Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
179s -
max time network
181s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
23/08/2024, 18:51
Static task
static1
Behavioral task
behavioral1
Sample
Retrac.Launcher_1.0.11_x64_en-US.msi
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
Retrac.Launcher_1.0.11_x64_en-US.msi
Resource
win10v2004-20240802-en
General
-
Target
Retrac.Launcher_1.0.11_x64_en-US.msi
-
Size
6.5MB
-
MD5
4eb0f591d4635eef867eba6b30519482
-
SHA1
ffbdf0b4e300686d4c637ec9ae1e93f5fe31d1e1
-
SHA256
d1861ff47ec977e9ce72cbeab98d2838f5981adb6ee8800ef41c59ab2bcda26b
-
SHA512
4f9d7827508e8491af2df7e3adcc9da47871546284381e9873283c00a81a98a0aa4cc60cfc3a2e61247ec13f1de08c72818096b56613be569b83fb1e6d56b4ee
-
SSDEEP
196608:Ky/Pz3ZHXtF+An59GSwXYUNtJo47IE4xLwe:KAbJtlu71jJo/Lwe
Malware Config
Signatures
-
Blocklisted process makes network request 3 IoCs
flow pid Process 35 2544 powershell.exe 53 2544 powershell.exe 57 2544 powershell.exe -
Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell and hide display window.
pid Process 2544 powershell.exe 2544 powershell.exe -
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA Retrac Launcher.exe -
Downloads MZ/PE file
-
Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\G: msiexec.exe -
Event Triggered Execution: Image File Execution Options Injection 1 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MicrosoftEdgeUpdate.exe MicrosoftEdgeUpdate.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MicrosoftEdgeUpdate.exe\DisableExceptionChainValidation = "0" MicrosoftEdgeUpdate.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 6 IoCs
flow ioc 131 raw.githubusercontent.com 144 discord.com 148 discord.com 118 raw.githubusercontent.com 119 raw.githubusercontent.com 130 raw.githubusercontent.com -
Checks computer location settings 2 TTPs 3 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\Control Panel\International\Geo\Nation MicrosoftEdgeUpdate.exe Key value queried \REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\Control Panel\International\Geo\Nation msedgewebview2.exe Key value queried \REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\Control Panel\International\Geo\Nation msedgewebview2.exe -
Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Checks system information in the registry 2 TTPs 12 IoCs
System information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName MicrosoftEdgeUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName MicrosoftEdgeUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer MicrosoftEdgeUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName MicrosoftEdgeUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName msedgewebview2.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer MicrosoftEdgeUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer MicrosoftEdgeUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName MicrosoftEdgeUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer MicrosoftEdgeUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName MicrosoftEdgeUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer MicrosoftEdgeUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer msedgewebview2.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\128.0.2739.42\dxcompiler.dll setup.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\128.0.2739.42\Trust Protection Lists\Sigma\Content setup.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\128.0.2739.42\Locales\ar.pak setup.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\128.0.2739.42\Locales\ta.pak setup.exe File created C:\Program Files (x86)\Microsoft\Temp\EU21FA.tmp\msedgeupdateres_cs.dll MicrosoftEdgeWebview2Setup.exe File created C:\Program Files (x86)\Microsoft\Temp\EU21FA.tmp\msedgeupdateres_uk.dll MicrosoftEdgeWebview2Setup.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\128.0.2739.42\icudtl.dat setup.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\128.0.2739.42\Locales\lb.pak setup.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\128.0.2739.42\EBWebView\x86\EmbeddedBrowserWebView.dll setup.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\128.0.2739.42\Locales\ko.pak setup.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\128.0.2739.42\Locales\ro.pak setup.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\128.0.2739.42\Locales\da.pak setup.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\128.0.2739.42\Locales\hu.pak setup.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\128.0.2739.42\Locales\qu.pak setup.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\128.0.2739.42\identity_proxy\resources.pri setup.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\128.0.2739.42\Locales\hu.pak setup.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\128.0.2739.42\PrivacySandboxAttestationsPreloaded\privacy-sandbox-attestations.dat setup.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\128.0.2739.42\msedge_wer.dll setup.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\128.0.2739.42\Locales\en-GB.pak setup.exe File created C:\Program Files (x86)\Microsoft\Temp\EU21FA.tmp\msedgeupdateres_gl.dll MicrosoftEdgeWebview2Setup.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\128.0.2739.42\VisualElements\SmallLogo.png setup.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\128.0.2739.42\show_third_party_software_licenses.bat setup.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\128.0.2739.42\Locales\bn-IN.pak setup.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\128.0.2739.42\Locales\he.pak setup.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\128.0.2739.42\PrivacySandboxAttestationsPreloaded\privacy-sandbox-attestations.dat setup.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\128.0.2739.42\Locales\kk.pak setup.exe File created C:\Program Files (x86)\Microsoft\Temp\EU21FA.tmp\msedgeupdateres_pt-BR.dll MicrosoftEdgeWebview2Setup.exe File created C:\Program Files (x86)\Microsoft\Temp\EU21FA.tmp\msedgeupdateres_ne.dll MicrosoftEdgeWebview2Setup.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate\Download\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}\128.0.2739.42\MicrosoftEdge_X64_128.0.2739.42.exe MicrosoftEdgeUpdate.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\128.0.2739.42\mip_protection_sdk.dll setup.exe File created C:\Program Files (x86)\Microsoft\Temp\EU21FA.tmp\msedgeupdateres_pt-PT.dll MicrosoftEdgeWebview2Setup.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\128.0.2739.42\Locales\zh-TW.pak setup.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\128.0.2739.42\msedgewebview2.exe.sig setup.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\128.0.2739.42\Locales\bg.pak setup.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\128.0.2739.42\WidevineCdm\_platform_specific\win_x64\widevinecdm.dll.sig setup.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\128.0.2739.42\Locales\ja.pak setup.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\128.0.2739.42\Locales\lo.pak setup.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\128.0.2739.42\identity_proxy\win10\identity_helper.Sparse.Beta.msix setup.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\128.0.2739.42\identity_proxy\win11\identity_helper.Sparse.Dev.msix setup.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\128.0.2739.42\Locales\sr-Latn-RS.pak setup.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\128.0.2739.42\Trust Protection Lists\Mu\Fingerprinting setup.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\128.0.2739.42\identity_proxy\win11\identity_helper.Sparse.Dev.msix setup.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\128.0.2739.42\Locales\mk.pak setup.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\128.0.2739.42\Locales\hi.pak setup.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\128.0.2739.42\Locales\hr.pak setup.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\128.0.2739.42\elevation_service.exe setup.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\128.0.2739.42\Locales\hi.pak setup.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\128.0.2739.42\Locales\te.pak setup.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\128.0.2739.42\resources.pak setup.exe File created C:\Program Files (x86)\Microsoft\Temp\EU21FA.tmp\msedgeupdateres_es-419.dll MicrosoftEdgeWebview2Setup.exe File opened for modification C:\Program Files\MsEdgeCrashpad\throttle_store.dat setup.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\128.0.2739.42\Locales\ar.pak setup.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\128.0.2739.42\Locales\mk.pak setup.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\128.0.2739.42\Locales\is.pak setup.exe File created C:\Program Files (x86)\Microsoft\Temp\EU21FA.tmp\psmachine_64.dll MicrosoftEdgeWebview2Setup.exe File created C:\Program Files (x86)\Microsoft\Temp\EU21FA.tmp\msedgeupdateres_ro.dll MicrosoftEdgeWebview2Setup.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\128.0.2739.42\Locales\ka.pak setup.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\128.0.2739.42\Locales\mr.pak setup.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\128.0.2739.42\Locales\as.pak setup.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\128.0.2739.42\Locales\mt.pak setup.exe File created C:\Program Files (x86)\Microsoft\Temp\EU21FA.tmp\psuser_64.dll MicrosoftEdgeWebview2Setup.exe File created C:\Program Files (x86)\Microsoft\Temp\EU21FA.tmp\msedgeupdateres_bg.dll MicrosoftEdgeWebview2Setup.exe File created C:\Program Files (x86)\Microsoft\Temp\EU21FA.tmp\msedgeupdateres_ur.dll MicrosoftEdgeWebview2Setup.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\128.0.2739.42\Locales\af.pak setup.exe -
Drops file in Windows directory 10 IoCs
description ioc Process File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File created C:\Windows\Installer\SourceHash{8139B297-E2FB-4C4C-9D44-8CE55558C8DB} msiexec.exe File opened for modification C:\Windows\Installer\MSIA9DC.tmp msiexec.exe File created C:\Windows\Installer\{8139B297-E2FB-4C4C-9D44-8CE55558C8DB}\ProductIcon msiexec.exe File created C:\Windows\Installer\e57a921.msi msiexec.exe File opened for modification C:\Windows\Installer\e57a921.msi msiexec.exe File opened for modification C:\Windows\Installer\{8139B297-E2FB-4C4C-9D44-8CE55558C8DB}\ProductIcon msiexec.exe File created C:\Windows\Installer\e57a923.msi msiexec.exe -
Executes dropped EXE 22 IoCs
pid Process 1116 MicrosoftEdgeWebview2Setup.exe 4504 MicrosoftEdgeUpdate.exe 3356 MicrosoftEdgeUpdate.exe 2160 MicrosoftEdgeUpdate.exe 4536 MicrosoftEdgeUpdateComRegisterShell64.exe 3940 MicrosoftEdgeUpdateComRegisterShell64.exe 2780 MicrosoftEdgeUpdateComRegisterShell64.exe 5052 MicrosoftEdgeUpdate.exe 3156 MicrosoftEdgeUpdate.exe 544 MicrosoftEdgeUpdate.exe 4572 MicrosoftEdgeUpdate.exe 4860 MicrosoftEdge_X64_128.0.2739.42.exe 1356 setup.exe 3956 setup.exe 3344 MicrosoftEdgeUpdate.exe 2824 Retrac Launcher.exe 736 msedgewebview2.exe 1192 msedgewebview2.exe 2544 msedgewebview2.exe 1852 msedgewebview2.exe 2816 msedgewebview2.exe 4476 msedgewebview2.exe -
Loads dropped DLL 38 IoCs
pid Process 3436 MsiExec.exe 4504 MicrosoftEdgeUpdate.exe 3356 MicrosoftEdgeUpdate.exe 2160 MicrosoftEdgeUpdate.exe 4536 MicrosoftEdgeUpdateComRegisterShell64.exe 2160 MicrosoftEdgeUpdate.exe 3940 MicrosoftEdgeUpdateComRegisterShell64.exe 2160 MicrosoftEdgeUpdate.exe 2780 MicrosoftEdgeUpdateComRegisterShell64.exe 2160 MicrosoftEdgeUpdate.exe 5052 MicrosoftEdgeUpdate.exe 3156 MicrosoftEdgeUpdate.exe 544 MicrosoftEdgeUpdate.exe 544 MicrosoftEdgeUpdate.exe 3156 MicrosoftEdgeUpdate.exe 4572 MicrosoftEdgeUpdate.exe 3344 MicrosoftEdgeUpdate.exe 3436 MsiExec.exe 2824 Retrac Launcher.exe 736 msedgewebview2.exe 1192 msedgewebview2.exe 736 msedgewebview2.exe 736 msedgewebview2.exe 736 msedgewebview2.exe 2544 msedgewebview2.exe 1852 msedgewebview2.exe 2544 msedgewebview2.exe 1852 msedgewebview2.exe 2816 msedgewebview2.exe 2544 msedgewebview2.exe 2816 msedgewebview2.exe 2544 msedgewebview2.exe 2544 msedgewebview2.exe 2544 msedgewebview2.exe 4476 msedgewebview2.exe 4476 msedgewebview2.exe 4476 msedgewebview2.exe 736 msedgewebview2.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
pid Process 4228 msiexec.exe -
System Location Discovery: System Language Discovery 1 TTPs 10 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MicrosoftEdgeWebview2Setup.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MicrosoftEdgeUpdate.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MicrosoftEdgeUpdate.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MicrosoftEdgeUpdate.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MicrosoftEdgeUpdate.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MicrosoftEdgeUpdate.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MicrosoftEdgeUpdate.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MicrosoftEdgeUpdate.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MicrosoftEdgeUpdate.exe -
System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 5 IoCs
Adversaries may check for Internet connectivity on compromised systems.
pid Process 5712 cmd.exe 5052 MicrosoftEdgeUpdate.exe 4572 MicrosoftEdgeUpdate.exe 3344 MicrosoftEdgeUpdate.exe 5936 cmd.exe -
Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000bf081c85bb6cd1e80000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000bf081c850000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3a000000ffffffff000000000700010000680900bf081c85000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1dbf081c85000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000bf081c8500000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe -
Enumerates system info in registry 2 TTPs 6 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedgewebview2.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedgewebview2.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedgewebview2.exe -
Kills process with taskkill 6 IoCs
pid Process 5668 taskkill.exe 5708 taskkill.exe 5656 taskkill.exe 5700 taskkill.exe 5664 taskkill.exe 5316 taskkill.exe -
Modifies data under HKEY_USERS 46 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates MicrosoftEdgeUpdate.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133689128810953914" msedgewebview2.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27 msiexec.exe Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry msedgewebview2.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates MicrosoftEdgeUpdate.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26 msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates MicrosoftEdgeUpdate.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs MicrosoftEdgeUpdate.exe -
Modifies registry class 64 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A6B716CB-028B-404D-B72C-50E153DD68DA}\AppID = "{A6B716CB-028B-404D-B72C-50E153DD68DA}" MicrosoftEdgeUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{177CAE89-4AD6-42F4-A458-00EC3389E3FE}\ = "ICurrentState" MicrosoftEdgeUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.PolicyStatusMachine\CurVer\ = "MicrosoftEdgeUpdate.PolicyStatusMachine.1.0" MicrosoftEdgeUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.ProcessLauncher\ = "Microsoft Edge Update Process Launcher Class" MicrosoftEdgeUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{CECDDD22-2E72-4832-9606-A9B0E5E344B2}\ = "ServiceModule" MicrosoftEdgeUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2EC826CB-5478-4533-9015-7580B3B5E03A}\ProxyStubClsid32\ = "{0E8770A1-043A-4818-BB5C-41862B93EEFF}" MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{AB4F4A7E-977C-4E23-AD8F-626A491715DF} MicrosoftEdgeUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F7B3738C-9BCA-4B14-90B7-89D0F3A3E497} MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.OnDemandCOMClassMachineFallback\CLSID\ = "{FF419FF9-90BE-4D9F-B410-A789F90E5A7C}" MicrosoftEdgeUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EA92A799-267E-4DF5-A6ED-6A7E0684BB8A}\ = "Microsoft Edge Update Update3Web" MicrosoftEdgeUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{450CF5FF-95C4-4679-BECA-22680389ECB9}\NumMethods\ = "10" MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{375D3B39-152A-41E1-BF1B-B648933F26D0}\InprocHandler32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.195.15\\psmachine_64.dll" MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{450CF5FF-95C4-4679-BECA-22680389ECB9} MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32 MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F7B3738C-9BCA-4B14-90B7-89D0F3A3E497}\ProxyStubClsid32 MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.CredentialDialogMachine\CLSID\ = "{5F6A18BB-6231-424B-8242-19E5BB94F8ED}" MicrosoftEdgeUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9A6B447A-35E2-4F6B-A87B-5DEEBBFDAD17} MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.Update3WebMachine.1.0\ = "Microsoft Edge Update Broker Class Factory" MicrosoftEdgeUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{99F8E195-1042-4F89-A28C-89CDB74A14AE}\NumMethods\ = "13" MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FF419FF9-90BE-4D9F-B410-A789F90E5A7C}\VersionIndependentProgID MicrosoftEdgeUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F7B3738C-9BCA-4B14-90B7-89D0F3A3E497}\NumMethods MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C20433B3-0D4B-49F6-9B6C-6EE0FAE07837} MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{2EC826CB-5478-4533-9015-7580B3B5E03A}\NumMethods MicrosoftEdgeUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D9AA3288-4EA7-4E67-AE60-D18EADCB923D}\ProxyStubClsid32 MicrosoftEdgeUpdateComRegisterShell64.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D1E8B1A6-32CE-443C-8E2E-EBA90C481353} MicrosoftEdgeUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C853632E-36CA-4999-B992-EC0D408CF5AB}\ProxyStubClsid32 MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E4518371-7326-4865-87F8-D9D3F3B287A3} MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AB4F4A7E-977C-4E23-AD8F-626A491715DF}\NumMethods MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DDD4B5D4-FD54-497C-8789-0830F29A60EE}\ProxyStubClsid32 MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1B9063E4-3882-485E-8797-F28A0240782F}\ProxyStubClsid32 MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.Update3WebMachineFallback\ = "Microsoft Edge Update Update3Web" MicrosoftEdgeUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.195.15\\psmachine.dll" MicrosoftEdgeUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{60355531-5BFD-45AB-942C-7912628752C7}\ = "IPolicyStatus3" MicrosoftEdgeUpdate.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{492E1C30-A1A2-4695-87C8-7A8CAD6F936F}\LOCALSERVER32 MicrosoftEdgeUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7584D24A-E056-4EB1-8E7B-632F2B0ADC69}\ProxyStubClsid32 MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FCE48F77-C677-4012-8A1A-54D2E2BC07BD}\ = "IGoogleUpdateCore" MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A6556DFF-AB15-4DC3-A890-AB54120BEAEC}\NumMethods MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FF419FF9-90BE-4D9F-B410-A789F90E5A7C}\ProgID MicrosoftEdgeUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E55B90F1-DA33-400B-B09E-3AFF7D46BD83}\ProxyStubClsid32\ = "{0E8770A1-043A-4818-BB5C-41862B93EEFF}" MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3805CA06-AC83-4F00-8A02-271DCD89BDEB}\ = "IPolicyStatus5" MicrosoftEdgeUpdateComRegisterShell64.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{08D832B9-D2FD-481F-98CF-904D00DF63CC}\VERSIONINDEPENDENTPROGID MicrosoftEdgeUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{77857D02-7A25-4B67-9266-3E122A8F39E4}\ProgID MicrosoftEdgeUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F7B3738C-9BCA-4B14-90B7-89D0F3A3E497} MicrosoftEdgeUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{2EC826CB-5478-4533-9015-7580B3B5E03A}\ProxyStubClsid32 MicrosoftEdgeUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{79E0C401-B7BC-4DE5-8104-71350F3A9B67}\ = "IGoogleUpdate" MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D9AA3288-4EA7-4E67-AE60-D18EADCB923D}\NumMethods\ = "4" MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E55B90F1-DA33-400B-B09E-3AFF7D46BD83}\ProxyStubClsid32 MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7B3B7A69-7D88-4847-A6BC-90E246A41F69}\NumMethods MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{3A49F783-1C7D-4D35-8F63-5C1C206B9B6E}\ProxyStubClsid32\ = "{0E8770A1-043A-4818-BB5C-41862B93EEFF}" MicrosoftEdgeUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C20433B3-0D4B-49F6-9B6C-6EE0FAE07837}\NumMethods\ = "4" MicrosoftEdgeUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2603C88B-F971-4167-9DE1-871EE4A3DC84}\NumMethods MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A6556DFF-AB15-4DC3-A890-AB54120BEAEC}\ProxyStubClsid32 MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.OnDemandCOMClassMachineFallback\CurVer\ = "MicrosoftEdgeUpdate.OnDemandCOMClassMachineFallback.1.0" MicrosoftEdgeUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\792B9318BF2EC4C4D944C85E55858CBD\ShortcutsFeature = "MainProgram" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{E4518371-7326-4865-87F8-D9D3F3B287A3}\NumMethods\ = "4" MicrosoftEdgeUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C853632E-36CA-4999-B992-EC0D408CF5AB}\NumMethods MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FCE48F77-C677-4012-8A1A-54D2E2BC07BD}\NumMethods MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D9AA3288-4EA7-4E67-AE60-D18EADCB923D}\ = "IJobObserver2" MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{5F9C80B5-9E50-43C9-887C-7C6412E110DF}\NumMethods\ = "11" MicrosoftEdgeUpdate.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB} MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.195.15\\psmachine_64.dll" MicrosoftEdgeUpdateComRegisterShell64.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{E421557C-0628-43FB-BF2B-7C9F8A4D067C}\ELEVATION MicrosoftEdgeUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6DFFE7FE-3153-4AF1-95D8-F8FCCA97E56B}\ProxyStubClsid32\ = "{0E8770A1-043A-4818-BB5C-41862B93EEFF}" MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FF419FF9-90BE-4D9F-B410-A789F90E5A7C}\ProgID\ = "MicrosoftEdgeUpdate.OnDemandCOMClassMachineFallback.1.0" MicrosoftEdgeUpdate.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2864 msiexec.exe 2864 msiexec.exe 2544 powershell.exe 2544 powershell.exe 2544 powershell.exe 4504 MicrosoftEdgeUpdate.exe 4504 MicrosoftEdgeUpdate.exe 4504 MicrosoftEdgeUpdate.exe 4504 MicrosoftEdgeUpdate.exe 4504 MicrosoftEdgeUpdate.exe 4504 MicrosoftEdgeUpdate.exe 2824 Retrac Launcher.exe 2824 Retrac Launcher.exe 2824 Retrac Launcher.exe 2824 Retrac Launcher.exe 2824 Retrac Launcher.exe 2824 Retrac Launcher.exe 2824 Retrac Launcher.exe 2824 Retrac Launcher.exe 2824 Retrac Launcher.exe 2824 Retrac Launcher.exe 2824 Retrac Launcher.exe 2824 Retrac Launcher.exe 2824 Retrac Launcher.exe 2824 Retrac Launcher.exe 2824 Retrac Launcher.exe 2824 Retrac Launcher.exe 2824 Retrac Launcher.exe 2824 Retrac Launcher.exe 2824 Retrac Launcher.exe 2824 Retrac Launcher.exe 2824 Retrac Launcher.exe 2824 Retrac Launcher.exe 2824 Retrac Launcher.exe 2824 Retrac Launcher.exe 2824 Retrac Launcher.exe 2824 Retrac Launcher.exe 2824 Retrac Launcher.exe 2824 Retrac Launcher.exe 2824 Retrac Launcher.exe 2824 Retrac Launcher.exe 2824 Retrac Launcher.exe 2824 Retrac Launcher.exe 2824 Retrac Launcher.exe 2824 Retrac Launcher.exe 2824 Retrac Launcher.exe 2824 Retrac Launcher.exe 2824 Retrac Launcher.exe 2824 Retrac Launcher.exe 2824 Retrac Launcher.exe 2824 Retrac Launcher.exe 2824 Retrac Launcher.exe 2824 Retrac Launcher.exe 2824 Retrac Launcher.exe 2824 Retrac Launcher.exe 2824 Retrac Launcher.exe 2824 Retrac Launcher.exe 2824 Retrac Launcher.exe 2824 Retrac Launcher.exe 2824 Retrac Launcher.exe 2824 Retrac Launcher.exe 2824 Retrac Launcher.exe 2824 Retrac Launcher.exe 2824 Retrac Launcher.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
pid Process 736 msedgewebview2.exe 560 msedge.exe 560 msedge.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 4228 msiexec.exe Token: SeIncreaseQuotaPrivilege 4228 msiexec.exe Token: SeSecurityPrivilege 2864 msiexec.exe Token: SeCreateTokenPrivilege 4228 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 4228 msiexec.exe Token: SeLockMemoryPrivilege 4228 msiexec.exe Token: SeIncreaseQuotaPrivilege 4228 msiexec.exe Token: SeMachineAccountPrivilege 4228 msiexec.exe Token: SeTcbPrivilege 4228 msiexec.exe Token: SeSecurityPrivilege 4228 msiexec.exe Token: SeTakeOwnershipPrivilege 4228 msiexec.exe Token: SeLoadDriverPrivilege 4228 msiexec.exe Token: SeSystemProfilePrivilege 4228 msiexec.exe Token: SeSystemtimePrivilege 4228 msiexec.exe Token: SeProfSingleProcessPrivilege 4228 msiexec.exe Token: SeIncBasePriorityPrivilege 4228 msiexec.exe Token: SeCreatePagefilePrivilege 4228 msiexec.exe Token: SeCreatePermanentPrivilege 4228 msiexec.exe Token: SeBackupPrivilege 4228 msiexec.exe Token: SeRestorePrivilege 4228 msiexec.exe Token: SeShutdownPrivilege 4228 msiexec.exe Token: SeDebugPrivilege 4228 msiexec.exe Token: SeAuditPrivilege 4228 msiexec.exe Token: SeSystemEnvironmentPrivilege 4228 msiexec.exe Token: SeChangeNotifyPrivilege 4228 msiexec.exe Token: SeRemoteShutdownPrivilege 4228 msiexec.exe Token: SeUndockPrivilege 4228 msiexec.exe Token: SeSyncAgentPrivilege 4228 msiexec.exe Token: SeEnableDelegationPrivilege 4228 msiexec.exe Token: SeManageVolumePrivilege 4228 msiexec.exe Token: SeImpersonatePrivilege 4228 msiexec.exe Token: SeCreateGlobalPrivilege 4228 msiexec.exe Token: SeCreateTokenPrivilege 4228 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 4228 msiexec.exe Token: SeLockMemoryPrivilege 4228 msiexec.exe Token: SeIncreaseQuotaPrivilege 4228 msiexec.exe Token: SeMachineAccountPrivilege 4228 msiexec.exe Token: SeTcbPrivilege 4228 msiexec.exe Token: SeSecurityPrivilege 4228 msiexec.exe Token: SeTakeOwnershipPrivilege 4228 msiexec.exe Token: SeLoadDriverPrivilege 4228 msiexec.exe Token: SeSystemProfilePrivilege 4228 msiexec.exe Token: SeSystemtimePrivilege 4228 msiexec.exe Token: SeProfSingleProcessPrivilege 4228 msiexec.exe Token: SeIncBasePriorityPrivilege 4228 msiexec.exe Token: SeCreatePagefilePrivilege 4228 msiexec.exe Token: SeCreatePermanentPrivilege 4228 msiexec.exe Token: SeBackupPrivilege 4228 msiexec.exe Token: SeRestorePrivilege 4228 msiexec.exe Token: SeShutdownPrivilege 4228 msiexec.exe Token: SeDebugPrivilege 4228 msiexec.exe Token: SeAuditPrivilege 4228 msiexec.exe Token: SeSystemEnvironmentPrivilege 4228 msiexec.exe Token: SeChangeNotifyPrivilege 4228 msiexec.exe Token: SeRemoteShutdownPrivilege 4228 msiexec.exe Token: SeUndockPrivilege 4228 msiexec.exe Token: SeSyncAgentPrivilege 4228 msiexec.exe Token: SeEnableDelegationPrivilege 4228 msiexec.exe Token: SeManageVolumePrivilege 4228 msiexec.exe Token: SeImpersonatePrivilege 4228 msiexec.exe Token: SeCreateGlobalPrivilege 4228 msiexec.exe Token: SeCreateTokenPrivilege 4228 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 4228 msiexec.exe Token: SeLockMemoryPrivilege 4228 msiexec.exe -
Suspicious use of FindShellTrayWindow 31 IoCs
pid Process 4228 msiexec.exe 4228 msiexec.exe 4228 msiexec.exe 2824 Retrac Launcher.exe 560 msedge.exe 560 msedge.exe 560 msedge.exe 560 msedge.exe 560 msedge.exe 560 msedge.exe 560 msedge.exe 560 msedge.exe 560 msedge.exe 560 msedge.exe 560 msedge.exe 560 msedge.exe 560 msedge.exe 560 msedge.exe 560 msedge.exe 560 msedge.exe 560 msedge.exe 560 msedge.exe 560 msedge.exe 560 msedge.exe 560 msedge.exe 560 msedge.exe 560 msedge.exe 560 msedge.exe 560 msedge.exe 560 msedge.exe 2824 Retrac Launcher.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 560 msedge.exe 560 msedge.exe 560 msedge.exe 560 msedge.exe 560 msedge.exe 560 msedge.exe 560 msedge.exe 560 msedge.exe 560 msedge.exe 560 msedge.exe 560 msedge.exe 560 msedge.exe 560 msedge.exe 560 msedge.exe 560 msedge.exe 560 msedge.exe 560 msedge.exe 560 msedge.exe 560 msedge.exe 560 msedge.exe 560 msedge.exe 560 msedge.exe 560 msedge.exe 560 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2864 wrote to memory of 3436 2864 msiexec.exe 90 PID 2864 wrote to memory of 3436 2864 msiexec.exe 90 PID 2864 wrote to memory of 3436 2864 msiexec.exe 90 PID 2864 wrote to memory of 1500 2864 msiexec.exe 94 PID 2864 wrote to memory of 1500 2864 msiexec.exe 94 PID 2864 wrote to memory of 2544 2864 msiexec.exe 96 PID 2864 wrote to memory of 2544 2864 msiexec.exe 96 PID 2544 wrote to memory of 1116 2544 powershell.exe 109 PID 2544 wrote to memory of 1116 2544 powershell.exe 109 PID 2544 wrote to memory of 1116 2544 powershell.exe 109 PID 1116 wrote to memory of 4504 1116 MicrosoftEdgeWebview2Setup.exe 110 PID 1116 wrote to memory of 4504 1116 MicrosoftEdgeWebview2Setup.exe 110 PID 1116 wrote to memory of 4504 1116 MicrosoftEdgeWebview2Setup.exe 110 PID 4504 wrote to memory of 3356 4504 MicrosoftEdgeUpdate.exe 111 PID 4504 wrote to memory of 3356 4504 MicrosoftEdgeUpdate.exe 111 PID 4504 wrote to memory of 3356 4504 MicrosoftEdgeUpdate.exe 111 PID 4504 wrote to memory of 2160 4504 MicrosoftEdgeUpdate.exe 112 PID 4504 wrote to memory of 2160 4504 MicrosoftEdgeUpdate.exe 112 PID 4504 wrote to memory of 2160 4504 MicrosoftEdgeUpdate.exe 112 PID 2160 wrote to memory of 4536 2160 MicrosoftEdgeUpdate.exe 113 PID 2160 wrote to memory of 4536 2160 MicrosoftEdgeUpdate.exe 113 PID 2160 wrote to memory of 3940 2160 MicrosoftEdgeUpdate.exe 114 PID 2160 wrote to memory of 3940 2160 MicrosoftEdgeUpdate.exe 114 PID 2160 wrote to memory of 2780 2160 MicrosoftEdgeUpdate.exe 115 PID 2160 wrote to memory of 2780 2160 MicrosoftEdgeUpdate.exe 115 PID 4504 wrote to memory of 5052 4504 MicrosoftEdgeUpdate.exe 116 PID 4504 wrote to memory of 5052 4504 MicrosoftEdgeUpdate.exe 116 PID 4504 wrote to memory of 5052 4504 MicrosoftEdgeUpdate.exe 116 PID 4504 wrote to memory of 3156 4504 MicrosoftEdgeUpdate.exe 117 PID 4504 wrote to memory of 3156 4504 MicrosoftEdgeUpdate.exe 117 PID 4504 wrote to memory of 3156 4504 MicrosoftEdgeUpdate.exe 117 PID 544 wrote to memory of 4572 544 MicrosoftEdgeUpdate.exe 119 PID 544 wrote to memory of 4572 544 MicrosoftEdgeUpdate.exe 119 PID 544 wrote to memory of 4572 544 MicrosoftEdgeUpdate.exe 119 PID 544 wrote to memory of 4860 544 MicrosoftEdgeUpdate.exe 122 PID 544 wrote to memory of 4860 544 MicrosoftEdgeUpdate.exe 122 PID 4860 wrote to memory of 1356 4860 MicrosoftEdge_X64_128.0.2739.42.exe 123 PID 4860 wrote to memory of 1356 4860 MicrosoftEdge_X64_128.0.2739.42.exe 123 PID 1356 wrote to memory of 3956 1356 setup.exe 124 PID 1356 wrote to memory of 3956 1356 setup.exe 124 PID 544 wrote to memory of 3344 544 MicrosoftEdgeUpdate.exe 132 PID 544 wrote to memory of 3344 544 MicrosoftEdgeUpdate.exe 132 PID 544 wrote to memory of 3344 544 MicrosoftEdgeUpdate.exe 132 PID 3436 wrote to memory of 2824 3436 MsiExec.exe 137 PID 3436 wrote to memory of 2824 3436 MsiExec.exe 137 PID 2824 wrote to memory of 736 2824 Retrac Launcher.exe 138 PID 2824 wrote to memory of 736 2824 Retrac Launcher.exe 138 PID 736 wrote to memory of 1192 736 msedgewebview2.exe 139 PID 736 wrote to memory of 1192 736 msedgewebview2.exe 139 PID 736 wrote to memory of 2544 736 msedgewebview2.exe 140 PID 736 wrote to memory of 2544 736 msedgewebview2.exe 140 PID 736 wrote to memory of 2544 736 msedgewebview2.exe 140 PID 736 wrote to memory of 2544 736 msedgewebview2.exe 140 PID 736 wrote to memory of 2544 736 msedgewebview2.exe 140 PID 736 wrote to memory of 2544 736 msedgewebview2.exe 140 PID 736 wrote to memory of 2544 736 msedgewebview2.exe 140 PID 736 wrote to memory of 2544 736 msedgewebview2.exe 140 PID 736 wrote to memory of 2544 736 msedgewebview2.exe 140 PID 736 wrote to memory of 2544 736 msedgewebview2.exe 140 PID 736 wrote to memory of 2544 736 msedgewebview2.exe 140 PID 736 wrote to memory of 2544 736 msedgewebview2.exe 140 PID 736 wrote to memory of 2544 736 msedgewebview2.exe 140 PID 736 wrote to memory of 2544 736 msedgewebview2.exe 140 PID 736 wrote to memory of 2544 736 msedgewebview2.exe 140 -
System policy modification 1 TTPs 1 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\DataCollection msedgewebview2.exe -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\Retrac.Launcher_1.0.11_x64_en-US.msi1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4228
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2864 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding B9CE96ECFC40077582D0D5B1E2959F28 C2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3436 -
C:\Program Files\Retrac Launcher\Retrac Launcher.exe"C:\Program Files\Retrac Launcher\Retrac Launcher.exe"3⤵
- Checks whether UAC is enabled
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2824 -
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\128.0.2739.42\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\128.0.2739.42\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name="Retrac Launcher.exe" --webview-exe-version=1.0.11 --user-data-dir="C:\Users\Admin\AppData\Local\site.retrac\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --enable-features=MojoIpcz --lang=en-US --mojo-named-platform-channel-pipe=2824.3064.149217326633320280764⤵
- Checks computer location settings
- Checks system information in the registry
- Executes dropped EXE
- Loads dropped DLL
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of WriteProcessMemory
- System policy modification
PID:736 -
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\128.0.2739.42\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\128.0.2739.42\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\site.retrac\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\site.retrac\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=128.0.6613.85 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\128.0.2739.42\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=128.0.2739.42 --initial-client-data=0x15c,0x160,0x164,0x138,0x198,0x7ffaa7fa9fd8,0x7ffaa7fa9fe4,0x7ffaa7fa9ff05⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1192
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\128.0.2739.42\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\128.0.2739.42\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\site.retrac\EBWebView" --webview-exe-name="Retrac Launcher.exe" --webview-exe-version=1.0.11 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=1848,i,2008121115238167912,9004531084044623169,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=1844 /prefetch:25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2544
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\128.0.2739.42\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\128.0.2739.42\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\site.retrac\EBWebView" --webview-exe-name="Retrac Launcher.exe" --webview-exe-version=1.0.11 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --field-trial-handle=1900,i,2008121115238167912,9004531084044623169,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=2224 /prefetch:35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1852
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\128.0.2739.42\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\128.0.2739.42\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\site.retrac\EBWebView" --webview-exe-name="Retrac Launcher.exe" --webview-exe-version=1.0.11 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --field-trial-handle=2260,i,2008121115238167912,9004531084044623169,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=2380 /prefetch:85⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2816
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\128.0.2739.42\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\128.0.2739.42\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\site.retrac\EBWebView" --webview-exe-name="Retrac Launcher.exe" --webview-exe-version=1.0.11 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --field-trial-handle=3396,i,2008121115238167912,9004531084044623169,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=3408 /prefetch:15⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
PID:4476
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://discord.com/oauth2/authorize?client_id=1212184991732080700&redirect_uri=https%3A%2F%2Fretrac.site%2Fretrac%2Fdiscord&response_type=code&scope=identify4⤵
- Enumerates system info in registry
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:560 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffaa9ab46f8,0x7ffaa9ab4708,0x7ffaa9ab47185⤵PID:3220
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2156,16042722612993806430,11010636736404419201,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2172 /prefetch:25⤵PID:4576
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2156,16042722612993806430,11010636736404419201,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2452 /prefetch:35⤵PID:4060
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2156,16042722612993806430,11010636736404419201,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2824 /prefetch:85⤵PID:3576
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,16042722612993806430,11010636736404419201,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3368 /prefetch:15⤵PID:5132
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,16042722612993806430,11010636736404419201,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3376 /prefetch:15⤵PID:5164
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2156,16042722612993806430,11010636736404419201,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=4752 /prefetch:85⤵PID:5596
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2156,16042722612993806430,11010636736404419201,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=4112 /prefetch:85⤵PID:5604
-
-
-
C:\Windows\system32\cmd.exe"cmd" /C "taskkill /F /IM" EpicGamesLauncher.exe4⤵PID:4928
-
C:\Windows\system32\taskkill.exetaskkill /F /IM EpicGamesLauncher.exe5⤵
- Kills process with taskkill
PID:5656
-
-
-
C:\Windows\system32\cmd.exe"cmd" /C "taskkill /F /IM" FortniteLauncher.exe4⤵PID:1576
-
C:\Windows\system32\taskkill.exetaskkill /F /IM FortniteLauncher.exe5⤵
- Kills process with taskkill
PID:5708
-
-
-
C:\Windows\system32\cmd.exe"cmd" /C "taskkill /F /IM" FortniteClient-Win64-Shipping_EAC.exe4⤵
- System Network Configuration Discovery: Internet Connection Discovery
PID:5936 -
C:\Windows\system32\taskkill.exetaskkill /F /IM FortniteClient-Win64-Shipping_EAC.exe5⤵
- Kills process with taskkill
PID:5316
-
-
-
C:\Windows\system32\cmd.exe"cmd" /C "taskkill /F /IM" FortniteClient-Win64-Shipping.exe4⤵
- System Network Configuration Discovery: Internet Connection Discovery
PID:5712 -
C:\Windows\system32\taskkill.exetaskkill /F /IM FortniteClient-Win64-Shipping.exe5⤵
- Kills process with taskkill
PID:5664
-
-
-
C:\Windows\system32\cmd.exe"cmd" /C "taskkill /F /IM" EasyAntiCheat_EOS.exe4⤵PID:2620
-
C:\Windows\system32\taskkill.exetaskkill /F /IM EasyAntiCheat_EOS.exe5⤵
- Kills process with taskkill
PID:5700
-
-
-
C:\Windows\system32\cmd.exe"cmd" /C "taskkill /F /IM" EpicWebHelper.exe4⤵PID:5608
-
C:\Windows\system32\taskkill.exetaskkill /F /IM EpicWebHelper.exe5⤵
- Kills process with taskkill
PID:5668
-
-
-
-
-
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵PID:1500
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -windowstyle hidden try { [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12 } catch {}; Invoke-WebRequest -Uri "https://go.microsoft.com/fwlink/p/?LinkId=2124703" -OutFile "$env:TEMP\MicrosoftEdgeWebview2Setup.exe" ; Start-Process -FilePath "$env:TEMP\MicrosoftEdgeWebview2Setup.exe" -ArgumentList ('/silent', '/install') -Wait2⤵
- Blocklisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2544 -
C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeWebview2Setup.exe"C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeWebview2Setup.exe" /silent /install3⤵
- Drops file in Program Files directory
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1116 -
C:\Program Files (x86)\Microsoft\Temp\EU21FA.tmp\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\Temp\EU21FA.tmp\MicrosoftEdgeUpdate.exe" /silent /install "appguid={F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}&appname=Microsoft%20Edge%20Webview2%20Runtime&needsadmin=prefers"4⤵
- Event Triggered Execution: Image File Execution Options Injection
- Checks computer location settings
- Checks system information in the registry
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4504 -
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regsvc5⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:3356
-
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regserver5⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2160 -
C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.195.15\MicrosoftEdgeUpdateComRegisterShell64.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.195.15\MicrosoftEdgeUpdateComRegisterShell64.exe"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
PID:4536
-
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.195.15\MicrosoftEdgeUpdateComRegisterShell64.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.195.15\MicrosoftEdgeUpdateComRegisterShell64.exe"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
PID:3940
-
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.195.15\MicrosoftEdgeUpdateComRegisterShell64.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.195.15\MicrosoftEdgeUpdateComRegisterShell64.exe"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
PID:2780
-
-
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xOTUuMTUiIHNoZWxsX3ZlcnNpb249IjEuMy4xOTUuMTUiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7OEY2REMxMTAtRjJDNC00QUQ5LTk3QUYtQjJDNURBMUM3QzQxfSIgdXNlcmlkPSJ7NzkxN0VDREYtM0FFNi00REM1LUE5NkMtNzg5QjhDQTM1NzU5fSIgaW5zdGFsbHNvdXJjZT0ib3RoZXJpbnN0YWxsY21kIiByZXF1ZXN0aWQ9Ins3RTZGOEU3OS1GNjkxLTQ5QUItODVGNS1CQUVDQ0Y0MzlFRTF9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iOCIgcGh5c21lbW9yeT0iOCIgZGlza190eXBlPSIyIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjE5MDQxLjEyODgiIHNwPSIiIGFyY2g9Ing2NCIgcHJvZHVjdF90eXBlPSI0OCIgaXNfd2lwPSIwIiBpc19pbl9sb2NrZG93bl9tb2RlPSIwIi8-PG9lbSBwcm9kdWN0X21hbnVmYWN0dXJlcj0iIiBwcm9kdWN0X25hbWU9IiIvPjxleHAgZXRhZz0iJnF1b3Q7VlBRb1AxRitmcTE1d1J6aDFrUEw0UE1wV2g4T1JNQjVpenZyT0MvY2hqUT0mcXVvdDsiLz48YXBwIGFwcGlkPSJ7RjNDNEZFMDAtRUZENS00MDNCLTk1NjktMzk4QTIwRjFCQTRBfSIgdmVyc2lvbj0iMS4zLjE5NS4xNSIgbmV4dHZlcnNpb249IjEuMy4xOTUuMTUiIGxhbmc9IiIgYnJhbmQ9IiIgY2xpZW50PSIiPjxldmVudCBldmVudHR5cGU9IjIiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjUxMzQ3NzA4ODIiIGluc3RhbGxfdGltZV9tcz0iNTYyIi8-PC9hcHA-PC9yZXF1ZXN0Pg5⤵
- Checks system information in the registry
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
PID:5052
-
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /handoff "appguid={F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}&appname=Microsoft%20Edge%20Webview2%20Runtime&needsadmin=prefers" /installsource otherinstallcmd /sessionid "{8F6DC110-F2C4-4AD9-97AF-B2C5DA1C7C41}" /silent5⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:3156
-
-
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
PID:2888
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /svc1⤵
- Checks system information in the registry
- Drops file in Program Files directory
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:544 -
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xOTUuMTUiIHNoZWxsX3ZlcnNpb249IjEuMy4xOTUuMTUiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7OEY2REMxMTAtRjJDNC00QUQ5LTk3QUYtQjJDNURBMUM3QzQxfSIgdXNlcmlkPSJ7NzkxN0VDREYtM0FFNi00REM1LUE5NkMtNzg5QjhDQTM1NzU5fSIgaW5zdGFsbHNvdXJjZT0ibGltaXRlZCIgcmVxdWVzdGlkPSJ7OTM1QkZBMEQtQTkzOC00QzZFLUE4MTQtQTZBQTJFMTI1NDI5fSIgZGVkdXA9ImNyIiBkb21haW5qb2luZWQ9IjAiPjxodyBsb2dpY2FsX2NwdXM9IjgiIHBoeXNtZW1vcnk9IjgiIGRpc2tfdHlwZT0iMiIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iMTAuMC4xOTA0MS4xMjg4IiBzcD0iIiBhcmNoPSJ4NjQiIHByb2R1Y3RfdHlwZT0iNDgiIGlzX3dpcD0iMCIgaXNfaW5fbG9ja2Rvd25fbW9kZT0iMCIvPjxvZW0gcHJvZHVjdF9tYW51ZmFjdHVyZXI9IiIgcHJvZHVjdF9uYW1lPSIiLz48ZXhwIGV0YWc9IiZxdW90O1ZQUW9QMUYrZnExNXdSemgxa1BMNFBNcFdoOE9STUI1aXp2ck9DL2NoalE9JnF1b3Q7Ii8-PGFwcCBhcHBpZD0iezhBNjlEMzQ1LUQ1NjQtNDYzYy1BRkYxLUE2OUQ5RTUzMEY5Nn0iIHZlcnNpb249IjEyMy4wLjYzMTIuMTIzIiBuZXh0dmVyc2lvbj0iIiBsYW5nPSJlbiIgYnJhbmQ9IkdHTFMiIGNsaWVudD0iIiBpbnN0YWxsYWdlPSIyMSIgaW5zdGFsbGRhdGV0aW1lPSIxNzIyNjAyNjYyIiBvb2JlX2luc3RhbGxfdGltZT0iMTMzNjcwNzUyODYxNDQyNzM1Ij48ZXZlbnQgZXZlbnR0eXBlPSIzMSIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMjExNDMyNSIgc3lzdGVtX3VwdGltZV90aWNrcz0iNTE0MTE3NzE0MiIvPjwvYXBwPjwvcmVxdWVzdD42⤵
- Checks system information in the registry
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
PID:4572
-
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{2BDCF765-60E3-462C-B74B-0E211304B16E}\MicrosoftEdge_X64_128.0.2739.42.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{2BDCF765-60E3-462C-B74B-0E211304B16E}\MicrosoftEdge_X64_128.0.2739.42.exe" --msedgewebview --verbose-logging --do-not-launch-msedge --system-level2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4860 -
C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{2BDCF765-60E3-462C-B74B-0E211304B16E}\EDGEMITMP_CEB6D.tmp\setup.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{2BDCF765-60E3-462C-B74B-0E211304B16E}\EDGEMITMP_CEB6D.tmp\setup.exe" --install-archive="C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{2BDCF765-60E3-462C-B74B-0E211304B16E}\MicrosoftEdge_X64_128.0.2739.42.exe" --msedgewebview --verbose-logging --do-not-launch-msedge --system-level3⤵
- Drops file in Program Files directory
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1356 -
C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{2BDCF765-60E3-462C-B74B-0E211304B16E}\EDGEMITMP_CEB6D.tmp\setup.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{2BDCF765-60E3-462C-B74B-0E211304B16E}\EDGEMITMP_CEB6D.tmp\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\MsEdgeCrashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=128.0.6613.85 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{2BDCF765-60E3-462C-B74B-0E211304B16E}\EDGEMITMP_CEB6D.tmp\setup.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=128.0.2739.42 --initial-client-data=0x114,0x230,0x234,0x100,0x238,0x7ff6135e06d8,0x7ff6135e06e4,0x7ff6135e06f04⤵
- Executes dropped EXE
PID:3956
-
-
-
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xOTUuMTUiIHNoZWxsX3ZlcnNpb249IjEuMy4xOTUuMTUiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7OEY2REMxMTAtRjJDNC00QUQ5LTk3QUYtQjJDNURBMUM3QzQxfSIgdXNlcmlkPSJ7NzkxN0VDREYtM0FFNi00REM1LUE5NkMtNzg5QjhDQTM1NzU5fSIgaW5zdGFsbHNvdXJjZT0ib3RoZXJpbnN0YWxsY21kIiByZXF1ZXN0aWQ9Ins2QURGODM3My03NzI5LTQwNTUtOTg4RC0xOTNGRUI2NjcxRjd9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iOCIgcGh5c21lbW9yeT0iOCIgZGlza190eXBlPSIyIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjE5MDQxLjEyODgiIHNwPSIiIGFyY2g9Ing2NCIgcHJvZHVjdF90eXBlPSI0OCIgaXNfd2lwPSIwIiBpc19pbl9sb2NrZG93bl9tb2RlPSIwIi8-PG9lbSBwcm9kdWN0X21hbnVmYWN0dXJlcj0iIiBwcm9kdWN0X25hbWU9IiIvPjxleHAgZXRhZz0iJnF1b3Q7SjdWaVpqYk55eDFHVnJIVytSZC9QZ1Zpem5GK3RxeGlVdFdYb0Z0SWhmVT0mcXVvdDsiLz48YXBwIGFwcGlkPSJ7RjMwMTcyMjYtRkUyQS00Mjk1LThCREYtMDBDM0E5QTdFNEM1fSIgdmVyc2lvbj0iIiBuZXh0dmVyc2lvbj0iMTI4LjAuMjczOS40MiIgbGFuZz0iIiBicmFuZD0iIiBjbGllbnQ9IiIgZXhwZXJpbWVudHM9ImNvbnNlbnQ9ZmFsc2UiIGluc3RhbGxhZ2U9Ii0xIiBpbnN0YWxsZGF0ZT0iLTEiPjx1cGRhdGVjaGVjay8-PGV2ZW50IGV2ZW50dHlwZT0iOSIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iNTE5MzA1MjY1NSIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIvPjxldmVudCBldmVudHR5cGU9IjUiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjUxOTMyMDgyNjkiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiLz48ZXZlbnQgZXZlbnR0eXBlPSIxIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI1NTMxMDE2MTg2IiBzb3VyY2VfdXJsX2luZGV4PSIwIiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIiBkb3dubG9hZGVyPSJiaXRzIiB1cmw9Imh0dHA6Ly9tc2VkZ2UuZi50bHUuZGwuZGVsaXZlcnkubXAubWljcm9zb2Z0LmNvbS9maWxlc3RyZWFtaW5nc2VydmljZS9maWxlcy9iMGY3MzFjZS1mNzA2LTRjODEtOTA2ZS1hMDVhYTAzNDc1N2Q_UDE9MTcyNTA0Mzk3MyZhbXA7UDI9NDA0JmFtcDtQMz0yJmFtcDtQND1WUjF2WXE1SjN5dm1yZlpoTElmdWJjdEJwWmVzJTJmYUlEU1hLJTJmQXAzSzc0UkloJTJiRWR2WTJOcTNiREhKRDY5UzlaeEd2QnJ4aXhrc2wwaWtDNXQwcm9LdyUzZCUzZCIgc2VydmVyX2lwX2hpbnQ9IiIgY2RuX2NpZD0iLTEiIGNkbl9jY2M9IiIgY2RuX21zZWRnZV9yZWY9IiIgY2RuX2F6dXJlX3JlZl9vcmlnaW5fc2hpZWxkPSIiIGNkbl9jYWNoZT0iIiBjZG5fcDNwPSIiIGRvd25sb2FkZWQ9IjE3Mzc1MDM0NCIgdG90YWw9IjE3Mzc1MDM0NCIgZG93bmxvYWRfdGltZV9tcz0iMjczOTAiLz48ZXZlbnQgZXZlbnR0eXBlPSIxIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI1NTMxMTcyMTMwIiBzb3VyY2VfdXJsX2luZGV4PSIwIiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIi8-PGV2ZW50IGV2ZW50dHlwZT0iNiIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iNTU0NDYwOTk4NiIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIvPjxldmVudCBldmVudHR5cGU9IjIiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjE5Njc1NyIgc3lzdGVtX3VwdGltZV90aWNrcz0iNTk4NTY5NTAzMCIgc291cmNlX3VybF9pbmRleD0iMCIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIgdXBkYXRlX2NoZWNrX3RpbWVfbXM9IjQ1MzIiIGRvd25sb2FkX3RpbWVfbXM9IjMzNzY1IiBkb3dubG9hZGVkPSIxNzM3NTAzNDQiIHRvdGFsPSIxNzM3NTAzNDQiIHBhY2thZ2VfY2FjaGVfcmVzdWx0PSIwIiBpbnN0YWxsX3RpbWVfbXM9IjQ0MTA5Ii8-PC9hcHA-PC9yZXF1ZXN0Pg2⤵
- Checks system information in the registry
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
PID:3344
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:5320
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:5404
Network
MITRE ATT&CK Enterprise v15
Persistence
Event Triggered Execution
3Component Object Model Hijacking
1Image File Execution Options Injection
1Installer Packages
1Privilege Escalation
Event Triggered Execution
3Component Object Model Hijacking
1Image File Execution Options Injection
1Installer Packages
1Discovery
Browser Information Discovery
1Network Share Discovery
1Peripheral Device Discovery
2Query Registry
6System Information Discovery
7System Location Discovery
1System Language Discovery
1System Network Configuration Discovery
1Internet Connection Discovery
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
10KB
MD5be6291ab46a452d7fad469d7555ccfa8
SHA10df49b58031c344f05bad2dba663fd6b3e8f273d
SHA25621c71b9e157301c0bdb765c0d9206c6fe6fa7fd4e03f031c25cec9eb14751433
SHA51225f8488179527ddc120bfc4d7a5e38996b317cbb0051056a81324921f906aa69c1dba504fb52a8d4654da87a9a59964edada849256fd5eea5a1940910d7e6069
-
Filesize
6.6MB
MD511a19165aa72e46ad47200ca46760c87
SHA12fe4616eadaf543846571564ca325e772ea5375c
SHA256eaac114b05373d005f91c2824c3b907d01842056468018b95a688e82ffcc95b1
SHA5125b4074ba1598c7441fd3dffed54cf0cea540a8e58ace339254b9a29bd6709a8e64458c10e9797a75ba8e0e84566e8c5935bf4891b0115dc02017396d70f47b27
-
Filesize
12KB
MD5369bbc37cff290adb8963dc5e518b9b8
SHA1de0ef569f7ef55032e4b18d3a03542cc2bbac191
SHA2563d7ec761bef1b1af418b909f1c81ce577c769722957713fdafbc8131b0a0c7d3
SHA5124f8ec1fd4de8d373a4973513aa95e646dfc5b1069549fafe0d125614116c902bfc04b0e6afd12554cc13ca6c53e1f258a3b14e54ac811f6b06ed50c9ac9890b1
-
Filesize
182KB
MD5b69894fc1c3f26c77b1826ef8b5a9fc5
SHA1cff7b4299253beda53fb015408dd840db59901a1
SHA256b91bad4c618eb6049b19364f62827470095e30519d07f4e0f2ccc387ddd5f1bf
SHA5128361e97d84082f8e888262d0657bac47c152bd72f972628f446f58cbeacf37c05f484dce3fb0d38c4f0da2a2dcbb0813639d201d127ec7f072b942d43b216755
-
Filesize
201KB
MD5136e8226d68856da40a4f60e70581b72
SHA16c1a09e12e3e07740feef7b209f673b06542ab62
SHA256b4b8a2f87ee9c5f731189fe9f622cb9cd18fa3d55b0e8e0ae3c3a44a0833709f
SHA5129a0215830e3f3a97e8b2cdcf1b98053ce266f0c6cb537942aec1f40e22627b60cb5bb499faece768481c41f7d851fcd5e10baa9534df25c419664407c6e5a399
-
Filesize
215KB
MD5205590d4fb4b1914d2853ab7a9839ccf
SHA1d9bbf8941df5993f72ffcf46beefcfcd88694ebd
SHA2565f82471d58b6e700248d9602ce4a0a5cda4d2e2863ef1eb9fee4effcc07f3767
SHA512bce1447d5d3210c22d52dec3b846db091b65ed03fd9d7cd11c6c4dbd2aa5a943d881360bc033c29abd61011581ff9354b35cbe421719d92568ed99997bfbbae8
-
Filesize
261KB
MD5b07ab49ee8453853021c7dac2b2131db
SHA1e1d87d6a6e7503d0d2b288ea5f034fe2f346196a
SHA256f8535d5d73ebebed15adc6ae2ced6bb4889aa23e6ffe55faeabd961bf77b05e4
SHA5125eaae533fbe71430ae2a717f7668fd0a26ec37624e198a32f09bfdbee7e3b6e93d64e4fbb78cbdb05c4fe390a864490ea997d11849ecd371f5153bc8bfafccc3
-
Filesize
4KB
MD56dd5bf0743f2366a0bdd37e302783bcd
SHA1e5ff6e044c40c02b1fc78304804fe1f993fed2e6
SHA25691d3fc490565ded7621ff5198960e501b6db857d5dd45af2fe7c3ecd141145f5
SHA512f546c1dff8902a3353c0b7c10ca9f69bb77ebd276e4d5217da9e0823a0d8d506a5267773f789343d8c56b41a0ee6a97d4470a44bbd81ceaa8529e5e818f4951e
-
Filesize
2.1MB
MD55d89123f9b96098d8fad74108bdd5f7e
SHA16309551b9656527563d2b2f3c335fd6805da0501
SHA25603c3c918886e58f096aa8e919b1e9f8dcd5a9f2a4765971049bf8da305476f44
SHA5129d8190e5374cd1b4adbbfb87c27fa40d4de529d7c0a20654e0ce189a4cb9a53d3708c4ce657a7a5469b015df7efbbff495fc844579d9cd363b329b7e007e85c8
-
Filesize
29KB
MD54f860d5995ab77e6efa8f589a758c6d2
SHA107536839ccfd3c654ec5dc2161020f729973196d
SHA2569841d787142dd54fea6b033bd897f05f3e617b48b051de0ee3cf5865b3393150
SHA5120b9a661b76360f1fb2eb3ee25c6bf2cbab7ec74e2363e0af321dc4d0afb3cad301dddd16ea367d588451a40a2c2ed41f21d7afae48307e1e4a4ec5b24165b378
-
Filesize
24KB
MD5f624de37750fd191eb29d4de36818f8b
SHA1b647dae9b9a3c673980afa651d73ce0a4985aae6
SHA256e284453cd512e446fcbf9440013f8cb2348ffd6b1acec5366f2511cdf88b1794
SHA512d1d65e29ed59e34d4ff66df11a2368f1a724730e32eb245022d4f3d1fadf16d445ba8532460afb0e6e91f8be60a7240d13577403193042d1e912a67e4bf23b1a
-
Filesize
26KB
MD55de3f4dabb5f033f24e29033142e7349
SHA15c446985de443501b545d75f6886a143c748b033
SHA2562533d443b68c5288468b0b20cc3a70dc05f0498369d5321368a97dd5bf3268c8
SHA512c96296e6f67edeff2be5dc03014a8eb65fc287fb899357d4608c36c07b4610827aa18cbec6ccd47b66230a12341af488aca8bd02632fa768f84ca7b1d9c9d065
-
Filesize
29KB
MD51fb14c6c4fee7bfabe41badb7c5acff8
SHA1953d94cd73951943db14c08cce37b2d3ac821b02
SHA256cd32339fd7e4a5959e93eb5bfd6e009e4137e15c5e6c2e861d7891487216da49
SHA512a93b081935fbe48fafa8071a9cd593ae7b19205c70eaf48c724397019a04161460c66d6d8c6ffd872f4d52a4a7aa25ba1cba04181b9ebaca04b76d111ea588d2
-
Filesize
29KB
MD5d3345579310f3bd080b406de47b2305f
SHA116aefb27ea6d81c684f041aa50ebb49fdd403d83
SHA256b4ea3c63fa0104093a2b2034f950428e66d2cf3d55f0fc5bd688483392d60d69
SHA51265e4aa8587bc579b5109d91e02745f6de96a23b6ac2962cdeb6d9d536b51abab12b2bbaeca72572c3ae1971dac5bd24430eb2ae5ccf44a7068427594e4afdd7a
-
Filesize
29KB
MD5ecf3405e9e712d685ef1e8a5377296ea
SHA19872cdf450adf4257d77282a39b75822ce1c8375
SHA256e400415638a7b7dcc28b14a257a28e93e423c396e89a02cba51623fdfbdc6b0b
SHA51237e5f1b3bdd97a4370718dc2a46d78ab5b66865d3cdb66a20a7dc20a9d423ccde954c08f97e574fbab24e8dfa905351cbfb94bd3e6692a9b6526097ea3dc911d
-
Filesize
29KB
MD5051c429fa2beec9c2842c403a86c0e7b
SHA10a06a45200a1f5c81c48fbd2d03549fc9fac3a58
SHA2561a8465922bbb05a97a24f6c2200fcc7afd8bd0ace245c2eda9d9d335d4fb9353
SHA512bb59b41804328f27ba8861af32824266ca69ddcfdaaa11551b1edd4e129dbba630da8070abedb28e180045f8d0ddc1209cd901919f6b9aa421c457188af795c6
-
Filesize
29KB
MD582711e45d2b0764997abc1e0678a73bb
SHA147908e8885c86477a6f52eea5fddb005ec5b3fa3
SHA2562bb7455999b8f53a2a0834588ca4da4703f4da362a127d01cc6bd60ca0303799
SHA5124b517796edc954ab7f5a26a5d6605925dc7e84b611bcf59352b3b95f719cedc72c77a465fb1e7bc2d2f422d596c97968dac5b57292c82967d5cfaff980128fc2
-
Filesize
28KB
MD5a0a1f791984f1de2f03a36171232d18d
SHA171f69d8fe47640ba9705725d7d627a05519c8016
SHA256d2c7da8f4745b81874a9666c7d10a779a9956b4de0ebdaa1647bf78d4e17d85a
SHA512a4267911846cd55eb91227b0117ccbfdf8ef6c4ed0b8935b08e5d41a91aeabd9259988c71da8606cfb2876c4d69df6ca5a246687440283f1625105624305eb33
-
Filesize
30KB
MD5897712b508931dab76d39b209611740c
SHA19d80e07c2dc744e2efce3b67aa9876949fb9edfe
SHA256ee64fdefdb3381ce61fc445190cc44b015e7b65a3a16d28f3477f68de6079f1b
SHA5123329e37318dd9b11f282301e453af106168d3d10beff1ed62ffdcda60c6b4edb6b9c69ac6b9bb8abce3c9a9686a0152404524012dbff025e571de2cfcb3b5d56
-
Filesize
30KB
MD5e90155442b28008992a7d899ca730222
SHA11d448e9709de0d301ded6d75caaeba4348a4793d
SHA2566ae98b5e2eda22a0236434b7e952d732e3cd5d9cae2e51cd70222f1fd5278563
SHA512a91d8357ca976db2eb5a081077304a50edc1b55b2775c00cfde05e03831f98bd04e43f0dba5b3efd5a6370afcb10b23bbf307412467502e9ef57e0beae636013
-
Filesize
28KB
MD51de961b662a374c3af918c18225f4364
SHA1e8f1c438e57b322f43b4b851698bf38c129eb6ae
SHA256bb1365c5770dacbb918af27b47b02f269504f4d2396cf3f82bf5ecb2551c5021
SHA512c6bf62b684039f62744f1aab07f4751948e0c175f7fb7fe126f20903ce23fcdd2e284f1b794922621dae7eaa15c6dae0177ad102289a18f967721486f21073a1
-
Filesize
28KB
MD529f027d2d5fd486bdc20386ace925603
SHA166b8605f23871b4a8302bef0aaccb36ee1e72755
SHA25603c8566f749e8fa349d97101849bc3b2cc0b7561b565a2b0928bf8fe901da813
SHA5123348bdf10b2d964b34b791a774e28c97d3caf28d7f90e36b948cc2cb6c21e84cda933b7ddbd51c8fc604a450361cb834322c15ddbe0f4851154d05e5a2a2ea42
-
Filesize
28KB
MD5b0ae9aa0d5c17ee7abfc57d21cdcbae6
SHA101019eb6ba9c123be528136e12192b0bb33df407
SHA256d10938919e3d28d71e8e3ba2d8e02e0f9dc2faf148cdedc21c166fd994c603e2
SHA5124cba25c8159df865231b08fe650eedfb92d54c3037d28b2b9af010c8a59fa23669041a6c393622fe69b0194c2532f71f02b740f7e26e0bbf7ef34a421d6747b8
-
Filesize
30KB
MD5ad5b530eabff0540078c5d17f27b9610
SHA17e53dbbf64e70e561d37669e69f50eb0da8e37d1
SHA25649f512316a51e51027b4e70de4ffe8c8ecb188e126439a90a5d12d52a0393966
SHA512e1cc853d96589220676d39d91d4108633ce56304640f770e7d22b97a9b3be9452d5fb94e4e7fcd1400b62f0c398da8255c53a31853194a9e7b7784982b5ff40f
-
Filesize
30KB
MD5a7e64339a5314e3576c0d170171fa52a
SHA16c12aab6c97c30aff3245b78f7a3afeea604215e
SHA2564e9ccecb8e4383395f2134347fbad00521345ec9c857d8fa102d5257c7bea9bf
SHA512a4ca3fb60a7f4bda50847544dd1289d750f0d4b3565929290a8392b92822ef1856cec15a1f63f2c6fe1ef2e7cc0936a35bdb38ee5d904eb08cd32f05addc6ee4
-
Filesize
27KB
MD574d4cf3b8efb6cc3d0acc3eac38bd5b7
SHA19337803aadad9042c895b6f418b4c733b81221e0
SHA256b83c8981d8835e4c78250bf265faa6d64693204b77764c8e349abc4365ae9871
SHA512e6112ef60d56101aa16327042162d6ef43519bc56668ca8eaa7fd3e1aaadc75c7df75c1e41583a292ff1a9bdc7d9ad9f5c0d97fa84964532dca2d5f3df604c23
-
Filesize
27KB
MD519dc1f6d1f309eb7abf1e0c8257f41f8
SHA1e2d3e86fe22c6af6b8ee5b359315dfa6ac4d52ec
SHA256046f6c532fcabd969c6e63bb7ee0d7a83d806fa659006508e1c3a9485190d6ef
SHA512478d6a84452cfadc48547930e336ad459eec188dd3d9e4c778cded4ec3d34e00b2b8c0538366aa644ee67f878b29c5c73444c1406c66e8394761bb0979c6483c
-
Filesize
29KB
MD58f7f515d78d2df371993fd70f863ab8d
SHA1dfae1b47e80f91abf2d9c2aac009c0a1767bc59d
SHA256ba57fbb9d3a32b84d6a76054b9ad180b6510e53206b9804bb9ea18ff73c2ae3e
SHA512308a62af00a4410551eac967bb9f2cea7adf7c13b471dd28b276bda40b1e4c0b4ebb60aec29b6165069d40180bc45b4f5da5baddc374ce7bc5a5bb223afb4e96
-
Filesize
29KB
MD56af05d448c842027f876e93f8ac58b65
SHA1f34c988e3875a1d1b267b082476fcfb8d7505a73
SHA25636876b14a214cf98dda5100a7e7134d7ebb78e895535d6bd7562099574607867
SHA512412031db59de0367a102a026f73072244b33d726adc5bb9fd079db3dd37b5d6a24d7420a9811576d0a356933b5ba15cc9e2a92046d2d6e6d6fef37e9d840aec6
-
Filesize
28KB
MD5ae9bdf6416c3630c4b0b5b119308a135
SHA1d7218c677b098d2a93cc91ead39c83d3a2c653b6
SHA25662da90c9417a70632aa190fecc17c31ecf433c1f84f82b08d7d7290669cabf32
SHA5124333ac6cd3737f25e6e1d429b195da781ced4340b89808cbd5d5d2aae2e79bcc700419d613123d632252e31ac44d95b7718f23da5b82ab5054407e80106a64a7
-
Filesize
28KB
MD5fe73dbc305da6223d1e94e1cf548c000
SHA1b16f2c40d68cd9718eaaa9b6db9c8e5c4b6acb9e
SHA2561ef64088a613a4e10b4cf4206f95f5414ee27872798747234a6574b7e5c70a7d
SHA512d9900720d89defffa52198dbe63515995095c94aa0cbbe4f32a1c09d26809cec480e92926d2240702604b8c13fcdc0032cc46910ade8e4c1d2fc9a4bd1b63858
-
Filesize
28KB
MD5367ea715e942c81dd3cb734274969a0b
SHA1f92f1ec2a5be9b775e67c4252a07c37ed0ca508b
SHA256082da1c09782c026c9cd73456dc12539a226f0bf5d113e59bc93b29c1e98b37c
SHA512c94e787ba3bdb56d1827a0477461cbba6b7cc68986722275e0d04ea7dc70db83b5d03887eec810bf9b67f70b18bd3c7b7d28f0e554938b81d3501bc11f97830a
-
Filesize
28KB
MD55a30bc4216af48a493eeb0f3a9f02607
SHA12fdf65a4002d91818d56a23fb8bfd08ab715002f
SHA2565131c23915ad6b5b469bcbff31d0ae31ef34ded28ca0ffff9f1eb998bba98aa1
SHA51234b3a4865f31ebdb8665780011b384ada768a0f71bff77f91706b140eb8cc07fff8787f710cdb1ee14a449cae8f22ee5fddadcc501cf1c921eea078e97dc2f89
-
Filesize
29KB
MD584c4736cf301b93998028ed7678caec1
SHA13b6f1f6b9eb3dd7d9a13c11dfd3ac56c93f1b10f
SHA2563c8dcb7e982dac3159298009a86909b1e1000ccf6f4d333341f16d4d6fbd84ad
SHA5125a1b77ef9450c32802e94e473a5b4e43e892c923ef368ee9bbbbb5b0090429320263cc79a4da0b281930c1a60861519211abd0bd67a9d9ee370bdda2230d2e81
-
Filesize
30KB
MD58993c0784111fc7cd6a90a82303e5f44
SHA18d1ff2fed98ebc608604c555ceb46ca628afb285
SHA2563d0ba88267018f592141ea86592757cf1ecaac1a3a18f99203e0fc5c5eacbd62
SHA512124d16d848dc8ea0a93b292b10ce1fbad23b56b13771d904cf14c19d54478614d214441b05f6cd9e1999b8310fdd26d1c6ecae784be00aecee7e80c96ba4ac88
-
Filesize
30KB
MD5a640aa4ff33662e06a474765df0b2a8d
SHA1c6265225532e389e48c6057bd717b69de2125b61
SHA256078b1943bf7f7955b90abc40f691b27e04376f8c43dd3abc4791614286cd4f23
SHA51259791eef021f94efd9c18737d6c46fbc45add582eec92d5b997cfd66993abc7da872720a037766c3c70862f0654ccf30d122d4a5a6b305151bf8bf1c053a466d
-
Filesize
29KB
MD55bcc643a969559317d09a9c87f53d04e
SHA13602d51cde97de16d8c018225a39d505c803e0fc
SHA256b48f57e90ea9db6d6a296c01e87f8db71e47ab05ab6c2a664cfa9f52cf1d2c18
SHA5124c65772f77e61e64d572df5b1f62733aceb02a5c967c296b303ff17c5d49831e5b7fc3d662724ae3ae1e88cd0fdcb704e838af5d4ae20f2d82b9577f57159159
-
Filesize
30KB
MD5aea23f526ef0c5bb3d2f8fdf192a49ea
SHA14d7695e33ed43c3efb95f304e29675ea885b2939
SHA2563cfe866c151a7e8a208af725c0c6f2a47fc3ada35f9ad3509b16b8d5229318b9
SHA512412e4742ebd46ce38010b4f6a46d8d524025f929ab4658040e271d768e79115d90903403b2f1e51ab910bbdf9677b49439eb3c8afc5959477af198efb0c7c3c9
-
Filesize
29KB
MD5295cd30c00f43d9131621baf4859578f
SHA1cab79a6263b7b0a799461f3e6df41f815029cded
SHA256b851c5a60cb6d1e8dd9aa161106cba99ccea047d0b39d007beaa7b9ef4a83397
SHA5125f5c1e62e6c0e11a63fad68928765e3f504f33cdbb1d9a05cd53cbc3ed145bf3528960a10e3d57e8c83b07c030c72257f403b9a57d12975d3ef8bc255418ad6c
-
Filesize
28KB
MD5c43c1ab37cd93e54068443bc330fb3d2
SHA1ab51a2cbc51b3c17cf184c6d99ac480c02eb63af
SHA2560c26a367355e766402c31fbab102dd1c35300d4a1301417c75be5fc4b3d54680
SHA512ff0193189fb846eb3c4188bb599dad8e6f415ec9612da567d95c9c513defb148b6013208371798d174569b46f443a744e4e8b83aaf139d68c31f7de0f94e63f9
-
Filesize
29KB
MD5a5544f517f7c1bfd1ec6a2e355d5a84c
SHA134a2a4a576300ad55b6757171bcba0fab005daa5
SHA2568274c64bb778b55d912929625cd849adfe733b2dd674d94895d53af8dfaabeca
SHA5129069bcfb736e13499250844dddef40e2cf64937e33ee1f81fc4968f024f7d7b89c6a778866bf1bff98d770686569e4752a473c0adfad4d4099cceda84da3cac3
-
Filesize
29KB
MD5c09876a180731c172fa2532f8be90a3d
SHA14359c7840ddb23142a40aff85129b9920360e954
SHA25650fd548ea12e2b72fc563bc082b870a89a523e8b3a4a0e9b65fe673384da2b58
SHA51291cee1b10fc12a01a2a285e67dba583d6f1bee0716cc89103fee0c7d0f52fadc0f9ac5b13e833834e7279963726950d3897847e7acac61857257fc031692033e
-
Filesize
29KB
MD5ee19156c12d2d7cce9b12e515f9ac6c5
SHA119ad46e40b3c1cb6195231bfcf45bb68ee1b43bf
SHA256c290883b4b99758792284755efa52c12eb09039f0f8027d8ba3b1d4bb2f3846f
SHA512631364472a450519ad8959971d6c319610570ca37b4486ea12d6af5b46aaecbf336aadddd1f3fefba841534ff82adf905b1e1a008638ed784bf08870a3b86ee1
-
Filesize
28KB
MD5eacd4638369bf96ccc7c23af37e15b5d
SHA115c4878b78c06095981abcc589c4a6f265ef96a3
SHA256a53c0fd74995090dbf48bbba4a00560e3cc344ce8120b8b2bfa1f9b953b536ef
SHA51219cc8d25bd8fd84481f77d301f79636208df5807647ddc6cb6beff3882d94672db49daa4ddfff0c334b584742f9d2fea3af73977032d7dfccd0cfd1314af4ae6
-
Filesize
28KB
MD519d44de8f930e07f41f9343478ed5c1d
SHA183ee0c5a86997dd491bd8312d221dde2b2e7d44a
SHA25669d3a21b7723e4df8b7b97e39493081e41231e2d3a3f5a4de462db41339987ec
SHA5124edb82aedfeca743a03815a889eca766fec8083afd0defa098593297a52edaf1780dbd5ad1d3325c614d815d34d8c57ec2283a0db215f94f42819f1890089c4a
-
Filesize
30KB
MD526cbb965c6976f59ac385ef9408bf81a
SHA116bb0530338e600fdfd13a7b03523a715e633bcb
SHA256bed996b25f77c7d4328d96147ed388f1b457abfc0510eb8956be4339d103821a
SHA5121efb1bdf0276de17f8516cde4d435e0be8fd066f52fb5d4c9e2fe2e17a135296ab6b34f523284941beae438e97d7e65de26f0541b7c437bceff229b60da4bb0d
-
Filesize
25KB
MD598f79d77ab05304bba8d60e50914418f
SHA1957590adc0f8a7274e765e2a804c1de7c76e3040
SHA2563764941b873ed59d5bc1097f6b9382ba59c06d443a96ff71ba6b693f161da522
SHA5129ca6af5c14193dce7b50251f1b9205870435e60b5495ab1a9f0d42ca14b98b78fef51bf3cd4165394ca5ba28d0e98bea7642ec67039c0f146383136145c7de59
-
Filesize
24KB
MD5b89ba9ecc6d4c77abff61b1c75fff16c
SHA1f381408f26be2c77c7b59681ad6280a701ccb472
SHA256bbd2c970f747a6ee8e4735939225f607ae630ddc6e2e39954e0300ca9a7a88b2
SHA51253a3db82f4cf5a300a5eab7692f4084451b987ad72ae24d9118d80f18692ac3604981c0e871c7a7625c5153803aea0e093d91822d33af0c10a07bcb6e766a5b6
-
Filesize
29KB
MD5d464fd223ba898e6fef4e485a3118394
SHA159c78983ce859485fea5458ba4e7803c38012b9d
SHA256066c5c4b4c87ffd201d0dbfc43cb7566cfb03a6ed2fbf8698220fb919637294d
SHA5126ac1d5fc59e6b7a10532902b059ac25a2bf58b0a63ab586e89b293e2de732c1d5d580c75ff28e4a2660a6ee3f0389f49e388567bcc07dd6e1cfd5d019db3ea52
-
Filesize
28KB
MD51b1202fc3e46d7b46ce3cb46cdc5ab21
SHA1e76d1065035d86eef011feb3cad3ac38eecd0b7d
SHA256b660a0e1d5161765881e0a7fd9d714abce341403b21f63667ffdedf7d5a254d0
SHA5127f11d5d6995f27bb4f8705ac7310273f070a71adc73cdb70d74766c89437b3e7a10453fc55588ac223fe3b449564758a49380168d779fdb6a4fac3b5cde767ea
-
Filesize
27KB
MD5126036b98853a9d31937f874484dcb83
SHA127ffb8f3f6e966c3b79824357e79eac4ec8ce0a7
SHA25690908e9108adcb0b4df84e4fbd9724e5e7a2d2eb54720fe49f37bdce977be635
SHA512b384657e0ca90270b96cb724aa55c52f5c8b569fdb1a7ee7085c18d6822c39fc81a490128bd42d0aec1c0ddac1853e30718710968f5921a5331211bd33e89316
-
Filesize
29KB
MD5e20f7a758cc9bab3d458d89d828521cc
SHA1cae0a6d29e5b3f0aed0db2d66fe19d5463c09cfb
SHA25692858a377f1ddc353b51bb44ec04f571ff2b4913d3c8104aa01359b72f91f2eb
SHA5128bf9b8c6765820db6dd95303cb996b97649796e14e67b465fded3c24ef180891d58f9fdcb06243ef1d4c5cdd4148f58f64d74d2ceb2cb214051718d33efc9707
-
Filesize
23KB
MD5f7dbd944a9126dbe568faf2489ecf053
SHA116ad534b4fa48d95224c74b8ca4d3d4533c76425
SHA256b1dd9c0fdd11a5f83ed5b7d1fbcd417bfaa94e42035647ca45f20e332b531703
SHA5120b6843fd208ea9448179e63b485c01b5ff824d555cad57cdb6575234bf43d6cf253e9494fa74150b9fa9ace9d1d1ce749e1a77c7b342c10498dd7bd3953d9a27
-
Filesize
28KB
MD5c1557eba649fc78356ed198d6754416d
SHA11ab42e71a88b127c40f8dd6d1b0660f271442a11
SHA2568c5a7b3e9f5a3a64214ca8e9d43ea152f69fc2633f47c0783b90385e00551ef9
SHA512e2f92c8c6ea823e1d716732b4bb5295d34da02d270079f645d9290261728bcf822b7f845f4a37dc2ef844580d6a3650a53c3e80be875eac5dffef651e8607993
-
Filesize
30KB
MD5b61c9c9ea8340b6b3a873162a2710cfe
SHA15017b90dbd61add602681b76542b0bd3974639af
SHA256f3eb2d26173d9ea8e26e234c3c5f91f9eb145fdf8b2b3e5011e0f33394fd8737
SHA5120d32f6a880509472a51ceaa9539e3169505bc6b508664d28c9dfdd1a3a72abec665574dfb89e385c18522166221f1d73741fe62e4ea0860bc132e198614cccf2
-
Filesize
27KB
MD56e6f49c35d2b74090529fc1d8d12eb2e
SHA15a0fc9397872d7d26803276292962cdb0a5e4739
SHA2566a25fc0ab6e2c73eb938b8e0f38578b9a02feb3a0634a16ac41ebc2a9642d260
SHA512d3838a88908b2ab9bf6018dfa4c6f784371774cc0bcc82e180761673a9e527e126fee17a150a51c6d0a1159575e2060c12f85ae751e7a95f0285e816799540bd
-
Filesize
28KB
MD5071ee832762aab532c59b858c7d3a46a
SHA10a976bd2c76d8db1f831a8912184d43e02ecf293
SHA256a47e46963fbc7020dfc9dd08eb5d7d8c4c2a9f0b0a8f51f1256453058a6a19f2
SHA51250ec7ff32da6f0d022ce067bcc160ccec00c4676ca56b789bc6ba1efc7f34ad485297f4cca6f6ed40be1c59018a7287c7fb490e6adcdd74f3f72b4526332a522
-
Filesize
29KB
MD5bf10592aafe1b8446c005ee9e5c305a8
SHA119b81a238e07c958f1757488440e42ba99b59b53
SHA2565cb166b350b425009080d39efa3b6ff5c0bf78f4276cc1ffce3043d4ef1a687f
SHA512b69d55757047170a7583f3f0525307e09e670adfe05906d30bf208dd78b70b3e18a19adf59aeccc861857c2e37cb08412e4729d597ffb45960d285e12357b4ff
-
Filesize
280B
MD53d95569511af6898507ddec83708540f
SHA1872654a8f7e99f837dd4fb3c290f16046203ff7e
SHA25660972cbc9018363dd2ff3cd2e3c15f1139333ce6490b183b480452c9a05094d7
SHA512f78a1078d51d399bb90280f560909dcaa9d283803eeb12ff192f839e61c2558f24af5824a3bdebb4d50a3c2c5e1b03b5af150700a1218b4cdfbaa65c78c8f0a2
-
Filesize
12.7MB
MD5d4581b57cf0ebc65ede69ae6105a612d
SHA1fe9a4784c4f40f04fdff4d603ff6bbc1daf33044
SHA256389b21dc194f7973175f047d55df4bfb3de2216e64b1967d2132fc528bdda9d7
SHA512cf19e79feafdf5e11e64661d94af002cb7c9e0f2da8b67186067abc2debecb619c0c6476fdb1949cce63ad60926d8cc40595f2d32ae5d7203c4c95f62572631b
-
Filesize
181KB
MD56847338aebf77f69a1e502afe5268e09
SHA1dfd16c665ae30ebcd147c1eb39ff8ac670f403c3
SHA256d7374e27bf9d9f07b472d2c348f42e59eab80c966845e15cccca7452f5b2c04a
SHA512cd4d14983eaa62f2ceb5ada96bd421a6ecbf8b1b3e711e1349265aaf120e8e95a4afec06b9256a0191a6986aad7f4053d4bae28b25c7e9e4d4d7d5b42af80bc2
-
Filesize
2KB
MD57a660ba9496250b586334371c657026f
SHA1bc6e31a62d5a8dcf12f314c499ab468db2906347
SHA256d6bf8ff2d5f57602d75df1decac4c409bfdbe9cbbec38bf1c29962bc2a956577
SHA512980af5f28ad356f1c47f350fd6b83d0a4b5031348a1adf4245b322730606f28eb510f35e2b972d684d3d2ed6d45350e897d8c608737abae56e91afa7fb23b610
-
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Retrac Launcher\Retrac Launcher.lnk~RFe57aac7.TMP
Filesize1KB
MD5d42b9ad0eab67db36708e9b07f8c7831
SHA14f3f4bed7c4e14edc83dc57266c28fb3eced11c1
SHA256e5b03436bb1777a3170f1e388934f130084d264aec8e226beea6d536d8c3d88c
SHA512c9dd394675d5221e39b3baa8aca00cf956108bb4474f89b06d4f1a99e6d5834a90ccb8e8d9e294cf6616f921ccb1ea565f48e37d14c63b930d49342e9f5d177d
-
Filesize
152B
MD52783c40400a8912a79cfd383da731086
SHA1001a131fe399c30973089e18358818090ca81789
SHA256331fa67da5f67bbb42794c3aeab8f7819f35347460ffb352ccc914e0373a22c5
SHA512b7c7d3aa966ad39a86aae02479649d74dcbf29d9cb3a7ff8b9b2354ea60704da55f5c0df803fd0a7191170a8e72fdd5eacfa1a739d7a74e390a7b74bdced1685
-
Filesize
152B
MD5ff63763eedb406987ced076e36ec9acf
SHA116365aa97cd1a115412f8ae436d5d4e9be5f7b5d
SHA2568f460e8b7a67f0c65b7248961a7c71146c9e7a19772b193972b486dbf05b8e4c
SHA512ce90336169c8b2de249d4faea2519bf7c3df48ae9d77cdf471dd5dbd8e8542d47d9348080a098074aa63c255890850ee3b80ddb8eef8384919fdca3bb9371d9f
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize480B
MD56b137f49f01b4011cdc65d88f0fff09d
SHA16d284678ff0770e29f5ea70c8b44a992752701a5
SHA256423f66211f453dd1feae739a44b6c669e099cf3c7a6fc91caeb77b188ed23999
SHA5122de84091231850fbb9cfecb21eafe062ac6fa3def60713e8bd4f1f670244e0aa8b650fd143199dfc9c995b03bbfba2d8b79de0743616e8e60b5a6fb3602ac9aa
-
Filesize
469B
MD58624b1f8b8dc089a568e155b04f73475
SHA122e87cea0d7c7916490872c010d0d054da1abbf3
SHA256b36357856114564304903ed59824ee3e71ccb241236adb6ee014dda13c2dd823
SHA512c24fdeee9ac89d8a802787ea8069e9cc9ee92c14586229d07552c2612689eb5d943c5be5931576eb5aefe5e6316304b4fec71b512d12dc76207d596f9a0d6e2b
-
Filesize
5KB
MD544f1190202f3d3ce47cb789bebbdba9c
SHA1bfaf77e8841bdd8b0691495eed20cec01f500699
SHA25644f23ebf2768e68e53e81484d644ec8877c872533db4b738f24773737fb9458c
SHA512488dfc6db3b7148bfd00265c84580d6f82ef3e6dea2e9f02769dc392ae9b10f4a7db7fd59cdb8b42a99f5657dfaecd57ed6a2098a7fae5869363427d602099ad
-
Filesize
6KB
MD55ee0db031984432f3cf6770bc0a499d3
SHA10007248a72d42290568f2bb059242a7af003f006
SHA2565c8f8b4f6b16741f69b7e477650167d5edbbc68c2b87c6cfa9cdb02776577e72
SHA51205909832949074e286a69b77ded021a6cfa6710c9c5bbc01999923d75e608921c7c9f61434089ac81fd8a8d2f9bb690978bbfc58b6fcb3c5b8d5277033a048f6
-
Filesize
16B
MD5206702161f94c5cd39fadd03f4014d98
SHA1bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA2561005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
SHA5120af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
-
Filesize
10KB
MD5558d14714f22c0d7ccab5a38f04015f5
SHA1cac22341d3a101cab39ef37d0df7ae1229afcb33
SHA256972492fff80d0d68e64e8dfada52bf6ebe31d13114b03592412bc868b38b6c37
SHA51237901b7091b0810e106956434dcc0725cf4cc451ec1b8ed93493afedaf51f10f94c7df79786d9032e0b54743d46dc7e424149651116702a29686743c80b694a9
-
Filesize
113KB
MD54fdd16752561cf585fed1506914d73e0
SHA1f00023b9ae3c8ce5b7bb92f25011eaebe6f9d424
SHA256aecd2d2fe766f6d439acc2bbf1346930ecc535012cf5ad7b3273d2875237b7e7
SHA5123695e7eb1e35ec959243a91ab5b4454eb59aeef0f2699aa5de8e03de8fbb89f756a89130526da5c08815408cb700284a17936522ad2cad594c3e6e9d18a3f600
-
Filesize
1.6MB
MD545e5ca74b9ae3c3fc6f6a63c609783b6
SHA1f36715bea96d69bb18075fac30b90502c6d2464b
SHA256b4afd37b9087df7e041ae749fd0fa342926d9cce533bde9cdc4283132c3820a9
SHA512014fd398d456fcb118dfd6b038b6f96008ca209d44d9707e175e85e7f14cfb3f2886deaed0d8ed25971813035e8dd7f88142c06972f3e2c9b4a534d84bec661a
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
280B
MD551f4ae1a414636ebf231e0ca74fead10
SHA1ec96a8ebbc1ebf098c749bb67b320e0bf6ce5dbf
SHA2564208e12f3382200991875bdc15159c95e313bd3d33d9bc4c229caec6db57aa9a
SHA51207fdbf2252e776538ffa8476d5c1f11a2311ef8500420123c18b9f8bd0b8b198e386e26e0b1ff0e9d2d2ad37d6d37b61798f5c0d05fddd4a1dedc0bb704468a6
-
Filesize
48B
MD5ac90d8349da61fc14be8aab5ee7da08d
SHA17bfed75d11c02447ab7af4c48413b272f96c8211
SHA256df56fe7883c84625ed705c32714d343ab7e911b05821244e543d6fbbe8691cf5
SHA51235de3a134440aaa62849d2fa6c4a6e3d2c96c2a538567c1720e014fcff3085f452cb1619f097b3a1425dcf1a0a09e5bc4508bd8de007095661646a4829287580
-
Filesize
96B
MD59a8570af388d468878896b0ecfb54a88
SHA1a863ef126114c68bdd191c9aebe1f153caa696b4
SHA256ba0f15815eaa9d75ef47897cbdc179c1f945ec751ed958d660dd5f1105f81457
SHA512fbdd8ed71a30d9f9f86bfeafa74622878848258d9c42db941281d54b993e5e682c6cb688a2280edad976dcdd5a3e2e88e3a74face519f7a56c8cf110d1547b2e
-
Filesize
16B
MD546295cac801e5d4857d09837238a6394
SHA144e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA2560f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA5128969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
-
Filesize
41B
MD55af87dfd673ba2115e2fcf5cfdb727ab
SHA1d5b5bbf396dc291274584ef71f444f420b6056f1
SHA256f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
SHA512de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
-
Filesize
1KB
MD56d7b60959176bcff364cd8eed746ddfe
SHA17709e1e4ff6fbf27d9c853d77cd2f37ab6ab19fa
SHA25678be48ecb8bf8184865a0ed850b6f57d30d8b0c0afad5326a482e905aade31bf
SHA512b27247a4059e785beae1af4ab4122ecbb53c53c6aed048070cfec08f0f7d7e294ce4199b17a4759e91fc1463628ad6fd82f2770ba98822aa8bb820b9b1e6ada5
-
C:\Users\Admin\AppData\Local\site.retrac\EBWebView\Default\Network\Network Persistent State~RFe5a1a30.TMP
Filesize59B
MD52800881c775077e1c4b6e06bf4676de4
SHA12873631068c8b3b9495638c865915be822442c8b
SHA256226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
SHA512e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
-
Filesize
2B
MD5d751713988987e9331980363e24189ce
SHA197d170e1550eee4afc0af065b78cda302a97674c
SHA2564f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
SHA512b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
-
Filesize
6KB
MD5654b21f18e626eb759e1ef78671a57d8
SHA1cdabe845feb334c38d1c938aee4c8a67dc8c7f44
SHA25660cf5dd9d26927faa6e58b360a0f8df4d9e3afda6126b5ffca979c8c4bb47f18
SHA512cab86cb7a26098a340bea242ee999e22bd81a7505de12291cb719eff7039e2cc739e7e29499f6fa09e43dbba4fe301c139c7b7a9726b3c5de47dd970316ef75a
-
Filesize
6KB
MD50ec0f1da5dd9b9394d308d60fab072d5
SHA14f0a678b22c60d67bdd973b0587ef13ddfc7ae5b
SHA2565be1df909215656766efd96c1d2de38dc7463f6e0a5312e843eaf006cc00ec4b
SHA512261c712d4da1df963709a21d7dd7ca691a7afb1f9f3e37cbe5f5c05a0de89ba63093dc6fd9fe936d7df2c7530c8a9b15a4fe9e74f0ae1815d7839d854baf9551
-
Filesize
8KB
MD5cf89d16bb9107c631daabf0c0ee58efb
SHA13ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA256d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
SHA5128cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
-
Filesize
8KB
MD50962291d6d367570bee5454721c17e11
SHA159d10a893ef321a706a9255176761366115bedcb
SHA256ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
SHA512f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
-
Filesize
8KB
MD541876349cb12d6db992f1309f22df3f0
SHA15cf26b3420fc0302cd0a71e8d029739b8765be27
SHA256e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
SHA512e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
-
Filesize
264KB
MD5d0d388f3865d0523e451d6ba0be34cc4
SHA18571c6a52aacc2747c048e3419e5657b74612995
SHA256902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
SHA512376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
-
Filesize
2KB
MD5cf47655c4836f8aadf417b8e3368849c
SHA11f681046f583b88891c64a1ac93d4abcbb39ff8e
SHA256b8e072db76cdcad05d206f822f2d63eac5d9f779be41569fc211b62f46aa2cb8
SHA512a1090e1f2f33e5ef26041c5b0b1a58796161270e9131df4ce8f5c7a5de62eefde55568ce2785922c6da21e77955cd66ddf750b8ef94259e0b23fc847196cee27
-
Filesize
3KB
MD5709f6777b1c4bc395fb65c302a351aa0
SHA1a972f64ae9defefc80d2168ec062f2f94a5c275b
SHA2562c196c866250437098073a889f964219eb8581e71513ec7126815aeebec3a110
SHA512665c4df4341f06e4cfbffceb90c56955fd60684b5b8a269f7b7949090e14bc938a86975246f4d3b8e939a1189a867d870c04a6cff565a24bd5cdf083080f7de9
-
Filesize
16KB
MD5cb87085c41f07e20c079628335b9ca27
SHA15cc5e174a57cf701c4e173fb60bb99f63dcfa0bc
SHA256304603f4128b2644784f87535916cff4b5ec7617a6a08bc457e429cd6f87af48
SHA5122c0339324aaedafa14b4a308ca98fa6b44d60ccc3e9015649f5bae8d740c45dd02f36fb8ae6b676160992320ca15470208ab524f0c557a02b043ada94988519b
-
Filesize
1KB
MD5ebf52f1f03811d369ea29b55c9de8c17
SHA13353297831111bae82cf24d623ddf792e9cb28bf
SHA256905dac8cdb0348dcdacda345a9a8d9036d8fd3c52e2b2e2be903ea366c85ffdd
SHA51257484471fab9da4c9114690cef42b36b0df99a151dfc611b3777c963b49128a464c4f7fd4d3e691c82944bbcf8db892be9913b08c8d23a5c8cd5a74f9fe2f814
-
Filesize
16KB
MD5c28cad30fc80f2c03e115e61d9fe335a
SHA16a249e43d5f88baf68aacbe47e46c4dd9d0ff981
SHA2567e068f0f1bbd61e8f7c1fbc2ad3124052641e7eaaa226bc00be51f3c0be59670
SHA512a8ae6b16472ad6b3bdbb672e57d62c51932f7e8a4f18164a04a8170799cf3958687a0bca94e0a5cd4dac06aa45bbf9035c572235105379213f4a2d47bb0f35e4
-
Filesize
1KB
MD5d1e168e6e0d0d0a1a2404c6f5ba640fd
SHA1ea33057a6c11bf3c58f29b4e8877856424c788ff
SHA256c6aaf037ae86187f1c3954b0161b9196e6a8c2d3ead0aed8c2bad0ce3abf2e2d
SHA512066f88430f0399160b1133654018357eb3bf4888c1c6c771e4c2ae51d4a6eae8a15b767c9cbb8e926cde61c0381815310636db3f60401f94b1a0d964e9a15f5e
-
Filesize
6.5MB
MD54eb0f591d4635eef867eba6b30519482
SHA1ffbdf0b4e300686d4c637ec9ae1e93f5fe31d1e1
SHA256d1861ff47ec977e9ce72cbeab98d2838f5981adb6ee8800ef41c59ab2bcda26b
SHA5124f9d7827508e8491af2df7e3adcc9da47871546284381e9873283c00a81a98a0aa4cc60cfc3a2e61247ec13f1de08c72818096b56613be569b83fb1e6d56b4ee
-
Filesize
23.7MB
MD5ed265ffc62b1bc7523c75f5188bbb079
SHA13abbc2128f1fc18ea3fb118c195f2bfa7cb27ffe
SHA256eafaa04bbd87d1a8c11ee8b98afd2500803c9edf511f201ce87742a4efade3c6
SHA5129cddfa5e23bfbd970cd05c399c7a37da754276ec880faff285f3572b93061f65b6f90cd3bfdd6f56c750ec5d4e85ff11817730ab46356f9d20b702a2d4fc5139
-
\??\Volume{851c08bf-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{a6ad003d-44fa-4397-b282-e6cb33763a41}_OnDiskSnapshotProp
Filesize6KB
MD5ce48fec50fd4bc0074b65994c122aad6
SHA15ce63536644c1a908ad3b36adf4d8b2889bd62f8
SHA256ab4bfb9fcfe54e685471f195813b55e69de8b1bc3e3d60fc2df5491617ea0ce7
SHA512b7d8addfe355b7313fd6e57392decba72edbd31810b95085762b70b1d7d75aa3fd1c00a8f417a7ce34146925197de943420cbbfe791ca91918758eb7a6f34cb3