msedgewebview --verbose-logging --do-not-launch-msedge --system-level
                                  3⤵
                                  • Drops file in Program Files directory
                                  • Executes dropped EXE
                                  • Suspicious use of WriteProcessMemory
                                  PID:1356
                                  • C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{2BDCF765-60E3-462C-B74B-0E211304B16E}\EDGEMITMP_CEB6D.tmp\setup.exe
                                    "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{2BDCF765-60E3-462C-B74B-0E211304B16E}\EDGEMITMP_CEB6D.tmp\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\MsEdgeCrashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=128.0.6613.85 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{2BDCF765-60E3-462C-B74B-0E211304B16E}\EDGEMITMP_CEB6D.tmp\setup.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=128.0.2739.42 --initial-client-data=0x114,0x230,0x234,0x100,0x238,0x7ff6135e06d8,0x7ff6135e06e4,0x7ff6135e06f0
                                    4⤵
                                    • Executes dropped EXE
                                    PID:3956
                              • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
                                "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xOTUuMTUiIHNoZWxsX3ZlcnNpb249IjEuMy4xOTUuMTUiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7OEY2REMxMTAtRjJDNC00QUQ5LTk3QUYtQjJDNURBMUM3QzQxfSIgdXNlcmlkPSJ7NzkxN0VDREYtM0FFNi00REM1LUE5NkMtNzg5QjhDQTM1NzU5fSIgaW5zdGFsbHNvdXJjZT0ib3RoZXJpbnN0YWxsY21kIiByZXF1ZXN0aWQ9Ins2QURGODM3My03NzI5LTQwNTUtOTg4RC0xOTNGRUI2NjcxRjd9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iOCIgcGh5c21lbW9yeT0iOCIgZGlza190eXBlPSIyIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjE5MDQxLjEyODgiIHNwPSIiIGFyY2g9Ing2NCIgcHJvZHVjdF90eXBlPSI0OCIgaXNfd2lwPSIwIiBpc19pbl9sb2NrZG93bl9tb2RlPSIwIi8-PG9lbSBwcm9kdWN0X21hbnVmYWN0dXJlcj0iIiBwcm9kdWN0X25hbWU9IiIvPjxleHAgZXRhZz0iJnF1b3Q7SjdWaVpqYk55eDFHVnJIVytSZC9QZ1Zpem5GK3RxeGlVdFdYb0Z0SWhmVT0mcXVvdDsiLz48YXBwIGFwcGlkPSJ7RjMwMTcyMjYtRkUyQS00Mjk1LThCREYtMDBDM0E5QTdFNEM1fSIgdmVyc2lvbj0iIiBuZXh0dmVyc2lvbj0iMTI4LjAuMjczOS40MiIgbGFuZz0iIiBicmFuZD0iIiBjbGllbnQ9IiIgZXhwZXJpbWVudHM9ImNvbnNlbnQ9ZmFsc2UiIGluc3RhbGxhZ2U9Ii0xIiBpbnN0YWxsZGF0ZT0iLTEiPjx1cGRhdGVjaGVjay8-PGV2ZW50IGV2ZW50dHlwZT0iOSIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iNTE5MzA1MjY1NSIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIvPjxldmVudCBldmVudHR5cGU9IjUiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjUxOTMyMDgyNjkiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiLz48ZXZlbnQgZXZlbnR0eXBlPSIxIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI1NTMxMDE2MTg2IiBzb3VyY2VfdXJsX2luZGV4PSIwIiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIiBkb3dubG9hZGVyPSJiaXRzIiB1cmw9Imh0dHA6Ly9tc2VkZ2UuZi50bHUuZGwuZGVsaXZlcnkubXAubWljcm9zb2Z0LmNvbS9maWxlc3RyZWFtaW5nc2VydmljZS9maWxlcy9iMGY3MzFjZS1mNzA2LTRjODEtOTA2ZS1hMDVhYTAzNDc1N2Q_UDE9MTcyNTA0Mzk3MyZhbXA7UDI9NDA0JmFtcDtQMz0yJmFtcDtQND1WUjF2WXE1SjN5dm1yZlpoTElmdWJjdEJwWmVzJTJmYUlEU1hLJTJmQXAzSzc0UkloJTJiRWR2WTJOcTNiREhKRDY5UzlaeEd2QnJ4aXhrc2wwaWtDNXQwcm9LdyUzZCUzZCIgc2VydmVyX2lwX2hpbnQ9IiIgY2RuX2NpZD0iLTEiIGNkbl9jY2M9IiIgY2RuX21zZWRnZV9yZWY9IiIgY2RuX2F6dXJlX3JlZl9vcmlnaW5fc2hpZWxkPSIiIGNkbl9jYWNoZT0iIiBjZG5fcDNwPSIiIGRvd25sb2FkZWQ9IjE3Mzc1MDM0NCIgdG90YWw9IjE3Mzc1MDM0NCIgZG93bmxvYWRfdGltZV9tcz0iMjczOTAiLz48ZXZlbnQgZXZlbnR0eXBlPSIxIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI1NTMxMTcyMTMwIiBzb3VyY2VfdXJsX2luZGV4PSIwIiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIi8-PGV2ZW50IGV2ZW50dHlwZT0iNiIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iNTU0NDYwOTk4NiIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIvPjxldmVudCBldmVudHR5cGU9IjIiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjE5Njc1NyIgc3lzdGVtX3VwdGltZV90aWNrcz0iNTk4NTY5NTAzMCIgc291cmNlX3VybF9pbmRleD0iMCIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIgdXBkYXRlX2NoZWNrX3RpbWVfbXM9IjQ1MzIiIGRvd25sb2FkX3RpbWVfbXM9IjMzNzY1IiBkb3dubG9hZGVkPSIxNzM3NTAzNDQiIHRvdGFsPSIxNzM3NTAzNDQiIHBhY2thZ2VfY2FjaGVfcmVzdWx0PSIwIiBpbnN0YWxsX3RpbWVfbXM9IjQ0MTA5Ii8-PC9hcHA-PC9yZXF1ZXN0Pg
                                2⤵
                                • Checks system information in the registry
                                • Executes dropped EXE
                                • Loads dropped DLL
                                • System Location Discovery: System Language Discovery
                                • System Network Configuration Discovery: Internet Connection Discovery
                                PID:3344
                            • C:\Windows\System32\CompPkgSrv.exe
                              C:\Windows\System32\CompPkgSrv.exe -Embedding
                              1⤵
                                PID:5320
                              • C:\Windows\System32\CompPkgSrv.exe
                                C:\Windows\System32\CompPkgSrv.exe -Embedding
                                1⤵
                                  PID:5404

                                Network

                                MITRE ATT&CK Enterprise v15

                                Replay Monitor

                                Loading Replay Monitor...

                                Downloads

                                • C:\Config.Msi\e57a922.rbs

                                  Filesize

                                  10KB

                                  MD5

                                  be6291ab46a452d7fad469d7555ccfa8

                                  SHA1

                                  0df49b58031c344f05bad2dba663fd6b3e8f273d

                                  SHA256

                                  21c71b9e157301c0bdb765c0d9206c6fe6fa7fd4e03f031c25cec9eb14751433

                                  SHA512

                                  25f8488179527ddc120bfc4d7a5e38996b317cbb0051056a81324921f906aa69c1dba504fb52a8d4654da87a9a59964edada849256fd5eea5a1940910d7e6069

                                • C:\Program Files (x86)\Microsoft\EdgeCore\128.0.2739.42\Installer\setup.exe

                                  Filesize

                                  6.6MB

                                  MD5

                                  11a19165aa72e46ad47200ca46760c87

                                  SHA1

                                  2fe4616eadaf543846571564ca325e772ea5375c

                                  SHA256

                                  eaac114b05373d005f91c2824c3b907d01842056468018b95a688e82ffcc95b1

                                  SHA512

                                  5b4074ba1598c7441fd3dffed54cf0cea540a8e58ace339254b9a29bd6709a8e64458c10e9797a75ba8e0e84566e8c5935bf4891b0115dc02017396d70f47b27

                                • C:\Program Files (x86)\Microsoft\Temp\EU21FA.tmp\EdgeUpdate.dat

                                  Filesize

                                  12KB

                                  MD5

                                  369bbc37cff290adb8963dc5e518b9b8

                                  SHA1

                                  de0ef569f7ef55032e4b18d3a03542cc2bbac191

                                  SHA256

                                  3d7ec761bef1b1af418b909f1c81ce577c769722957713fdafbc8131b0a0c7d3

                                  SHA512

                                  4f8ec1fd4de8d373a4973513aa95e646dfc5b1069549fafe0d125614116c902bfc04b0e6afd12554cc13ca6c53e1f258a3b14e54ac811f6b06ed50c9ac9890b1

                                • C:\Program Files (x86)\Microsoft\Temp\EU21FA.tmp\MicrosoftEdgeComRegisterShellARM64.exe

                                  Filesize

                                  182KB

                                  MD5

                                  b69894fc1c3f26c77b1826ef8b5a9fc5

                                  SHA1

                                  cff7b4299253beda53fb015408dd840db59901a1

                                  SHA256

                                  b91bad4c618eb6049b19364f62827470095e30519d07f4e0f2ccc387ddd5f1bf

                                  SHA512

                                  8361e97d84082f8e888262d0657bac47c152bd72f972628f446f58cbeacf37c05f484dce3fb0d38c4f0da2a2dcbb0813639d201d127ec7f072b942d43b216755

                                • C:\Program Files (x86)\Microsoft\Temp\EU21FA.tmp\MicrosoftEdgeUpdate.exe

                                  Filesize

                                  201KB

                                  MD5

                                  136e8226d68856da40a4f60e70581b72

                                  SHA1

                                  6c1a09e12e3e07740feef7b209f673b06542ab62

                                  SHA256

                                  b4b8a2f87ee9c5f731189fe9f622cb9cd18fa3d55b0e8e0ae3c3a44a0833709f

                                  SHA512

                                  9a0215830e3f3a97e8b2cdcf1b98053ce266f0c6cb537942aec1f40e22627b60cb5bb499faece768481c41f7d851fcd5e10baa9534df25c419664407c6e5a399

                                • C:\Program Files (x86)\Microsoft\Temp\EU21FA.tmp\MicrosoftEdgeUpdateComRegisterShell64.exe

                                  Filesize

                                  215KB

                                  MD5

                                  205590d4fb4b1914d2853ab7a9839ccf

                                  SHA1

                                  d9bbf8941df5993f72ffcf46beefcfcd88694ebd

                                  SHA256

                                  5f82471d58b6e700248d9602ce4a0a5cda4d2e2863ef1eb9fee4effcc07f3767

                                  SHA512

                                  bce1447d5d3210c22d52dec3b846db091b65ed03fd9d7cd11c6c4dbd2aa5a943d881360bc033c29abd61011581ff9354b35cbe421719d92568ed99997bfbbae8

                                • C:\Program Files (x86)\Microsoft\Temp\EU21FA.tmp\MicrosoftEdgeUpdateCore.exe

                                  Filesize

                                  261KB

                                  MD5

                                  b07ab49ee8453853021c7dac2b2131db

                                  SHA1

                                  e1d87d6a6e7503d0d2b288ea5f034fe2f346196a

                                  SHA256

                                  f8535d5d73ebebed15adc6ae2ced6bb4889aa23e6ffe55faeabd961bf77b05e4

                                  SHA512

                                  5eaae533fbe71430ae2a717f7668fd0a26ec37624e198a32f09bfdbee7e3b6e93d64e4fbb78cbdb05c4fe390a864490ea997d11849ecd371f5153bc8bfafccc3

                                • C:\Program Files (x86)\Microsoft\Temp\EU21FA.tmp\NOTICE.TXT

                                  Filesize

                                  4KB

                                  MD5

                                  6dd5bf0743f2366a0bdd37e302783bcd

                                  SHA1

                                  e5ff6e044c40c02b1fc78304804fe1f993fed2e6

                                  SHA256

                                  91d3fc490565ded7621ff5198960e501b6db857d5dd45af2fe7c3ecd141145f5

                                  SHA512

                                  f546c1dff8902a3353c0b7c10ca9f69bb77ebd276e4d5217da9e0823a0d8d506a5267773f789343d8c56b41a0ee6a97d4470a44bbd81ceaa8529e5e818f4951e

                                • C:\Program Files (x86)\Microsoft\Temp\EU21FA.tmp\msedgeupdate.dll

                                  Filesize

                                  2.1MB

                                  MD5

                                  5d89123f9b96098d8fad74108bdd5f7e

                                  SHA1

                                  6309551b9656527563d2b2f3c335fd6805da0501

                                  SHA256

                                  03c3c918886e58f096aa8e919b1e9f8dcd5a9f2a4765971049bf8da305476f44

                                  SHA512

                                  9d8190e5374cd1b4adbbfb87c27fa40d4de529d7c0a20654e0ce189a4cb9a53d3708c4ce657a7a5469b015df7efbbff495fc844579d9cd363b329b7e007e85c8

                                • C:\Program Files (x86)\Microsoft\Temp\EU21FA.tmp\msedgeupdateres_af.dll

                                  Filesize

                                  29KB

                                  MD5

                                  4f860d5995ab77e6efa8f589a758c6d2

                                  SHA1

                                  07536839ccfd3c654ec5dc2161020f729973196d

                                  SHA256

                                  9841d787142dd54fea6b033bd897f05f3e617b48b051de0ee3cf5865b3393150

                                  SHA512

                                  0b9a661b76360f1fb2eb3ee25c6bf2cbab7ec74e2363e0af321dc4d0afb3cad301dddd16ea367d588451a40a2c2ed41f21d7afae48307e1e4a4ec5b24165b378

                                • C:\Program Files (x86)\Microsoft\Temp\EU21FA.tmp\msedgeupdateres_am.dll

                                  Filesize

                                  24KB

                                  MD5

                                  f624de37750fd191eb29d4de36818f8b

                                  SHA1

                                  b647dae9b9a3c673980afa651d73ce0a4985aae6

                                  SHA256

                                  e284453cd512e446fcbf9440013f8cb2348ffd6b1acec5366f2511cdf88b1794

                                  SHA512

                                  d1d65e29ed59e34d4ff66df11a2368f1a724730e32eb245022d4f3d1fadf16d445ba8532460afb0e6e91f8be60a7240d13577403193042d1e912a67e4bf23b1a

                                • C:\Program Files (x86)\Microsoft\Temp\EU21FA.tmp\msedgeupdateres_ar.dll

                                  Filesize

                                  26KB

                                  MD5

                                  5de3f4dabb5f033f24e29033142e7349

                                  SHA1

                                  5c446985de443501b545d75f6886a143c748b033

                                  SHA256

                                  2533d443b68c5288468b0b20cc3a70dc05f0498369d5321368a97dd5bf3268c8

                                  SHA512

                                  c96296e6f67edeff2be5dc03014a8eb65fc287fb899357d4608c36c07b4610827aa18cbec6ccd47b66230a12341af488aca8bd02632fa768f84ca7b1d9c9d065

                                • C:\Program Files (x86)\Microsoft\Temp\EU21FA.tmp\msedgeupdateres_as.dll

                                  Filesize

                                  29KB

                                  MD5

                                  1fb14c6c4fee7bfabe41badb7c5acff8

                                  SHA1

                                  953d94cd73951943db14c08cce37b2d3ac821b02

                                  SHA256

                                  cd32339fd7e4a5959e93eb5bfd6e009e4137e15c5e6c2e861d7891487216da49

                                  SHA512

                                  a93b081935fbe48fafa8071a9cd593ae7b19205c70eaf48c724397019a04161460c66d6d8c6ffd872f4d52a4a7aa25ba1cba04181b9ebaca04b76d111ea588d2

                                • C:\Program Files (x86)\Microsoft\Temp\EU21FA.tmp\msedgeupdateres_az.dll

                                  Filesize

                                  29KB

                                  MD5

                                  d3345579310f3bd080b406de47b2305f

                                  SHA1

                                  16aefb27ea6d81c684f041aa50ebb49fdd403d83

                                  SHA256

                                  b4ea3c63fa0104093a2b2034f950428e66d2cf3d55f0fc5bd688483392d60d69

                                  SHA512

                                  65e4aa8587bc579b5109d91e02745f6de96a23b6ac2962cdeb6d9d536b51abab12b2bbaeca72572c3ae1971dac5bd24430eb2ae5ccf44a7068427594e4afdd7a

                                • C:\Program Files (x86)\Microsoft\Temp\EU21FA.tmp\msedgeupdateres_bg.dll

                                  Filesize

                                  29KB

                                  MD5

                                  ecf3405e9e712d685ef1e8a5377296ea

                                  SHA1

                                  9872cdf450adf4257d77282a39b75822ce1c8375

                                  SHA256

                                  e400415638a7b7dcc28b14a257a28e93e423c396e89a02cba51623fdfbdc6b0b

                                  SHA512

                                  37e5f1b3bdd97a4370718dc2a46d78ab5b66865d3cdb66a20a7dc20a9d423ccde954c08f97e574fbab24e8dfa905351cbfb94bd3e6692a9b6526097ea3dc911d

                                • C:\Program Files (x86)\Microsoft\Temp\EU21FA.tmp\msedgeupdateres_bn-IN.dll

                                  Filesize

                                  29KB

                                  MD5

                                  051c429fa2beec9c2842c403a86c0e7b

                                  SHA1

                                  0a06a45200a1f5c81c48fbd2d03549fc9fac3a58

                                  SHA256

                                  1a8465922bbb05a97a24f6c2200fcc7afd8bd0ace245c2eda9d9d335d4fb9353

                                  SHA512

                                  bb59b41804328f27ba8861af32824266ca69ddcfdaaa11551b1edd4e129dbba630da8070abedb28e180045f8d0ddc1209cd901919f6b9aa421c457188af795c6

                                • C:\Program Files (x86)\Microsoft\Temp\EU21FA.tmp\msedgeupdateres_bn.dll

                                  Filesize

                                  29KB

                                  MD5

                                  82711e45d2b0764997abc1e0678a73bb

                                  SHA1

                                  47908e8885c86477a6f52eea5fddb005ec5b3fa3

                                  SHA256

                                  2bb7455999b8f53a2a0834588ca4da4703f4da362a127d01cc6bd60ca0303799

                                  SHA512

                                  4b517796edc954ab7f5a26a5d6605925dc7e84b611bcf59352b3b95f719cedc72c77a465fb1e7bc2d2f422d596c97968dac5b57292c82967d5cfaff980128fc2

                                • C:\Program Files (x86)\Microsoft\Temp\EU21FA.tmp\msedgeupdateres_bs.dll

                                  Filesize

                                  28KB

                                  MD5

                                  a0a1f791984f1de2f03a36171232d18d

                                  SHA1

                                  71f69d8fe47640ba9705725d7d627a05519c8016

                                  SHA256

                                  d2c7da8f4745b81874a9666c7d10a779a9956b4de0ebdaa1647bf78d4e17d85a

                                  SHA512

                                  a4267911846cd55eb91227b0117ccbfdf8ef6c4ed0b8935b08e5d41a91aeabd9259988c71da8606cfb2876c4d69df6ca5a246687440283f1625105624305eb33

                                • C:\Program Files (x86)\Microsoft\Temp\EU21FA.tmp\msedgeupdateres_ca-Es-VALENCIA.dll

                                  Filesize

                                  30KB

                                  MD5

                                  897712b508931dab76d39b209611740c

                                  SHA1

                                  9d80e07c2dc744e2efce3b67aa9876949fb9edfe

                                  SHA256

                                  ee64fdefdb3381ce61fc445190cc44b015e7b65a3a16d28f3477f68de6079f1b

                                  SHA512

                                  3329e37318dd9b11f282301e453af106168d3d10beff1ed62ffdcda60c6b4edb6b9c69ac6b9bb8abce3c9a9686a0152404524012dbff025e571de2cfcb3b5d56

                                • C:\Program Files (x86)\Microsoft\Temp\EU21FA.tmp\msedgeupdateres_ca.dll

                                  Filesize

                                  30KB

                                  MD5

                                  e90155442b28008992a7d899ca730222

                                  SHA1

                                  1d448e9709de0d301ded6d75caaeba4348a4793d

                                  SHA256

                                  6ae98b5e2eda22a0236434b7e952d732e3cd5d9cae2e51cd70222f1fd5278563

                                  SHA512

                                  a91d8357ca976db2eb5a081077304a50edc1b55b2775c00cfde05e03831f98bd04e43f0dba5b3efd5a6370afcb10b23bbf307412467502e9ef57e0beae636013

                                • C:\Program Files (x86)\Microsoft\Temp\EU21FA.tmp\msedgeupdateres_cs.dll

                                  Filesize

                                  28KB

                                  MD5

                                  1de961b662a374c3af918c18225f4364

                                  SHA1

                                  e8f1c438e57b322f43b4b851698bf38c129eb6ae

                                  SHA256

                                  bb1365c5770dacbb918af27b47b02f269504f4d2396cf3f82bf5ecb2551c5021

                                  SHA512

                                  c6bf62b684039f62744f1aab07f4751948e0c175f7fb7fe126f20903ce23fcdd2e284f1b794922621dae7eaa15c6dae0177ad102289a18f967721486f21073a1

                                • C:\Program Files (x86)\Microsoft\Temp\EU21FA.tmp\msedgeupdateres_cy.dll

                                  Filesize

                                  28KB

                                  MD5

                                  29f027d2d5fd486bdc20386ace925603

                                  SHA1

                                  66b8605f23871b4a8302bef0aaccb36ee1e72755

                                  SHA256

                                  03c8566f749e8fa349d97101849bc3b2cc0b7561b565a2b0928bf8fe901da813

                                  SHA512

                                  3348bdf10b2d964b34b791a774e28c97d3caf28d7f90e36b948cc2cb6c21e84cda933b7ddbd51c8fc604a450361cb834322c15ddbe0f4851154d05e5a2a2ea42

                                • C:\Program Files (x86)\Microsoft\Temp\EU21FA.tmp\msedgeupdateres_da.dll

                                  Filesize

                                  28KB

                                  MD5

                                  b0ae9aa0d5c17ee7abfc57d21cdcbae6

                                  SHA1

                                  01019eb6ba9c123be528136e12192b0bb33df407

                                  SHA256

                                  d10938919e3d28d71e8e3ba2d8e02e0f9dc2faf148cdedc21c166fd994c603e2

                                  SHA512

                                  4cba25c8159df865231b08fe650eedfb92d54c3037d28b2b9af010c8a59fa23669041a6c393622fe69b0194c2532f71f02b740f7e26e0bbf7ef34a421d6747b8

                                • C:\Program Files (x86)\Microsoft\Temp\EU21FA.tmp\msedgeupdateres_de.dll

                                  Filesize

                                  30KB

                                  MD5

                                  ad5b530eabff0540078c5d17f27b9610

                                  SHA1

                                  7e53dbbf64e70e561d37669e69f50eb0da8e37d1

                                  SHA256

                                  49f512316a51e51027b4e70de4ffe8c8ecb188e126439a90a5d12d52a0393966

                                  SHA512

                                  e1cc853d96589220676d39d91d4108633ce56304640f770e7d22b97a9b3be9452d5fb94e4e7fcd1400b62f0c398da8255c53a31853194a9e7b7784982b5ff40f

                                • C:\Program Files (x86)\Microsoft\Temp\EU21FA.tmp\msedgeupdateres_el.dll

                                  Filesize

                                  30KB

                                  MD5

                                  a7e64339a5314e3576c0d170171fa52a

                                  SHA1

                                  6c12aab6c97c30aff3245b78f7a3afeea604215e

                                  SHA256

                                  4e9ccecb8e4383395f2134347fbad00521345ec9c857d8fa102d5257c7bea9bf

                                  SHA512

                                  a4ca3fb60a7f4bda50847544dd1289d750f0d4b3565929290a8392b92822ef1856cec15a1f63f2c6fe1ef2e7cc0936a35bdb38ee5d904eb08cd32f05addc6ee4

                                • C:\Program Files (x86)\Microsoft\Temp\EU21FA.tmp\msedgeupdateres_en-GB.dll

                                  Filesize

                                  27KB

                                  MD5

                                  74d4cf3b8efb6cc3d0acc3eac38bd5b7

                                  SHA1

                                  9337803aadad9042c895b6f418b4c733b81221e0

                                  SHA256

                                  b83c8981d8835e4c78250bf265faa6d64693204b77764c8e349abc4365ae9871

                                  SHA512

                                  e6112ef60d56101aa16327042162d6ef43519bc56668ca8eaa7fd3e1aaadc75c7df75c1e41583a292ff1a9bdc7d9ad9f5c0d97fa84964532dca2d5f3df604c23

                                • C:\Program Files (x86)\Microsoft\Temp\EU21FA.tmp\msedgeupdateres_en.dll

                                  Filesize

                                  27KB

                                  MD5

                                  19dc1f6d1f309eb7abf1e0c8257f41f8

                                  SHA1

                                  e2d3e86fe22c6af6b8ee5b359315dfa6ac4d52ec

                                  SHA256

                                  046f6c532fcabd969c6e63bb7ee0d7a83d806fa659006508e1c3a9485190d6ef

                                  SHA512

                                  478d6a84452cfadc48547930e336ad459eec188dd3d9e4c778cded4ec3d34e00b2b8c0538366aa644ee67f878b29c5c73444c1406c66e8394761bb0979c6483c

                                • C:\Program Files (x86)\Microsoft\Temp\EU21FA.tmp\msedgeupdateres_es-419.dll

                                  Filesize

                                  29KB

                                  MD5

                                  8f7f515d78d2df371993fd70f863ab8d

                                  SHA1

                                  dfae1b47e80f91abf2d9c2aac009c0a1767bc59d

                                  SHA256

                                  ba57fbb9d3a32b84d6a76054b9ad180b6510e53206b9804bb9ea18ff73c2ae3e

                                  SHA512

                                  308a62af00a4410551eac967bb9f2cea7adf7c13b471dd28b276bda40b1e4c0b4ebb60aec29b6165069d40180bc45b4f5da5baddc374ce7bc5a5bb223afb4e96

                                • C:\Program Files (x86)\Microsoft\Temp\EU21FA.tmp\msedgeupdateres_es.dll

                                  Filesize

                                  29KB

                                  MD5

                                  6af05d448c842027f876e93f8ac58b65

                                  SHA1

                                  f34c988e3875a1d1b267b082476fcfb8d7505a73

                                  SHA256

                                  36876b14a214cf98dda5100a7e7134d7ebb78e895535d6bd7562099574607867

                                  SHA512

                                  412031db59de0367a102a026f73072244b33d726adc5bb9fd079db3dd37b5d6a24d7420a9811576d0a356933b5ba15cc9e2a92046d2d6e6d6fef37e9d840aec6

                                • C:\Program Files (x86)\Microsoft\Temp\EU21FA.tmp\msedgeupdateres_et.dll

                                  Filesize

                                  28KB

                                  MD5

                                  ae9bdf6416c3630c4b0b5b119308a135

                                  SHA1

                                  d7218c677b098d2a93cc91ead39c83d3a2c653b6

                                  SHA256

                                  62da90c9417a70632aa190fecc17c31ecf433c1f84f82b08d7d7290669cabf32

                                  SHA512

                                  4333ac6cd3737f25e6e1d429b195da781ced4340b89808cbd5d5d2aae2e79bcc700419d613123d632252e31ac44d95b7718f23da5b82ab5054407e80106a64a7

                                • C:\Program Files (x86)\Microsoft\Temp\EU21FA.tmp\msedgeupdateres_eu.dll

                                  Filesize

                                  28KB

                                  MD5

                                  fe73dbc305da6223d1e94e1cf548c000

                                  SHA1

                                  b16f2c40d68cd9718eaaa9b6db9c8e5c4b6acb9e

                                  SHA256

                                  1ef64088a613a4e10b4cf4206f95f5414ee27872798747234a6574b7e5c70a7d

                                  SHA512

                                  d9900720d89defffa52198dbe63515995095c94aa0cbbe4f32a1c09d26809cec480e92926d2240702604b8c13fcdc0032cc46910ade8e4c1d2fc9a4bd1b63858

                                • C:\Program Files (x86)\Microsoft\Temp\EU21FA.tmp\msedgeupdateres_fa.dll

                                  Filesize

                                  28KB

                                  MD5

                                  367ea715e942c81dd3cb734274969a0b

                                  SHA1

                                  f92f1ec2a5be9b775e67c4252a07c37ed0ca508b

                                  SHA256

                                  082da1c09782c026c9cd73456dc12539a226f0bf5d113e59bc93b29c1e98b37c

                                  SHA512

                                  c94e787ba3bdb56d1827a0477461cbba6b7cc68986722275e0d04ea7dc70db83b5d03887eec810bf9b67f70b18bd3c7b7d28f0e554938b81d3501bc11f97830a

                                • C:\Program Files (x86)\Microsoft\Temp\EU21FA.tmp\msedgeupdateres_fi.dll

                                  Filesize

                                  28KB

                                  MD5

                                  5a30bc4216af48a493eeb0f3a9f02607

                                  SHA1

                                  2fdf65a4002d91818d56a23fb8bfd08ab715002f

                                  SHA256

                                  5131c23915ad6b5b469bcbff31d0ae31ef34ded28ca0ffff9f1eb998bba98aa1

                                  SHA512

                                  34b3a4865f31ebdb8665780011b384ada768a0f71bff77f91706b140eb8cc07fff8787f710cdb1ee14a449cae8f22ee5fddadcc501cf1c921eea078e97dc2f89

                                • C:\Program Files (x86)\Microsoft\Temp\EU21FA.tmp\msedgeupdateres_fil.dll

                                  Filesize

                                  29KB

                                  MD5

                                  84c4736cf301b93998028ed7678caec1

                                  SHA1

                                  3b6f1f6b9eb3dd7d9a13c11dfd3ac56c93f1b10f

                                  SHA256

                                  3c8dcb7e982dac3159298009a86909b1e1000ccf6f4d333341f16d4d6fbd84ad

                                  SHA512

                                  5a1b77ef9450c32802e94e473a5b4e43e892c923ef368ee9bbbbb5b0090429320263cc79a4da0b281930c1a60861519211abd0bd67a9d9ee370bdda2230d2e81

                                • C:\Program Files (x86)\Microsoft\Temp\EU21FA.tmp\msedgeupdateres_fr-CA.dll

                                  Filesize

                                  30KB

                                  MD5

                                  8993c0784111fc7cd6a90a82303e5f44

                                  SHA1

                                  8d1ff2fed98ebc608604c555ceb46ca628afb285

                                  SHA256

                                  3d0ba88267018f592141ea86592757cf1ecaac1a3a18f99203e0fc5c5eacbd62

                                  SHA512

                                  124d16d848dc8ea0a93b292b10ce1fbad23b56b13771d904cf14c19d54478614d214441b05f6cd9e1999b8310fdd26d1c6ecae784be00aecee7e80c96ba4ac88

                                • C:\Program Files (x86)\Microsoft\Temp\EU21FA.tmp\msedgeupdateres_fr.dll

                                  Filesize

                                  30KB

                                  MD5

                                  a640aa4ff33662e06a474765df0b2a8d

                                  SHA1

                                  c6265225532e389e48c6057bd717b69de2125b61

                                  SHA256

                                  078b1943bf7f7955b90abc40f691b27e04376f8c43dd3abc4791614286cd4f23

                                  SHA512

                                  59791eef021f94efd9c18737d6c46fbc45add582eec92d5b997cfd66993abc7da872720a037766c3c70862f0654ccf30d122d4a5a6b305151bf8bf1c053a466d

                                • C:\Program Files (x86)\Microsoft\Temp\EU21FA.tmp\msedgeupdateres_ga.dll

                                  Filesize

                                  29KB

                                  MD5

                                  5bcc643a969559317d09a9c87f53d04e

                                  SHA1

                                  3602d51cde97de16d8c018225a39d505c803e0fc

                                  SHA256

                                  b48f57e90ea9db6d6a296c01e87f8db71e47ab05ab6c2a664cfa9f52cf1d2c18

                                  SHA512

                                  4c65772f77e61e64d572df5b1f62733aceb02a5c967c296b303ff17c5d49831e5b7fc3d662724ae3ae1e88cd0fdcb704e838af5d4ae20f2d82b9577f57159159

                                • C:\Program Files (x86)\Microsoft\Temp\EU21FA.tmp\msedgeupdateres_gd.dll

                                  Filesize

                                  30KB

                                  MD5

                                  aea23f526ef0c5bb3d2f8fdf192a49ea

                                  SHA1

                                  4d7695e33ed43c3efb95f304e29675ea885b2939

                                  SHA256

                                  3cfe866c151a7e8a208af725c0c6f2a47fc3ada35f9ad3509b16b8d5229318b9

                                  SHA512

                                  412e4742ebd46ce38010b4f6a46d8d524025f929ab4658040e271d768e79115d90903403b2f1e51ab910bbdf9677b49439eb3c8afc5959477af198efb0c7c3c9

                                • C:\Program Files (x86)\Microsoft\Temp\EU21FA.tmp\msedgeupdateres_gl.dll

                                  Filesize

                                  29KB

                                  MD5

                                  295cd30c00f43d9131621baf4859578f

                                  SHA1

                                  cab79a6263b7b0a799461f3e6df41f815029cded

                                  SHA256

                                  b851c5a60cb6d1e8dd9aa161106cba99ccea047d0b39d007beaa7b9ef4a83397

                                  SHA512

                                  5f5c1e62e6c0e11a63fad68928765e3f504f33cdbb1d9a05cd53cbc3ed145bf3528960a10e3d57e8c83b07c030c72257f403b9a57d12975d3ef8bc255418ad6c

                                • C:\Program Files (x86)\Microsoft\Temp\EU21FA.tmp\msedgeupdateres_gu.dll

                                  Filesize

                                  28KB

                                  MD5

                                  c43c1ab37cd93e54068443bc330fb3d2

                                  SHA1

                                  ab51a2cbc51b3c17cf184c6d99ac480c02eb63af

                                  SHA256

                                  0c26a367355e766402c31fbab102dd1c35300d4a1301417c75be5fc4b3d54680

                                  SHA512

                                  ff0193189fb846eb3c4188bb599dad8e6f415ec9612da567d95c9c513defb148b6013208371798d174569b46f443a744e4e8b83aaf139d68c31f7de0f94e63f9

                                • C:\Program Files (x86)\Microsoft\Temp\EU21FA.tmp\msedgeupdateres_hi.dll

                                  Filesize

                                  29KB

                                  MD5

                                  a5544f517f7c1bfd1ec6a2e355d5a84c

                                  SHA1

                                  34a2a4a576300ad55b6757171bcba0fab005daa5

                                  SHA256

                                  8274c64bb778b55d912929625cd849adfe733b2dd674d94895d53af8dfaabeca

                                  SHA512

                                  9069bcfb736e13499250844dddef40e2cf64937e33ee1f81fc4968f024f7d7b89c6a778866bf1bff98d770686569e4752a473c0adfad4d4099cceda84da3cac3

                                • C:\Program Files (x86)\Microsoft\Temp\EU21FA.tmp\msedgeupdateres_hr.dll

                                  Filesize

                                  29KB

                                  MD5

                                  c09876a180731c172fa2532f8be90a3d

                                  SHA1

                                  4359c7840ddb23142a40aff85129b9920360e954

                                  SHA256

                                  50fd548ea12e2b72fc563bc082b870a89a523e8b3a4a0e9b65fe673384da2b58

                                  SHA512

                                  91cee1b10fc12a01a2a285e67dba583d6f1bee0716cc89103fee0c7d0f52fadc0f9ac5b13e833834e7279963726950d3897847e7acac61857257fc031692033e

                                • C:\Program Files (x86)\Microsoft\Temp\EU21FA.tmp\msedgeupdateres_hu.dll

                                  Filesize

                                  29KB

                                  MD5

                                  ee19156c12d2d7cce9b12e515f9ac6c5

                                  SHA1

                                  19ad46e40b3c1cb6195231bfcf45bb68ee1b43bf

                                  SHA256

                                  c290883b4b99758792284755efa52c12eb09039f0f8027d8ba3b1d4bb2f3846f

                                  SHA512

                                  631364472a450519ad8959971d6c319610570ca37b4486ea12d6af5b46aaecbf336aadddd1f3fefba841534ff82adf905b1e1a008638ed784bf08870a3b86ee1

                                • C:\Program Files (x86)\Microsoft\Temp\EU21FA.tmp\msedgeupdateres_id.dll

                                  Filesize

                                  28KB

                                  MD5

                                  eacd4638369bf96ccc7c23af37e15b5d

                                  SHA1

                                  15c4878b78c06095981abcc589c4a6f265ef96a3

                                  SHA256

                                  a53c0fd74995090dbf48bbba4a00560e3cc344ce8120b8b2bfa1f9b953b536ef

                                  SHA512

                                  19cc8d25bd8fd84481f77d301f79636208df5807647ddc6cb6beff3882d94672db49daa4ddfff0c334b584742f9d2fea3af73977032d7dfccd0cfd1314af4ae6

                                • C:\Program Files (x86)\Microsoft\Temp\EU21FA.tmp\msedgeupdateres_is.dll

                                  Filesize

                                  28KB

                                  MD5

                                  19d44de8f930e07f41f9343478ed5c1d

                                  SHA1

                                  83ee0c5a86997dd491bd8312d221dde2b2e7d44a

                                  SHA256

                                  69d3a21b7723e4df8b7b97e39493081e41231e2d3a3f5a4de462db41339987ec

                                  SHA512

                                  4edb82aedfeca743a03815a889eca766fec8083afd0defa098593297a52edaf1780dbd5ad1d3325c614d815d34d8c57ec2283a0db215f94f42819f1890089c4a

                                • C:\Program Files (x86)\Microsoft\Temp\EU21FA.tmp\msedgeupdateres_it.dll

                                  Filesize

                                  30KB

                                  MD5

                                  26cbb965c6976f59ac385ef9408bf81a

                                  SHA1

                                  16bb0530338e600fdfd13a7b03523a715e633bcb

                                  SHA256

                                  bed996b25f77c7d4328d96147ed388f1b457abfc0510eb8956be4339d103821a

                                  SHA512

                                  1efb1bdf0276de17f8516cde4d435e0be8fd066f52fb5d4c9e2fe2e17a135296ab6b34f523284941beae438e97d7e65de26f0541b7c437bceff229b60da4bb0d

                                • C:\Program Files (x86)\Microsoft\Temp\EU21FA.tmp\msedgeupdateres_iw.dll

                                  Filesize

                                  25KB

                                  MD5

                                  98f79d77ab05304bba8d60e50914418f

                                  SHA1

                                  957590adc0f8a7274e765e2a804c1de7c76e3040

                                  SHA256

                                  3764941b873ed59d5bc1097f6b9382ba59c06d443a96ff71ba6b693f161da522

                                  SHA512

                                  9ca6af5c14193dce7b50251f1b9205870435e60b5495ab1a9f0d42ca14b98b78fef51bf3cd4165394ca5ba28d0e98bea7642ec67039c0f146383136145c7de59

                                • C:\Program Files (x86)\Microsoft\Temp\EU21FA.tmp\msedgeupdateres_ja.dll

                                  Filesize

                                  24KB

                                  MD5

                                  b89ba9ecc6d4c77abff61b1c75fff16c

                                  SHA1

                                  f381408f26be2c77c7b59681ad6280a701ccb472

                                  SHA256

                                  bbd2c970f747a6ee8e4735939225f607ae630ddc6e2e39954e0300ca9a7a88b2

                                  SHA512

                                  53a3db82f4cf5a300a5eab7692f4084451b987ad72ae24d9118d80f18692ac3604981c0e871c7a7625c5153803aea0e093d91822d33af0c10a07bcb6e766a5b6

                                • C:\Program Files (x86)\Microsoft\Temp\EU21FA.tmp\msedgeupdateres_ka.dll

                                  Filesize

                                  29KB

                                  MD5

                                  d464fd223ba898e6fef4e485a3118394

                                  SHA1

                                  59c78983ce859485fea5458ba4e7803c38012b9d

                                  SHA256

                                  066c5c4b4c87ffd201d0dbfc43cb7566cfb03a6ed2fbf8698220fb919637294d

                                  SHA512

                                  6ac1d5fc59e6b7a10532902b059ac25a2bf58b0a63ab586e89b293e2de732c1d5d580c75ff28e4a2660a6ee3f0389f49e388567bcc07dd6e1cfd5d019db3ea52

                                • C:\Program Files (x86)\Microsoft\Temp\EU21FA.tmp\msedgeupdateres_kk.dll

                                  Filesize

                                  28KB

                                  MD5

                                  1b1202fc3e46d7b46ce3cb46cdc5ab21

                                  SHA1

                                  e76d1065035d86eef011feb3cad3ac38eecd0b7d

                                  SHA256

                                  b660a0e1d5161765881e0a7fd9d714abce341403b21f63667ffdedf7d5a254d0

                                  SHA512

                                  7f11d5d6995f27bb4f8705ac7310273f070a71adc73cdb70d74766c89437b3e7a10453fc55588ac223fe3b449564758a49380168d779fdb6a4fac3b5cde767ea

                                • C:\Program Files (x86)\Microsoft\Temp\EU21FA.tmp\msedgeupdateres_km.dll

                                  Filesize

                                  27KB

                                  MD5

                                  126036b98853a9d31937f874484dcb83

                                  SHA1

                                  27ffb8f3f6e966c3b79824357e79eac4ec8ce0a7

                                  SHA256

                                  90908e9108adcb0b4df84e4fbd9724e5e7a2d2eb54720fe49f37bdce977be635

                                  SHA512

                                  b384657e0ca90270b96cb724aa55c52f5c8b569fdb1a7ee7085c18d6822c39fc81a490128bd42d0aec1c0ddac1853e30718710968f5921a5331211bd33e89316

                                • C:\Program Files (x86)\Microsoft\Temp\EU21FA.tmp\msedgeupdateres_kn.dll

                                  Filesize

                                  29KB

                                  MD5

                                  e20f7a758cc9bab3d458d89d828521cc

                                  SHA1

                                  cae0a6d29e5b3f0aed0db2d66fe19d5463c09cfb

                                  SHA256

                                  92858a377f1ddc353b51bb44ec04f571ff2b4913d3c8104aa01359b72f91f2eb

                                  SHA512

                                  8bf9b8c6765820db6dd95303cb996b97649796e14e67b465fded3c24ef180891d58f9fdcb06243ef1d4c5cdd4148f58f64d74d2ceb2cb214051718d33efc9707

                                • C:\Program Files (x86)\Microsoft\Temp\EU21FA.tmp\msedgeupdateres_ko.dll

                                  Filesize

                                  23KB

                                  MD5

                                  f7dbd944a9126dbe568faf2489ecf053

                                  SHA1

                                  16ad534b4fa48d95224c74b8ca4d3d4533c76425

                                  SHA256

                                  b1dd9c0fdd11a5f83ed5b7d1fbcd417bfaa94e42035647ca45f20e332b531703

                                  SHA512

                                  0b6843fd208ea9448179e63b485c01b5ff824d555cad57cdb6575234bf43d6cf253e9494fa74150b9fa9ace9d1d1ce749e1a77c7b342c10498dd7bd3953d9a27

                                • C:\Program Files (x86)\Microsoft\Temp\EU21FA.tmp\msedgeupdateres_kok.dll

                                  Filesize

                                  28KB

                                  MD5

                                  c1557eba649fc78356ed198d6754416d

                                  SHA1

                                  1ab42e71a88b127c40f8dd6d1b0660f271442a11

                                  SHA256

                                  8c5a7b3e9f5a3a64214ca8e9d43ea152f69fc2633f47c0783b90385e00551ef9

                                  SHA512

                                  e2f92c8c6ea823e1d716732b4bb5295d34da02d270079f645d9290261728bcf822b7f845f4a37dc2ef844580d6a3650a53c3e80be875eac5dffef651e8607993

                                • C:\Program Files (x86)\Microsoft\Temp\EU21FA.tmp\msedgeupdateres_lb.dll

                                  Filesize

                                  30KB

                                  MD5

                                  b61c9c9ea8340b6b3a873162a2710cfe

                                  SHA1

                                  5017b90dbd61add602681b76542b0bd3974639af

                                  SHA256

                                  f3eb2d26173d9ea8e26e234c3c5f91f9eb145fdf8b2b3e5011e0f33394fd8737

                                  SHA512

                                  0d32f6a880509472a51ceaa9539e3169505bc6b508664d28c9dfdd1a3a72abec665574dfb89e385c18522166221f1d73741fe62e4ea0860bc132e198614cccf2

                                • C:\Program Files (x86)\Microsoft\Temp\EU21FA.tmp\msedgeupdateres_lo.dll

                                  Filesize

                                  27KB

                                  MD5

                                  6e6f49c35d2b74090529fc1d8d12eb2e

                                  SHA1

                                  5a0fc9397872d7d26803276292962cdb0a5e4739

                                  SHA256

                                  6a25fc0ab6e2c73eb938b8e0f38578b9a02feb3a0634a16ac41ebc2a9642d260

                                  SHA512

                                  d3838a88908b2ab9bf6018dfa4c6f784371774cc0bcc82e180761673a9e527e126fee17a150a51c6d0a1159575e2060c12f85ae751e7a95f0285e816799540bd

                                • C:\Program Files (x86)\Microsoft\Temp\EU21FA.tmp\msedgeupdateres_lt.dll

                                  Filesize

                                  28KB

                                  MD5

                                  071ee832762aab532c59b858c7d3a46a

                                  SHA1

                                  0a976bd2c76d8db1f831a8912184d43e02ecf293

                                  SHA256

                                  a47e46963fbc7020dfc9dd08eb5d7d8c4c2a9f0b0a8f51f1256453058a6a19f2

                                  SHA512

                                  50ec7ff32da6f0d022ce067bcc160ccec00c4676ca56b789bc6ba1efc7f34ad485297f4cca6f6ed40be1c59018a7287c7fb490e6adcdd74f3f72b4526332a522

                                • C:\Program Files (x86)\Microsoft\Temp\EU21FA.tmp\msedgeupdateres_lv.dll

                                  Filesize

                                  29KB

                                  MD5

                                  bf10592aafe1b8446c005ee9e5c305a8

                                  SHA1

                                  19b81a238e07c958f1757488440e42ba99b59b53

                                  SHA256

                                  5cb166b350b425009080d39efa3b6ff5c0bf78f4276cc1ffce3043d4ef1a687f

                                  SHA512

                                  b69d55757047170a7583f3f0525307e09e670adfe05906d30bf208dd78b70b3e18a19adf59aeccc861857c2e37cb08412e4729d597ffb45960d285e12357b4ff

                                • C:\Program Files\MsEdgeCrashpad\settings.dat

                                  Filesize

                                  280B

                                  MD5

                                  3d95569511af6898507ddec83708540f

                                  SHA1

                                  872654a8f7e99f837dd4fb3c290f16046203ff7e

                                  SHA256

                                  60972cbc9018363dd2ff3cd2e3c15f1139333ce6490b183b480452c9a05094d7

                                  SHA512

                                  f78a1078d51d399bb90280f560909dcaa9d283803eeb12ff192f839e61c2558f24af5824a3bdebb4d50a3c2c5e1b03b5af150700a1218b4cdfbaa65c78c8f0a2

                                • C:\Program Files\Retrac Launcher\Retrac Launcher.exe

                                  Filesize

                                  12.7MB

                                  MD5

                                  d4581b57cf0ebc65ede69ae6105a612d

                                  SHA1

                                  fe9a4784c4f40f04fdff4d603ff6bbc1daf33044

                                  SHA256

                                  389b21dc194f7973175f047d55df4bfb3de2216e64b1967d2132fc528bdda9d7

                                  SHA512

                                  cf19e79feafdf5e11e64661d94af002cb7c9e0f2da8b67186067abc2debecb619c0c6476fdb1949cce63ad60926d8cc40595f2d32ae5d7203c4c95f62572631b

                                • C:\ProgramData\Microsoft\EdgeUpdate\Log\MicrosoftEdgeUpdate.log

                                  Filesize

                                  181KB

                                  MD5

                                  6847338aebf77f69a1e502afe5268e09

                                  SHA1

                                  dfd16c665ae30ebcd147c1eb39ff8ac670f403c3

                                  SHA256

                                  d7374e27bf9d9f07b472d2c348f42e59eab80c966845e15cccca7452f5b2c04a

                                  SHA512

                                  cd4d14983eaa62f2ceb5ada96bd421a6ecbf8b1b3e711e1349265aaf120e8e95a4afec06b9256a0191a6986aad7f4053d4bae28b25c7e9e4d4d7d5b42af80bc2

                                • C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Retrac Launcher\Retrac Launcher.lnk

                                  Filesize

                                  2KB

                                  MD5

                                  7a660ba9496250b586334371c657026f

                                  SHA1

                                  bc6e31a62d5a8dcf12f314c499ab468db2906347

                                  SHA256

                                  d6bf8ff2d5f57602d75df1decac4c409bfdbe9cbbec38bf1c29962bc2a956577

                                  SHA512

                                  980af5f28ad356f1c47f350fd6b83d0a4b5031348a1adf4245b322730606f28eb510f35e2b972d684d3d2ed6d45350e897d8c608737abae56e91afa7fb23b610

                                • C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Retrac Launcher\Retrac Launcher.lnk~RFe57aac7.TMP

                                  Filesize

                                  1KB

                                  MD5

                                  d42b9ad0eab67db36708e9b07f8c7831

                                  SHA1

                                  4f3f4bed7c4e14edc83dc57266c28fb3eced11c1

                                  SHA256

                                  e5b03436bb1777a3170f1e388934f130084d264aec8e226beea6d536d8c3d88c

                                  SHA512

                                  c9dd394675d5221e39b3baa8aca00cf956108bb4474f89b06d4f1a99e6d5834a90ccb8e8d9e294cf6616f921ccb1ea565f48e37d14c63b930d49342e9f5d177d

                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                  Filesize

                                  152B

                                  MD5

                                  2783c40400a8912a79cfd383da731086

                                  SHA1

                                  001a131fe399c30973089e18358818090ca81789

                                  SHA256

                                  331fa67da5f67bbb42794c3aeab8f7819f35347460ffb352ccc914e0373a22c5

                                  SHA512

                                  b7c7d3aa966ad39a86aae02479649d74dcbf29d9cb3a7ff8b9b2354ea60704da55f5c0df803fd0a7191170a8e72fdd5eacfa1a739d7a74e390a7b74bdced1685

                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                  Filesize

                                  152B

                                  MD5

                                  ff63763eedb406987ced076e36ec9acf

                                  SHA1

                                  16365aa97cd1a115412f8ae436d5d4e9be5f7b5d

                                  SHA256

                                  8f460e8b7a67f0c65b7248961a7c71146c9e7a19772b193972b486dbf05b8e4c

                                  SHA512

                                  ce90336169c8b2de249d4faea2519bf7c3df48ae9d77cdf471dd5dbd8e8542d47d9348080a098074aa63c255890850ee3b80ddb8eef8384919fdca3bb9371d9f

                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

                                  Filesize

                                  480B

                                  MD5

                                  6b137f49f01b4011cdc65d88f0fff09d

                                  SHA1

                                  6d284678ff0770e29f5ea70c8b44a992752701a5

                                  SHA256

                                  423f66211f453dd1feae739a44b6c669e099cf3c7a6fc91caeb77b188ed23999

                                  SHA512

                                  2de84091231850fbb9cfecb21eafe062ac6fa3def60713e8bd4f1f670244e0aa8b650fd143199dfc9c995b03bbfba2d8b79de0743616e8e60b5a6fb3602ac9aa

                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                  Filesize

                                  469B

                                  MD5

                                  8624b1f8b8dc089a568e155b04f73475

                                  SHA1

                                  22e87cea0d7c7916490872c010d0d054da1abbf3

                                  SHA256

                                  b36357856114564304903ed59824ee3e71ccb241236adb6ee014dda13c2dd823

                                  SHA512

                                  c24fdeee9ac89d8a802787ea8069e9cc9ee92c14586229d07552c2612689eb5d943c5be5931576eb5aefe5e6316304b4fec71b512d12dc76207d596f9a0d6e2b

                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                  Filesize

                                  5KB

                                  MD5

                                  44f1190202f3d3ce47cb789bebbdba9c

                                  SHA1

                                  bfaf77e8841bdd8b0691495eed20cec01f500699

                                  SHA256

                                  44f23ebf2768e68e53e81484d644ec8877c872533db4b738f24773737fb9458c

                                  SHA512

                                  488dfc6db3b7148bfd00265c84580d6f82ef3e6dea2e9f02769dc392ae9b10f4a7db7fd59cdb8b42a99f5657dfaecd57ed6a2098a7fae5869363427d602099ad

                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                  Filesize

                                  6KB

                                  MD5

                                  5ee0db031984432f3cf6770bc0a499d3

                                  SHA1

                                  0007248a72d42290568f2bb059242a7af003f006

                                  SHA256

                                  5c8f8b4f6b16741f69b7e477650167d5edbbc68c2b87c6cfa9cdb02776577e72

                                  SHA512

                                  05909832949074e286a69b77ded021a6cfa6710c9c5bbc01999923d75e608921c7c9f61434089ac81fd8a8d2f9bb690978bbfc58b6fcb3c5b8d5277033a048f6

                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

                                  Filesize

                                  16B

                                  MD5

                                  206702161f94c5cd39fadd03f4014d98

                                  SHA1

                                  bd8bfc144fb5326d21bd1531523d9fb50e1b600a

                                  SHA256

                                  1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

                                  SHA512

                                  0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                  Filesize

                                  10KB

                                  MD5

                                  558d14714f22c0d7ccab5a38f04015f5

                                  SHA1

                                  cac22341d3a101cab39ef37d0df7ae1229afcb33

                                  SHA256

                                  972492fff80d0d68e64e8dfada52bf6ebe31d13114b03592412bc868b38b6c37

                                  SHA512

                                  37901b7091b0810e106956434dcc0725cf4cc451ec1b8ed93493afedaf51f10f94c7df79786d9032e0b54743d46dc7e424149651116702a29686743c80b694a9

                                • C:\Users\Admin\AppData\Local\Temp\MSI761A.tmp

                                  Filesize

                                  113KB

                                  MD5

                                  4fdd16752561cf585fed1506914d73e0

                                  SHA1

                                  f00023b9ae3c8ce5b7bb92f25011eaebe6f9d424

                                  SHA256

                                  aecd2d2fe766f6d439acc2bbf1346930ecc535012cf5ad7b3273d2875237b7e7

                                  SHA512

                                  3695e7eb1e35ec959243a91ab5b4454eb59aeef0f2699aa5de8e03de8fbb89f756a89130526da5c08815408cb700284a17936522ad2cad594c3e6e9d18a3f600

                                • C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeWebview2Setup.exe

                                  Filesize

                                  1.6MB

                                  MD5

                                  45e5ca74b9ae3c3fc6f6a63c609783b6

                                  SHA1

                                  f36715bea96d69bb18075fac30b90502c6d2464b

                                  SHA256

                                  b4afd37b9087df7e041ae749fd0fa342926d9cce533bde9cdc4283132c3820a9

                                  SHA512

                                  014fd398d456fcb118dfd6b038b6f96008ca209d44d9707e175e85e7f14cfb3f2886deaed0d8ed25971813035e8dd7f88142c06972f3e2c9b4a534d84bec661a

                                • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_y2bu51qp.ytp.ps1

                                  Filesize

                                  60B

                                  MD5

                                  d17fe0a3f47be24a6453e9ef58c94641

                                  SHA1

                                  6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                  SHA256

                                  96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                  SHA512

                                  5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                • C:\Users\Admin\AppData\Local\site.retrac\EBWebView\Crashpad\settings.dat

                                  Filesize

                                  280B

                                  MD5

                                  51f4ae1a414636ebf231e0ca74fead10

                                  SHA1

                                  ec96a8ebbc1ebf098c749bb67b320e0bf6ce5dbf

                                  SHA256

                                  4208e12f3382200991875bdc15159c95e313bd3d33d9bc4c229caec6db57aa9a

                                  SHA512

                                  07fdbf2252e776538ffa8476d5c1f11a2311ef8500420123c18b9f8bd0b8b198e386e26e0b1ff0e9d2d2ad37d6d37b61798f5c0d05fddd4a1dedc0bb704468a6

                                • C:\Users\Admin\AppData\Local\site.retrac\EBWebView\Default\Code Cache\js\index-dir\the-real-index

                                  Filesize

                                  48B

                                  MD5

                                  ac90d8349da61fc14be8aab5ee7da08d

                                  SHA1

                                  7bfed75d11c02447ab7af4c48413b272f96c8211

                                  SHA256

                                  df56fe7883c84625ed705c32714d343ab7e911b05821244e543d6fbbe8691cf5

                                  SHA512

                                  35de3a134440aaa62849d2fa6c4a6e3d2c96c2a538567c1720e014fcff3085f452cb1619f097b3a1425dcf1a0a09e5bc4508bd8de007095661646a4829287580

                                • C:\Users\Admin\AppData\Local\site.retrac\EBWebView\Default\Code Cache\js\index-dir\the-real-index

                                  Filesize

                                  96B

                                  MD5

                                  9a8570af388d468878896b0ecfb54a88

                                  SHA1

                                  a863ef126114c68bdd191c9aebe1f153caa696b4

                                  SHA256

                                  ba0f15815eaa9d75ef47897cbdc179c1f945ec751ed958d660dd5f1105f81457

                                  SHA512

                                  fbdd8ed71a30d9f9f86bfeafa74622878848258d9c42db941281d54b993e5e682c6cb688a2280edad976dcdd5a3e2e88e3a74face519f7a56c8cf110d1547b2e

                                • C:\Users\Admin\AppData\Local\site.retrac\EBWebView\Default\Extension Rules\CURRENT

                                  Filesize

                                  16B

                                  MD5

                                  46295cac801e5d4857d09837238a6394

                                  SHA1

                                  44e0fa1b517dbf802b18faf0785eeea6ac51594b

                                  SHA256

                                  0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

                                  SHA512

                                  8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

                                • C:\Users\Admin\AppData\Local\site.retrac\EBWebView\Default\Extension Rules\MANIFEST-000001

                                  Filesize

                                  41B

                                  MD5

                                  5af87dfd673ba2115e2fcf5cfdb727ab

                                  SHA1

                                  d5b5bbf396dc291274584ef71f444f420b6056f1

                                  SHA256

                                  f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

                                  SHA512

                                  de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

                                • C:\Users\Admin\AppData\Local\site.retrac\EBWebView\Default\Network\Network Persistent State

                                  Filesize

                                  1KB

                                  MD5

                                  6d7b60959176bcff364cd8eed746ddfe

                                  SHA1

                                  7709e1e4ff6fbf27d9c853d77cd2f37ab6ab19fa

                                  SHA256

                                  78be48ecb8bf8184865a0ed850b6f57d30d8b0c0afad5326a482e905aade31bf

                                  SHA512

                                  b27247a4059e785beae1af4ab4122ecbb53c53c6aed048070cfec08f0f7d7e294ce4199b17a4759e91fc1463628ad6fd82f2770ba98822aa8bb820b9b1e6ada5

                                • C:\Users\Admin\AppData\Local\site.retrac\EBWebView\Default\Network\Network Persistent State~RFe5a1a30.TMP

                                  Filesize

                                  59B

                                  MD5

                                  2800881c775077e1c4b6e06bf4676de4

                                  SHA1

                                  2873631068c8b3b9495638c865915be822442c8b

                                  SHA256

                                  226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974

                                  SHA512

                                  e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b

                                • C:\Users\Admin\AppData\Local\site.retrac\EBWebView\Default\Network\SCT Auditing Pending Reports

                                  Filesize

                                  2B

                                  MD5

                                  d751713988987e9331980363e24189ce

                                  SHA1

                                  97d170e1550eee4afc0af065b78cda302a97674c

                                  SHA256

                                  4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

                                  SHA512

                                  b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

                                • C:\Users\Admin\AppData\Local\site.retrac\EBWebView\Default\Preferences

                                  Filesize

                                  6KB

                                  MD5

                                  654b21f18e626eb759e1ef78671a57d8

                                  SHA1

                                  cdabe845feb334c38d1c938aee4c8a67dc8c7f44

                                  SHA256

                                  60cf5dd9d26927faa6e58b360a0f8df4d9e3afda6126b5ffca979c8c4bb47f18

                                  SHA512

                                  cab86cb7a26098a340bea242ee999e22bd81a7505de12291cb719eff7039e2cc739e7e29499f6fa09e43dbba4fe301c139c7b7a9726b3c5de47dd970316ef75a

                                • C:\Users\Admin\AppData\Local\site.retrac\EBWebView\Default\Preferences~RFe5a19c3.TMP

                                  Filesize

                                  6KB

                                  MD5

                                  0ec0f1da5dd9b9394d308d60fab072d5

                                  SHA1

                                  4f0a678b22c60d67bdd973b0587ef13ddfc7ae5b

                                  SHA256

                                  5be1df909215656766efd96c1d2de38dc7463f6e0a5312e843eaf006cc00ec4b

                                  SHA512

                                  261c712d4da1df963709a21d7dd7ca691a7afb1f9f3e37cbe5f5c05a0de89ba63093dc6fd9fe936d7df2c7530c8a9b15a4fe9e74f0ae1815d7839d854baf9551

                                • C:\Users\Admin\AppData\Local\site.retrac\EBWebView\GrShaderCache\data_0

                                  Filesize

                                  8KB

                                  MD5

                                  cf89d16bb9107c631daabf0c0ee58efb

                                  SHA1

                                  3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b

                                  SHA256

                                  d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e

                                  SHA512

                                  8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0

                                • C:\Users\Admin\AppData\Local\site.retrac\EBWebView\GrShaderCache\data_2

                                  Filesize

                                  8KB

                                  MD5

                                  0962291d6d367570bee5454721c17e11

                                  SHA1

                                  59d10a893ef321a706a9255176761366115bedcb

                                  SHA256

                                  ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7

                                  SHA512

                                  f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed

                                • C:\Users\Admin\AppData\Local\site.retrac\EBWebView\GrShaderCache\data_3

                                  Filesize

                                  8KB

                                  MD5

                                  41876349cb12d6db992f1309f22df3f0

                                  SHA1

                                  5cf26b3420fc0302cd0a71e8d029739b8765be27

                                  SHA256

                                  e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c

                                  SHA512

                                  e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e

                                • C:\Users\Admin\AppData\Local\site.retrac\EBWebView\GraphiteDawnCache\data_1

                                  Filesize

                                  264KB

                                  MD5

                                  d0d388f3865d0523e451d6ba0be34cc4

                                  SHA1

                                  8571c6a52aacc2747c048e3419e5657b74612995

                                  SHA256

                                  902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b

                                  SHA512

                                  376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17

                                • C:\Users\Admin\AppData\Local\site.retrac\EBWebView\Local State

                                  Filesize

                                  2KB

                                  MD5

                                  cf47655c4836f8aadf417b8e3368849c

                                  SHA1

                                  1f681046f583b88891c64a1ac93d4abcbb39ff8e

                                  SHA256

                                  b8e072db76cdcad05d206f822f2d63eac5d9f779be41569fc211b62f46aa2cb8

                                  SHA512

                                  a1090e1f2f33e5ef26041c5b0b1a58796161270e9131df4ce8f5c7a5de62eefde55568ce2785922c6da21e77955cd66ddf750b8ef94259e0b23fc847196cee27

                                • C:\Users\Admin\AppData\Local\site.retrac\EBWebView\Local State

                                  Filesize

                                  3KB

                                  MD5

                                  709f6777b1c4bc395fb65c302a351aa0

                                  SHA1

                                  a972f64ae9defefc80d2168ec062f2f94a5c275b

                                  SHA256

                                  2c196c866250437098073a889f964219eb8581e71513ec7126815aeebec3a110

                                  SHA512

                                  665c4df4341f06e4cfbffceb90c56955fd60684b5b8a269f7b7949090e14bc938a86975246f4d3b8e939a1189a867d870c04a6cff565a24bd5cdf083080f7de9

                                • C:\Users\Admin\AppData\Local\site.retrac\EBWebView\Local State

                                  Filesize

                                  16KB

                                  MD5

                                  cb87085c41f07e20c079628335b9ca27

                                  SHA1

                                  5cc5e174a57cf701c4e173fb60bb99f63dcfa0bc

                                  SHA256

                                  304603f4128b2644784f87535916cff4b5ec7617a6a08bc457e429cd6f87af48

                                  SHA512

                                  2c0339324aaedafa14b4a308ca98fa6b44d60ccc3e9015649f5bae8d740c45dd02f36fb8ae6b676160992320ca15470208ab524f0c557a02b043ada94988519b

                                • C:\Users\Admin\AppData\Local\site.retrac\EBWebView\Local State

                                  Filesize

                                  1KB

                                  MD5

                                  ebf52f1f03811d369ea29b55c9de8c17

                                  SHA1

                                  3353297831111bae82cf24d623ddf792e9cb28bf

                                  SHA256

                                  905dac8cdb0348dcdacda345a9a8d9036d8fd3c52e2b2e2be903ea366c85ffdd

                                  SHA512

                                  57484471fab9da4c9114690cef42b36b0df99a151dfc611b3777c963b49128a464c4f7fd4d3e691c82944bbcf8db892be9913b08c8d23a5c8cd5a74f9fe2f814

                                • C:\Users\Admin\AppData\Local\site.retrac\EBWebView\Local State

                                  Filesize

                                  16KB

                                  MD5

                                  c28cad30fc80f2c03e115e61d9fe335a

                                  SHA1

                                  6a249e43d5f88baf68aacbe47e46c4dd9d0ff981

                                  SHA256

                                  7e068f0f1bbd61e8f7c1fbc2ad3124052641e7eaaa226bc00be51f3c0be59670

                                  SHA512

                                  a8ae6b16472ad6b3bdbb672e57d62c51932f7e8a4f18164a04a8170799cf3958687a0bca94e0a5cd4dac06aa45bbf9035c572235105379213f4a2d47bb0f35e4

                                • C:\Users\Admin\AppData\Local\site.retrac\EBWebView\Local State~RFe59d7d8.TMP

                                  Filesize

                                  1KB

                                  MD5

                                  d1e168e6e0d0d0a1a2404c6f5ba640fd

                                  SHA1

                                  ea33057a6c11bf3c58f29b4e8877856424c788ff

                                  SHA256

                                  c6aaf037ae86187f1c3954b0161b9196e6a8c2d3ead0aed8c2bad0ce3abf2e2d

                                  SHA512

                                  066f88430f0399160b1133654018357eb3bf4888c1c6c771e4c2ae51d4a6eae8a15b767c9cbb8e926cde61c0381815310636db3f60401f94b1a0d964e9a15f5e

                                • C:\Windows\Installer\e57a921.msi

                                  Filesize

                                  6.5MB

                                  MD5

                                  4eb0f591d4635eef867eba6b30519482

                                  SHA1

                                  ffbdf0b4e300686d4c637ec9ae1e93f5fe31d1e1

                                  SHA256

                                  d1861ff47ec977e9ce72cbeab98d2838f5981adb6ee8800ef41c59ab2bcda26b

                                  SHA512

                                  4f9d7827508e8491af2df7e3adcc9da47871546284381e9873283c00a81a98a0aa4cc60cfc3a2e61247ec13f1de08c72818096b56613be569b83fb1e6d56b4ee

                                • \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2

                                  Filesize

                                  23.7MB

                                  MD5

                                  ed265ffc62b1bc7523c75f5188bbb079

                                  SHA1

                                  3abbc2128f1fc18ea3fb118c195f2bfa7cb27ffe

                                  SHA256

                                  eafaa04bbd87d1a8c11ee8b98afd2500803c9edf511f201ce87742a4efade3c6

                                  SHA512

                                  9cddfa5e23bfbd970cd05c399c7a37da754276ec880faff285f3572b93061f65b6f90cd3bfdd6f56c750ec5d4e85ff11817730ab46356f9d20b702a2d4fc5139

                                • \??\Volume{851c08bf-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{a6ad003d-44fa-4397-b282-e6cb33763a41}_OnDiskSnapshotProp

                                  Filesize

                                  6KB

                                  MD5

                                  ce48fec50fd4bc0074b65994c122aad6

                                  SHA1

                                  5ce63536644c1a908ad3b36adf4d8b2889bd62f8

                                  SHA256

                                  ab4bfb9fcfe54e685471f195813b55e69de8b1bc3e3d60fc2df5491617ea0ce7

                                  SHA512

                                  b7d8addfe355b7313fd6e57392decba72edbd31810b95085762b70b1d7d75aa3fd1c00a8f417a7ce34146925197de943420cbbfe791ca91918758eb7a6f34cb3

                                • memory/2544-45-0x0000023071640000-0x0000023071662000-memory.dmp

                                  Filesize

                                  136KB

                                • memory/2544-350-0x00007FFAC7210000-0x00007FFAC7211000-memory.dmp

                                  Filesize

                                  4KB

                                • memory/2816-361-0x00007FFAC7D60000-0x00007FFAC7D61000-memory.dmp

                                  Filesize

                                  4KB

                                • memory/2816-360-0x00007FFAC7D50000-0x00007FFAC7D51000-memory.dmp

                                  Filesize

                                  4KB

                                • memory/4476-359-0x00007FFAC7210000-0x00007FFAC7211000-memory.dmp

                                  Filesize

                                  4KB

                                • memory/4504-307-0x0000000000FD0000-0x0000000001005000-memory.dmp

                                  Filesize

                                  212KB

                                • memory/4504-262-0x00000000745F0000-0x0000000074815000-memory.dmp

                                  Filesize

                                  2.1MB

                                • memory/4504-250-0x00000000745F0000-0x0000000074815000-memory.dmp

                                  Filesize

                                  2.1MB

                                • memory/4504-249-0x0000000000FD0000-0x0000000001005000-memory.dmp

                                  Filesize

                                  212KB