f25ac4aed0f36abdb2f0ea2cdb67e4249d7d70467718f718445559cf4e0ffd89

Analysis

max time kernel
149s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
03/08/2026, 04:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Retrac_3.0.8_x64_en-US.msi
Size 14.4MB
Sample260803-fanesscb55
SHA256 f25ac4aed0f36abdb2f0ea2cdb67e4249d7d70467718f718445559cf4e0ffd89
MD5 965f3d0bff58a004b2642bf6d637dedc
SHA1 1c65936cb7545559f090173a494ff1bc2839f1eb
SHA512 68baec2ebd5d6b4eecc6190eb02265572ed952f609423399d5cb5e3f7dd43c8c0e005491bd52be72fdb289f700cfcadee33caea80ca30bf7f5cd5b60fcd2f28d
SSDEEP 393216:Xgwqa+Wmti6d4hGDOQ1X0ADGK/pC6HuAhUO2bJRA:wwc1fdMvFADZ/pCJAhUFN+
TLSH
T151E633873D96DB11C8A21D7A44BBC3A822387D400624D9A777DCB82DDEF23C095769DE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery persistence privilege_escalation ransomware spyware trojan

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1924	retrac.exe

Loads dropped DLL 1 IoCs

pid	Process
6108	MsiExec.exe

Badlisted process makes network request 1 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
4	4960	msiexec.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	retrac.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files\Retrac\retrac.exe	msiexec.exe
File created	C:\Program Files\Retrac\Uninstall Retrac.lnk	msiexec.exe

Drops file in Windows directory 21 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\SystemTemp\~DFC9B0EDBC7493FF7E.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5680_6728706\kp_pinslist.pb	msedgewebview2.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\SystemTemp\~DF326F0196B5F9D79C.TMP	msiexec.exe
File created	C:\Windows\Installer\SourceHash{F2567F58-5A4A-4F82-886D-ED5C11F380BE}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI50A2.tmp	msiexec.exe
File created	C:\Windows\Installer\{F2567F58-5A4A-4F82-886D-ED5C11F380BE}\ProductIcon	msiexec.exe
File created	C:\Windows\SystemTemp\~DF864D98ECBC8E62AE.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5680_1821164591\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5680_1821164591\manifest.fingerprint	msedgewebview2.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File created	C:\Windows\SystemTemp\~DFE383FCD9582F9C59.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\{F2567F58-5A4A-4F82-886D-ED5C11F380BE}\ProductIcon	msiexec.exe
File created	C:\Windows\Installer\e5a4ad7.msi	msiexec.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5680_6728706\manifest.json	msedgewebview2.exe
File created	C:\Windows\Installer\e5a4ad5.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e5a4ad5.msi	msiexec.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5680_6728706\crs.pb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5680_6728706\ct_config.pb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5680_6728706\manifest.fingerprint	msedgewebview2.exe

Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs

persistence privilege_escalation

Installer Packages

T1546.016

Msiexec

T1218.007

pid	Process
4960	msiexec.exe

Modifies trusted root certificate store through registry 1 TTPs 2 IoCs

A root certificate was added, modified, or removed in the trusted certificate store registry paths.

defense_evasion

Install Root Certificate

T1553.004

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 6b000000010000002000000096bcec06264976f37460779acf28c5a7cfe8a3c0aae11a8ffcee05c0bddf08c61900000001000000100000002fe1f70bb05d7c92335bc5e05b984da6030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f6314000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e20000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	retrac.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 5c00000001000000040000000010000014000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e0f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f63030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e81900000001000000100000002fe1f70bb05d7c92335bc5e05b984da66b000000010000002000000096bcec06264976f37460779acf28c5a7cfe8a3c0aae11a8ffcee05c0bddf08c620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	retrac.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000ad3b1fc6af0fc0350000000000000000000000000000000000000000000000000000000000000000000000000000000000001071020000000000c0120000000000000000000000002701010000883801ad3b1fc60000000000001071020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d0830200000000006025c501000000000000000000000700010000e84101ad3b1fc6000000000000d08302000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9c701000000000000050000000000000000000000070001000098d4e3ad3b1fc600000000000030a9c7010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9cc0100000000000005000000000000000000000007000100009854e6ad3b1fc600000000000030a9cc01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe

Modifies registry class 46 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\85F7652FA4A528F488D6DEC5113F08EB\SourceList\Media\1 = ";"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\85F7652FA4A528F488D6DEC5113F08EB\ProductName = "Retrac"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\85F7652FA4A528F488D6DEC5113F08EB\AuthorizedLUAApp = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\85F7652FA4A528F488D6DEC5113F08EB\SourceList	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\retrac\DefaultIcon	retrac.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\retrac\DefaultIcon\ = "C:\\Program Files\\Retrac\\retrac.exe,0"	retrac.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\D39F67BF21D37C75581F63A03A3CC6BF	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\retrac\shell\open\command	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\retrac\shell\open\command	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\85F7652FA4A528F488D6DEC5113F08EB\MainProgram	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\85F7652FA4A528F488D6DEC5113F08EB\Assignment = "1"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\85F7652FA4A528F488D6DEC5113F08EB\ProductIcon = "C:\\Windows\\Installer\\{F2567F58-5A4A-4F82-886D-ED5C11F380BE}\\ProductIcon"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\D39F67BF21D37C75581F63A03A3CC6BF\85F7652FA4A528F488D6DEC5113F08EB	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\retrac\shell\open	retrac.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\retrac\URL Protocol	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\retrac\ = "URL: protocol"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\85F7652FA4A528F488D6DEC5113F08EB\External	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\85F7652FA4A528F488D6DEC5113F08EB\PackageCode = "6AFF5C71F42D1914DA5EF303DCA200A2"	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\retrac\URL Protocol	retrac.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\retrac\shell\open\command\ = "\"C:\\Program Files\\Retrac\\retrac.exe\" \"%1\""	retrac.exe
Key created	\REGISTRY\MACHINE\Software\Classes\retrac	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\85F7652FA4A528F488D6DEC5113F08EB	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\85F7652FA4A528F488D6DEC5113F08EB\Language = "0"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\85F7652FA4A528F488D6DEC5113F08EB\AdvertiseFlags = "388"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\85F7652FA4A528F488D6DEC5113F08EB\DeploymentFlags = "3"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\85F7652FA4A528F488D6DEC5113F08EB\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\85F7652FA4A528F488D6DEC5113F08EB\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\retrac\shell\open\command	retrac.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\retrac\DefaultIcon\ = "\"C:\\PROGRA~1\\Retrac\\retrac.exe\",0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\85F7652FA4A528F488D6DEC5113F08EB	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\85F7652FA4A528F488D6DEC5113F08EB\Environment = "MainProgram"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\85F7652FA4A528F488D6DEC5113F08EB\SourceList\Media	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\retrac\ = "URL:launcher.retrac.site protocol"	retrac.exe
Key created	\REGISTRY\MACHINE\Software\Classes\retrac\DefaultIcon	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\retrac\shell\open\command\ = "\"C:\\PROGRA~1\\Retrac\\retrac.exe\" \"%1\""	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\85F7652FA4A528F488D6DEC5113F08EB\ShortcutsFeature = "MainProgram"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\85F7652FA4A528F488D6DEC5113F08EB\SourceList\PackageName = "Retrac_3.0.8_x64_en-US.msi"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\retrac\shell	retrac.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\retrac\shell	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\retrac\shell\open	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\85F7652FA4A528F488D6DEC5113F08EB\Version = "50331656"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\85F7652FA4A528F488D6DEC5113F08EB\InstanceType = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\85F7652FA4A528F488D6DEC5113F08EB\SourceList\Net	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\85F7652FA4A528F488D6DEC5113F08EB\Clients = 3a0000000000	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\retrac	retrac.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\retrac	msiexec.exe

Modifies system certificate store 2 TTPs 1 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8	retrac.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
816	msiexec.exe
816	msiexec.exe
1924	retrac.exe
1924	retrac.exe
1924	retrac.exe
1924	retrac.exe
1924	retrac.exe
1924	retrac.exe
1924	retrac.exe
1924	retrac.exe
1924	retrac.exe
1924	retrac.exe
1924	retrac.exe
1924	retrac.exe
1924	retrac.exe
1924	retrac.exe
1924	retrac.exe
1924	retrac.exe
1924	retrac.exe
1924	retrac.exe
1924	retrac.exe
1924	retrac.exe
1924	retrac.exe
1924	retrac.exe
1924	retrac.exe
1924	retrac.exe
1924	retrac.exe
1924	retrac.exe
1924	retrac.exe
1924	retrac.exe
1924	retrac.exe
1924	retrac.exe
1924	retrac.exe
1924	retrac.exe
1924	retrac.exe
1924	retrac.exe
1924	retrac.exe
1924	retrac.exe
1924	retrac.exe
1924	retrac.exe
1924	retrac.exe
1924	retrac.exe
1924	retrac.exe
1924	retrac.exe
1924	retrac.exe
1924	retrac.exe
1924	retrac.exe
1924	retrac.exe
1924	retrac.exe
1924	retrac.exe
1924	retrac.exe
1924	retrac.exe
1924	retrac.exe
1924	retrac.exe
1924	retrac.exe
1924	retrac.exe
1924	retrac.exe
1924	retrac.exe
1924	retrac.exe
1924	retrac.exe
1924	retrac.exe
1924	retrac.exe
1924	retrac.exe
1924	retrac.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs

pid	Process
5680	msedgewebview2.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4960	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4960	msiexec.exe
Token: SeSecurityPrivilege	816	msiexec.exe
Token: SeCreateTokenPrivilege	4960	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	4960	msiexec.exe
Token: SeLockMemoryPrivilege	4960	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4960	msiexec.exe
Token: SeMachineAccountPrivilege	4960	msiexec.exe
Token: SeTcbPrivilege	4960	msiexec.exe
Token: SeSecurityPrivilege	4960	msiexec.exe
Token: SeTakeOwnershipPrivilege	4960	msiexec.exe
Token: SeLoadDriverPrivilege	4960	msiexec.exe
Token: SeSystemProfilePrivilege	4960	msiexec.exe
Token: SeSystemtimePrivilege	4960	msiexec.exe
Token: SeProfSingleProcessPrivilege	4960	msiexec.exe
Token: SeIncBasePriorityPrivilege	4960	msiexec.exe
Token: SeCreatePagefilePrivilege	4960	msiexec.exe
Token: SeCreatePermanentPrivilege	4960	msiexec.exe
Token: SeBackupPrivilege	4960	msiexec.exe
Token: SeRestorePrivilege	4960	msiexec.exe
Token: SeShutdownPrivilege	4960	msiexec.exe
Token: SeDebugPrivilege	4960	msiexec.exe
Token: SeAuditPrivilege	4960	msiexec.exe
Token: SeSystemEnvironmentPrivilege	4960	msiexec.exe
Token: SeChangeNotifyPrivilege	4960	msiexec.exe
Token: SeRemoteShutdownPrivilege	4960	msiexec.exe
Token: SeUndockPrivilege	4960	msiexec.exe
Token: SeSyncAgentPrivilege	4960	msiexec.exe
Token: SeEnableDelegationPrivilege	4960	msiexec.exe
Token: SeManageVolumePrivilege	4960	msiexec.exe
Token: SeImpersonatePrivilege	4960	msiexec.exe
Token: SeCreateGlobalPrivilege	4960	msiexec.exe
Token: SeCreateTokenPrivilege	4960	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	4960	msiexec.exe
Token: SeLockMemoryPrivilege	4960	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4960	msiexec.exe
Token: SeMachineAccountPrivilege	4960	msiexec.exe
Token: SeTcbPrivilege	4960	msiexec.exe
Token: SeSecurityPrivilege	4960	msiexec.exe
Token: SeTakeOwnershipPrivilege	4960	msiexec.exe
Token: SeLoadDriverPrivilege	4960	msiexec.exe
Token: SeSystemProfilePrivilege	4960	msiexec.exe
Token: SeSystemtimePrivilege	4960	msiexec.exe
Token: SeProfSingleProcessPrivilege	4960	msiexec.exe
Token: SeIncBasePriorityPrivilege	4960	msiexec.exe
Token: SeCreatePagefilePrivilege	4960	msiexec.exe
Token: SeCreatePermanentPrivilege	4960	msiexec.exe
Token: SeBackupPrivilege	4960	msiexec.exe
Token: SeRestorePrivilege	4960	msiexec.exe
Token: SeShutdownPrivilege	4960	msiexec.exe
Token: SeDebugPrivilege	4960	msiexec.exe
Token: SeAuditPrivilege	4960	msiexec.exe
Token: SeSystemEnvironmentPrivilege	4960	msiexec.exe
Token: SeChangeNotifyPrivilege	4960	msiexec.exe
Token: SeRemoteShutdownPrivilege	4960	msiexec.exe
Token: SeUndockPrivilege	4960	msiexec.exe
Token: SeSyncAgentPrivilege	4960	msiexec.exe
Token: SeEnableDelegationPrivilege	4960	msiexec.exe
Token: SeManageVolumePrivilege	4960	msiexec.exe
Token: SeImpersonatePrivilege	4960	msiexec.exe
Token: SeCreateGlobalPrivilege	4960	msiexec.exe
Token: SeCreateTokenPrivilege	4960	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	4960	msiexec.exe
Token: SeLockMemoryPrivilege	4960	msiexec.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
4960	msiexec.exe
4960	msiexec.exe
1924	retrac.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
4960	msiexec.exe
816	msiexec.exe
6108	MsiExec.exe

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 816 wrote to memory of 6108	816	msiexec.exe	90
PID 816 wrote to memory of 1312	816	msiexec.exe	96
PID 4960 wrote to memory of 1924	4960	msiexec.exe	99
PID 1924 wrote to memory of 5680	1924	retrac.exe	100
PID 5680 wrote to memory of 4256	5680	msedgewebview2.exe	101
PID 5680 wrote to memory of 4840	5680	msedgewebview2.exe	102
PID 5680 wrote to memory of 4840	5680	msedgewebview2.exe	102
PID 5680 wrote to memory of 4840	5680	msedgewebview2.exe	102
PID 5680 wrote to memory of 4840	5680	msedgewebview2.exe	102
PID 5680 wrote to memory of 5800	5680	msedgewebview2.exe	103
PID 5680 wrote to memory of 3284	5680	msedgewebview2.exe	104
PID 5680 wrote to memory of 3284	5680	msedgewebview2.exe	104
PID 5680 wrote to memory of 3284	5680	msedgewebview2.exe	104
PID 5680 wrote to memory of 1116	5680	msedgewebview2.exe	105
PID 5680 wrote to memory of 1116	5680	msedgewebview2.exe	105
PID 5680 wrote to memory of 1116	5680	msedgewebview2.exe	105
PID 5680 wrote to memory of 1116	5680	msedgewebview2.exe	105
PID 5680 wrote to memory of 1116	5680	msedgewebview2.exe	105
PID 5680 wrote to memory of 2512	5680	msedgewebview2.exe	108
PID 5680 wrote to memory of 2512	5680	msedgewebview2.exe	108
PID 5680 wrote to memory of 2512	5680	msedgewebview2.exe	108
PID 5680 wrote to memory of 3676	5680	msedgewebview2.exe	109
PID 5680 wrote to memory of 3676	5680	msedgewebview2.exe	109
PID 5680 wrote to memory of 3676	5680	msedgewebview2.exe	109

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\Retrac_3.0.8_x64_en-US.msi
1⤵
- Badlisted process makes network request
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4960
- C:\Program Files\Retrac\retrac.exe
  "C:\Program Files\Retrac\retrac.exe"
  2⤵
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - Modifies trusted root certificate store through registry
  - Modifies registry class
  - Modifies system certificate store
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:1924
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=retrac.exe --webview-exe-version=3.0.8 --user-data-dir="C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --enable-features=MojoIpcz --lang=en-US --accept-lang=en-US --mojo-named-platform-channel-pipe=1924.1240.445072403704112353 /pfhostedapp:fd0de7e5cefc9f8a2e2a61a11d5c8b08aabc87ca
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of WriteProcessMemory
    PID:5680
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView /prefetch:4 /pfhostedapp:fd0de7e5cefc9f8a2e2a61a11d5c8b08aabc87ca --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x184,0x188,0x18c,0x160,0x194,0x7ffcf4725fd8,0x7ffcf4725fe4,0x7ffcf4725ff0
      4⤵
      PID:4256
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView" --webview-exe-name=retrac.exe --webview-exe-version=3.0.8 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1816 --field-trial-handle=1820,i,15938274026715831446,9322036812309660219,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:2 /pfhostedapp:fd0de7e5cefc9f8a2e2a61a11d5c8b08aabc87ca
      4⤵
      PID:4840
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView" --webview-exe-name=retrac.exe --webview-exe-version=3.0.8 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2256 --field-trial-handle=1820,i,15938274026715831446,9322036812309660219,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:3 /pfhostedapp:fd0de7e5cefc9f8a2e2a61a11d5c8b08aabc87ca
      4⤵
      PID:5800
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView" --webview-exe-name=retrac.exe --webview-exe-version=3.0.8 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2360 --field-trial-handle=1820,i,15938274026715831446,9322036812309660219,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:fd0de7e5cefc9f8a2e2a61a11d5c8b08aabc87ca
      4⤵
      PID:3284
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView" --webview-exe-name=retrac.exe --webview-exe-version=3.0.8 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --autoplay-policy=no-user-gesture-required --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3292 --field-trial-handle=1820,i,15938274026715831446,9322036812309660219,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /pfhostedapp:fd0de7e5cefc9f8a2e2a61a11d5c8b08aabc87ca /prefetch:1
      4⤵
      PID:1116
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView" --webview-exe-name=retrac.exe --webview-exe-version=3.0.8 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4536 --field-trial-handle=1820,i,15938274026715831446,9322036812309660219,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:fd0de7e5cefc9f8a2e2a61a11d5c8b08aabc87ca
      4⤵
      PID:2512
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView" --webview-exe-name=retrac.exe --webview-exe-version=3.0.8 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4540 --field-trial-handle=1820,i,15938274026715831446,9322036812309660219,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:fd0de7e5cefc9f8a2e2a61a11d5c8b08aabc87ca
      4⤵
      PID:3676

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:816
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding AF79094C8E430C687F2FF5405CED7BB1 C
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:6108
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:1312

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
PID:2808

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Installer Packages

T1546.016

Privilege Escalation

Event Triggered Execution

T1546

Installer Packages

T1546.016

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

System Binary Proxy Execution

T1218

Msiexec

T1218.007

Credential Access

Discovery

Network Share Discovery

T1135

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e5a4ad6.rbs

Path C:\Config.Msi\e5a4ad6.rbs
Size 10KB
SHA256 c444f4a3e0d59180a831e17a5eaf2e42c0ae63facd028ebacd171090b07e2834
MD5 db0df6909e4a1624e5bb3db9a8303116
SHA1 360fadbbf685f29499d5aa9cab3f09cbeaf1a18e
SHA512 f75d254b34077c008e500285be1f4dae0660f12f21bd7359f7cbfc93a955c83d0e67d42c11d5f2cb1733864edc51b97ff84b5ce82f86129d1e159f751257344e
SSDEEP 192:m3mvcD7AyCGoEuGvEuuTLbiIM4oWRiMupBCv:mWvcD7AdEhEnAbq
TLSH
T13E22FD42B740C2D2E9921B74DB0717263BB2DA988315674B0BCE75248F833D95EAA1CF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

retrac.exe

Path C:\Program Files\Retrac\retrac.exe
Size 26.0MB
SHA256 2550eee702fb10f576042a913674938b4a4becdcf9b887853dbaef46d6f90bd2
MD5 789fb187c94581916bd728ce786ce972
SHA1 aaacb9eeca073c4a727ec0b7a5264db1479bd7ec
SHA512 4e333b330dd94204694c2355521dad82fc01dab2acdd90453c7dccd3e8e1fe1b3fc389bd1a22a0671e871741c515a0d77301f62891eb49ac39a12189c6f60cc1
SSDEEP 393216:WYq62DqPMcqO0BwUdrsPAQK1Jmii8l/RlpLFo:WYq/O7BfPW1JNl/1
TLSH
T128575B207B9AA96DD05AC47483878A724A7130DB0B35B9FF44D496783F6DBF42F38258
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Retrac.lnk

Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Retrac\Retrac.lnk
Size 1KB
SHA256 89560114f28167f08597269a63b7ada264cf32cb99985a69815304bd47b9865e
MD5 bb6476935996b88ca50735bf160ee67e
SHA1 98bbc45b6e2a88afa42c7111bcd0d820ebb9803d
SHA512 202d7925f399ad2bf8671233168522f47b96cd7a897f800336b634d27ff82c2bb9a5de530c96aacfdffd22456f4502f36da2f9268a2b68b31f7a8db04a2d1d80
TLSH
T1DF41BE0167E50705F3A34639AD784922DE32BC02E5348F3F43CA45CA18B15419A29F2F
MD5 SHA1 SHA512 TLSH

Submit Download

Retrac.lnk~RFe5a5342.TMP

Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Retrac\Retrac.lnk~RFe5a5342.TMP
Size 1KB
SHA256 be5fd6f3a27d10875706ff9b4cb731d77531dd80b7027ea366cbc66c6b078e25
MD5 7c69fe98ebe0fae8966d5fb8224d45d9
SHA1 eef96de8acc834517468e97e16943fa6f510c20c
SHA512 ac9ab926f9ac78e1a8d2be4584d5b25657131a016f3592d2ec56cb76a64ce00ba04948e2b3bd2bd4641f87bcd466e17461ad921ac911db1823a2fc60bf30722c
TLSH
T14B41AF0167E50705F3A34639BEAD4A22DE32BC02E5319F6F43C745CA18B15419A29F2F
MD5 SHA1 SHA512 TLSH

Submit Download

MSIF1C9.tmp

Path C:\Users\Admin\AppData\Local\Temp\MSIF1C9.tmp
Size 132KB
SHA256 7f47d98ab25cfea9b3a2e898c3376cc9ba1cd893b4948b0c27caa530fd0e34cc
MD5 cfbb8568bd3711a97e6124c56fcfa8d9
SHA1 d7a098ae58bdd5e93a3c1b04b3d69a14234d5e57
SHA512 860cbf3286ac4915580cefaf56a9c3d48938eb08e3f31b7f024c4339c037d7c8bdf16e766d08106505ba535be4922a87dc46bd029aae99a64ea2fc02cf3aec04
SSDEEP 3072:Kx2YbpcgwmiTPJDnCO+DATkURBnrskNwPj2:XXgwmY1CPx2XG2
TLSH
T1DBD39D02B5D0C473D9BE09390870DB229F7EB930DF909EDB636856699E702C19E35A37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 f336f86986b32a463da5ff6b175edf7dcb99014acc613a66dd408357d82337b8
MD5 0cef2263be3dd9332acb6422be8d4e4e
SHA1 4b0a3fd1fcb5411786a5f0f15b97c333133c31aa
SHA512 0096c9d64b7f14ef4b528fb28c79d86e3cc18e342b19c50b4768681763212705994fc89929bcad0fc7d980e41be587a6171f33fb959f0a51fd8c471f32e00d30
TLSH
T134D004305100D401CC441C7154304550054D4C14401301044114410574F3C514411505
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 407157000435c47b66b44991f3527c24b48cb746b897df8a9859c7d45e1a00be
MD5 1f841ff359f80fbd21202e5c6f5d378b
SHA1 35999676c6fa91ed863330058fbb4a22ce439b58
SHA512 a8cab17902bd9f8e6cc2a385486d25df739e719edb6c6ca0e29348ab41744e0c63df6c3bd943aa2af686172bd7555d5bebb841c977716ebcdce4615470a1a611
TLSH
T160D0123232018534CC102873141265480845C51F80074004942CC61E7A658A00D12842
MD5 SHA1 SHA512 TLSH

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

2cba5ce2-4afc-45b0-8bc2-5abca1586dc8.tmp

Path C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView\Default\2cba5ce2-4afc-45b0-8bc2-5abca1586dc8.tmp
Size 6KB
SHA256 6d06a1f350c79f95d633d6685ce654a7891710e257bc0ee8d60cccd4286eb754
MD5 6610eea88c5ed8e5d2a55072996e5de3
SHA1 e1b28cfc2bbfc3834e07a67af6ac081695b5f51d
SHA512 4a6e618724baaeaa6c1b8a17e1a85331c306ec63daf072d5a392d44b46b707fb484a9d9ea090e9426a2446bd9401e5527c769b1a23fc313eeea7e1181bd6f63e
SSDEEP 96:stv/dgl4Fb9okao5h16Z0Ys7/x+6MhmuecJLD1eje2K+gX28XM1C7K:st3ORBonYsV+FdLDQjOpG6K
TLSH
T163D1B5425E68797F4CCAE508FA397A23E2F5603260D51E58E7F8562C08DB6DC6303E0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 72B
SHA256 1e8c48dde0ea035129d91cc0abdec21cd04177f0e6c25d778f25855613129ac1
MD5 14882e39f3bc2b8504717e84af489d48
SHA1 c12f0c3bd643f16e9b215c5786df4d87f482bd69
SHA512 65d30983ed78f03f6d05f2c2a2f276c4f54cfd07e792440a9382c00a31c88ac46cd1405447d5d74ee9bef2e586dbfdb29a672c21e7c47b4a352fc5f51ba274a9
TLSH
T176A002146A402823F245077135C2574D72344834CA8F0653F09516BBD951B946515342
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5ac063.TMP

Path C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView\Default\Code Cache\js\index-dir\the-real-index~RFe5ac063.TMP
Size 48B
SHA256 68995f3825bf36f155cadceffa82bb6c6560064d0811b0ae151c09f75a853771
MD5 f1942492f311f4b29ca322ec2a9f26f3
SHA1 b76852657b121ab5fceaa0fecef377876c879cc5
SHA512 fd8975d31baa2b0cbc6b3a088c100b1cdc99a21e6beac01ab9b4a040b60be3bf5b153128b4f68e305b14db1baa3ffd5baa66d3c487003a111d7e6f3d6af6c970
MD5 SHA1 SHA512

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView\Default\GPUCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView\Default\Network\Network Persistent State
Size 821B
SHA256 6117b315cca1abc96dc6e973a57f66ac1d8791d0f39b311fc6f13a885a26cbf8
MD5 4324588afe809f3a179481c262e74bc7
SHA1 3893a163857260339a68fcbfb295d264cfb7a150
SHA512 64b1a948a51f582140fa49f52dffd679687c343504e3bb4e491bcdde0cec477439cfbaccd33d432992075256c570149d1ffc4af086c5972516cd82d9061bf657
TLSH
T128018EA2C3D4C6BD8A4157F067343C13CD2E091A92282E2BDDE9EFDA57E2075D11050F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State~RFe5b8365.TMP

Path C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView\Default\Network\Network Persistent State~RFe5b8365.TMP
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

d0525b21-48dd-4d22-ae47-b4e9217bb09a.tmp

Path C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView\Default\Network\d0525b21-48dd-4d22-ae47-b4e9217bb09a.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView\Default\Site Characteristics Database\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView\Default\Site Characteristics Database\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView\GraphiteDawnCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView\GraphiteDawnCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView\GraphiteDawnCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView\Local State
Size 3KB
SHA256 97425e6d5a5a31cfd2cd9a73ad7f14e2a2fcfbcb8b3f9a2a910761aa603bb60d
MD5 6cac74bbc692abf53182f08e0e633779
SHA1 abd17971643e098cff72004911ea304a4bef376c
SHA512 294beb247b427206d75b757043fc3d16f4a960ccc4c562a72e346a334089427336f0ba52c40da45ec0db7e06e26f6c5c25d8d0e3b725ed91d2f8008223dac9a9
TLSH
T1B96177776875BA3B8DF39A0578863B16A7E48123E5C53FA5D6EC1F1C01C72981382C27
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView\Local State
Size 15KB
SHA256 98c5a4d5f48a2d205af7a63e5bcb445d80360c87390139ea38a9eebff0c18c6c
MD5 2126c0df66432e7f5047c5a1717a33c1
SHA1 ffc789fcf8f8e5dd8083c2ebfc2214dc83b12284
SHA512 6f54b84f2d799929d7127c928e9dcfc7672aad7ca064c51a45906d57fd1f130adcfc100d669791701c7ef92c973eae26db5a722dcc666306438fd186a680f1d6
SSDEEP 384:h+aQikB+z/xvxjg/qhEwNBSO0t+NAVdpoH9zJ:s/UxvxjgC+/gNUCFJ
TLSH
T1D0729E27947A3E27A5F7BA05795D0B9BCBF8847294C16EB84EAD6F0D06C72D40342C16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView\Local State
Size 2KB
SHA256 ed27c0a2660f17c059059efa2f982afc85a7acd41acb2c28c0c98238de90cc22
MD5 8183856dadb0cf8137768df71a001a46
SHA1 defea0377ef9357f446ea14ce652f127e4387e95
SHA512 7dac0291c486038301fdda247e2d32273e4f567ba5335c7812992a4678cefc6697f9ca8aa579014dcd2341838ae94710906ac8996c66656d80331c7acee433d6
TLSH
T19051747378657B7B85F34A19794A3F33DEB48262AA961F609ADC2B1C00C716C5382C37
MD5 SHA1 SHA512 TLSH

Submit Download

Local State~RFe5a6eb9.TMP

Path C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView\Local State~RFe5a6eb9.TMP
Size 1KB
SHA256 d17c7345691b7323768cff3862b2d480d8208fd9b942a9a180f2ac79e0d49d46
MD5 087b851041467a6a3384d0f753dd7537
SHA1 b108b3638c5b632634aecc8121974c3988ef0318
SHA512 e2fd1e4086d0f9b8fc1ec9871713e64d214a67bea6f2ed5831d2c0ccb6227f7b3ba4d274085137746090bdd98f4faae83f099dd1102314469c7e510067e4884a
TLSH
T1D02135B3A0B12F37E8A3151A31477B6B6EB04167D5454F5466DC472C01D219CE6AAD32
MD5 SHA1 SHA512 TLSH

Submit Download

e5a4ad5.msi

Path C:\Windows\Installer\e5a4ad5.msi
Size 14.4MB
SHA256 f25ac4aed0f36abdb2f0ea2cdb67e4249d7d70467718f718445559cf4e0ffd89
MD5 965f3d0bff58a004b2642bf6d637dedc
SHA1 1c65936cb7545559f090173a494ff1bc2839f1eb
SHA512 68baec2ebd5d6b4eecc6190eb02265572ed952f609423399d5cb5e3f7dd43c8c0e005491bd52be72fdb289f700cfcadee33caea80ca30bf7f5cd5b60fcd2f28d
SSDEEP 393216:Xgwqa+Wmti6d4hGDOQ1X0ADGK/pC6HuAhUO2bJRA:wwc1fdMvFADZ/pCJAhUFN+
TLSH
T151E633873D96DB11C8A21D7A44BBC3A822387D400624D9A777DCB82DDEF23C095769DE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata-2

Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
Size 26.1MB
SHA256 3c39e1eaaaed833393b3a98dec197a17be6819a57e1d2661f916868d7e14239d
MD5 909cc3e4ca502a7c4f28ee0f0800112b
SHA1 b1c10f5e145f8136dacdcba41bf703d0e034c94b
SHA512 98d06109a65a8d3cc754e61886e63f033639e3b91a8be3774e968be1ff573d4d4df22317d176309bd67df422db5914cd9654f71fa2d99a701c9c75ca133662b6
SSDEEP 24576:VFo3DMPydoO/vvTL/Sg88iFQvrumHb7P0BKudxSUKpyKpb9cMoRWclmd4+S:iHU
TLSH
T17057B42436F92200E7F79E3DA8F06A234D397D5BAC15DE8D45511B4E0822F71E872F6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{2bc96b44-659d-432e-b991-35774c590e39}_OnDiskSnapshotProp

Path \??\Volume{c61f3bad-0000-0000-0000-d08302000000}\System Volume Information\SPP\OnlineMetadataCache\{2bc96b44-659d-432e-b991-35774c590e39}_OnDiskSnapshotProp
Size 6KB
SHA256 523c9a4a03163269d2c8e779a2a540931f79535b628b818b1cf9988ab1f09a3e
MD5 945b718800cf8d665f5041743591c946
SHA1 e9900e2f602a80c5da06ea0eaa5668bf58c3a4e2
SHA512 07d01b4c8f7b131334f00c1111946fb4efd85c2d3b0ca4c831bad31ac7f5578d91a44b57dd3fbf3e21825d3d59e6e410e8c2da134006ecc80e36dbb53ae914ed
SSDEEP 96:FZ+7LCvc6DD84LTHzbOHXOHBlBRQn8Sc9XE56tOSVQpu:Deeb++uVm
TLSH
T178D188085AF54711E2B3AB3129F18557A837B811EF33CB8E0198238E6671A10F935F6F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1116-252-0x00000207F9980000-0x00000207F9A96000-memory.dmp

Download

memory/1116-87-0x00007FFD171C0000-0x00007FFD171C1000-memory.dmp

Download

memory/2512-313-0x00007FFD179F0000-0x00007FFD179F1000-memory.dmp

Download

memory/2512-312-0x00007FFD179E0000-0x00007FFD179E1000-memory.dmp

Download

memory/4840-251-0x000001F890B90000-0x000001F890CA6000-memory.dmp

Download

memory/4840-71-0x00007FFD171C0000-0x00007FFD171C1000-memory.dmp

Download

memory/4840-267-0x000001F890B90000-0x000001F890CA6000-memory.dmp

Download

memory/4840-283-0x000001F890B90000-0x000001F890CA6000-memory.dmp

Download