hxxp://theretroproject[.]com

Analysis

user interaction
yes
max time kernel
103s
max time network
106s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
04/08/2026, 03:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://theretroproject.com
Sample260804-dwdfls1dkc

Score

8^/10

defense_evasion discovery installer persistence privilege_escalation trojan

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
12	4068	chrome.exe

Modifies Windows Firewall 2 TTPs 6 IoCs

defense_evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
4696	netsh.exe
3320	netsh.exe
4164	netsh.exe
6064	netsh.exe
5920	netsh.exe
4364	netsh.exe

Executes dropped EXE 3 IoCs

pid	Process
6020	TheRetroProject-Setup.exe
5680	TheRetroProject-Setup.tmp
3128	The Retro Project.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	The Retro Project.exe

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
3	raw.githubusercontent.com
46	raw.githubusercontent.com

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\TheRetroProject-Setup.exe:Zone.Identifier	chrome.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 18 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TheRetroProject-Setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TheRetroProject-Setup.tmp

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4068	chrome.exe

Inno Setup is an open-source installation builder for Windows applications. 3 IoCs

Inno Setup installer

installer

resource	yara_rule
behavioral1/memory/6020-97-0x0000000000650000-0x0000000000742000-memory.dmp	innosetup
behavioral1/memory/6020-112-0x0000000000650000-0x0000000000742000-memory.dmp	innosetup
behavioral1/memory/6020-632-0x0000000000650000-0x0000000000742000-memory.dmp	innosetup

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	The Retro Project.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	The Retro Project.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134302872896818554"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedgewebview2.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\TheRetroProject-Setup.exe:Zone.Identifier	chrome.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
3848	chrome.exe
3848	chrome.exe
5680	TheRetroProject-Setup.tmp
5680	TheRetroProject-Setup.tmp
3848	chrome.exe
3848	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
3848	chrome.exe
3848	chrome.exe
3848	chrome.exe
3848	chrome.exe
712	msedgewebview2.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3848	chrome.exe
Token: SeCreatePagefilePrivilege	3848	chrome.exe
Token: SeShutdownPrivilege	3848	chrome.exe
Token: SeCreatePagefilePrivilege	3848	chrome.exe
Token: SeShutdownPrivilege	3848	chrome.exe
Token: SeCreatePagefilePrivilege	3848	chrome.exe
Token: SeShutdownPrivilege	3848	chrome.exe
Token: SeCreatePagefilePrivilege	3848	chrome.exe
Token: SeShutdownPrivilege	3848	chrome.exe
Token: SeCreatePagefilePrivilege	3848	chrome.exe
Token: SeShutdownPrivilege	3848	chrome.exe
Token: SeCreatePagefilePrivilege	3848	chrome.exe
Token: SeShutdownPrivilege	3848	chrome.exe
Token: SeCreatePagefilePrivilege	3848	chrome.exe
Token: SeShutdownPrivilege	3848	chrome.exe
Token: SeCreatePagefilePrivilege	3848	chrome.exe
Token: SeShutdownPrivilege	3848	chrome.exe
Token: SeCreatePagefilePrivilege	3848	chrome.exe
Token: SeShutdownPrivilege	3848	chrome.exe
Token: SeCreatePagefilePrivilege	3848	chrome.exe
Token: SeShutdownPrivilege	3848	chrome.exe
Token: SeCreatePagefilePrivilege	3848	chrome.exe
Token: SeShutdownPrivilege	3848	chrome.exe
Token: SeCreatePagefilePrivilege	3848	chrome.exe
Token: SeShutdownPrivilege	3848	chrome.exe
Token: SeCreatePagefilePrivilege	3848	chrome.exe
Token: SeShutdownPrivilege	3848	chrome.exe
Token: SeCreatePagefilePrivilege	3848	chrome.exe
Token: SeShutdownPrivilege	3848	chrome.exe
Token: SeCreatePagefilePrivilege	3848	chrome.exe
Token: SeShutdownPrivilege	3848	chrome.exe
Token: SeCreatePagefilePrivilege	3848	chrome.exe
Token: SeShutdownPrivilege	3848	chrome.exe
Token: SeCreatePagefilePrivilege	3848	chrome.exe
Token: SeShutdownPrivilege	3848	chrome.exe
Token: SeCreatePagefilePrivilege	3848	chrome.exe
Token: SeShutdownPrivilege	3848	chrome.exe
Token: SeCreatePagefilePrivilege	3848	chrome.exe
Token: SeShutdownPrivilege	3848	chrome.exe
Token: SeCreatePagefilePrivilege	3848	chrome.exe
Token: SeShutdownPrivilege	3848	chrome.exe
Token: SeCreatePagefilePrivilege	3848	chrome.exe
Token: SeShutdownPrivilege	3848	chrome.exe
Token: SeCreatePagefilePrivilege	3848	chrome.exe
Token: SeShutdownPrivilege	3848	chrome.exe
Token: SeCreatePagefilePrivilege	3848	chrome.exe
Token: SeShutdownPrivilege	3848	chrome.exe
Token: SeCreatePagefilePrivilege	3848	chrome.exe
Token: SeShutdownPrivilege	3848	chrome.exe
Token: SeCreatePagefilePrivilege	3848	chrome.exe
Token: SeShutdownPrivilege	3848	chrome.exe
Token: SeCreatePagefilePrivilege	3848	chrome.exe
Token: SeShutdownPrivilege	3848	chrome.exe
Token: SeCreatePagefilePrivilege	3848	chrome.exe
Token: SeShutdownPrivilege	3848	chrome.exe
Token: SeCreatePagefilePrivilege	3848	chrome.exe
Token: SeShutdownPrivilege	3848	chrome.exe
Token: SeCreatePagefilePrivilege	3848	chrome.exe
Token: SeShutdownPrivilege	3848	chrome.exe
Token: SeCreatePagefilePrivilege	3848	chrome.exe
Token: SeShutdownPrivilege	3848	chrome.exe
Token: SeCreatePagefilePrivilege	3848	chrome.exe
Token: SeShutdownPrivilege	3848	chrome.exe
Token: SeCreatePagefilePrivilege	3848	chrome.exe

Suspicious use of FindShellTrayWindow 46 IoCs

pid	Process
3848	chrome.exe
3848	chrome.exe
3848	chrome.exe
3848	chrome.exe
3848	chrome.exe
3848	chrome.exe
3848	chrome.exe
3848	chrome.exe
3848	chrome.exe
3848	chrome.exe
3848	chrome.exe
3848	chrome.exe
3848	chrome.exe
3848	chrome.exe
3848	chrome.exe
3848	chrome.exe
3848	chrome.exe
3848	chrome.exe
3848	chrome.exe
3848	chrome.exe
3848	chrome.exe
3848	chrome.exe
3848	chrome.exe
3848	chrome.exe
3848	chrome.exe
3848	chrome.exe
3848	chrome.exe
3848	chrome.exe
3848	chrome.exe
3848	chrome.exe
3848	chrome.exe
3848	chrome.exe
3848	chrome.exe
3848	chrome.exe
3848	chrome.exe
3848	chrome.exe
3848	chrome.exe
3848	chrome.exe
3848	chrome.exe
3848	chrome.exe
3848	chrome.exe
3848	chrome.exe
3848	chrome.exe
3848	chrome.exe
3848	chrome.exe
5680	TheRetroProject-Setup.tmp

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
3848	chrome.exe
3848	chrome.exe
3848	chrome.exe
3848	chrome.exe
3848	chrome.exe
3848	chrome.exe
3848	chrome.exe
3848	chrome.exe
3848	chrome.exe
3848	chrome.exe
3848	chrome.exe
3848	chrome.exe
3848	chrome.exe
3848	chrome.exe
3848	chrome.exe
3848	chrome.exe

Suspicious use of WriteProcessMemory 41 IoCs

description	pid	Process	procid_target
PID 3848 wrote to memory of 2432	3848	chrome.exe	81
PID 3848 wrote to memory of 3268	3848	chrome.exe	83
PID 3848 wrote to memory of 4068	3848	chrome.exe	84
PID 3848 wrote to memory of 3268	3848	chrome.exe	83
PID 3848 wrote to memory of 660	3848	chrome.exe	85
PID 3848 wrote to memory of 660	3848	chrome.exe	85
PID 3848 wrote to memory of 3812	3848	chrome.exe	86
PID 3848 wrote to memory of 3812	3848	chrome.exe	86
PID 3848 wrote to memory of 1456	3848	chrome.exe	87
PID 3848 wrote to memory of 1456	3848	chrome.exe	87
PID 3848 wrote to memory of 1264	3848	chrome.exe	88
PID 3848 wrote to memory of 1264	3848	chrome.exe	88
PID 3848 wrote to memory of 2664	3848	chrome.exe	90
PID 3848 wrote to memory of 2664	3848	chrome.exe	90
PID 3848 wrote to memory of 3764	3848	chrome.exe	91
PID 3848 wrote to memory of 5568	3848	chrome.exe	93
PID 3848 wrote to memory of 6020	3848	chrome.exe	94
PID 6020 wrote to memory of 5680	6020	TheRetroProject-Setup.exe	95
PID 3848 wrote to memory of 1116	3848	chrome.exe	96
PID 3848 wrote to memory of 5916	3848	chrome.exe	97
PID 3848 wrote to memory of 1460	3848	chrome.exe	98
PID 5680 wrote to memory of 4364	5680	TheRetroProject-Setup.tmp	99
PID 5680 wrote to memory of 4696	5680	TheRetroProject-Setup.tmp	102
PID 5680 wrote to memory of 3320	5680	TheRetroProject-Setup.tmp	104
PID 5680 wrote to memory of 4164	5680	TheRetroProject-Setup.tmp	106
PID 5680 wrote to memory of 6064	5680	TheRetroProject-Setup.tmp	108
PID 5680 wrote to memory of 3128	5680	TheRetroProject-Setup.tmp	110
PID 3128 wrote to memory of 5920	3128	The Retro Project.exe	111
PID 3128 wrote to memory of 712	3128	The Retro Project.exe	113
PID 712 wrote to memory of 5872	712	msedgewebview2.exe	114
PID 712 wrote to memory of 3700	712	msedgewebview2.exe	115
PID 712 wrote to memory of 3700	712	msedgewebview2.exe	115
PID 712 wrote to memory of 3700	712	msedgewebview2.exe	115
PID 712 wrote to memory of 5228	712	msedgewebview2.exe	116
PID 712 wrote to memory of 2924	712	msedgewebview2.exe	117
PID 712 wrote to memory of 2924	712	msedgewebview2.exe	117
PID 712 wrote to memory of 760	712	msedgewebview2.exe	118
PID 712 wrote to memory of 760	712	msedgewebview2.exe	118
PID 712 wrote to memory of 760	712	msedgewebview2.exe	118
PID 712 wrote to memory of 2560	712	msedgewebview2.exe	119
PID 712 wrote to memory of 2560	712	msedgewebview2.exe	119

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://theretroproject.com
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3848
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb126cc728,0x7ffb126cc734,0x7ffb126cc740
  2⤵
  PID:2432
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1676,i,15811532584361135895,3190904010596749179,262144 --field-trial-handle=2092,i,1240282367351658823,7140068712514421785,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2088 /prefetch:2
  2⤵
  PID:3268
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1456,i,5940736321016691883,3741066508196162419,524288 --field-trial-handle=2092,i,1240282367351658823,7140068712514421785,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2128 /prefetch:11
  2⤵
  - Downloads MZ/PE file
  - System Time Discovery
  PID:4068
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2288,i,13068621564192603578,3917527216758305311,524288 --field-trial-handle=2092,i,1240282367351658823,7140068712514421785,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2788 /prefetch:13
  2⤵
  PID:660
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=2964,i,5099972899666872567,7969721960457808338,2097152 --field-trial-handle=2092,i,1240282367351658823,7140068712514421785,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2976 /prefetch:1
  2⤵
  PID:3812
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=2972,i,11521893223967176556,790571460341625084,2097152 --field-trial-handle=2092,i,1240282367351658823,7140068712514421785,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3104 /prefetch:1
  2⤵
  PID:1456
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4088,i,10617327919509897513,4268402894816541454,2097152 --field-trial-handle=2092,i,1240282367351658823,7140068712514421785,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4104 /prefetch:9
  2⤵
  PID:1264
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4656,i,16405671291680880979,8357117784351539595,2097152 --field-trial-handle=2092,i,1240282367351658823,7140068712514421785,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4768 /prefetch:1
  2⤵
  PID:2664
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5728,i,4569876306361207174,519190904043117582,524288 --field-trial-handle=2092,i,1240282367351658823,7140068712514421785,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5716 /prefetch:14
  2⤵
  PID:3764
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5764,i,17349046602915133538,8659693533481176815,524288 --field-trial-handle=2092,i,1240282367351658823,7140068712514421785,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5860 /prefetch:14
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - NTFS ADS
  PID:5568
- C:\Users\Admin\Downloads\TheRetroProject-Setup.exe
  "C:\Users\Admin\Downloads\TheRetroProject-Setup.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:6020
- - C:\Users\Admin\AppData\Local\Temp\is-1VL4UJ2I0A.tmp\TheRetroProject-Setup.tmp
    "C:\Users\Admin\AppData\Local\Temp\is-1VL4UJ2I0A.tmp\TheRetroProject-Setup.tmp" /SL5="$1A022C,120687672,931840,C:\Users\Admin\Downloads\TheRetroProject-Setup.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:5680
  - - C:\Windows\system32\netsh.exe
      "C:\Windows\system32\netsh.exe" advfirewall firewall delete rule name="Retro Project Player"
      4⤵
      Modifies Windows Firewall
      Event Triggered Execution: Netsh Helper DLL
      PID:4364
  - - C:\Windows\system32\netsh.exe
      "C:\Windows\system32\netsh.exe" advfirewall firewall add rule name="Retro Project Player" dir=in action=allow program="C:\Retronaga\engine\retro-player.exe" enable=yes profile=any
      4⤵
      Modifies Windows Firewall
      Event Triggered Execution: Netsh Helper DLL
      PID:4696
  - - C:\Windows\system32\netsh.exe
      "C:\Windows\system32\netsh.exe" advfirewall firewall add rule name="Retro Project Player" dir=out action=allow program="C:\Retronaga\engine\retro-player.exe" enable=yes profile=any
      4⤵
      Modifies Windows Firewall
      Event Triggered Execution: Netsh Helper DLL
      PID:3320
  - - C:\Windows\system32\netsh.exe
      "C:\Windows\system32\netsh.exe" advfirewall firewall add rule name="Retro Project Player" dir=in action=allow program="C:\Retronaga\engine\pcsx2-qt.exe" enable=yes profile=any
      4⤵
      Modifies Windows Firewall
      Event Triggered Execution: Netsh Helper DLL
      PID:4164
  - - C:\Windows\system32\netsh.exe
      "C:\Windows\system32\netsh.exe" advfirewall firewall add rule name="Retro Project Player" dir=out action=allow program="C:\Retronaga\engine\pcsx2-qt.exe" enable=yes profile=any
      4⤵
      Modifies Windows Firewall
      Event Triggered Execution: Netsh Helper DLL
      PID:6064
  - - C:\Retronaga\The Retro Project.exe
      "C:\Retronaga\The Retro Project.exe"
      4⤵
      Executes dropped EXE
      Checks whether UAC is enabled
      Checks processor information in registry
      Suspicious use of WriteProcessMemory
      PID:3128
    - - C:\Windows\system32\netsh.exe
        
        netsh advfirewall firewall show rule "name=Retro Project Player"
        5⤵
        Modifies Windows Firewall
        Event Triggered Execution: Netsh Helper DLL
        
        PID:5920
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name="The Retro Project.exe" --webview-exe-version=1.3.0.0 --user-data-dir="C:\Users\Admin\AppData\Roaming\The Retro Project.exe\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --use-fake-ui-for-media-stream --mojo-named-platform-channel-pipe=3128.4784.4160134257151236550
        5⤵
        Enumerates system info in registry
        Modifies data under HKEY_USERS
        Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        Suspicious use of WriteProcessMemory
        
        PID:712
      - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\The Retro Project.exe\EBWebView" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\The Retro Project.exe\EBWebView\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0x170,0x174,0x178,0x14c,0x128,0x7ffafd50b078,0x7ffafd50b084,0x7ffafd50b090
        6⤵
        
        PID:5872
      - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\The Retro Project.exe\EBWebView" --webview-exe-name="The Retro Project.exe" --webview-exe-version=1.3.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1700,i,13928708198156854370,2535094029490974745,262144 --variations-seed-version --mojo-platform-channel-handle=1692 /prefetch:2
        6⤵
        
        PID:3700
      - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\The Retro Project.exe\EBWebView" --webview-exe-name="The Retro Project.exe" --webview-exe-version=1.3.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=1988,i,13928708198156854370,2535094029490974745,262144 --variations-seed-version --mojo-platform-channel-handle=2020 /prefetch:11
        6⤵
        
        PID:5228
      - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\The Retro Project.exe\EBWebView" --webview-exe-name="The Retro Project.exe" --webview-exe-version=1.3.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2292,i,13928708198156854370,2535094029490974745,262144 --variations-seed-version --mojo-platform-channel-handle=2300 /prefetch:13
        6⤵
        
        PID:2924
      - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\The Retro Project.exe\EBWebView" --webview-exe-name="The Retro Project.exe" --webview-exe-version=1.3.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --use-fake-ui-for-media-stream --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3692,i,13928708198156854370,2535094029490974745,262144 --variations-seed-version --mojo-platform-channel-handle=3728 /prefetch:1
        6⤵
        
        PID:760
      - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\The Retro Project.exe\EBWebView" --webview-exe-name="The Retro Project.exe" --webview-exe-version=1.3.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=3988,i,13928708198156854370,2535094029490974745,262144 --variations-seed-version --mojo-platform-channel-handle=4084 /prefetch:12
        6⤵
        
        PID:2560
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=212,i,2932418413557786621,4487224765453888237,524288 --field-trial-handle=2092,i,1240282367351658823,7140068712514421785,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3920 /prefetch:14
  2⤵
  PID:1116
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4932,i,13406179288013717147,16145820921150689233,524288 --field-trial-handle=2092,i,1240282367351658823,7140068712514421785,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3808 /prefetch:14
  2⤵
  PID:5916
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5764,i,3274284535013117734,5186340313710939270,524288 --field-trial-handle=2092,i,1240282367351658823,7140068712514421785,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6140 /prefetch:14
  2⤵
  PID:1460

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1160

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:3412

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc
1⤵
PID:6136

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Discovery

Browser Information Discovery

T1217

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

The Retro Project.exe

Path C:\Retronaga\The Retro Project.exe
Size 16.4MB
SHA256 2bc22c42a556e08fff8ca8dbe7525f565996ca69cdae76f6ac17053a8106bb18
MD5 0049097b406e58e6b07f82446d2cf132
SHA1 17cd694e4594a135039970037d9ccb125c20c344
SHA512 f122a9bc5fbf6adb90ba26c10a0c11f4b4ba61ed4ce799c83699a96ca14025d27b87191c3a55fc8cab56bb7afe7c6b435a205aa118ada5742be080a96e125f54
SSDEEP 196608:5+FAJ2lE46A0cOo9hgv7jK86CuDWjbbuzYHzUxu9ClDHM:57J2IAhBY7pyWjbbJUxIC
TLSH
T1EA07BE17EE9408E9C9BEC13089725223BB717C4A172523D73B50F2282FBABD45DB9794
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 15888478c5e173be2765d36bae3c6c252b756cf18a31bfc5e6e2710ee68d4e9b
MD5 5aaacdca1a4d16460d464afc53baad7d
SHA1 f7e0c7598eb348975f6d24faf79d52153f6fbbcc
SHA512 d206c82a8c828c452f5490504ab37918502b53ecbe0ed0099053dc540dae3d6194f5b09535dd274bba2a5be3e4cc9be5744fa22317d01916ca2573e23777ff0d
TLSH
T140E02BA9D826EC3B08FD2B2A50504787FB5013171740895F3A3C91198FB163E4586D5C
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 1f424a731a124226f30da4ddc82be3502f4fd8137da787c65b7f63999bfea3a8
MD5 a17b21b4a96f46395825a6ec8c2eaeec
SHA1 a60a7797532ffaac3a2944d022df2b953fc7d947
SHA512 e21626150ed7185ca54b75fccf173e349f9d4151da5e842d9798a646d81a49c98c2b3fdddfe37727da96325f265aca87f22084ff705784b16d9e4d4e09e5175d
TLSH
T1B1517BF783B4897D8A1196F4AA15AE1FDE6D0924031D3CA688D4AE1B53F2872D20434F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 57db2483d13f30c77f3fce52ca1475f1ade8c40ff10698c01ee3d0eb93f77915
MD5 68143d34455ddaacd6653ba0ab766c6d
SHA1 15b99dad9bda08ba9ec22ab7a029baa30953c147
SHA512 3b7f1ff67529621cb239c9fb3b86dc709fb039f1d4c1e0872898744f6b2b462f657533468ca118a2f10771ac76f32acb989d1a4ca1ef97bcde5ef84a64c005ae
SSDEEP 192:pR+e7G8WWAv75pAPRp2FZ98Hsb+WNGgApQSAoas02Rknwe5iwnaHmVyIsnAUgE:pR+eyecVUXAuwqQGq2GnraeE
TLSH
T1B352B52EE914697B6DDBC21AFA267767E3F6102121D02E40E6FCC92C15E7ADC221711B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 f1ab05ffaf04aa6ab6fdbe3922de27c1c14504861bbcbe9ad53344a31b2a11a7
MD5 69d0ffd559e602ee53386ce1f55d6468
SHA1 4aed8439a87383342777e317e6f23ca114c988f2
SHA512 a1b30d3135256ccb296951bbfd24c92d996641e4ac711630e1390cfaa201d7895b5886ed6ee382aa35d908cee8cb145ae0229d471ccaca135f44d618c07ee874
SSDEEP 192:pR+77G8WWAv75pAPRp2FZ98Hsb+WNGgAp/s02Qknwe5iwnaHCVyIsnAUge:pR+7yecVUXAuwqD2pnraie
TLSH
T10E42C62EFE14697B5DDBC22AFA267767D3F6102121D02D80E6FC892C14E7ADC221711B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 6580b9be38e043e5d2436ff4ae9296f74b369cbea58296d9af5604bd4b1cc474
MD5 64d379491386bdf9d2b82bfed49740e5
SHA1 522dcfd2f4d188bbcad58538c6461f8bbd43b2e9
SHA512 5d58b317ff66bb8f8373e7f5972247e20a553af50c4ad2756a022edf34ee0bb5688a058056e953d457420c82cddb02044d6062aa1788af614d0c7bcf05ddc3bf
SSDEEP 384:ywjuJ7KxkXqKf/pUZNCgVLH2Hfgslu17pLuLcSjwxXODuh+ErU37PHG7iK:y0uJ7KxkXqKf/pUZNCgVLH2Hfgsc17pV
TLSH
T10B72FA67BC4C9E370F94CA8CD9167F4FADF5024A65E9886482FA9C2503D5BCA11092FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 c9b61f2168ec731fb4b6ff35c9c016cb798876161f31001a98331fd7a807f1b0
MD5 54ab63ef7cacf29235a40af1865856df
SHA1 cd94b882b99a79a0576be179006d3c0cd9dc8220
SHA512 9f990976a09e2ffaa2170a3f28e2b6fd2d0297ef8eec7e6cb725ac9b46055f3c5a47479baaa9d9e8f2eb9f86dec71935e632b4c6b4fb06d05ea2184316fcdf7b
TLSH
T130B0128080816101C00706F4154228D871D99F10BE0A1B0163E06D6A88261608115091
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58a090.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58a090.TMP
Size 96B
SHA256 3bcd0005a0bf57f067dc013c9c962f1a58107b3a375d54403ae48a5924590f58
MD5 d884479f5e4563cd8b525664c27153cb
SHA1 672578071a7c27559314b3232f91f519c8c8eb33
SHA512 567b958f306ea9584a95444d155e883980a4b910756e8b5cde543c58d7cae80ce96a5fe9ecd14d4fda95ee377d9e12aca19e9275727875b0079c048e6a44b365
TLSH
T1A1B02200C0022A03C00303B028C0C8C8B020CF20C303020A82F02B22CCBB2B00A23E30
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 5922654541336d67a96010c2b57ea454d372a776c861569951cb6f875a12f300
MD5 76642a7e46b1939e81a4e3535a025194
SHA1 f90b931f096d886b57967d8812cd7b5c63dc6351
SHA512 f93bf9d1afa964c2d51f28a8e9f15297cb948ade55edf81f360251a397177dd3da257f66abdbc4df3b59b0a55612ea4fe9023d93fac078ecb611021b8adafee3
SSDEEP 3072:SuGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMF:Spm7Rkm1tYpBeh2BAoF
TLSH
T117C3123B5D74A8774DB5BB1EB04E0E1F1DF249A7CD20ED92C8D85A0463EABDC0A45A34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 b95dde171414f2e8f057ee89e8cca772dae1160a6017417c6ba31d3cf1b9c1f7
MD5 66c5b394981448141a1943c6b77014b6
SHA1 3caeabec3f659f47afc8d9db0dcb020bc6760512
SHA512 1e8f7e2d046c53dd37e130f1c54513ca2cb22df72b88090f94bc290fb8da46a2c0cadfbf523d4477f04623e5b8f45cedcefbbade3f4884c4f40408e4fddfdcda
SSDEEP 3072:iGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMF:Vm7Rkm1tYpBeh2BAoF
TLSH
T170C3123B5D70E97759B8BB4EB08E0B1E1EF149A6C930DE92C8D85A0477F97DC0A04A34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 222d0e905d94216e292a7e5f7e9b374904ba2bae510ec00c77f480ac3860163e
MD5 1c9ef01a1d17152791f7afcf6bd555b3
SHA1 57a44cc617a426d2f9e357d10b0c33a223c951c0
SHA512 8d9ff3f072160f9432d84c49f54734cdeac913aaadf666a0c800f40dbce67fb0427b9d873097dedc90371a9066c3c775f7c69eed0ae6c13217a25083a9d0047a
SSDEEP 3072:K6Gm7D5Lk17ox1tIpud63U8BehbCBi9fTrMF:Kdm7Rkm1tYpBeh2BAoF
TLSH
T142C3123B5DB4F87659B5BB1EB04E0A1F1EF149A3CD20DE92C8D85A0473EA7DC0A45A34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 224e9c4161453670ce27fb52c2ca3c0b3e53dc83205a60cd3f04af60b2d9b021
MD5 c9903cc8eb46d9c0a7d7956c757ff371
SHA1 c2bbcc4d6967f20b657e91584e280f0572e534b3
SHA512 248c9671ae98442788d86f1748d62fef9a49f44b55fec00afbf99dcc0f8530618926d514ada6d0ff83fd9a880cdf3fdb8a1e88b9fecec567eec0ee55911350c5
SSDEEP 3072:lKGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMF:lNm7Rkm1tYpBeh2BAoF
TLSH
T14FC3123B5D74A8774DB5BB1EB04E0E1F1DF249A7CD20EE92C8D85A0463E9BDC0A45A34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 5caf27327ba1fd79ec3ec77a8a47ff9fdae8295e6892d879b85df54e355853ca
MD5 3e9fe16b4e8629bc0691bf4dc03642a4
SHA1 2204aaf2542475a4c3cd9482b79b1342ea1d9868
SHA512 029074ab91c6078089e1d719dd5a9308e386dbc6ba17b222831bac837b23ed588d06f87c1d727646702cfc0f944fee2a591dcabb9b2d6efc94216bb0022b4cc2
SSDEEP 3072:z6Gm7D5Lk17ox1tIpud63U8BehbCBi9fTrMF:zdm7Rkm1tYpBeh2BAoF
TLSH
T119C3122B5DB4F87659B5BB1EB04E0A1F1EF149A3CD20DE92C8D85A0473EA7DC0A45A34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TheRetroProject-Setup.tmp

Path C:\Users\Admin\AppData\Local\Temp\is-1VL4UJ2I0A.tmp\TheRetroProject-Setup.tmp
Size 4.2MB
SHA256 8c2e6933aeb7fa2dd18ba3ca623c18e030a5c2222e893f1e75b2b6fed267b98a
MD5 154c6d49ded7281f642eac0e6e5f1a43
SHA1 c309fe9e8801cb6a7e66f9a9be73fad37b72f8e7
SHA512 82393c800168562f6e779aa67f4606478e6a2d1d16c8eb7da9b923c5de6b4409b5a1eb54018455bc63fc8f3ad8cf43527233ff626d2fc3f78236f325c77b7f25
SSDEEP 98304:P9SZUvl30aj90ZFcvdQ0hdgvminQLMj+J/333ZFoM:8ItJj90Z6RgKwAb
TLSH
T1B3268F03B388753EE4B71A3A883FA654583F7A213A26CD4B6BF40D5C4F396416D2A747
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Roaming\The Retro Project.exe\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 a963a7be57166e38a518aba62af5bc65490194ddf0937b5231833ede55f629ae
MD5 60c306fd6467669c1b66fe6d106e5ef5
SHA1 c3e1faa37d55ca8013193f347b169b18bd777c2c
SHA512 96d6c84182bb00f82a959012416cae224c2eac62a5dca52748753a08c6fa03d9a0676be0a6c3ae4c013dfdf0c414e5d3cc78f2eccf51a3cc5c0f9a93774fa871
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Roaming\The Retro Project.exe\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 9d42f713ae6940e82e33d011eff7a15016a4f4cfccfdf8289bb4f3b872283649
MD5 e00331617c38245bf4cf4d10a3cbe6c6
SHA1 20c4cff52bfeddf36b527b3a2ff026f19c815656
SHA512 56485ee14977f004918cf87da1b6f659cccabbae2734dc9a0c417ad8142bccb673444bd42773b3f5c4619f98d509a45b0e960fe1492358945bcd73950e6d4588
TLSH
T1B3D012367605097CC47024330112710D0400E22F41054001542C8A6D1A080D00912846
MD5 SHA1 SHA512 TLSH

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Roaming\The Retro Project.exe\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

f_000002

Path C:\Users\Admin\AppData\Roaming\The Retro Project.exe\EBWebView\Default\Cache\Cache_Data\f_000002
Size 63KB
SHA256 c3ab5184e5f2eba9bdffe08632aa4573b9122e97d013d22e58e79e08ba2ad3eb
MD5 7dd33bd61f651da48212d7d4efa5c426
SHA1 1039e684d899e808f07ee8b087e021381bfebe61
SHA512 474b80bcf9b00b6c5e3227929e5676f98ce2d54304b44490e716dd40ceed93a1c678dd08c94489eab21a871b9a232c4806cf0ca4a9ed8c3045647c0d44c1b01e
SSDEEP 1536:+Epxgl0xDmhu5TlGt4O0ELt8Bu/8SoPuk43GJEvEjAG:Na0xDm+xw4Ott4uUY32E0R
TLSH
T1EB5302DBCF5261C47F29E67591243DD53BA5D3C2878266EE14A207D3B128900B46F663
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Roaming\The Retro Project.exe\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 72B
SHA256 b7b717f72a10e643e445490ec480ec6220252155f45c89f070dd29f0f8135360
MD5 c3e220f91a0de23593a6e3994d76fc93
SHA1 e8c3821cd54a682ed7b67833c77a7480a47e57c4
SHA512 fddcaa4543f1e65a887f19814c6a912d97a7c952f6b7f431f3bc868a475ed9bc743dab968af42b8f577c0d626a1e2d8d5171e643598367d901b7233666e05749
TLSH
T184A002E4D6D1091DDE2483B2205136D563554CB54121575B40E4288B989B9D08513189
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Roaming\The Retro Project.exe\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 48B
SHA256 0f99fdfc4aed0b9cef79018e1fecc658919f8bd36c305c4ecb5ca53600a7f32f
MD5 3e54662eedc99bbee43d4eaf127176f4
SHA1 4678e66125a7574ed8342bf9bde618ae8f6c18ed
SHA512 90cc1a8d76f1ec8e806e90e485dbf8e9c3ece2a5a85f12f4234ad2ae1426b459b49043fe5a6a6a21d58d0c02eebf40a7c6fafb27d2dcfabbcd64f984b00236a2
MD5 SHA1 SHA512

Submit Download

data_1

Path C:\Users\Admin\AppData\Roaming\The Retro Project.exe\EBWebView\Default\DawnGraphiteCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_0

Path C:\Users\Admin\AppData\Roaming\The Retro Project.exe\EBWebView\Default\DawnWebGPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Roaming\The Retro Project.exe\EBWebView\Default\DawnWebGPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Roaming\The Retro Project.exe\EBWebView\Default\DawnWebGPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Roaming\The Retro Project.exe\EBWebView\Default\Extension Scripts\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Roaming\The Retro Project.exe\EBWebView\Default\Preferences
Size 6KB
SHA256 cc03fa8f2ccc9d93b95bdad55199354f02cabe75971ccf6b5acce9a40b99c524
MD5 e602684aadf2e5c409ba7fd0bc9355c0
SHA1 6c4799b7485c4fc7b583430f7311dde5dac04a76
SHA512 e21a9b372989f9c3360ea9f5b56100f1632f7b3e1a6c3c338241fca078a0a39f4ae016a0785a706a770f80bfe0219c827bdc38811b3fbb2666feabbfddcfb2cd
SSDEEP 96:sto05lHnUsb9WLffQZ8i0vhEckQbm/7qx+WVHMSm+uec90CjMdQjZ+gkFMEB:sto07gLf4Z8paiK/S+WiP0CodYSFM8
TLSH
T14AD1C8065F68797B4CCBF6197A35BB52D2FA102265D50E9CEBFC861C08E66CC630790B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Roaming\The Retro Project.exe\EBWebView\Default\Preferences
Size 6KB
SHA256 23e23741ff084aedebc2ffb617bca16ae3ac746b53ab6f9701031b9e5580b0a2
MD5 e93223fcdd838908d33ed82626fa72bf
SHA1 e4dbb7dbaaed9cf753ddf68c28dbeb187e1926ef
SHA512 f2aa0c8e93dde98add16bcc56f0094afce448e39c999729c75af8b28883c678586a8243334b812c7698cf18992f075e7309d187fbb3a33c9b143ea9be2a45d51
SSDEEP 96:sto05EaHnUsb9WcffQZ8i0vhEckQbm/7qx+WVHMSm+uec9IvMFHdQjZ+g2FMOB:sto0Bgcf4Z8paiK/S+WiPIvqdYAFMC
TLSH
T17EE1C8465F68797B4CCBF6197A35BB52E2FA102261C50E58EBFC871C09E66CC630790B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences~RFe597cd7.TMP

Path C:\Users\Admin\AppData\Roaming\The Retro Project.exe\EBWebView\Default\Preferences~RFe597cd7.TMP
Size 6KB
SHA256 f6ccf66f3abcc20dd7414796aa6e40febde1b4e5adb24b4a9293bb5c4dcebdde
MD5 b69cf2fc8cf0e3ef5424a4a77de74427
SHA1 87ad05cc73d9a6e5b84a8180fa2888432b664163
SHA512 80c37ef676649f06998de515c261a10ab570c947031a29a7c455b6eb7d78ad85bda154f03dca450886b68f7e285f3c0a9e1d7ccae6e72c11b4b7dee25a78f99c
SSDEEP 96:ro05lHnUsb9WLffqdZ8i0oEckQbm/7qx+WVHMSm+uec9KY1idQjZ+gaFMEB:ro07gLfUZ8pFiK/S+WiPKYwdYcFM8
TLSH
T1E9D1B8065F68797B4CCBE2197A35BB52D2FA102165D50E5DEBFC872C08E66CC620B90B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Roaming\The Retro Project.exe\EBWebView\Default\Sync Data\LevelDB\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Roaming\The Retro Project.exe\EBWebView\Local State
Size 4KB
SHA256 aca71c680b9dd09e0ce875ba0ad8c04500b979bf5833e12fcd24dff5373f9791
MD5 cb0a128930426166d44493db95d4804a
SHA1 1d8b99d2f4c5f2fd7a3c051859cf55cad0108851
SHA512 0148b4b96989dffde62ffbc707868bc4ab9ff1ab4b089c691438aff774adc1ec91b8da1df489f8e3cba7c2026f88e034ce4994f5b501fc3b14376200f415fc64
SSDEEP 96:zudDbNkCEFVnVfHjJEww8Frh/cInURoDoto+5cXDHBHesY6h9Z2ZeTClta:z4DbNb23ooDUhQhHeseWv
TLSH
T15691B522A9A8B9374DF3E545B9853B12BBA61123D0947FA9DAEC0F0C01DB38D1303E17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Roaming\The Retro Project.exe\EBWebView\Local State
Size 16KB
SHA256 277a79b5eb11e150f51680a6e1ab12287d81b179a907b54684f2e4eeeaa1fff0
MD5 6e5e12760b0f48ff0d43687ec34453af
SHA1 74f6d667f5c1e6c9e894a855fb93333c88ae73b5
SHA512 4e0db46afc229a23e67d8ca932383bc1e700229ee7ca7a637219848276daaa25611c38fc593173e4f05529cc279bfbb1c8136e812e6123a3692449183525aec0
SSDEEP 384:zo+aQikB+z/xvxjg/qhEwNb4fBbx2U89zk:T/UxvxjgC+5Zx2U8Fk
TLSH
T120728D3B55A97E33A8B3F5057A5C1B5BDAB944A250816EB84EED2F0D02DB3DC0303E16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Roaming\The Retro Project.exe\EBWebView\Local State
Size 1KB
SHA256 39d41a1b6e2e6364fcff50fc585820c4dc9de79024e6fbd8cdbc4f5e676a4dcc
MD5 ffaee481b195357cbe204066399fbd5f
SHA1 c68e6bd07910eb26b0b99cabd0d82bc973e65fb3
SHA512 71604c8e8c64567831b6ecd3b8984af40102c1fb7db8d74f2cc73360cd78388a8f87253e1d34c34c5c89b7bb4459a6234ea64fd7b0e654b03f48ca2014d6c390
TLSH
T1513185B3A8D83772AC96614673453767AE73016A80104F6861DD0B1C02D378CD22BE33
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Roaming\The Retro Project.exe\EBWebView\Local State
Size 2KB
SHA256 bd7dc3c33a1ac3c427b39cdc24413f7238cb0e8fec79c951cc971bcbe65c0473
MD5 dfa1bd98050f9dc6d4f413992bd1e53b
SHA1 b2814718c1aadcf31ca83a0f7839fd250e9593c8
SHA512 df627fde87c393c3abb061d6e18bd8c693aacd7944459953ec45244d7ef0791c7ec1313ba2a741929f51008b2dffb03430bae28502ddc819fc8baddea0a9ea53
TLSH
T14C519273BC88B67389E355447A493B22EE3A026195612F70AADC0B1C01DB79C6307E37
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Roaming\The Retro Project.exe\EBWebView\Local State
Size 3KB
SHA256 d10c6d13158559ec40579ade7012dea66f211ad9efce3919542b164e2b57cbfe
MD5 2e5a9640a4e2628e56a2dae8e9fcf486
SHA1 8861baa163f0155b8a5b1b5288c4c9b9bcbdb896
SHA512 0a835e9130308e56295be9c9841c2f2dcb64f2712aec37f0dd16177e67390a88e01c01c8bb1168e1021fb2a36d6688ae69e34dbfa2694ed63f2244d7dc27de50
TLSH
T17B71833669A8B5374DE3A905B9853B26BAA60227D0913FA8D9EC0F1C01D739C1303E27
MD5 SHA1 SHA512 TLSH

Submit Download

Local State~RFe592c17.TMP

Path C:\Users\Admin\AppData\Roaming\The Retro Project.exe\EBWebView\Local State~RFe592c17.TMP
Size 1KB
SHA256 71ecbf2d2d6ee1ca12b45720ffb75029e777f0dbfcdd37fd6f290c0dd22ee43e
MD5 dd818b53a4812239be089177401c89db
SHA1 dba7a26660ce690e3511a6a93ac0fc321b522239
SHA512 e1c0b9ccce868966c8374ef537c1ec8c51e011ee2f1c8179c14e1569b909803c1007e15ed08cf47ecb7fcf48e3e0c82cd1ce6706b2e7452948ead55d10217fba
TLSH
T1242184B7D8D83672BC865045B345779B7EA6027A81148F28A1DD071C12D77DCD22BE33
MD5 SHA1 SHA512 TLSH

Submit Download

TheRetroProject-Setup.exe:Zone.Identifier

Path C:\Users\Admin\Downloads\TheRetroProject-Setup.exe:Zone.Identifier
Size 150B
SHA256 e9f43f0a907165c223eaa2286f3dc11ca0076c01cca3f8f17530ba558c28a408
MD5 75f4ccec9a60af5c414871e0a10791d5
SHA1 94da45639d390725e4441452b240b0bae5dffd39
SHA512 24ee27b9623e19778c4d0d49021e2178b4f8a2413d32c6ff8e88c7dfa17a076950d881c5d49f32a9ee236ed7d8ab240117270ffc477ad5d1d62a82343370d5b0
TLSH
T140C09B578400CC185BE451FC279DBB1CF54F3D484C6B7275DE41C1C258C5296E75C523
MD5 SHA1 SHA512 TLSH

Submit Download

memory/760-788-0x00007FFB209D0000-0x00007FFB209D1000-memory.dmp

Download

memory/3128-1090-0x00007FF7AF1B0000-0x00007FF7B2272000-memory.dmp

Download

memory/3128-917-0x00007FF7AF1B0000-0x00007FF7B2272000-memory.dmp

Download

memory/3128-1116-0x00007FF7AF1B0000-0x00007FF7B2272000-memory.dmp

Download

memory/3128-1008-0x00007FF7AF1B0000-0x00007FF7B2272000-memory.dmp

Download

memory/3700-664-0x00007FFB209D0000-0x00007FFB209D1000-memory.dmp

Download

memory/5680-102-0x00000000033A0000-0x00000000033A1000-memory.dmp

Download

memory/5680-631-0x0000000000A80000-0x0000000000ECD000-memory.dmp

Download

memory/5680-613-0x0000000000A80000-0x0000000000ECD000-memory.dmp

Download

memory/5680-113-0x0000000000A80000-0x0000000000ECD000-memory.dmp

Download

memory/5680-114-0x00000000033A0000-0x00000000033A1000-memory.dmp

Download

memory/6020-112-0x0000000000650000-0x0000000000742000-memory.dmp

Download

memory/6020-97-0x0000000000650000-0x0000000000742000-memory.dmp

Download

memory/6020-632-0x0000000000650000-0x0000000000742000-memory.dmp

Download