921ccce853756f16dd75d1f6da6307218beca5f6bde82f8d524fcc7ebdb81620

Analysis

max time kernel
76s
max time network
79s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
30/07/2026, 01:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Retrac_3.0.3_x64_en_US.msi
Size 14.0MB
Sample260730-bm6dxsar21
SHA256 921ccce853756f16dd75d1f6da6307218beca5f6bde82f8d524fcc7ebdb81620
MD5 83ae3dae4ff8ceb1d9914f6ca6159da3
SHA1 1525edd1e78aa3d6e1bd56429a5849034efc0cb9
SHA512 1c64fb8039db7361237551f87f4757b6de7bdfd7a65455c4c103bb8a707989a928af475732509d40c96f41e82f75dd454813a1c0cedcf1eaa7a570cb6ff56459
SSDEEP 393216:cQ09TbnSeDVNQs3b6+WvWCjYuPKDbAKhUS1Q1vaN:k9hDYsL7w2/hZQR
TLSH
T19EE633273E025B36C81B5FB754FBCB244279FC445AA0690333D8B81AF9F62C5157A9CA
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery persistence privilege_escalation ransomware trojan

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4420	retrac.exe

Loads dropped DLL 1 IoCs

pid	Process
4700	MsiExec.exe

Badlisted process makes network request 2 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
5	2332	msiexec.exe
7	2332	msiexec.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	retrac.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files\Retrac\retrac.exe	msiexec.exe
File created	C:\Program Files\Retrac\Uninstall Retrac.lnk	msiexec.exe

Drops file in Windows directory 10 IoCs

description	ioc	Process
File created	C:\Windows\Installer\e592560.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{B64341E3-8AF2-4B11-8395-8748AE7D1423}	msiexec.exe
File created	C:\Windows\Installer\{B64341E3-8AF2-4B11-8395-8748AE7D1423}\ProductIcon	msiexec.exe
File opened for modification	C:\Windows\Installer\{B64341E3-8AF2-4B11-8395-8748AE7D1423}\ProductIcon	msiexec.exe
File created	C:\Windows\Installer\e592562.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e592560.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI2735.tmp	msiexec.exe

Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs

persistence privilege_escalation

Installer Packages

T1546.016

Msiexec

T1218.007

pid	Process
2332	msiexec.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000ee28096e8f31db0b0000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000ee28096e0000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed35000000ffffffff000000000700010000680900ee28096e000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff350000000000000005000000ffffffff000000000700010000f8ff1aee28096e000000000000f0ff350000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1dee28096e000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe

Modifies data under HKEY_USERS 5 IoCs

description	ioc	Process
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedgewebview2.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134298478708730407"	msedgewebview2.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E	msiexec.exe

Modifies registry class 46 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\retrac\shell\open\command	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3E14346B2FA811B438597884EAD74132\InstanceType = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3E14346B2FA811B438597884EAD74132\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\retrac\ = "URL:launcher.retrac.site protocol"	retrac.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\retrac\DefaultIcon	retrac.exe
Key created	\REGISTRY\MACHINE\Software\Classes\retrac	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\3E14346B2FA811B438597884EAD74132\ShortcutsFeature = "MainProgram"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3E14346B2FA811B438597884EAD74132\Version = "50331651"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3E14346B2FA811B438597884EAD74132\AuthorizedLUAApp = "0"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3E14346B2FA811B438597884EAD74132\DeploymentFlags = "3"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3E14346B2FA811B438597884EAD74132\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\retrac	retrac.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\retrac\shell\open\command\ = "\"C:\\Program Files\\Retrac\\retrac.exe\" \"%1\""	retrac.exe
Key created	\REGISTRY\MACHINE\Software\Classes\retrac\DefaultIcon	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\retrac\DefaultIcon\ = "\"C:\\PROGRA~1\\Retrac\\retrac.exe\",0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\retrac	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\retrac\shell\open	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3E14346B2FA811B438597884EAD74132\Language = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3E14346B2FA811B438597884EAD74132\ProductIcon = "C:\\Windows\\Installer\\{B64341E3-8AF2-4B11-8395-8748AE7D1423}\\ProductIcon"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\D39F67BF21D37C75581F63A03A3CC6BF	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\D39F67BF21D37C75581F63A03A3CC6BF\3E14346B2FA811B438597884EAD74132	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\retrac\shell	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3E14346B2FA811B438597884EAD74132	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3E14346B2FA811B438597884EAD74132\PackageCode = "5AF8DFF4402CB2D43B0C16EE2B44E2EE"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3E14346B2FA811B438597884EAD74132\SourceList	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3E14346B2FA811B438597884EAD74132\SourceList\PackageName = "Retrac_3.0.3_x64_en_US.msi"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3E14346B2FA811B438597884EAD74132\SourceList\Net	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3E14346B2FA811B438597884EAD74132\SourceList\Media\1 = ";"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3E14346B2FA811B438597884EAD74132\Clients = 3a0000000000	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\3E14346B2FA811B438597884EAD74132	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3E14346B2FA811B438597884EAD74132\AdvertiseFlags = "388"	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\retrac\URL Protocol	retrac.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\retrac\shell	retrac.exe
Key created	\REGISTRY\MACHINE\Software\Classes\retrac\shell\open\command	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3E14346B2FA811B438597884EAD74132\SourceList\Media	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\retrac\DefaultIcon\ = "C:\\Program Files\\Retrac\\retrac.exe,0"	retrac.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\retrac\ = "URL: protocol"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\3E14346B2FA811B438597884EAD74132\Environment = "MainProgram"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\3E14346B2FA811B438597884EAD74132\External	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3E14346B2FA811B438597884EAD74132\ProductName = "Retrac"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3E14346B2FA811B438597884EAD74132\Assignment = "1"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\retrac\shell\open\command\ = "\"C:\\PROGRA~1\\Retrac\\retrac.exe\" \"%1\""	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\3E14346B2FA811B438597884EAD74132\MainProgram	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\retrac\shell\open\command	retrac.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\retrac\shell\open	retrac.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\retrac\URL Protocol	msiexec.exe

Suspicious behavior: EnumeratesProcesses 22 IoCs

pid	Process
4076	msiexec.exe
4076	msiexec.exe
4420	retrac.exe
4420	retrac.exe
4420	retrac.exe
4420	retrac.exe
4420	retrac.exe
4420	retrac.exe
4420	retrac.exe
4420	retrac.exe
4420	retrac.exe
4420	retrac.exe
4420	retrac.exe
4420	retrac.exe
4420	retrac.exe
4420	retrac.exe
4420	retrac.exe
4420	retrac.exe
4420	retrac.exe
4420	retrac.exe
4420	retrac.exe
4420	retrac.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs

pid	Process
4332	msedgewebview2.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2332	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2332	msiexec.exe
Token: SeSecurityPrivilege	4076	msiexec.exe
Token: SeCreateTokenPrivilege	2332	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	2332	msiexec.exe
Token: SeLockMemoryPrivilege	2332	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2332	msiexec.exe
Token: SeMachineAccountPrivilege	2332	msiexec.exe
Token: SeTcbPrivilege	2332	msiexec.exe
Token: SeSecurityPrivilege	2332	msiexec.exe
Token: SeTakeOwnershipPrivilege	2332	msiexec.exe
Token: SeLoadDriverPrivilege	2332	msiexec.exe
Token: SeSystemProfilePrivilege	2332	msiexec.exe
Token: SeSystemtimePrivilege	2332	msiexec.exe
Token: SeProfSingleProcessPrivilege	2332	msiexec.exe
Token: SeIncBasePriorityPrivilege	2332	msiexec.exe
Token: SeCreatePagefilePrivilege	2332	msiexec.exe
Token: SeCreatePermanentPrivilege	2332	msiexec.exe
Token: SeBackupPrivilege	2332	msiexec.exe
Token: SeRestorePrivilege	2332	msiexec.exe
Token: SeShutdownPrivilege	2332	msiexec.exe
Token: SeDebugPrivilege	2332	msiexec.exe
Token: SeAuditPrivilege	2332	msiexec.exe
Token: SeSystemEnvironmentPrivilege	2332	msiexec.exe
Token: SeChangeNotifyPrivilege	2332	msiexec.exe
Token: SeRemoteShutdownPrivilege	2332	msiexec.exe
Token: SeUndockPrivilege	2332	msiexec.exe
Token: SeSyncAgentPrivilege	2332	msiexec.exe
Token: SeEnableDelegationPrivilege	2332	msiexec.exe
Token: SeManageVolumePrivilege	2332	msiexec.exe
Token: SeImpersonatePrivilege	2332	msiexec.exe
Token: SeCreateGlobalPrivilege	2332	msiexec.exe
Token: SeCreateTokenPrivilege	2332	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	2332	msiexec.exe
Token: SeLockMemoryPrivilege	2332	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2332	msiexec.exe
Token: SeMachineAccountPrivilege	2332	msiexec.exe
Token: SeTcbPrivilege	2332	msiexec.exe
Token: SeSecurityPrivilege	2332	msiexec.exe
Token: SeTakeOwnershipPrivilege	2332	msiexec.exe
Token: SeLoadDriverPrivilege	2332	msiexec.exe
Token: SeSystemProfilePrivilege	2332	msiexec.exe
Token: SeSystemtimePrivilege	2332	msiexec.exe
Token: SeProfSingleProcessPrivilege	2332	msiexec.exe
Token: SeIncBasePriorityPrivilege	2332	msiexec.exe
Token: SeCreatePagefilePrivilege	2332	msiexec.exe
Token: SeCreatePermanentPrivilege	2332	msiexec.exe
Token: SeBackupPrivilege	2332	msiexec.exe
Token: SeRestorePrivilege	2332	msiexec.exe
Token: SeShutdownPrivilege	2332	msiexec.exe
Token: SeDebugPrivilege	2332	msiexec.exe
Token: SeAuditPrivilege	2332	msiexec.exe
Token: SeSystemEnvironmentPrivilege	2332	msiexec.exe
Token: SeChangeNotifyPrivilege	2332	msiexec.exe
Token: SeRemoteShutdownPrivilege	2332	msiexec.exe
Token: SeUndockPrivilege	2332	msiexec.exe
Token: SeSyncAgentPrivilege	2332	msiexec.exe
Token: SeEnableDelegationPrivilege	2332	msiexec.exe
Token: SeManageVolumePrivilege	2332	msiexec.exe
Token: SeImpersonatePrivilege	2332	msiexec.exe
Token: SeCreateGlobalPrivilege	2332	msiexec.exe
Token: SeCreateTokenPrivilege	2332	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	2332	msiexec.exe
Token: SeLockMemoryPrivilege	2332	msiexec.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
2332	msiexec.exe
4420	retrac.exe
2332	msiexec.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 4076 wrote to memory of 4700	4076	msiexec.exe	94
PID 4076 wrote to memory of 4824	4076	msiexec.exe	99
PID 2332 wrote to memory of 4420	2332	msiexec.exe	101
PID 4420 wrote to memory of 4332	4420	retrac.exe	102
PID 4332 wrote to memory of 4220	4332	msedgewebview2.exe	104
PID 4332 wrote to memory of 2940	4332	msedgewebview2.exe	105
PID 4332 wrote to memory of 2940	4332	msedgewebview2.exe	105
PID 4332 wrote to memory of 2940	4332	msedgewebview2.exe	105
PID 4332 wrote to memory of 1492	4332	msedgewebview2.exe	106
PID 4332 wrote to memory of 5008	4332	msedgewebview2.exe	107
PID 4332 wrote to memory of 5008	4332	msedgewebview2.exe	107
PID 4332 wrote to memory of 1932	4332	msedgewebview2.exe	108
PID 4332 wrote to memory of 1932	4332	msedgewebview2.exe	108
PID 4332 wrote to memory of 1932	4332	msedgewebview2.exe	108

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\Retrac_3.0.3_x64_en_US.msi
1⤵
- Badlisted process makes network request
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2332
- C:\Program Files\Retrac\retrac.exe
  "C:\Program Files\Retrac\retrac.exe"
  2⤵
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:4420
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=retrac.exe --webview-exe-version=1.0.0 --user-data-dir="C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --lang=en-US --mojo-named-platform-channel-pipe=4420.3508.17142570365908577101
    3⤵
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of WriteProcessMemory
    PID:4332
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0x15c,0x160,0x164,0x138,0x16c,0x7ffa1577b078,0x7ffa1577b084,0x7ffa1577b090
      4⤵
      PID:4220
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView" --webview-exe-name=retrac.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1716,i,1999986911414305871,551978802258182455,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=1748 /prefetch:2
      4⤵
      PID:2940
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView" --webview-exe-name=retrac.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2060,i,1999986911414305871,551978802258182455,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=2072 /prefetch:3
      4⤵
      PID:1492
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView" --webview-exe-name=retrac.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2400,i,1999986911414305871,551978802258182455,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=2416 /prefetch:8
      4⤵
      PID:5008
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView" --webview-exe-name=retrac.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3668,i,1999986911414305871,551978802258182455,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=3676 /prefetch:1
      4⤵
      PID:1932

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4076
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding B10AE32B773A08ACC939E64E1720BA6E C
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:4700
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:4824

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
PID:1232

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Installer Packages

T1546.016

Privilege Escalation

Event Triggered Execution

T1546

Installer Packages

T1546.016

Defense Evasion

System Binary Proxy Execution

T1218

Msiexec

T1218.007

Credential Access

Discovery

Network Share Discovery

T1135

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e592561.rbs

Path C:\Config.Msi\e592561.rbs
Size 10KB
SHA256 5be0780858ecbf6f63676df153f3273ee871ee831190596433734c392c705add
MD5 b769acf368b87817518fe921fa80ac69
SHA1 f6da8c8d3d647fc52ac8322ad6a4a06e09565843
SHA512 c0716b14949c016d370e7d18e333f29e6ebbfce2c0e684fadb38ea8a8181ebd8dcd46d66a8d82c06995e2a95f0e545a5a20be5fa0a34e041b6ca23455a0a5921
SSDEEP 192:X+QQDQEQDPQIQTQeIoORaAUdGZ3aAUduEjNhZcgjixj91jFhWjUiYDSUF53srpBa:XscTD4nMoWuau8EjNQ4il9hF4dYDSUFh
TLSH
T1A0221E02BA4085D2FA576F35CB871B143BB3C7D84338678F17CDE0289E56BC92E5568A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

retrac.exe

Path C:\Program Files\Retrac\retrac.exe
Size 25.0MB
SHA256 c724f7f13ae4213190228cb63a25778ee26a14124ad61f6ea588e58f46f2a0fb
MD5 70c648ec13e81d4d822c07b7152fcfe4
SHA1 8600bbf1adcafe7c52e11965ed70bf08a6dd083d
SHA512 f08ff5b89fd12c078b93e46c98a31ea0bf63603bb6122bfa1611359d04e8a6b25d576bebf6cd15f060e35e62c43f0603b09f340c8595ce6b62adb7d91931f711
SSDEEP 393216:eWepOHw+Y8Avmii8lXqOedAMaCsPAwBxK7ifpIPC5:upOQ+Y8kNl/bdP47il5
TLSH
T151475A217B9A996CD19AC47483474AB24E7170DB0B35BAFF449492383F6DBF42F38258
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Retrac.lnk

Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Retrac\Retrac.lnk
Size 1KB
SHA256 af39efb3633b2c2f45d8bcf8f68c248dc4b49e2a6fcaf26eb952becf50ab9f85
MD5 77bc6e2b0736ffe789d81ae2c8bc76b7
SHA1 3fe64c82f488fa043d443f10f1f56a1427fc1567
SHA512 ba0f67a329d5d9ba47e887b539106a7d0471261d31eab10bd8d2e8cc24c6da2fedb961a4bac2c23125581728c651c7f8674912631e5edf61b3ab0b868b0a0eed
TLSH
T174416810EBD41B19F373473DAEB91B208F32FC06AA259F6F4188548E0A75501A96DF2E
MD5 SHA1 SHA512 TLSH

Submit Download

Retrac.lnk~RFe592bb9.TMP

Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Retrac\Retrac.lnk~RFe592bb9.TMP
Size 1KB
SHA256 a9027d804db90a457f4a1f4a809ddf22b79675d5647c7a1e751bbd02feaf6762
MD5 6a12d189c0a4a4b91ef923a426bb8a8c
SHA1 77245b0d70a5fb7ccf31ab3b1a6545c3d7f3aa7c
SHA512 ffb5fcc830bce3dd829b85b3ab7ee702738738c36e9a220e0d171e5b2d9a4cdfd253fa8ac1e8481cac46dd0e3049910e30c5e4f8511ca256fd0e4ba47459dad8
TLSH
T128417C10EBD01B19F333473DAEB91B208F32FC069A255F6F4188548E0675501A96DF2F
MD5 SHA1 SHA512 TLSH

Submit Download

698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
Size 471B
SHA256 b6370e40beec453b472e64045b4033fc9e4caa08a5916d0908da56399875f33c
MD5 a1a888ceb8f65fc4934aa181bfca5cbf
SHA1 e5681dab2fff23f4d59373d9780bdd9f0e0821c4
SHA512 609c29c07506f3f5c85bc4853b244b0828522f82b1d7d7c73d70a2a044eca5f8d352c8064a9f180dbc3427655194d4e39b4cb8a9328ee85e589111cca07a92c8
TLSH
T135F0D46745F228B11A95449C11F459557878B7CF08838066607808D5EA462A5744F455
MD5 SHA1 SHA512 TLSH

Submit Download

8EC9B1D0ABBD7F98B401D425828828CE_B989BB1CBF9ED0A18C88CA75EE4B928E

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EC9B1D0ABBD7F98B401D425828828CE_B989BB1CBF9ED0A18C88CA75EE4B928E
Size 727B
SHA256 e1f87da1007d8c0c85d5461e2a272bba2e68879e67ebd90416c9dd62c0353e08
MD5 1c0bb682bc45028b9f79ccf1e5fec681
SHA1 b05d3eba428358e034fc5af3ce107f3b1bdfe8c3
SHA512 0531ca5448b316ff8434644d456742e89dd7b207d3178a6b2cf25d2a84008d562ea4aeee17381e7e27952917f43c76f980f751b15b3de3b4e59e714fedbc0d16
TLSH
T1AC0194437ED64B46AD824C62DA58067AB84D011408FE07C9C02A1A5DFC1E7333249788
MD5 SHA1 SHA512 TLSH

Submit Download

C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
Size 727B
SHA256 a979724fe78a75e9ebd04b45951bedf4560a843e90fe02283b2da2d01c3c6f11
MD5 e08d7206c6b1328162021158be2a3bba
SHA1 b2be6544fe648af07b04b5df08ed12055966c822
SHA512 7f7ad41d29021a1402267706e79dcaaefb26e46ed9e65b37901098745ed0a863e0f897d54ce1c35592719b92bc2aaaf95bd95443c0707e664f45b31be848f07e
TLSH
T18301991744B5D3603523050AFB9C65A93A670E8408E283B53E920CFF2C8DCFD0F8E410
MD5 SHA1 SHA512 TLSH

Submit Download

698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
Size 400B
SHA256 69d0bc5cc90ab4e55ee3718a299adf30b692740f4f539c99b9851155cc9bf527
MD5 393d10589d06e9113131d03144f5028f
SHA1 bb014ee7e1dfc2e6ef95595a0f09178f77936b9b
SHA512 dd27369c086e21f0c1549e9692ffe4fd1be4c06969657b58b30b3455b4d256cc4e0100b2bab35b2d1d00eafeeaa43a0889833907c446f54d4dfec251837eb174
TLSH
T18FE026342BFF506FF5B09B7843E991A6AF26F1077C4652BE1E81542D990BA409CA6C31
MD5 SHA1 SHA512 TLSH

Submit Download

8EC9B1D0ABBD7F98B401D425828828CE_B989BB1CBF9ED0A18C88CA75EE4B928E

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_B989BB1CBF9ED0A18C88CA75EE4B928E
Size 408B
SHA256 ba94f19252449b4f0af3399a7da84a27a21f4eb9475efd7e73220fa1a7a400c8
MD5 ebb42a1b4d7f7072a98b5f219fe069aa
SHA1 e59a0f3e533640bbf4fd9d7b913a44d775b58814
SHA512 7c1d26d3b2848182daeaee1441759679dabe46f1c0103d42855c7a3e30fe59f0f92093592b2afe27a3098a5a6f0c9e111902e180624cbf373cadb9133837661b
TLSH
T14FE0C07032F84909F4F0D43813E57922AD1DF30B1601826516413746AA15B004CA263C
MD5 SHA1 SHA512 TLSH

Submit Download

C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
Size 412B
SHA256 5cb531221ef838ccaadf1bcffd7caa784d5d9d40bd4a5de6612bf60a3fc4d56b
MD5 9156bab180009cdb32dbe3fa67206eb7
SHA1 671222dd7835fe1611b621a253f162edfbbc6285
SHA512 8cfd523559bbb5368328ee645c3a0d767626893101cfbe733df659bdb97e5663a02dbe9b53502d8bf965451ad1b7b734d7fdbc071ca970d0462133877930924e
TLSH
T1BCE0683822AFA40EF060D83042E5A17A1D59F206210192B916D04348F70AF005D519F4
MD5 SHA1 SHA512 TLSH

Submit Download

MSID126.tmp

Path C:\Users\Admin\AppData\Local\Temp\MSID126.tmp
Size 132KB
SHA256 7f47d98ab25cfea9b3a2e898c3376cc9ba1cd893b4948b0c27caa530fd0e34cc
MD5 cfbb8568bd3711a97e6124c56fcfa8d9
SHA1 d7a098ae58bdd5e93a3c1b04b3d69a14234d5e57
SHA512 860cbf3286ac4915580cefaf56a9c3d48938eb08e3f31b7f024c4339c037d7c8bdf16e766d08106505ba535be4922a87dc46bd029aae99a64ea2fc02cf3aec04
SSDEEP 3072:Kx2YbpcgwmiTPJDnCO+DATkURBnrskNwPj2:XXgwmY1CPx2XG2
TLSH
T1DBD39D02B5D0C473D9BE09390870DB229F7EB930DF909EDB636856699E702C19E35A37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 0edadde29f2947d6f2a9655c8ff4edf1779c8c3d64dc39f4a7bf464f0899e0e2
MD5 ad41cee1755acfbda3af869ac8a689d0
SHA1 49f56a5480b6d8742156a5c527dea482abf85620
SHA512 e07d8452efa2ad23a680336b10e40d3e2664f0f072949bff95a13e595f1405d9bb1244ab3236af44c2542567df35a1507956fc91b2d965dad4787977a4f0ea29
TLSH
T149D024137F014134C41433730443F10C3D41D54F4105C00D543CD51D1FC40501D03453
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 09feb48c5fc253ac72387e0a3102d5aca4cac61d48d1c839ef3452af52833e43
MD5 f4c9c1263574b315494b2a2cda02e8e7
SHA1 7e76b18b544f070c912a149ead4fb387b82f5fd7
SHA512 d851603f1969452e93c61e7d517558d9811f4b2272cdf1525046b9f906148f2eab7ff330e4f0773b1600c9a5ba4a8e4210d2ac152e02e0b0b8e55e02fb1efeb0
MD5 SHA1 SHA512

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 72B
SHA256 f08699bdf14c541414ac5c192eb16b43f7b7e54a043267cc0902baa4f2760687
MD5 47da90c7c066f0aa4f93df29bc2fd02f
SHA1 3cafdc05cff27d3126f8c6b6ca3bf4dd78acab29
SHA512 c7f00e356bc0221408a45a52a2160b74c8e0af3c2ee33eab64bfba87dfa1329e509d850461f8d53ceed9fe1d8ce102d6f93c899f43d8ea3948cabfd32509fe94
TLSH
T1BDA0021412601453D272337562C2254032784C50431B4B81C1D8B064DC787434516411
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 48B
SHA256 7785c8f49bb580e51a1bebbc7ecb889c1c1b9eb28e5a0e14ac7b71d5d8e48c76
MD5 19ed9af98c77a63acab2c0d8a4b846ba
SHA1 4d9d207189e8549cf4569645b0c623eeb1142aef
SHA512 ec081be75f0a6f2405ec570d111644c2feb73aa6a68a2eb07cda0a81f0343f19005f59e5d3ec4fae56444f070a82704bdb371086afde379ccf7e90b18e4a7362
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView\Default\DawnWebGPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView\Default\DawnWebGPUCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView\Default\DawnWebGPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView\Default\DawnWebGPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView\Default\Extension Rules\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView\Default\Sync Data\LevelDB\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView\Local State
Size 1KB
SHA256 c204dedf0b459f2428232f170d7e83ef4398e41881c7988b95107eda5e0dbf24
MD5 7cc557569f45717456f6692e87503857
SHA1 7199d5a35abce69f38178e055c5dca14ebbbff72
SHA512 c9fe7c900f8f26bb6e836002a2b540d43a69db636792fbe91025b0dabfa3261d3a97539ec72b3f353902c51dedfc9a03636b227d290a8993d5ff2c9c9426712f
TLSH
T1DB31A7B2E4906F325D825581F2527A5B2E224177D3509F8461FF874C12EB58C672BD37
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView\Local State
Size 2KB
SHA256 ddb2ad42e82fbced6f695c0d2eeddbd592699f94ca2c62de5cf17869bb22a97d
MD5 d6eb503bd2db2e11f6d92c117421384f
SHA1 f05fc09bea9174af4ca7fc492e2f6675fcf8dcbb
SHA512 940809e8d2a34baae98f4e42a66d3fdbde762f504402de012a7d90e8df92b813850326881b809efd907d86cdbcb5d5e6eeff28ec17f7bbc7caba463cbea0c7f3
TLSH
T1EE51B873BC44AB374DD38A44B9563B126B3A9166D7917F9099EE0B0C01EB55C2303C3B
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView\Local State
Size 3KB
SHA256 54829da59e32d51fbc730e9291324cb5ecec8bbedb5f88b69fec4f98757f66dc
MD5 1211cad6ea1b9f3b277141fddf82f886
SHA1 05129ecdbce3a4ed4b55477ab0bf15d8f43d8812
SHA512 1b2fd128a353554a119a7152a5870e0ee66b183867b0f4483ad8a0ac9873bd680bd205ce0ffd76da5c6f80cfed352395d558ab48264311e0924690db458dbb47
TLSH
T17571C576A964E9374DE39A44F8863B1677664137E6C13FA5D9FD0F0C01DB2882302C2B
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView\Local State
Size 16KB
SHA256 feec43d8a9000ca35bfa0fd73e977707ea592974c29afe1aa5b379e75ec85b4a
MD5 f4623cca5efb960d93dee060e84b39be
SHA1 f7645e7e27f4fff36a719963709e5a6a14b4a003
SHA512 a342e69583d5dde514028bcbefbad073e6603aed1bc9b64799591410c8a562d74b57cbaa8f4c7439b4b37217acb23a7d3cbf2352d9724d23ffc11c1deb007ef6
SSDEEP 384:zp+aQikB+z/xvxjg/qhEwNbchAv/WwyVO589zu:Y/UxvxjgC+nSHWwyVO58Fu
TLSH
T17172AE3F95686E2295F2EA04BA5D1B5BDBB9847281C16EF84EFD4F0D06CB2941303C1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State~RFe594b09.TMP

Path C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView\Local State~RFe594b09.TMP
Size 1KB
SHA256 55094d13fb5ce8b6345e76bc43b663f9a7aefdb9a3806b6fb819796df6c855da
MD5 b5e66ff6ccdba6c3dbd4a9775049c0d7
SHA1 50f7959367b0f13abc64cfbb239967a0a5a7fa67
SHA512 63485ae048458ed20f3ffcc283ed066173d497bef09ef2fafd46c873c837a8a44f60314465c29e4e272527f5caccbf6a4d5e9d3e15b587e05c3cc8c08cf27434
TLSH
T1D12184B7E4C47E326D824581F223B64A2E11417BD310AF49A1FF935912EB88C9727C37
MD5 SHA1 SHA512 TLSH

Submit Download

e592560.msi

Path C:\Windows\Installer\e592560.msi
Size 14.0MB
SHA256 921ccce853756f16dd75d1f6da6307218beca5f6bde82f8d524fcc7ebdb81620
MD5 83ae3dae4ff8ceb1d9914f6ca6159da3
SHA1 1525edd1e78aa3d6e1bd56429a5849034efc0cb9
SHA512 1c64fb8039db7361237551f87f4757b6de7bdfd7a65455c4c103bb8a707989a928af475732509d40c96f41e82f75dd454813a1c0cedcf1eaa7a570cb6ff56459
SSDEEP 393216:cQ09TbnSeDVNQs3b6+WvWCjYuPKDbAKhUS1Q1vaN:k9hDYsL7w2/hZQR
TLSH
T19EE633273E025B36C81B5FB754FBCB244279FC445AA0690333D8B81AF9F62C5157A9CA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata-2

Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
Size 24.1MB
SHA256 41b798add4cd37aa002a7ee62bed448255aea7bf637219fb0fe7e469e036750d
MD5 7dafc7e9db593d463b18ac4e5d462147
SHA1 8207003ae6468112339e0d9f07c990dc102d87ac
SHA512 ed88775ebf25ef9447157176ef4f306bea7d663f0f63ac7b1a701517d0a2343fe63502bd471529a629167d90c6847398c76dc8d5137264346726f4b8e92b1067
SSDEEP 24576:Ru8m+1zKdoO/vvTLrWNOoWaZsEEjF1dSBbGNPic1FUaMeK0wo/lEFb2RY:A
TLSH
T1D247F52437F92510E7F39E3DACF06A2349397D9B9C199E8D05811F4E0921BB1E872F5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{63afce12-eade-40d2-bad8-ede039e07ea9}_OnDiskSnapshotProp

Path \??\Volume{6e0928ee-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{63afce12-eade-40d2-bad8-ede039e07ea9}_OnDiskSnapshotProp
Size 6KB
SHA256 57c44c8a601adce4d2b82f781b6dcb2b8a423226d099f0d9422f75593b8524e9
MD5 7822d8777cce6f487f9ee263d9890fb2
SHA1 fc84900a03f63ee1ce634e7b168ec2e26bba8dae
SHA512 c54b02f9eb5a1d654fe42e3660638b8bccd3db670e377d4b1f65aca7083f5cfff21597ba9615e11070c0de8104a0ec8d962339937044de3fc1ae52b639ae2d6d
SSDEEP 96:FLeVfFIZvc8DD84LTHzbOHXOHBlBRQ88Sc9XE56tOSVQpu:I1Mb++ZVm
TLSH
T19BD18B0C5AF54711E2B3AB3129F14557A877B951EF33CB8E0198238E6670910F935F5B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1932-203-0x00007FFA334E0000-0x00007FFA334E1000-memory.dmp

Download

memory/2940-87-0x00007FFA334E0000-0x00007FFA334E1000-memory.dmp

Download

memory/5008-99-0x00007FFA32860000-0x00007FFA32861000-memory.dmp

Download

memory/5008-100-0x00007FFA33110000-0x00007FFA33111000-memory.dmp

Download