8a01ae81a248625f271d5fc7c30bc279478b15ecb94bc8b79d9816ef48f4e04c

Analysis

user interaction
yes
max time kernel
30s
max time network
32s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
01/06/2026, 12:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Retrac_2.1.2_x64_en-US.msi
Size 13.9MB
Sample260601-prdrcscs21
SHA256 8a01ae81a248625f271d5fc7c30bc279478b15ecb94bc8b79d9816ef48f4e04c
MD5 2e0bf2086136be7acac180beb2056aa5
SHA1 fdf4e18e33f55946dc4da692f65ce5d063e1c5c4
SHA512 320c6d3578325d39bcd62d1fc4261aae0396a4696d6a4bcb78a2d1ca57c7700d57f870f90545add31551b12efa1ff9cfa2afbf6304fae581f054e5718ec20f38
SSDEEP 393216:OvIy1nVd6Mu+hgcoSWoHEKSBc1PRIQFJFsoyTcWgLKwH:Vy1nCz+hgc7HE/cDVFMYWg
TLSH
T102E6334B3E559F20C82D1D3B05FBCBB916383D446B4888276389B92DE5FAAC04D758E7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery persistence privilege_escalation ransomware trojan

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
3140	retrac.exe

Loads dropped DLL 1 IoCs

pid	Process
3888	MsiExec.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	retrac.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files\Retrac\retrac.exe	msiexec.exe
File created	C:\Program Files\Retrac\Uninstall Retrac.lnk	msiexec.exe

Drops file in Windows directory 10 IoCs

description	ioc	Process
File created	C:\Windows\Installer\e58461c.msi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{5DAC92B8-19B3-4A3E-BF28-39555B14D8A5}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI4716.tmp	msiexec.exe
File created	C:\Windows\Installer\{5DAC92B8-19B3-4A3E-BF28-39555B14D8A5}\ProductIcon	msiexec.exe
File opened for modification	C:\Windows\Installer\{5DAC92B8-19B3-4A3E-BF28-39555B14D8A5}\ProductIcon	msiexec.exe
File opened for modification	C:\Windows\Installer\e58461c.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\Installer\e58461e.msi	msiexec.exe

Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs

persistence privilege_escalation

Installer Packages

T1546.016

Msiexec

T1218.007

pid	Process
3828	msiexec.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000499bfc0d34bfe76b0000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000499bfc0d0000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed35000000ffffffff000000000700010000680900499bfc0d000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff350000000000000005000000ffffffff000000000700010000f8ff1a499bfc0d000000000000f0ff350000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1d499bfc0d000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe

Modifies registry class 46 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\8B29CAD53B91E3A4FB829355B5418D5A\External	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8B29CAD53B91E3A4FB829355B5418D5A\DeploymentFlags = "3"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8B29CAD53B91E3A4FB829355B5418D5A\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\retrac\shell	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\8B29CAD53B91E3A4FB829355B5418D5A	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\retrac\DefaultIcon\ = "C:\\Program Files\\Retrac\\retrac.exe,0"	retrac.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\retrac\URL Protocol	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\retrac\shell\open\command\ = "\"C:\\PROGRA~1\\Retrac\\retrac.exe\" \"%1\""	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\8B29CAD53B91E3A4FB829355B5418D5A\MainProgram	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8B29CAD53B91E3A4FB829355B5418D5A\Language = "0"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8B29CAD53B91E3A4FB829355B5418D5A\Assignment = "1"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8B29CAD53B91E3A4FB829355B5418D5A\InstanceType = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\D39F67BF21D37C75581F63A03A3CC6BF	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8B29CAD53B91E3A4FB829355B5418D5A\SourceList\PackageName = "Retrac_2.1.2_x64_en-US.msi"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8B29CAD53B91E3A4FB829355B5418D5A	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8B29CAD53B91E3A4FB829355B5418D5A\ProductIcon = "C:\\Windows\\Installer\\{5DAC92B8-19B3-4A3E-BF28-39555B14D8A5}\\ProductIcon"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\retrac\DefaultIcon	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8B29CAD53B91E3A4FB829355B5418D5A\Version = "33619970"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\D39F67BF21D37C75581F63A03A3CC6BF\8B29CAD53B91E3A4FB829355B5418D5A	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8B29CAD53B91E3A4FB829355B5418D5A\SourceList	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8B29CAD53B91E3A4FB829355B5418D5A\SourceList\Net	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8B29CAD53B91E3A4FB829355B5418D5A\SourceList\Media\1 = ";"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\retrac	retrac.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\retrac\DefaultIcon	retrac.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8B29CAD53B91E3A4FB829355B5418D5A\AuthorizedLUAApp = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\retrac\shell\open\command	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\retrac\shell\open\command	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\8B29CAD53B91E3A4FB829355B5418D5A\ShortcutsFeature = "MainProgram"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\8B29CAD53B91E3A4FB829355B5418D5A\Environment = "MainProgram"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8B29CAD53B91E3A4FB829355B5418D5A\ProductName = "Retrac"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8B29CAD53B91E3A4FB829355B5418D5A\AdvertiseFlags = "388"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8B29CAD53B91E3A4FB829355B5418D5A\SourceList\Media	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\retrac\ = "URL: protocol"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\retrac\DefaultIcon\ = "\"C:\\PROGRA~1\\Retrac\\retrac.exe\",0"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8B29CAD53B91E3A4FB829355B5418D5A\Clients = 3a0000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8B29CAD53B91E3A4FB829355B5418D5A\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\retrac\ = "URL:launcher.retrac.site protocol"	retrac.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\retrac\shell	retrac.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\retrac\shell\open\command\ = "\"C:\\Program Files\\Retrac\\retrac.exe\" \"%1\""	retrac.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\retrac	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8B29CAD53B91E3A4FB829355B5418D5A\PackageCode = "4087F8FFD0EDB1F43B9357EC4B447120"	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\retrac\URL Protocol	retrac.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\retrac\shell\open\command	retrac.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\retrac\shell\open	retrac.exe
Key created	\REGISTRY\MACHINE\Software\Classes\retrac	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\retrac\shell\open	msiexec.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4624	msiexec.exe
4624	msiexec.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs

pid	Process
944	msedgewebview2.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3828	msiexec.exe
Token: SeIncreaseQuotaPrivilege	3828	msiexec.exe
Token: SeSecurityPrivilege	4624	msiexec.exe
Token: SeCreateTokenPrivilege	3828	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	3828	msiexec.exe
Token: SeLockMemoryPrivilege	3828	msiexec.exe
Token: SeIncreaseQuotaPrivilege	3828	msiexec.exe
Token: SeMachineAccountPrivilege	3828	msiexec.exe
Token: SeTcbPrivilege	3828	msiexec.exe
Token: SeSecurityPrivilege	3828	msiexec.exe
Token: SeTakeOwnershipPrivilege	3828	msiexec.exe
Token: SeLoadDriverPrivilege	3828	msiexec.exe
Token: SeSystemProfilePrivilege	3828	msiexec.exe
Token: SeSystemtimePrivilege	3828	msiexec.exe
Token: SeProfSingleProcessPrivilege	3828	msiexec.exe
Token: SeIncBasePriorityPrivilege	3828	msiexec.exe
Token: SeCreatePagefilePrivilege	3828	msiexec.exe
Token: SeCreatePermanentPrivilege	3828	msiexec.exe
Token: SeBackupPrivilege	3828	msiexec.exe
Token: SeRestorePrivilege	3828	msiexec.exe
Token: SeShutdownPrivilege	3828	msiexec.exe
Token: SeDebugPrivilege	3828	msiexec.exe
Token: SeAuditPrivilege	3828	msiexec.exe
Token: SeSystemEnvironmentPrivilege	3828	msiexec.exe
Token: SeChangeNotifyPrivilege	3828	msiexec.exe
Token: SeRemoteShutdownPrivilege	3828	msiexec.exe
Token: SeUndockPrivilege	3828	msiexec.exe
Token: SeSyncAgentPrivilege	3828	msiexec.exe
Token: SeEnableDelegationPrivilege	3828	msiexec.exe
Token: SeManageVolumePrivilege	3828	msiexec.exe
Token: SeImpersonatePrivilege	3828	msiexec.exe
Token: SeCreateGlobalPrivilege	3828	msiexec.exe
Token: SeCreateTokenPrivilege	3828	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	3828	msiexec.exe
Token: SeLockMemoryPrivilege	3828	msiexec.exe
Token: SeIncreaseQuotaPrivilege	3828	msiexec.exe
Token: SeMachineAccountPrivilege	3828	msiexec.exe
Token: SeTcbPrivilege	3828	msiexec.exe
Token: SeSecurityPrivilege	3828	msiexec.exe
Token: SeTakeOwnershipPrivilege	3828	msiexec.exe
Token: SeLoadDriverPrivilege	3828	msiexec.exe
Token: SeSystemProfilePrivilege	3828	msiexec.exe
Token: SeSystemtimePrivilege	3828	msiexec.exe
Token: SeProfSingleProcessPrivilege	3828	msiexec.exe
Token: SeIncBasePriorityPrivilege	3828	msiexec.exe
Token: SeCreatePagefilePrivilege	3828	msiexec.exe
Token: SeCreatePermanentPrivilege	3828	msiexec.exe
Token: SeBackupPrivilege	3828	msiexec.exe
Token: SeRestorePrivilege	3828	msiexec.exe
Token: SeShutdownPrivilege	3828	msiexec.exe
Token: SeDebugPrivilege	3828	msiexec.exe
Token: SeAuditPrivilege	3828	msiexec.exe
Token: SeSystemEnvironmentPrivilege	3828	msiexec.exe
Token: SeChangeNotifyPrivilege	3828	msiexec.exe
Token: SeRemoteShutdownPrivilege	3828	msiexec.exe
Token: SeUndockPrivilege	3828	msiexec.exe
Token: SeSyncAgentPrivilege	3828	msiexec.exe
Token: SeEnableDelegationPrivilege	3828	msiexec.exe
Token: SeManageVolumePrivilege	3828	msiexec.exe
Token: SeImpersonatePrivilege	3828	msiexec.exe
Token: SeCreateGlobalPrivilege	3828	msiexec.exe
Token: SeCreateTokenPrivilege	3828	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	3828	msiexec.exe
Token: SeLockMemoryPrivilege	3828	msiexec.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
3828	msiexec.exe
3828	msiexec.exe

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 4624 wrote to memory of 3888	4624	msiexec.exe	92
PID 4624 wrote to memory of 4680	4624	msiexec.exe	100
PID 3828 wrote to memory of 3140	3828	msiexec.exe	103
PID 944 wrote to memory of 4208	944	msedgewebview2.exe	105
PID 944 wrote to memory of 4760	944	msedgewebview2.exe	106
PID 944 wrote to memory of 4760	944	msedgewebview2.exe	106
PID 944 wrote to memory of 4760	944	msedgewebview2.exe	106
PID 944 wrote to memory of 1312	944	msedgewebview2.exe	107
PID 944 wrote to memory of 4536	944	msedgewebview2.exe	108
PID 944 wrote to memory of 4536	944	msedgewebview2.exe	108
PID 944 wrote to memory of 4976	944	msedgewebview2.exe	109
PID 944 wrote to memory of 4976	944	msedgewebview2.exe	109
PID 944 wrote to memory of 4976	944	msedgewebview2.exe	109

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\Retrac_2.1.2_x64_en-US.msi
1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:3828
- C:\Program Files\Retrac\retrac.exe
  "C:\Program Files\Retrac\retrac.exe"
  2⤵
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - Modifies registry class
  PID:3140
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=retrac.exe --webview-exe-version=2.1.2 --user-data-dir="C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --enable-features=RemoveRedirectionBitmap --lang=en-US --mojo-named-platform-channel-pipe=3140.3544.12609285966175877233
    3⤵
    - Enumerates system info in registry
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of WriteProcessMemory
    PID:944
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0x15c,0x160,0x164,0x138,0x16c,0x7ffabb7cb078,0x7ffabb7cb084,0x7ffabb7cb090
      4⤵
      PID:4208
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView" --webview-exe-name=retrac.exe --webview-exe-version=2.1.2 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1720,i,9443514971662493930,12266915059252757411,262144 --enable-features=RemoveRedirectionBitmap --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=1716 /prefetch:2
      4⤵
      PID:4760
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView" --webview-exe-name=retrac.exe --webview-exe-version=2.1.2 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2028,i,9443514971662493930,12266915059252757411,262144 --enable-features=RemoveRedirectionBitmap --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=2040 /prefetch:3
      4⤵
      PID:1312
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView" --webview-exe-name=retrac.exe --webview-exe-version=2.1.2 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2344,i,9443514971662493930,12266915059252757411,262144 --enable-features=RemoveRedirectionBitmap --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=2376 /prefetch:8
      4⤵
      PID:4536
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView" --webview-exe-name=retrac.exe --webview-exe-version=2.1.2 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3628,i,9443514971662493930,12266915059252757411,262144 --enable-features=RemoveRedirectionBitmap --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=3636 /prefetch:1
      4⤵
      PID:4976

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4624
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 1451DE71343B16ADA9321F1AC6FB109E C
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:3888
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:4680

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
PID:3528

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Installer Packages

T1546.016

Privilege Escalation

Event Triggered Execution

T1546

Installer Packages

T1546.016

Defense Evasion

System Binary Proxy Execution

T1218

Msiexec

T1218.007

Credential Access

Discovery

Network Share Discovery

T1135

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e58461d.rbs

Path C:\Config.Msi\e58461d.rbs
Size 10KB
SHA256 56e02952fb0fd0e15e7caa140a26bcae8787b603aa504fa216a1c7ffe7477bb3
MD5 d3e12b12bdbb6e948b0fd4e22df01814
SHA1 1b68bc94538a665b7b0bf1f43dc4b5fef0604ff9
SHA512 837272b8800ecb4bcf13e131ae317c8ffe9a9f1359a16912313bd5abe867c1a17f17fffb2970c1556b0b92b69b3d8167be794da78ee74353b7e39ee71635f5c8
SSDEEP 96:tkm/PRCTThxcnCpZ4BQe6qN6NUsU1iCOTlLUsU1iCgjjWbfRjTlFLP5aR15UKQ+N:7xwTDcngeamVhGqVhuOToP/WWiFSpBZ
TLSH
T1F8220E02B24196D3E9861B34CF1F37603FAAEAE99355274F0ACCA1205F567851FA528B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

retrac.exe

Path C:\Program Files\Retrac\retrac.exe
Size 24.5MB
SHA256 ddf1b33de46505ddfd0d06a09c9eaf57a5451cf9f6764390bb993c675eba8c9e
MD5 e995bf0be1bdf8fa0e2fde41b7fb1848
SHA1 9c4c7182298b5eaadbfb983f45d8fc744bf3bf47
SHA512 0dbbfb593719c4e83c3e1d77bfc1e2da710d0d6977763afe46d43e8bb205014377f129f5ebb0988d50d9928f34dda302d1bdcb8c91294ec5cef45d90907704d5
SSDEEP 393216:Mc2wSWXvuvrsPApv8Keqmii8lKqO2B0dHMos0oLEJGU:mwSWX9PYbeqNlY/Bot
TLSH
T1EA475A207B9A996DD15AC47083874A765E3170DB0B35BAFF48D492382F6DBF42F38258
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Retrac.lnk

Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Retrac\Retrac.lnk
Size 1KB
SHA256 6e4b7a4c4ed35ddcc6958b018e342ab801762d3f1be67c05833f60d1aafae6d7
MD5 0c11b3b26b3acd7c25353030f11711da
SHA1 282e2a9c7c04d45d617e808c483d149339dce269
SHA512 4befaa7d05a7b0df18976bdbd16eb655118f1fa0d2f0c580cbeb791f49938f4f3eb3b270eed69aa9759f5f3be59b80358e265efb87e82ce820a4a6cf72177b8d
TLSH
T12841E20057D92766F377423969B92F31CB36BC42D9259F3F018A008A1AB84409C68F7F
MD5 SHA1 SHA512 TLSH

Submit Download

Retrac.lnk~RFe58482f.TMP

Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Retrac\Retrac.lnk~RFe58482f.TMP
Size 1KB
SHA256 c4e4b247b429d6a863f0e65a33ee7a9cceb937c951c74ae72ae27ee90c40e6dd
MD5 f14a6dcfe0d1ec5d4640cbcc12d418e9
SHA1 aa2de199885c2d24487c0b8b33cbffde1a294286
SHA512 963fe6a2f8b007d767651c08458af7474b686cb31eda5db6320a6c98fbf023d5505427bbbc166dcbe0ea05840d542d2a584c6bc0d2fa34f4bdf046b89440f15a
TLSH
T15341C10057E91776F3779339AAB93B30DB36BC4199255F3F0186008A1AB5540AD68FBF
MD5 SHA1 SHA512 TLSH

Submit Download

MSID59.tmp

Path C:\Users\Admin\AppData\Local\Temp\MSID59.tmp
Size 132KB
SHA256 7f47d98ab25cfea9b3a2e898c3376cc9ba1cd893b4948b0c27caa530fd0e34cc
MD5 cfbb8568bd3711a97e6124c56fcfa8d9
SHA1 d7a098ae58bdd5e93a3c1b04b3d69a14234d5e57
SHA512 860cbf3286ac4915580cefaf56a9c3d48938eb08e3f31b7f024c4339c037d7c8bdf16e766d08106505ba535be4922a87dc46bd029aae99a64ea2fc02cf3aec04
SSDEEP 3072:Kx2YbpcgwmiTPJDnCO+DATkURBnrskNwPj2:XXgwmY1CPx2XG2
TLSH
T1DBD39D02B5D0C473D9BE09390870DB229F7EB930DF909EDB636856699E702C19E35A37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 308e180aadafc90fd02a6735dc43804f47bb88f941b27a4ad13eb6c61f6facbf
MD5 b7bddd2c2c65d3034709a3824f9d0cd7
SHA1 d1a8c7bb288eb75d499674929b7eac9f58a1e443
SHA512 c25ff7e0df6b1e6b00ef67613d304e2d9696e643511cdd20e395d7ef6570a6008dedf043f713ce68d0c5b729f11959e445ff1835ada2948117449d25bfb25cfc
TLSH
T130D01212375205B9C01034332002A15C0C00E60F40495011B43C891D2E241540D07683
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 f7faec34df4b2b4fb93fd3e59a70e2ad8d959e5e7a2fe81c7affe716134be899
MD5 c7be5cc5aeaf49a0ef157714422a4dd5
SHA1 36e123f154328789dc8dcc9e4f97f13ae9262573
SHA512 fa9ff3214fc4c3ee66c1d75e0282fa3f2054fb42f4101e43db805a53f83d78ec054f0720f2cd09ae137d0a8ba9382e5d387f9547ec70840afe4e9c4d3b72164f
MD5 SHA1 SHA512

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView\Default\DawnGraphiteCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView\Default\DawnWebGPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView\Default\DawnWebGPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView\Default\DawnWebGPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView\Default\Extension Rules\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView\Default\Site Characteristics Database\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView\Local State
Size 2KB
SHA256 5941c87b0783c7bfe134233d15ef8e8a2927fec13b536ef1c03d97bed3eeeebe
MD5 2ff7e3ffefbd36e79067586cce0a1cef
SHA1 e8cacbd76a132abc4bed4ff3907dd2ee683e9a47
SHA512 dcf55bb78c72f598093b6cc308c102055e9e9a34052c7f116deb17f676160ae06d43908b95391094ca812e5ed476752204bbba1c2665a04c304cbf4819499a03
TLSH
T1CA518673B95897B78EE39A84BD497B137E255162C7821F5095DF0F0D01DB75C1322C2A
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView\Local State
Size 3KB
SHA256 4c243ddd0347d73c68ddaa8a62268262c0b3d9f38b19b346686774b916b4dee0
MD5 9bcf1785366f1e66ba30ac484a34dc8b
SHA1 71e664edf010cd5c5eda14f75933bc554e8e26ef
SHA512 7a798f2172c5fe081499aebaa6cff69fd416873f29ad0fec2088899a8f76de61e370b714fd238b02989826f44edeae77a1896889ceafe546d0fb51179093e960
TLSH
T1B5718333BAA8E6674EE3D980BC856B177B655133D2812F94D5EE0F0D01DB7981312C1A
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView\Local State
Size 1KB
SHA256 f8221d6b428b3ab83416052f1615cf117812689cb5435ef5ba40524760a27ba7
MD5 99c91b1c5aa1cf86c0c31267b22a34b3
SHA1 3c21d0e83e27dd0ff78ed007c0ec8f5fb5c7fd47
SHA512 ae5010575357594ac53d28f1dae9dfce6fa5a046af8cb9521f60d98d0fb2208b8a423d74d27419531eb360732a0ae0a18fd7c3337fad6f81bd36557ca3a3c2b1
TLSH
T18A318573F9A86BB26DC2A685B905E7573E101137C2418E4461CF4F0E02E7B8C963AC2A
MD5 SHA1 SHA512 TLSH

Submit Download

Local State~RFe585e86.TMP

Path C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView\Local State~RFe585e86.TMP
Size 1KB
SHA256 e0ff7371afa39f3ebc4939321376f4be9b10a7e410b6aa4c7a2a5eca5c36036e
MD5 7e9112bf4201d80658352bee41944b42
SHA1 ae3a232e23bc8704b70ac9a1bc348c4410518ae6
SHA512 02bed7a2e471c21e73cfabfabb221e49d8d366c8fbe3b475e664494d4aa39f639d8a1e0ee76c78268283d8f734af1fdc952be695604bed6492eb1fb36af8f87e
TLSH
T1D3211273F9A857B26E969985BD02E74B3E10517782458E04A1CF4B0E12D7A9C8736C36
MD5 SHA1 SHA512 TLSH

Submit Download

e58461c.msi

Path C:\Windows\Installer\e58461c.msi
Size 13.9MB
SHA256 8a01ae81a248625f271d5fc7c30bc279478b15ecb94bc8b79d9816ef48f4e04c
MD5 2e0bf2086136be7acac180beb2056aa5
SHA1 fdf4e18e33f55946dc4da692f65ce5d063e1c5c4
SHA512 320c6d3578325d39bcd62d1fc4261aae0396a4696d6a4bcb78a2d1ca57c7700d57f870f90545add31551b12efa1ff9cfa2afbf6304fae581f054e5718ec20f38
SSDEEP 393216:OvIy1nVd6Mu+hgcoSWoHEKSBc1PRIQFJFsoyTcWgLKwH:Vy1nCz+hgc7HE/cDVFMYWg
TLSH
T102E6334B3E559F20C82D1D3B05FBCBB916383D446B4888276389B92DE5FAAC04D758E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata-2

Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
Size 24.1MB
SHA256 2c3d889ab2584143827edb42e8474fd326751a28aa3420bbc9932707aabbd249
MD5 f65c14d1f5395e2bb788e9e6b6c699ee
SHA1 6582648b264ce01f8fb26151564ad365409de27e
SHA512 e526e1f4fd375c8aaa9f26637a98741b8ec827951a8829a375ad90a5b0c67c19464033cfcf9d81fa06f5b0aaed0468f706d1c9ff326afee1c715592b468d4358
SSDEEP 24576:+u8m+1z6doO/vvTL7W6u/maObDkzylKSGM2NIFb1ykqredzHIvlzicRRv:b
TLSH
T11A47B22477F92210E7F79E3CA8F06A234D3A7D5B9C259E8D45411B4E0921FB0E872F5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{ea483e24-8f42-44f5-895f-4174cc9b507d}_OnDiskSnapshotProp

Path \??\Volume{0dfc9b49-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{ea483e24-8f42-44f5-895f-4174cc9b507d}_OnDiskSnapshotProp
Size 6KB
SHA256 5e02a71ecb91501930c58f21045534785d7b893d812165ff05e6b4bc7fce3f4e
MD5 8bbc1de531a309ec09497228da8f9a79
SHA1 361872b9149aa25c318cd8153ab0fd1647c675c5
SHA512 3a8c464660f47f2fd1e94985fac29b8f954041486f8284ad3c1cbbe1aababe294fd3dd944a65d1145eed31418af1a79133edc824e391f388bb9f56156b609f34
SSDEEP 96:FOVJGGPGtvc8DD84LTHzbOHXOHBlBRQ88Sc9XE56tOSVQpu:MyGPGnb++ZVm
TLSH
T112D19A085AF54711E2B3AB7129F14557A877B911EF33CB8E0198238E6630914F836F5F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4536-112-0x00007FFADB330000-0x00007FFADB331000-memory.dmp

Download

memory/4536-113-0x00007FFADA400000-0x00007FFADA401000-memory.dmp

Download

memory/4760-69-0x00007FFADA6C0000-0x00007FFADA6C1000-memory.dmp

Download

memory/4976-173-0x00007FFADA6C0000-0x00007FFADA6C1000-memory.dmp

Download