921ccce853756f16dd75d1f6da6307218beca5f6bde82f8d524fcc7ebdb81620

Analysis

user interaction
yes
max time kernel
63s
max time network
66s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
30/07/2026, 01:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Retrac_3.0.3_x64_en-US.msi
Size 14.0MB
Sample260730-b6bcwsbk31
SHA256 921ccce853756f16dd75d1f6da6307218beca5f6bde82f8d524fcc7ebdb81620
MD5 83ae3dae4ff8ceb1d9914f6ca6159da3
SHA1 1525edd1e78aa3d6e1bd56429a5849034efc0cb9
SHA512 1c64fb8039db7361237551f87f4757b6de7bdfd7a65455c4c103bb8a707989a928af475732509d40c96f41e82f75dd454813a1c0cedcf1eaa7a570cb6ff56459
SSDEEP 393216:cQ09TbnSeDVNQs3b6+WvWCjYuPKDbAKhUS1Q1vaN:k9hDYsL7w2/hZQR
TLSH
T19EE633273E025B36C81B5FB754FBCB244279FC445AA0690333D8B81AF9F62C5157A9CA
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery persistence privilege_escalation ransomware trojan

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4204	retrac.exe

Loads dropped DLL 1 IoCs

pid	Process
4168	MsiExec.exe

Badlisted process makes network request 2 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
4	4236	msiexec.exe
7	4236	msiexec.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	retrac.exe

Contacts third-party web service commonly abused for C2 1 TTPs 3 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
98	discord.com
99	discord.com
106	discord.com

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files\Retrac\retrac.exe	msiexec.exe
File created	C:\Program Files\Retrac\Uninstall Retrac.lnk	msiexec.exe

Drops file in Windows directory 10 IoCs

description	ioc	Process
File created	C:\Windows\Installer\e584f15.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File created	C:\Windows\Installer\SourceHash{B64341E3-8AF2-4B11-8395-8748AE7D1423}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI5128.tmp	msiexec.exe
File created	C:\Windows\Installer\{B64341E3-8AF2-4B11-8395-8748AE7D1423}\ProductIcon	msiexec.exe
File opened for modification	C:\Windows\Installer\{B64341E3-8AF2-4B11-8395-8748AE7D1423}\ProductIcon	msiexec.exe
File created	C:\Windows\Installer\e584f17.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e584f15.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe

Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs

persistence privilege_escalation

Installer Packages

T1546.016

Msiexec

T1218.007

pid	Process
4236	msiexec.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1424	msedge.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000f94cc820840d1c590000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000f94cc8200000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed35000000ffffffff000000000700010000680900f94cc820000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff350000000000000005000000ffffffff000000000700010000f8ff1af94cc820000000000000f0ff350000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1df94cc820000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe

Modifies registry class 46 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\3E14346B2FA811B438597884EAD74132\MainProgram	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3E14346B2FA811B438597884EAD74132\Language = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3E14346B2FA811B438597884EAD74132\SourceList	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\retrac\DefaultIcon\ = "C:\\Program Files\\Retrac\\retrac.exe,0"	retrac.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\3E14346B2FA811B438597884EAD74132\ShortcutsFeature = "MainProgram"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\retrac\ = "URL: protocol"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\retrac\shell	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\3E14346B2FA811B438597884EAD74132\Environment = "MainProgram"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3E14346B2FA811B438597884EAD74132\InstanceType = "0"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\retrac\DefaultIcon	retrac.exe
Key created	\REGISTRY\MACHINE\Software\Classes\retrac	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3E14346B2FA811B438597884EAD74132\ProductName = "Retrac"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3E14346B2FA811B438597884EAD74132\PackageCode = "5AF8DFF4402CB2D43B0C16EE2B44E2EE"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3E14346B2FA811B438597884EAD74132\Assignment = "1"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3E14346B2FA811B438597884EAD74132\ProductIcon = "C:\\Windows\\Installer\\{B64341E3-8AF2-4B11-8395-8748AE7D1423}\\ProductIcon"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3E14346B2FA811B438597884EAD74132\SourceList\Net	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\retrac\shell\open	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\retrac\shell\open\command	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\3E14346B2FA811B438597884EAD74132\External	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3E14346B2FA811B438597884EAD74132\Version = "50331651"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3E14346B2FA811B438597884EAD74132\AdvertiseFlags = "388"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3E14346B2FA811B438597884EAD74132\Clients = 3a0000000000	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\retrac\shell\open	retrac.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\retrac\URL Protocol	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3E14346B2FA811B438597884EAD74132	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3E14346B2FA811B438597884EAD74132\AuthorizedLUAApp = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3E14346B2FA811B438597884EAD74132\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\retrac\ = "URL:launcher.retrac.site protocol"	retrac.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\retrac\shell	retrac.exe
Key created	\REGISTRY\MACHINE\Software\Classes\retrac\shell\open\command	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\retrac\shell\open\command\ = "\"C:\\PROGRA~1\\Retrac\\retrac.exe\" \"%1\""	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\retrac\URL Protocol	retrac.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\retrac\shell\open\command	retrac.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\retrac\shell\open\command\ = "\"C:\\Program Files\\Retrac\\retrac.exe\" \"%1\""	retrac.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\retrac	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\D39F67BF21D37C75581F63A03A3CC6BF\3E14346B2FA811B438597884EAD74132	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3E14346B2FA811B438597884EAD74132\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3E14346B2FA811B438597884EAD74132\SourceList\Media	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3E14346B2FA811B438597884EAD74132\SourceList\Media\1 = ";"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\retrac	retrac.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\D39F67BF21D37C75581F63A03A3CC6BF	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\retrac\DefaultIcon\ = "\"C:\\PROGRA~1\\Retrac\\retrac.exe\",0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\3E14346B2FA811B438597884EAD74132	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3E14346B2FA811B438597884EAD74132\DeploymentFlags = "3"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3E14346B2FA811B438597884EAD74132\SourceList\PackageName = "Retrac_3.0.3_x64_en-US.msi"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\retrac\DefaultIcon	msiexec.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
1640	msiexec.exe
1640	msiexec.exe
4204	retrac.exe
4204	retrac.exe
4204	retrac.exe
4204	retrac.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs

pid	Process
1268	msedgewebview2.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4236	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4236	msiexec.exe
Token: SeSecurityPrivilege	1640	msiexec.exe
Token: SeCreateTokenPrivilege	4236	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	4236	msiexec.exe
Token: SeLockMemoryPrivilege	4236	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4236	msiexec.exe
Token: SeMachineAccountPrivilege	4236	msiexec.exe
Token: SeTcbPrivilege	4236	msiexec.exe
Token: SeSecurityPrivilege	4236	msiexec.exe
Token: SeTakeOwnershipPrivilege	4236	msiexec.exe
Token: SeLoadDriverPrivilege	4236	msiexec.exe
Token: SeSystemProfilePrivilege	4236	msiexec.exe
Token: SeSystemtimePrivilege	4236	msiexec.exe
Token: SeProfSingleProcessPrivilege	4236	msiexec.exe
Token: SeIncBasePriorityPrivilege	4236	msiexec.exe
Token: SeCreatePagefilePrivilege	4236	msiexec.exe
Token: SeCreatePermanentPrivilege	4236	msiexec.exe
Token: SeBackupPrivilege	4236	msiexec.exe
Token: SeRestorePrivilege	4236	msiexec.exe
Token: SeShutdownPrivilege	4236	msiexec.exe
Token: SeDebugPrivilege	4236	msiexec.exe
Token: SeAuditPrivilege	4236	msiexec.exe
Token: SeSystemEnvironmentPrivilege	4236	msiexec.exe
Token: SeChangeNotifyPrivilege	4236	msiexec.exe
Token: SeRemoteShutdownPrivilege	4236	msiexec.exe
Token: SeUndockPrivilege	4236	msiexec.exe
Token: SeSyncAgentPrivilege	4236	msiexec.exe
Token: SeEnableDelegationPrivilege	4236	msiexec.exe
Token: SeManageVolumePrivilege	4236	msiexec.exe
Token: SeImpersonatePrivilege	4236	msiexec.exe
Token: SeCreateGlobalPrivilege	4236	msiexec.exe
Token: SeCreateTokenPrivilege	4236	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	4236	msiexec.exe
Token: SeLockMemoryPrivilege	4236	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4236	msiexec.exe
Token: SeMachineAccountPrivilege	4236	msiexec.exe
Token: SeTcbPrivilege	4236	msiexec.exe
Token: SeSecurityPrivilege	4236	msiexec.exe
Token: SeTakeOwnershipPrivilege	4236	msiexec.exe
Token: SeLoadDriverPrivilege	4236	msiexec.exe
Token: SeSystemProfilePrivilege	4236	msiexec.exe
Token: SeSystemtimePrivilege	4236	msiexec.exe
Token: SeProfSingleProcessPrivilege	4236	msiexec.exe
Token: SeIncBasePriorityPrivilege	4236	msiexec.exe
Token: SeCreatePagefilePrivilege	4236	msiexec.exe
Token: SeCreatePermanentPrivilege	4236	msiexec.exe
Token: SeBackupPrivilege	4236	msiexec.exe
Token: SeRestorePrivilege	4236	msiexec.exe
Token: SeShutdownPrivilege	4236	msiexec.exe
Token: SeDebugPrivilege	4236	msiexec.exe
Token: SeAuditPrivilege	4236	msiexec.exe
Token: SeSystemEnvironmentPrivilege	4236	msiexec.exe
Token: SeChangeNotifyPrivilege	4236	msiexec.exe
Token: SeRemoteShutdownPrivilege	4236	msiexec.exe
Token: SeUndockPrivilege	4236	msiexec.exe
Token: SeSyncAgentPrivilege	4236	msiexec.exe
Token: SeEnableDelegationPrivilege	4236	msiexec.exe
Token: SeManageVolumePrivilege	4236	msiexec.exe
Token: SeImpersonatePrivilege	4236	msiexec.exe
Token: SeCreateGlobalPrivilege	4236	msiexec.exe
Token: SeCreateTokenPrivilege	4236	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	4236	msiexec.exe
Token: SeLockMemoryPrivilege	4236	msiexec.exe

Suspicious use of FindShellTrayWindow 5 IoCs

pid	Process
4236	msiexec.exe
4236	msiexec.exe
4236	msiexec.exe
4204	retrac.exe
4236	msiexec.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 1640 wrote to memory of 4168	1640	msiexec.exe	88
PID 1640 wrote to memory of 4872	1640	msiexec.exe	92
PID 4236 wrote to memory of 4204	4236	msiexec.exe	100
PID 4204 wrote to memory of 1268	4204	retrac.exe	104
PID 1268 wrote to memory of 2512	1268	msedgewebview2.exe	105
PID 1268 wrote to memory of 652	1268	msedgewebview2.exe	106
PID 1268 wrote to memory of 652	1268	msedgewebview2.exe	106
PID 1268 wrote to memory of 652	1268	msedgewebview2.exe	106
PID 1268 wrote to memory of 316	1268	msedgewebview2.exe	107
PID 1268 wrote to memory of 4024	1268	msedgewebview2.exe	108
PID 1268 wrote to memory of 4024	1268	msedgewebview2.exe	108
PID 1268 wrote to memory of 696	1268	msedgewebview2.exe	109
PID 1268 wrote to memory of 696	1268	msedgewebview2.exe	109
PID 1268 wrote to memory of 696	1268	msedgewebview2.exe	109

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\Retrac_3.0.3_x64_en-US.msi
1⤵
- Badlisted process makes network request
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4236
- C:\Program Files\Retrac\retrac.exe
  "C:\Program Files\Retrac\retrac.exe"
  2⤵
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:4204
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=retrac.exe --webview-exe-version=1.0.0 --user-data-dir="C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --lang=en-US --mojo-named-platform-channel-pipe=4204.4276.10482074538501460688
    3⤵
    - Enumerates system info in registry
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of WriteProcessMemory
    PID:1268
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0x168,0x16c,0x170,0x144,0xe4,0x7ffa3d98b078,0x7ffa3d98b084,0x7ffa3d98b090
      4⤵
      PID:2512
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView" --webview-exe-name=retrac.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1724,i,12151047466950182549,5069556085390784374,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=1720 /prefetch:2
      4⤵
      PID:652
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView" --webview-exe-name=retrac.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2028,i,12151047466950182549,5069556085390784374,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=2044 /prefetch:3
      4⤵
      PID:316
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView" --webview-exe-name=retrac.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2372,i,12151047466950182549,5069556085390784374,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=2384 /prefetch:8
      4⤵
      PID:4024
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView" --webview-exe-name=retrac.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3596,i,12151047466950182549,5069556085390784374,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=3648 /prefetch:1
      4⤵
      PID:696
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://oauth-service-prod.retr.ac/oauth/authorise?client_id=01K5FQWCFHYHK3PNW357RE9YRZ&response_type=code&redirect_uri=retrac%3A%2F%2Fcallback
    3⤵
    PID:2052
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-skip-compat-layer-relaunch --single-argument https://oauth-service-prod.retr.ac/oauth/authorise?client_id=01K5FQWCFHYHK3PNW357RE9YRZ&response_type=code&redirect_uri=retrac%3A%2F%2Fcallback
      4⤵
      PID:5036
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x234,0x238,0x23c,0x230,0x258,0x7ffa3b24c188,0x7ffa3b24c194,0x7ffa3b24c1a0
        5⤵
        
        PID:1624
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1944,i,2537343651843601146,1003371913451450945,524288 --field-trial-handle=2476,i,3503239023272721873,7554840199181718384,262144 --variations-seed-version --mojo-platform-channel-handle=2496 /prefetch:3
        5⤵
        System Time Discovery
        
        PID:1424
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1636,i,9695636737133339818,10758096299688760588,262144 --field-trial-handle=2476,i,3503239023272721873,7554840199181718384,262144 --variations-seed-version --mojo-platform-channel-handle=2472 /prefetch:2
        5⤵
        
        PID:5140
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2276,i,6083231161986134518,13310355462568396781,524288 --field-trial-handle=2476,i,3503239023272721873,7554840199181718384,262144 --variations-seed-version --mojo-platform-channel-handle=3136 /prefetch:8
        5⤵
        
        PID:5180
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3464,i,15406632155383138060,17521330787870700110,2097152 --field-trial-handle=2476,i,3503239023272721873,7554840199181718384,262144 --variations-seed-version --mojo-platform-channel-handle=3520 /prefetch:1
        5⤵
        
        PID:5280
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3484,i,5562828433376120486,4358581466758729240,2097152 --field-trial-handle=2476,i,3503239023272721873,7554840199181718384,262144 --variations-seed-version --mojo-platform-channel-handle=3528 /prefetch:1
        5⤵
        
        PID:5288
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4084,i,6633757657481193320,15562406130222808632,2097152 --field-trial-handle=2476,i,3503239023272721873,7554840199181718384,262144 --variations-seed-version --mojo-platform-channel-handle=4108 /prefetch:1
        5⤵
        
        PID:5428
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4104,i,14167192251139447078,3363598895457403056,2097152 --field-trial-handle=2476,i,3503239023272721873,7554840199181718384,262144 --variations-seed-version --mojo-platform-channel-handle=4132 /prefetch:2
        5⤵
        
        PID:5436
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5032,i,17271165428535396129,10036273677623212755,524288 --field-trial-handle=2476,i,3503239023272721873,7554840199181718384,262144 --variations-seed-version --mojo-platform-channel-handle=5036 /prefetch:8
        5⤵
        
        PID:5752
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5196,i,12336637745463213971,4354656550138056404,524288 --field-trial-handle=2476,i,3503239023272721873,7554840199181718384,262144 --variations-seed-version --mojo-platform-channel-handle=5192 /prefetch:8
        5⤵
        
        PID:5900
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=5352,i,2193938659434647470,392757097520465884,2097152 --field-trial-handle=2476,i,3503239023272721873,7554840199181718384,262144 --variations-seed-version --mojo-platform-channel-handle=5360 /prefetch:1
        5⤵
        
        PID:5964
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3968,i,14497894011601088789,7289229477135450042,524288 --field-trial-handle=2476,i,3503239023272721873,7554840199181718384,262144 --variations-seed-version --mojo-platform-channel-handle=5544 /prefetch:8
        5⤵
        
        PID:6052
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4296,i,12444493757983388989,1310414866792661510,524288 --field-trial-handle=2476,i,3503239023272721873,7554840199181718384,262144 --variations-seed-version --mojo-platform-channel-handle=5568 /prefetch:8
        5⤵
        
        PID:6060

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1640
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding C2D5E4F810C71F6B13D30602EF82EFD9 C
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:4168
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:4872

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
PID:4904

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5132

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Installer Packages

T1546.016

Privilege Escalation

Event Triggered Execution

T1546

Installer Packages

T1546.016

Defense Evasion

System Binary Proxy Execution

T1218

Msiexec

T1218.007

Credential Access

Discovery

Network Share Discovery

T1135

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e584f16.rbs

Path C:\Config.Msi\e584f16.rbs
Size 10KB
SHA256 d2e2a474b5db485083a3f173cec7595d762fade0521901bd723115c00742682c
MD5 df333da54708be31e5c0b54d24984784
SHA1 6f6713e3bb323948254816ee846c4b6340c3c075
SHA512 6543976ea0d740e2eaf987b9d43e9da278baf941bcabac69de5a94b9edcd71a2ad524bf136e941277b8075673f75e8c2d61cc383157f15df8832ebec90d7b596
SSDEEP 192:G+OQDQEQDPQIQTQeUQORaAUdGZ3aAUduEjNhZcgjixj91jFhWjUiYDSUF53srpBA:GKcTD4noQWuau8EjNQ4il9hF4dYDSUFf
TLSH
T1FD222E02BA4085C2FA576F35C7871B143BB3C7D85338678F17CDE0289E56BC92E5568A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

retrac.exe

Path C:\Program Files\Retrac\retrac.exe
Size 25.0MB
SHA256 c724f7f13ae4213190228cb63a25778ee26a14124ad61f6ea588e58f46f2a0fb
MD5 70c648ec13e81d4d822c07b7152fcfe4
SHA1 8600bbf1adcafe7c52e11965ed70bf08a6dd083d
SHA512 f08ff5b89fd12c078b93e46c98a31ea0bf63603bb6122bfa1611359d04e8a6b25d576bebf6cd15f060e35e62c43f0603b09f340c8595ce6b62adb7d91931f711
SSDEEP 393216:eWepOHw+Y8Avmii8lXqOedAMaCsPAwBxK7ifpIPC5:upOQ+Y8kNl/bdP47il5
TLSH
T151475A217B9A996CD19AC47483474AB24E7170DB0B35BAFF449492383F6DBF42F38258
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Retrac.lnk

Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Retrac\Retrac.lnk
Size 1KB
SHA256 86df05efac8d6584b8a87d9561a82a7f6c70cd03695c116629de07939cec1885
MD5 baa80f9a6129e2436b8b33b2b8e028d0
SHA1 5a3b450cd78a94ffaa9f881e9ed8c6ecbb9c90d2
SHA512 14b7dd66078568c3679095f5bf8ce1137b4926d44763f4ab08894a36079e4fcc348492ddbd143ccb0b9c2bc00de5b7244b21785a15be453882dfb96156de6f5c
TLSH
T15741A01097D10759F23787396DB91B218E32FC06A9655F3F4188408E0675500D96DF6B
MD5 SHA1 SHA512 TLSH

Submit Download

Retrac.lnk~RFe5852af.TMP

Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Retrac\Retrac.lnk~RFe5852af.TMP
Size 1KB
SHA256 329e53895019dd71cf8ab1f6040c2d8c0170d93c512b81685d83dccc55f10bae
MD5 5cdabbbd53edec1827cc83f5ef1aa59e
SHA1 2c4ac63118de1855df8dcd99d552445606a19fec
SHA512 e84de555e8cdea4b222de07e0ad95b4f5157aecfd76d529376951be3ec8f878b41a11dc167dab926104138550bdd11f74314938f9043187cae040d52995c47ab
TLSH
T1A941AF2097D10B5AF23387396EB91B218E32FC06A9615F3B4188008E0675500D91DF6F
MD5 SHA1 SHA512 TLSH

Submit Download

698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
Size 471B
SHA256 b6370e40beec453b472e64045b4033fc9e4caa08a5916d0908da56399875f33c
MD5 a1a888ceb8f65fc4934aa181bfca5cbf
SHA1 e5681dab2fff23f4d59373d9780bdd9f0e0821c4
SHA512 609c29c07506f3f5c85bc4853b244b0828522f82b1d7d7c73d70a2a044eca5f8d352c8064a9f180dbc3427655194d4e39b4cb8a9328ee85e589111cca07a92c8
TLSH
T135F0D46745F228B11A95449C11F459557878B7CF08838066607808D5EA462A5744F455
MD5 SHA1 SHA512 TLSH

Submit Download

8EC9B1D0ABBD7F98B401D425828828CE_B989BB1CBF9ED0A18C88CA75EE4B928E

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EC9B1D0ABBD7F98B401D425828828CE_B989BB1CBF9ED0A18C88CA75EE4B928E
Size 727B
SHA256 e1f87da1007d8c0c85d5461e2a272bba2e68879e67ebd90416c9dd62c0353e08
MD5 1c0bb682bc45028b9f79ccf1e5fec681
SHA1 b05d3eba428358e034fc5af3ce107f3b1bdfe8c3
SHA512 0531ca5448b316ff8434644d456742e89dd7b207d3178a6b2cf25d2a84008d562ea4aeee17381e7e27952917f43c76f980f751b15b3de3b4e59e714fedbc0d16
TLSH
T1AC0194437ED64B46AD824C62DA58067AB84D011408FE07C9C02A1A5DFC1E7333249788
MD5 SHA1 SHA512 TLSH

Submit Download

C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
Size 727B
SHA256 a979724fe78a75e9ebd04b45951bedf4560a843e90fe02283b2da2d01c3c6f11
MD5 e08d7206c6b1328162021158be2a3bba
SHA1 b2be6544fe648af07b04b5df08ed12055966c822
SHA512 7f7ad41d29021a1402267706e79dcaaefb26e46ed9e65b37901098745ed0a863e0f897d54ce1c35592719b92bc2aaaf95bd95443c0707e664f45b31be848f07e
TLSH
T18301991744B5D3603523050AFB9C65A93A670E8408E283B53E920CFF2C8DCFD0F8E410
MD5 SHA1 SHA512 TLSH

Submit Download

698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
Size 400B
SHA256 3517ff859206505bdb25eeb4bfd4882f7091b76397fa559d3063dacc82602a85
MD5 16db353331261c91fe3f9c726b35d24f
SHA1 ad612fa9cbf8968dcf75be853bbb91093eb85c6c
SHA512 c45ba3a4c1784206baadc21bb3adc11ab94b21192a234052355673e9a1be36e1b658f32b1aa2efec62c968f156e08b15c43c806bab95c9998f8d373a3e31d617
TLSH
T192E0203427FF105FF564577403D9919A6F26F1133C4552BE1D81541D591AD404C66D71
MD5 SHA1 SHA512 TLSH

Submit Download

8EC9B1D0ABBD7F98B401D425828828CE_B989BB1CBF9ED0A18C88CA75EE4B928E

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_B989BB1CBF9ED0A18C88CA75EE4B928E
Size 408B
SHA256 4643114352c1a47298b6df3a8580c00eb643cdbc520961c7b0f074127459b9d8
MD5 b1d2a18b94d20be0ad30dcbbe010c47f
SHA1 f3c17f1cfd9f988328203cb2fa475e363e9a815b
SHA512 a426f65a896117bd1e15563fee0a8db82ab72d1a784e2a116a0521c4d1da24f4096d4d6056e92e0eccc17ef698bb5bc2184ef4db35c99b9cf348f916103869af
TLSH
T19DE0C07432F84A0DF8F5D43412E179729C0DF30B1601826626402706AA55A004CA262C
MD5 SHA1 SHA512 TLSH

Submit Download

C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
Size 412B
SHA256 0037906ef51ed1400890e47227e5479c3e0c533bb45ab4355e5071d4fd8ebcd4
MD5 29d54f50ab698953f1412864378e465e
SHA1 5cff7fa53061db22812c39e094d46eafe505222e
SHA512 ebd69de73a4de1046d039d791891ebfef5e2f657ed5b0f3a54abc1948ae10f7860b6d678ef427a1a255e129492372893690d1cf70047b081e70cc47b9c425fe6
TLSH
T145E0683811ABA40EF060DC3446F5A17A1D48E20A1404927806C04348F70AF009E51AB4
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 98eae6fcc56d922689f3a45ab65635857e6510c437555d4eae3a6cd68dff3acb
MD5 338a3c92e96cad1510815c958fc76de7
SHA1 e1234ace09aad728f9bde0798e2fb22ee82583de
SHA512 e29c9087bb4c9c94c8525a95c307117f14827336de29aa01f837bd02b05b3aecd1c1771970519a60972a1495e05b4f68ab34cf5e4ec9d7060f6383ac019c2ed7
TLSH
T17DD0803337C9A500F6567375F412C7412F2705741586C713A168C45CDC794C557C92C7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 85da5d101c008762046da9670ca95944217bbb1829e60a748f367ee4f9926b13
MD5 ef105d8d3e87a813544857290c28833d
SHA1 bfe7010cf80fb8cbcb9eeb5e0d0b551ece0b3134
SHA512 ae71c302652e2de890fca25723381f403f4f9ee51e2da6583977318de3e7ff00defb73b202e17a287def3ff618de86c0af96c0fca7729ef3efe0a4ba3cfdfc63
TLSH
T16FD0803377C9A100F6567375F413C7412F27057415868613A168C45CDC784C557C92C7
MD5 SHA1 SHA512 TLSH

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 b3dff849fb75e42a7409e11c340fadc03958af7a0fb4a016783370da9ce22ac9
MD5 7308eab2e9b3143372c196f127e9a113
SHA1 40ae003563da00cfe6749ed4af34251e42cc8d64
SHA512 b1723719969c8db3f87f06b652cd56c14cf1f0f6ffd2031cc5da8f63c4c8360fe7967746ba7568b22c648a9fa235c0ad4245608115cfcdfdc67d59466c64fc29
SSDEEP 96:BqONk5QsjpfmUTFK5ih/cIPURHl8h4otop5EfkDhUBaPwivh50xy0SFYKHAxEYeW:oONF6kAQmiUyThYc903cmxmFlcR4qlU6
TLSH
T1C6123932A868AC7B5DE3A491F48336131FA5812BEF897F90D9DC2B1C04DF25C130B826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 82cdf940e5572e241998a0d54ef0384fbc304488cc06f33fe260a1358c4cf398
MD5 c9ebc214b41e8ef8629db1f9e1bcdfd6
SHA1 5597e900a204084deb84965dfa03c5576184d468
SHA512 437d543c69d2084301d3f9a42d319a0ad0517ac5dd32cd7d8b470662aa856b655be68daca8ae59ca517cd090c0a5b989bfeec5b54b0e1fc996b62222f320b84a
SSDEEP 96:ZqONkhQsjpfmUTmDK5ih/cIPURHl8h4otop5E5DhUBhPwivh50xy0SFYKHAxEYej:gONp6kDfQmiUy2hYZ903cmxQi0o8U6
TLSH
T1E902083568786CBB9EE3AE4AF4477B275FA5213BEA912F84D9E41B1C44C764C1303836
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 41daced07821a171c4f392d1ae8486bf6fc4772aca13d894dd1d953c4ddfc2b2
MD5 397d8f9fc1cee211b0d8d0db7527a8b2
SHA1 d0a90edd44a0b65a2291972f14d879bf54cd1826
SHA512 36ff0f184072cf77b03af932a0f425b45940a427b1a3628530d537aa10702f8f9aa683744ec6c1d94076d2e426f3c2019ee782fb3239dc1533da275455221d80
TLSH
T12241E958BAFA1148B3B76E5AABF6A46D487FB8372F07D85D10110E4E0667B41C872733
MD5 SHA1 SHA512 TLSH

Submit Download

MSI125A.tmp

Path C:\Users\Admin\AppData\Local\Temp\MSI125A.tmp
Size 132KB
SHA256 7f47d98ab25cfea9b3a2e898c3376cc9ba1cd893b4948b0c27caa530fd0e34cc
MD5 cfbb8568bd3711a97e6124c56fcfa8d9
SHA1 d7a098ae58bdd5e93a3c1b04b3d69a14234d5e57
SHA512 860cbf3286ac4915580cefaf56a9c3d48938eb08e3f31b7f024c4339c037d7c8bdf16e766d08106505ba535be4922a87dc46bd029aae99a64ea2fc02cf3aec04
SSDEEP 3072:Kx2YbpcgwmiTPJDnCO+DATkURBnrskNwPj2:XXgwmY1CPx2XG2
TLSH
T1DBD39D02B5D0C473D9BE09390870DB229F7EB930DF909EDB636856699E702C19E35A37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 53e5a8aa9ba097d126c16dbc4d3c53bced61955d68cca14e3e66eac59349c02b
MD5 d7c4fdfae14aa79072e4441091e86017
SHA1 a4e44d6a5da5f6d07bc3a8f3e1b7464f80841a7d
SHA512 1a66d9580509024aaed489915fa7f7b1ef857cf17cb3232453d26c89fd2b2ee7487949d88bb3c231da46c0064dd56142c9f612eabbe091b84ea826fe4234705e
TLSH
T120D0121336014134C0103073540265DC0941D30B4006C204943C852E6E440642902881
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 105de1f900fec12b3f49cb1b3603f1156ef6d093e310eb672564cab1ea17efaf
MD5 4fff9a519e652ca12bc45438bcdfd355
SHA1 0d6cf590a26f138c21f949727da37c331b241e99
SHA512 09ac4978c450276545dcf9a53a46bac9ebbe1c7c2986e6539b8db82b54100c3d4b997846a14cf7f06b17c4b2ca5e115a987bde122ca06f7c215977735f15cf50
MD5 SHA1 SHA512

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView\Default\DawnWebGPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView\Default\DawnWebGPUCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView\Default\DawnWebGPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView\Default\DawnWebGPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView\Default\Extension Rules\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

000001.dbtmp

Path C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView\Default\Site Characteristics Database\000001.dbtmp
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView\Local State
Size 1KB
SHA256 61492d8618130af21509cfab5aeca6a854ac482793756e03f74e283d7fc74f3f
MD5 fac5ca97826636fd31acc22e97654e8c
SHA1 9b2eda37b12d8a4b9762940d84272cda9daa95f4
SHA512 e3e9fe0294847c4095adb25c8a39647fc691be9f34f10033bdc99a8a3bedce5c2b05deb3bfa272fc004d0c3e5e838c917f506216e6ffe3c2083dcef840fed26b
TLSH
T1FA3162B2A4901B37DCA12685B10677672E6160BDC2608F08B1DE8B1802E76DD977AC36
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView\Local State
Size 2KB
SHA256 785ecb61dce30084cba0a455c1aa9af65df0fa1e22d8d8c1b814664ccc9aac00
MD5 dcdba50dbb014efe3c7f1cfe4615ff60
SHA1 22076d65a91195b09a87383c4149718f3943f3d2
SHA512 fb9981132864a20f352a3d21de7a45643c6205773e6fc2b6d7b65977c7adf5e68ca31722fee9087fb3c51e93b1ddee96a9804eace97e3d68aaa02c72a9d6fd8c
TLSH
T19251B67378145A37CDF35A44F84A3B22BA3651B8DBA26F50A5DD4B0C01D76AC2356C36
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView\Local State
Size 3KB
SHA256 76f559d8edb519f69d76b3c1a153e5ec8628539391f1fce8a3229dffb447cf26
MD5 dac39c5760fd6d02f4b833b7b055a2bb
SHA1 21ff06044fe6b1b5c9ba452600b63b1ba4847a98
SHA512 1350bd88ee386ef562da7ad2ca6fb193d4c04c47d140446204653c244f6486fe9a861b2c2ccf47eee747d11538fd24f46c4603afce705daca220c5c1013ab0a4
TLSH
T16171E6366864993B8DF39A40F8863B16B7A6513AD6D17FA8E5EC0F0C01D73D81342C17
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView\Local State
Size 4KB
SHA256 45f4d41eb048028a5b7a371889cad425622e3934ceadfe8a805d776b9524f7cf
MD5 67d6f61846ec34f003fdcd4806b4bd93
SHA1 d70480875cb68c6ef1ca9a4978dc3f7039b8e898
SHA512 d2c6d3443f09ab78da90733b6c07f13feb69c5293eedc35f89f94eb4573cd427c4ed2173604947a3e71fd1334fe3b5c0e1316c8faee55ccc3da16c04f0cdc2b2
SSDEEP 96:zuAbNkCEjfmy9aA+8Frh/cInURoDoto+5qhDCcBCZJ6sWZ/8ZTTxlAa:z5bNbNeBooDUhoCwCZVZP7
TLSH
T1CC91C522A47499378DF2DA44F8463B13B6A55076D695BF98D9EC4F0C02D73D81342C1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State~RFe587b26.TMP

Path C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView\Local State~RFe587b26.TMP
Size 1KB
SHA256 41a8ded3de8b46725ebc95176e5c7bfe6b6d4f3b7e1989d901814b0d1fed2595
MD5 93b421fbd9c9948161d9f038ba6b2306
SHA1 66aee0a19493cb3b6c4c362ab47051a8306027fe
SHA512 cc1290b854612df19feada781a4212ce806ff2551f87f6e38731a9bd95c552fafb50f0d21a0264a92e7cc97e1e4bd92fc3f5eae29e67ff48c58b6621e0a93c2a
TLSH
T13C2170B3D8941A77EC911A88F002B75B2E5060BC83608F08F1CE871902D7ADD87BBC36
MD5 SHA1 SHA512 TLSH

Submit Download

e584f15.msi

Path C:\Windows\Installer\e584f15.msi
Size 14.0MB
SHA256 921ccce853756f16dd75d1f6da6307218beca5f6bde82f8d524fcc7ebdb81620
MD5 83ae3dae4ff8ceb1d9914f6ca6159da3
SHA1 1525edd1e78aa3d6e1bd56429a5849034efc0cb9
SHA512 1c64fb8039db7361237551f87f4757b6de7bdfd7a65455c4c103bb8a707989a928af475732509d40c96f41e82f75dd454813a1c0cedcf1eaa7a570cb6ff56459
SSDEEP 393216:cQ09TbnSeDVNQs3b6+WvWCjYuPKDbAKhUS1Q1vaN:k9hDYsL7w2/hZQR
TLSH
T19EE633273E025B36C81B5FB754FBCB244279FC445AA0690333D8B81AF9F62C5157A9CA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata-2

Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
Size 24.1MB
SHA256 cfdb6ad49ff25c9611bc1e1189c10c40c69ed56430acb83de2a4337df8da719a
MD5 88fd01adf3daf75decd75e47ce2c6319
SHA1 e29343877f40022bee08efde7e7a51d5e1fe055a
SHA512 ef20e363981a7dead6d93ba9e2821405e8cd23e54976b9b8b2b6cff17bbc78e554290aaf0d057cf79c561e02a55cae907826be147a37cf954258bb729dfc1c26
SSDEEP 24576:Zu8m+1zrdoO/vvTLrWceJG64dl0zEVMiwKmNeTtlU06tuLlBovVFk6XRp:B
TLSH
T1B747E42436F92110E7F79E3CA8F16A234D3A7D5B8C159E8D05411B4E0962FB1E872F6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{16ee5b20-4802-4963-99e6-af60cf6a1334}_OnDiskSnapshotProp

Path \??\Volume{20c84cf9-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{16ee5b20-4802-4963-99e6-af60cf6a1334}_OnDiskSnapshotProp
Size 6KB
SHA256 b306889f7a67a7a03338fec04042114ff3300afe94bbe9e346b8b3fd583cc253
MD5 48be4558a6085acf83c919b78d9aef33
SHA1 1872a02d806b23857419cb8cbe7bf7857645ea50
SHA512 dd0a8deaa88cb443e731670e124b288c96793a1445639dd8dc8c064af77959ebac60d238f9965cfc79a0a5e9263b7c15d8e3cc2fa5082b461550858ebbc57120
SSDEEP 96:Fm3VcAyvc8DD84LTHzbOHXOHBlBRQ88Sc9XE56tOSVQpu:M3Ub++ZVm
TLSH
T163D18A0C5AF54711E2B3AB3129F58557A877B811EF33CB8E0298238E6671910F936F5B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/652-88-0x00007FFA5B540000-0x00007FFA5B541000-memory.dmp

Download

memory/696-189-0x00007FFA5B540000-0x00007FFA5B541000-memory.dmp

Download

memory/4024-103-0x00007FFA5C6B0000-0x00007FFA5C6B1000-memory.dmp

Download

memory/4024-102-0x00007FFA5B860000-0x00007FFA5B861000-memory.dmp

Download