f25ac4aed0f36abdb2f0ea2cdb67e4249d7d70467718f718445559cf4e0ffd89

Analysis

user interaction
yes
max time kernel
150s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
06/08/2026, 22:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Retrac_3.0.8_x64_en-US (1).msi
Size 14.4MB
Sample260806-1xt63sbl2s
SHA256 f25ac4aed0f36abdb2f0ea2cdb67e4249d7d70467718f718445559cf4e0ffd89
MD5 965f3d0bff58a004b2642bf6d637dedc
SHA1 1c65936cb7545559f090173a494ff1bc2839f1eb
SHA512 68baec2ebd5d6b4eecc6190eb02265572ed952f609423399d5cb5e3f7dd43c8c0e005491bd52be72fdb289f700cfcadee33caea80ca30bf7f5cd5b60fcd2f28d
SSDEEP 393216:Xgwqa+Wmti6d4hGDOQ1X0ADGK/pC6HuAhUO2bJRA:wwc1fdMvFADZ/pCJAhUFN+
TLSH
T151E633873D96DB11C8A21D7A44BBC3A822387D400624D9A777DCB82DDEF23C095769DE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery ransomware spyware trojan

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
6740	retrac.exe

Loads dropped DLL 1 IoCs

pid	Process
3108	MsiExec.exe

Badlisted process makes network request 1 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
4	6080	msiexec.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	retrac.exe

Contacts third-party web service commonly abused for C2 1 TTPs 5 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
59	discord.com
60	discord.com
62	discord.com
69	discord.com
76	discord.com

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files\Retrac\retrac.exe	msiexec.exe
File created	C:\Program Files\Retrac\Uninstall Retrac.lnk	msiexec.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\Installer\{F2567F58-5A4A-4F82-886D-ED5C11F380BE}\ProductIcon	msiexec.exe
File created	C:\Windows\SystemTemp\msedge_url_fetcher_4636_1191921700\GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_108_1_0.crx	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4636_1089528577\service_worker_bin_prod.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4636_1089528577\_locales\sr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4636_1089528577\_locales\mr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4636_1089528577\_locales\th\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4636_1089528577\_locales\pl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4636_1089528577\_locales\az\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4636_1089528577\page_embed_script.js	msedge.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File opened for modification	C:\Windows\Installer\{F2567F58-5A4A-4F82-886D-ED5C11F380BE}\ProductIcon	msiexec.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4636_1089528577\_locales\ml\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4636_1089528577\_locales\sk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4636_1089528577\_locales\my\messages.json	msedge.exe
File created	C:\Windows\Installer\SourceHash{F2567F58-5A4A-4F82-886D-ED5C11F380BE}	msiexec.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4636_1089528577\_locales\de\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4636_1089528577\_locales\ro\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4636_1089528577\_locales\tr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4636_1089528577\_locales\is\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4636_1089528577\_locales\hr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4636_1089528577\_locales\ca\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4636_1089528577\_locales\it\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4636_1089528577\_locales\en_US\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4636_1089528577\_locales\gl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4636_1089528577\_locales\sl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4636_1089528577\_locales\lo\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4636_1089528577\_locales\si\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4636_1089528577\_locales\af\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4636_1089528577\_locales\ru\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4636_1089528577\_locales\pt_PT\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4636_1089528577\_locales\fr_CA\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4636_1089528577\_locales\nl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4636_1089528577\_locales\fi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4636_1089528577\_locales\ta\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4636_1089528577\_locales\hu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4636_1089528577\_locales\ms\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4636_1089528577\_locales\zh_TW\messages.json	msedge.exe
File created	C:\Windows\Installer\e59c1ef.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e59c1ef.msi	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4636_1089528577\offscreendocument_main.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4636_1089528577\_locales\te\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4636_1089528577\_locales\sv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4636_1089528577\_locales\id\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4636_1089528577\_locales\en_GB\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4636_1089528577\_locales\el\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4636_1089528577\_locales\pt_BR\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4636_1089528577\_locales\en_CA\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4636_1089528577\_locales\da\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4636_1089528577\_locales\zh_CN\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4636_1089528577\_locales\lv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4636_1089528577\_locales\uz\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4636_1089528577\_locales\et\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\~DFF2B0F80EC18F5516.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4636_1089528577\_locales\sw\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4636_1089528577\_locales\uk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4636_1089528577\offscreendocument.html	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4636_1089528577\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\Installer\e59c1f1.msi	msiexec.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4636_1089528577\_locales\no\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4636_1089528577\_locales\zh_HK\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4636_1089528577\_locales\es_419\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4636_1089528577\_locales\ka\messages.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies trusted root certificate store through registry 1 TTPs 2 IoCs

A root certificate was added, modified, or removed in the trusted certificate store registry paths.

defense_evasion

Install Root Certificate

T1553.004

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 6b000000010000002000000096bcec06264976f37460779acf28c5a7cfe8a3c0aae11a8ffcee05c0bddf08c61900000001000000100000002fe1f70bb05d7c92335bc5e05b984da6030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f6314000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e20000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	retrac.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 5c00000001000000040000000010000014000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e0f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f63030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e81900000001000000100000002fe1f70bb05d7c92335bc5e05b984da66b000000010000002000000096bcec06264976f37460779acf28c5a7cfe8a3c0aae11a8ffcee05c0bddf08c620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	retrac.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5788	msedge.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000392849c4232396370000000000000000000000000000000000000000000000000000000000000000000000000000000000001071020000000000c0120000000000000000000000002701010000883801392849c40000000000001071020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d0830200000000006025c501000000000000000000000700010000e84101392849c4000000000000d08302000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9c701000000000000050000000000000000000000070001000098d4e3392849c400000000000030a9c7010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9cc0100000000000005000000000000000000000007000100009854e6392849c400000000000030a9cc01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe

Modifies data under HKEY_USERS 12 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134305274542138220"	msedge.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe

Modifies registry class 48 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\85F7652FA4A528F488D6DEC5113F08EB\Version = "50331656"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\85F7652FA4A528F488D6DEC5113F08EB\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\retrac\shell\open	retrac.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1014449518-1831897916-4205727055-1000\{5D9071C5-229B-404F-BF2A-08D1EEEA8557}	msedge.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\85F7652FA4A528F488D6DEC5113F08EB\AuthorizedLUAApp = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\D39F67BF21D37C75581F63A03A3CC6BF	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\retrac\ = "URL: protocol"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\retrac	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\retrac\shell	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\85F7652FA4A528F488D6DEC5113F08EB\External	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\85F7652FA4A528F488D6DEC5113F08EB\SourceList\Media	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\85F7652FA4A528F488D6DEC5113F08EB\Clients = 3a0000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\D39F67BF21D37C75581F63A03A3CC6BF\85F7652FA4A528F488D6DEC5113F08EB	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\retrac	retrac.exe
Key created	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\retrac\shell\open\command	retrac.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\retrac\shell\open\command\ = "\"C:\\Program Files\\Retrac\\retrac.exe\" \"%1\""	retrac.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1014449518-1831897916-4205727055-1000\{42777C90-2B42-475B-B3A2-702EBC0B082F}	msedge.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\85F7652FA4A528F488D6DEC5113F08EB\MainProgram	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\retrac\URL Protocol	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\retrac\DefaultIcon	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\retrac\DefaultIcon\ = "\"C:\\PROGRA~1\\Retrac\\retrac.exe\",0"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\retrac\shell\open\command	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\85F7652FA4A528F488D6DEC5113F08EB\Environment = "MainProgram"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\85F7652FA4A528F488D6DEC5113F08EB\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\85F7652FA4A528F488D6DEC5113F08EB	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\85F7652FA4A528F488D6DEC5113F08EB\ShortcutsFeature = "MainProgram"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\85F7652FA4A528F488D6DEC5113F08EB	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\85F7652FA4A528F488D6DEC5113F08EB\ProductName = "Retrac"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\85F7652FA4A528F488D6DEC5113F08EB\SourceList\PackageName = "Retrac_3.0.8_x64_en-US (1).msi"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\85F7652FA4A528F488D6DEC5113F08EB\SourceList\Media\1 = ";"	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\retrac\URL Protocol	retrac.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\retrac\DefaultIcon\ = "C:\\Program Files\\Retrac\\retrac.exe,0"	retrac.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\85F7652FA4A528F488D6DEC5113F08EB\Assignment = "1"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\85F7652FA4A528F488D6DEC5113F08EB\ProductIcon = "C:\\Windows\\Installer\\{F2567F58-5A4A-4F82-886D-ED5C11F380BE}\\ProductIcon"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\85F7652FA4A528F488D6DEC5113F08EB\DeploymentFlags = "3"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\retrac\shell\open\command	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\retrac\shell\open\command\ = "\"C:\\PROGRA~1\\Retrac\\retrac.exe\" \"%1\""	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\85F7652FA4A528F488D6DEC5113F08EB\PackageCode = "6AFF5C71F42D1914DA5EF303DCA200A2"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\85F7652FA4A528F488D6DEC5113F08EB\Language = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\85F7652FA4A528F488D6DEC5113F08EB\SourceList	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\retrac\shell\open	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\85F7652FA4A528F488D6DEC5113F08EB\AdvertiseFlags = "388"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\85F7652FA4A528F488D6DEC5113F08EB\InstanceType = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\85F7652FA4A528F488D6DEC5113F08EB\SourceList\Net	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\retrac\ = "URL:launcher.retrac.site protocol"	retrac.exe
Key created	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\retrac\DefaultIcon	retrac.exe
Key created	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\retrac\shell	retrac.exe
Key created	\REGISTRY\MACHINE\Software\Classes\retrac	msiexec.exe

Modifies system certificate store 2 TTPs 1 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8	retrac.exe

Suspicious behavior: EnumeratesProcesses 48 IoCs

pid	Process
7056	msiexec.exe
7056	msiexec.exe
6740	retrac.exe
6740	retrac.exe
6740	retrac.exe
6740	retrac.exe
6740	retrac.exe
6740	retrac.exe
6740	retrac.exe
6740	retrac.exe
6740	retrac.exe
6740	retrac.exe
6740	retrac.exe
6740	retrac.exe
6740	retrac.exe
6740	retrac.exe
6740	retrac.exe
6740	retrac.exe
6740	retrac.exe
6740	retrac.exe
6740	retrac.exe
6740	retrac.exe
6740	retrac.exe
6740	retrac.exe
6740	retrac.exe
6740	retrac.exe
6740	retrac.exe
6740	retrac.exe
6740	retrac.exe
6740	retrac.exe
6740	retrac.exe
6740	retrac.exe
6740	retrac.exe
6740	retrac.exe
6740	retrac.exe
6740	retrac.exe
6740	retrac.exe
6740	retrac.exe
6740	retrac.exe
6740	retrac.exe
6740	retrac.exe
6740	retrac.exe
6740	retrac.exe
6740	retrac.exe
6740	retrac.exe
6740	retrac.exe
6740	retrac.exe
6740	retrac.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
5672	msedgewebview2.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	6080	msiexec.exe
Token: SeIncreaseQuotaPrivilege	6080	msiexec.exe
Token: SeSecurityPrivilege	7056	msiexec.exe
Token: SeCreateTokenPrivilege	6080	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	6080	msiexec.exe
Token: SeLockMemoryPrivilege	6080	msiexec.exe
Token: SeIncreaseQuotaPrivilege	6080	msiexec.exe
Token: SeMachineAccountPrivilege	6080	msiexec.exe
Token: SeTcbPrivilege	6080	msiexec.exe
Token: SeSecurityPrivilege	6080	msiexec.exe
Token: SeTakeOwnershipPrivilege	6080	msiexec.exe
Token: SeLoadDriverPrivilege	6080	msiexec.exe
Token: SeSystemProfilePrivilege	6080	msiexec.exe
Token: SeSystemtimePrivilege	6080	msiexec.exe
Token: SeProfSingleProcessPrivilege	6080	msiexec.exe
Token: SeIncBasePriorityPrivilege	6080	msiexec.exe
Token: SeCreatePagefilePrivilege	6080	msiexec.exe
Token: SeCreatePermanentPrivilege	6080	msiexec.exe
Token: SeBackupPrivilege	6080	msiexec.exe
Token: SeRestorePrivilege	6080	msiexec.exe
Token: SeShutdownPrivilege	6080	msiexec.exe
Token: SeDebugPrivilege	6080	msiexec.exe
Token: SeAuditPrivilege	6080	msiexec.exe
Token: SeSystemEnvironmentPrivilege	6080	msiexec.exe
Token: SeChangeNotifyPrivilege	6080	msiexec.exe
Token: SeRemoteShutdownPrivilege	6080	msiexec.exe
Token: SeUndockPrivilege	6080	msiexec.exe
Token: SeSyncAgentPrivilege	6080	msiexec.exe
Token: SeEnableDelegationPrivilege	6080	msiexec.exe
Token: SeManageVolumePrivilege	6080	msiexec.exe
Token: SeImpersonatePrivilege	6080	msiexec.exe
Token: SeCreateGlobalPrivilege	6080	msiexec.exe
Token: SeCreateTokenPrivilege	6080	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	6080	msiexec.exe
Token: SeLockMemoryPrivilege	6080	msiexec.exe
Token: SeIncreaseQuotaPrivilege	6080	msiexec.exe
Token: SeMachineAccountPrivilege	6080	msiexec.exe
Token: SeTcbPrivilege	6080	msiexec.exe
Token: SeSecurityPrivilege	6080	msiexec.exe
Token: SeTakeOwnershipPrivilege	6080	msiexec.exe
Token: SeLoadDriverPrivilege	6080	msiexec.exe
Token: SeSystemProfilePrivilege	6080	msiexec.exe
Token: SeSystemtimePrivilege	6080	msiexec.exe
Token: SeProfSingleProcessPrivilege	6080	msiexec.exe
Token: SeIncBasePriorityPrivilege	6080	msiexec.exe
Token: SeCreatePagefilePrivilege	6080	msiexec.exe
Token: SeCreatePermanentPrivilege	6080	msiexec.exe
Token: SeBackupPrivilege	6080	msiexec.exe
Token: SeRestorePrivilege	6080	msiexec.exe
Token: SeShutdownPrivilege	6080	msiexec.exe
Token: SeDebugPrivilege	6080	msiexec.exe
Token: SeAuditPrivilege	6080	msiexec.exe
Token: SeSystemEnvironmentPrivilege	6080	msiexec.exe
Token: SeChangeNotifyPrivilege	6080	msiexec.exe
Token: SeRemoteShutdownPrivilege	6080	msiexec.exe
Token: SeUndockPrivilege	6080	msiexec.exe
Token: SeSyncAgentPrivilege	6080	msiexec.exe
Token: SeEnableDelegationPrivilege	6080	msiexec.exe
Token: SeManageVolumePrivilege	6080	msiexec.exe
Token: SeImpersonatePrivilege	6080	msiexec.exe
Token: SeCreateGlobalPrivilege	6080	msiexec.exe
Token: SeCreateTokenPrivilege	6080	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	6080	msiexec.exe
Token: SeLockMemoryPrivilege	6080	msiexec.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
6080	msiexec.exe
6740	retrac.exe
6080	msiexec.exe
4636	msedge.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
6080	msiexec.exe
7056	msiexec.exe
3108	MsiExec.exe

Suspicious use of WriteProcessMemory 50 IoCs

description	pid	Process	procid_target
PID 7056 wrote to memory of 3108	7056	msiexec.exe	91
PID 7056 wrote to memory of 6220	7056	msiexec.exe	97
PID 6080 wrote to memory of 6740	6080	msiexec.exe	100
PID 6740 wrote to memory of 5672	6740	retrac.exe	101
PID 5672 wrote to memory of 5804	5672	msedgewebview2.exe	102
PID 5672 wrote to memory of 3652	5672	msedgewebview2.exe	103
PID 5672 wrote to memory of 3652	5672	msedgewebview2.exe	103
PID 5672 wrote to memory of 3652	5672	msedgewebview2.exe	103
PID 5672 wrote to memory of 3652	5672	msedgewebview2.exe	103
PID 5672 wrote to memory of 4088	5672	msedgewebview2.exe	104
PID 5672 wrote to memory of 5332	5672	msedgewebview2.exe	105
PID 5672 wrote to memory of 5332	5672	msedgewebview2.exe	105
PID 5672 wrote to memory of 5332	5672	msedgewebview2.exe	105
PID 5672 wrote to memory of 1796	5672	msedgewebview2.exe	106
PID 5672 wrote to memory of 1796	5672	msedgewebview2.exe	106
PID 5672 wrote to memory of 1796	5672	msedgewebview2.exe	106
PID 5672 wrote to memory of 1796	5672	msedgewebview2.exe	106
PID 5672 wrote to memory of 1796	5672	msedgewebview2.exe	106
PID 6740 wrote to memory of 4636	6740	retrac.exe	107
PID 4636 wrote to memory of 3364	4636	msedge.exe	108
PID 4636 wrote to memory of 5788	4636	msedge.exe	109
PID 4636 wrote to memory of 4180	4636	msedge.exe	111
PID 4636 wrote to memory of 4180	4636	msedge.exe	111
PID 4636 wrote to memory of 7036	4636	msedge.exe	110
PID 4636 wrote to memory of 7036	4636	msedge.exe	110
PID 4636 wrote to memory of 7036	4636	msedge.exe	110
PID 4636 wrote to memory of 5956	4636	msedge.exe	113
PID 4636 wrote to memory of 5956	4636	msedge.exe	113
PID 4636 wrote to memory of 5956	4636	msedge.exe	113
PID 4636 wrote to memory of 3088	4636	msedge.exe	114
PID 4636 wrote to memory of 3088	4636	msedge.exe	114
PID 4636 wrote to memory of 3088	4636	msedge.exe	114
PID 4636 wrote to memory of 1148	4636	msedge.exe	115
PID 4636 wrote to memory of 1148	4636	msedge.exe	115
PID 4636 wrote to memory of 1148	4636	msedge.exe	115
PID 4636 wrote to memory of 4996	4636	msedge.exe	116
PID 4636 wrote to memory of 3876	4636	msedge.exe	117
PID 4636 wrote to memory of 3876	4636	msedge.exe	117
PID 4636 wrote to memory of 2092	4636	msedge.exe	118
PID 4636 wrote to memory of 2092	4636	msedge.exe	118
PID 4636 wrote to memory of 4560	4636	msedge.exe	119
PID 4636 wrote to memory of 4560	4636	msedge.exe	119
PID 4636 wrote to memory of 2628	4636	msedge.exe	123
PID 4636 wrote to memory of 5960	4636	msedge.exe	127
PID 4636 wrote to memory of 2680	4636	msedge.exe	128
PID 4636 wrote to memory of 3640	4636	msedge.exe	129
PID 4636 wrote to memory of 3808	4636	msedge.exe	130
PID 4636 wrote to memory of 3808	4636	msedge.exe	130
PID 4636 wrote to memory of 2548	4636	msedge.exe	131
PID 4636 wrote to memory of 2548	4636	msedge.exe	131

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I "C:\Users\Admin\AppData\Local\Temp\Retrac_3.0.8_x64_en-US (1).msi"
1⤵
- Badlisted process makes network request
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6080
- C:\Program Files\Retrac\retrac.exe
  "C:\Program Files\Retrac\retrac.exe"
  2⤵
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - Modifies trusted root certificate store through registry
  - Modifies registry class
  - Modifies system certificate store
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:6740
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=retrac.exe --webview-exe-version=3.0.8 --user-data-dir="C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --enable-features=MojoIpcz --lang=en-US --accept-lang=en-US --mojo-named-platform-channel-pipe=6740.5984.2305448554348693065 /pfhostedapp:fd0de7e5cefc9f8a2e2a61a11d5c8b08aabc87ca
    3⤵
    - Enumerates system info in registry
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of WriteProcessMemory
    PID:5672
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView /prefetch:4 /pfhostedapp:fd0de7e5cefc9f8a2e2a61a11d5c8b08aabc87ca --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x184,0x188,0x18c,0x160,0x194,0x7ff933dd5fd8,0x7ff933dd5fe4,0x7ff933dd5ff0
      4⤵
      PID:5804
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView" --webview-exe-name=retrac.exe --webview-exe-version=3.0.8 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1764 --field-trial-handle=1768,i,13345507017379908639,11588868923769118107,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:2 /pfhostedapp:fd0de7e5cefc9f8a2e2a61a11d5c8b08aabc87ca
      4⤵
      PID:3652
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView" --webview-exe-name=retrac.exe --webview-exe-version=3.0.8 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2124 --field-trial-handle=1768,i,13345507017379908639,11588868923769118107,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:3 /pfhostedapp:fd0de7e5cefc9f8a2e2a61a11d5c8b08aabc87ca
      4⤵
      PID:4088
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView" --webview-exe-name=retrac.exe --webview-exe-version=3.0.8 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2312 --field-trial-handle=1768,i,13345507017379908639,11588868923769118107,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:fd0de7e5cefc9f8a2e2a61a11d5c8b08aabc87ca
      4⤵
      PID:5332
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView" --webview-exe-name=retrac.exe --webview-exe-version=3.0.8 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --autoplay-policy=no-user-gesture-required --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3296 --field-trial-handle=1768,i,13345507017379908639,11588868923769118107,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /pfhostedapp:fd0de7e5cefc9f8a2e2a61a11d5c8b08aabc87ca /prefetch:1
      4⤵
      PID:1796
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://oauth-service-prod.retr.ac/oauth/authorise?client_id=01K5FQWCFHYHK3PNW357RE9YRZ&response_type=code&redirect_uri=retrac%3A%2F%2Fcallback
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:4636
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x368,0x7ff9317fc188,0x7ff9317fc194,0x7ff9317fc1a0
      4⤵
      PID:3364
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=1688,i,12625486647862235174,16611275671901691679,524288 --field-trial-handle=2560,i,5941092249571035323,9872964221760985415,262144 --variations-seed-version --mojo-platform-channel-handle=2588 /prefetch:11
      4⤵
      System Time Discovery
      PID:5788
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --subproc-heap-profiling --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1552,i,506275218626900464,16889029514100621195,262144 --field-trial-handle=2560,i,5941092249571035323,9872964221760985415,262144 --variations-seed-version --mojo-platform-channel-handle=2556 /prefetch:2
      4⤵
      PID:7036
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=2008,i,13589562318841004894,15018022368432096824,524288 --field-trial-handle=2560,i,5941092249571035323,9872964221760985415,262144 --variations-seed-version --mojo-platform-channel-handle=2448 /prefetch:13
      4⤵
      PID:4180
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --subproc-heap-profiling --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3556,i,15872927455802348146,2704167494699525675,2097152 --field-trial-handle=2560,i,5941092249571035323,9872964221760985415,262144 --variations-seed-version --mojo-platform-channel-handle=3608 /prefetch:1
      4⤵
      PID:5956
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --subproc-heap-profiling --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3560,i,14946741676061282356,5725410761504074910,2097152 --field-trial-handle=2560,i,5941092249571035323,9872964221760985415,262144 --variations-seed-version --mojo-platform-channel-handle=3612 /prefetch:1
      4⤵
      PID:3088
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --subproc-heap-profiling --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=5180,i,10170593179364918821,5693695951743925152,2097152 --field-trial-handle=2560,i,5941092249571035323,9872964221760985415,262144 --variations-seed-version --mojo-platform-channel-handle=5188 /prefetch:1
      4⤵
      PID:1148
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=5504,i,15214772361320874203,2243901913998203799,524288 --field-trial-handle=2560,i,5941092249571035323,9872964221760985415,262144 --variations-seed-version --mojo-platform-channel-handle=5532 /prefetch:14
      4⤵
      Modifies registry class
      PID:4996
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=5508,i,8706794969575086745,16859774928252299063,524288 --field-trial-handle=2560,i,5941092249571035323,9872964221760985415,262144 --variations-seed-version --mojo-platform-channel-handle=5480 /prefetch:12
      4⤵
      PID:3876
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=6148,i,368920849910645806,17817453528545377766,524288 --field-trial-handle=2560,i,5941092249571035323,9872964221760985415,262144 --variations-seed-version --mojo-platform-channel-handle=6152 /prefetch:14
      4⤵
      PID:2092
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=6156,i,12939141058303434697,11096801272421956004,524288 --field-trial-handle=2560,i,5941092249571035323,9872964221760985415,262144 --variations-seed-version --mojo-platform-channel-handle=5912 /prefetch:14
      4⤵
      PID:4560
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=6444,i,17293018476029163510,10030249830986417275,524288 --field-trial-handle=2560,i,5941092249571035323,9872964221760985415,262144 --variations-seed-version --mojo-platform-channel-handle=6464 /prefetch:14
      4⤵
      PID:1088
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=6444,i,17293018476029163510,10030249830986417275,524288 --field-trial-handle=2560,i,5941092249571035323,9872964221760985415,262144 --variations-seed-version --mojo-platform-channel-handle=6464 /prefetch:14
      4⤵
      PID:2628
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=7500,i,12772549301082882573,804230503768525352,524288 --field-trial-handle=2560,i,5941092249571035323,9872964221760985415,262144 --variations-seed-version --mojo-platform-channel-handle=6548 /prefetch:14
      4⤵
      PID:5960
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=7504,i,7653945815298369138,11688429938972976958,524288 --field-trial-handle=2560,i,5941092249571035323,9872964221760985415,262144 --variations-seed-version --mojo-platform-channel-handle=7452 /prefetch:14
      4⤵
      PID:2680
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=7496,i,17849622123304257793,11351072885016141259,524288 --field-trial-handle=2560,i,5941092249571035323,9872964221760985415,262144 --variations-seed-version --mojo-platform-channel-handle=7404 /prefetch:14
      4⤵
      PID:3640
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=3484,i,4775200456101464424,17387856542571245380,524288 --field-trial-handle=2560,i,5941092249571035323,9872964221760985415,262144 --variations-seed-version --mojo-platform-channel-handle=3648 /prefetch:14
      4⤵
      PID:3808
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=2444,i,8456472091124967616,17832834365689209193,524288 --field-trial-handle=2560,i,5941092249571035323,9872964221760985415,262144 --variations-seed-version --mojo-platform-channel-handle=3884 /prefetch:14
      4⤵
      PID:2548

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:7056
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 4DC04B176EB54A3005A6461D28FAAC1A C
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:3108
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:6220

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
PID:7144

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:6504

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:6836

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:1700

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:1808

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:6008

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Browser Information Discovery

T1217

Network Share Discovery

T1135

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e59c1f0.rbs

Path C:\Config.Msi\e59c1f0.rbs
Size 10KB
SHA256 e774ce6fa94866354662798deaecbbb9301bcb32b0cb707673995c483b4b8f26
MD5 053377f54f905fb94b9bf2630de9fe2f
SHA1 94d4cbe390ec10adbd9f744e0738adc357a47961
SHA512 eae24b239bd08621c338ebdbb8040ba4ea54cccadf105868650746914f6beab8b6b29cfdba772bd9795ecb06b761ac162a8e06fb11c5d292d7095453c3fea851
SSDEEP 192:ABmvcD7AyCHonuGvnuuTLbiIM4oWRiMupBQv:AQvcD7AmnhnnAb4
TLSH
T1C822FD42B744C2D2E9931B74DB0717263BB2DA988315674B0BCE75248F833D95E9A18B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

retrac.exe

Path C:\Program Files\Retrac\retrac.exe
Size 26.0MB
SHA256 2550eee702fb10f576042a913674938b4a4becdcf9b887853dbaef46d6f90bd2
MD5 789fb187c94581916bd728ce786ce972
SHA1 aaacb9eeca073c4a727ec0b7a5264db1479bd7ec
SHA512 4e333b330dd94204694c2355521dad82fc01dab2acdd90453c7dccd3e8e1fe1b3fc389bd1a22a0671e871741c515a0d77301f62891eb49ac39a12189c6f60cc1
SSDEEP 393216:WYq62DqPMcqO0BwUdrsPAQK1Jmii8l/RlpLFo:WYq/O7BfPW1JNl/1
TLSH
T128575B207B9AA96DD05AC47483878A724A7130DB0B35B9FF44D496783F6DBF42F38258
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Retrac.lnk

Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Retrac\Retrac.lnk
Size 1KB
SHA256 e14707648367ce5b563fca92a483102f028bf48ea70ff9b91ab3bdbf69428237
MD5 88dd2e5b77c38910086439bf06fdc32f
SHA1 24db530f21a0671b9f03fbb87d99c31c7c044cb6
SHA512 be95184674c80739f3e29d81fee5ce450442b17affed82910a07770368f0a5a7988a820d7bb10c0159f0d60afdd4547bf83c64ac7aed1db1b2e33e48fb4f9f53
TLSH
T1C941D00167E50B19F3735639EDB94A21DE31BC05B6348F2E028A41CF09719819AA9F7F
MD5 SHA1 SHA512 TLSH

Submit Download

Retrac.lnk~RFe59cb93.TMP

Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Retrac\Retrac.lnk~RFe59cb93.TMP
Size 1KB
SHA256 18a8df17f202931612f79bf9e01d7b0cc76e708b345b24a59ebd031df0552d67
MD5 15728478aa6a5bbc8ce93b113c51eaa5
SHA1 ff36e714ac6e68e5ebc03095927ed5b71bb13084
SHA512 6090c45f3c865e3bc5c85d9ae896078bd36c7debe589a86062bbb0378daff04b2e24c69494335f0d2a10b411d5cfc26c00740391a471c6f32589f2a4e7d7e702
TLSH
T16E41AF1167E50B19F363523DEDB94A20EE32BC05B6349F1A028741CF09719829A69F7F
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 e9e31f5fb014f6a7439a4e224bdae6d3d8b22db7c287d9c004b0184cc18e6bf8
MD5 00fe8112e1beaff1b09c3e772b0b70e6
SHA1 1d234f4d61d2fe0153bb63a7a246d37e6fc0aabe
SHA512 aaafc34862d38399e66858477aa9d3d624e9e071371fe2961aac0159845c41dbe1ed0ae62f8b9c52f327e4e4a97abdaf614ae741bcfd2627ec55b1d4f6fb6d74
TLSH
T1EAD08071B7286847D9551931D432CB017A57546365BAD1025160410C6C7BDB553CA155
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ba1406dd0117e6bb02a18e1f0ca40a20fdf33f68d611dcf6b59a242ae289374a
MD5 8a26ea5cde92773cb558eb116e113216
SHA1 2f807e9fd5e13c4ff550fceca7d90f11683ae33e
SHA512 dca9db1a71d0ad99193f78ee9f9221519b875eb1beb13ebfbd9d64a1b449eb8a027a5b2ceadf9158001b4548f036b26ed4f2c36ce3e8b981af5a54590c0e94a5
TLSH
T1B8D0C030B7286803D5141931D022CB007A17002321BBD1025160C00C2C3BCB163CA141
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 eda152cbda120da6488121fdd5b675f9873611b73b86d9fe242637032357cca7
MD5 65834e5aaf5910d3705e4bde932405c9
SHA1 3a96150b847a9f5c9354e20f7294be5ee450628c
SHA512 1334f6e9d9ccac0177f55382d0d296f1212d04e59f31175ca7f41cd9d6234d0b94795a9d93300e8a4a410dfb9e14276b7e86a2b5f21e409e1a9db96e134074fd
TLSH
T146E02B95C930FC271DFC6B186294064BE740135B3B51884B3B3C916C8FB063B8287C5C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 6KB
SHA256 c847208f98db5d5c3f3aef41772fb31883db98c00a7041c9a2c92493e251f377
MD5 ad9396e5c7281d8357ebee7d42080e7c
SHA1 ad728daa4c42c840c16ca758db5121fb6944dcd8
SHA512 dcd38ad6e190e79bd61ad39a8c8a6eabb586a1bc859b9a96c6edf4e0785cff1458314c16f2a920550a91010fb1ef9a1df0ab8f755a67909f63ffa29a87e0cde4
SSDEEP 96:0dCXpEp3yRvvgNSTkL6h30l80dEqjC+yH0zySwJtYHKYag2aaa8:0SW8Rvth30BhC+yUWYqW2tl
TLSH
T13BE18674E2D968A1DB3152F57CE9A8A579BF384D13470EC290DE3CFA2E25F4918B1702
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe5b2f88.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5b2f88.TMP
Size 1KB
SHA256 418132f5130dc925b5082309e55430d9154b06b421fec0ffa2b01ea92ae961e5
MD5 c0078c686684fa37acfe2cc5ebf116a9
SHA1 b1bedf4d02dd67ff40cfc88cefbaf8da49c1bad8
SHA512 dea191f4aa493021f3b12114b1e78f0aac8656b3b1160f7ba7e897a22c01e43e4d7faf9e6bf8f940f26765cd8596c475c63851ccc5716bcceba7bde23a71af55
TLSH
T10931211C835258C5DF6563F6AEDE8CE97EF4888942CB2BD2C4D05D744D2AF5020F2463
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 2f0124613b41fe0b380607a581da99622270dfbcb726001d8feb48281d979efd
MD5 5b1527de2c52c6a09200511218b4f832
SHA1 febfc52fedf3945d12faa42fed38024f78279654
SHA512 c4d8bafbda3b6a9714437f27eea95f63f51909aab50507f42f60a620dce8bec0776daa4b024d359ca285dfce40e27bdf4bf5a5d16d51829dc80750e067e30ef2
TLSH
T14941C1F783F4856ECA0195F0AA18AE2FCE1C0515432C3D9AC9E0AE1793E3471E141A5F
MD5 SHA1 SHA512 TLSH

Submit Download

de9ed901-d608-47f0-8e49-deabbd3aa74e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\de9ed901-d608-47f0-8e49-deabbd3aa74e.tmp
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 18353abc35afe3d2314b7fe471094c2c19fc7845f98ca2f34ffd876bc1a990a3
MD5 36d27f615fb9dd55f33c1afb3e11aec0
SHA1 8d94bd8604fb7b31d075a1aeff7edb890e14e41f
SHA512 5b74828a63e7136c0d41ede6d92fe92c9d833294e45c6336c49df8cf2e9d35bd5583de8d9384d89aa0b1fd303e7f7ce38d71f7b0a34008080836dab3a4e28bb6
SSDEEP 384:sxRL18f/fdspXN/RIgmj/5q/WEgsGQnvjX:sXqf/f+dWZ/5QWEgsGQnb
TLSH
T16672E816AA249D7B8DDBD209FA957F93D3FC5173A1545E44AAFCCA0C04E66EC210382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 70de29d3761cc1c85db2ed95b3da4640429e0c6d3ca1ca0e9e48b382560484df
MD5 fed9fae41d9c0ddb70084ab27bbf503e
SHA1 589997d2e7f3c1530468e5fb779e417d492c795e
SHA512 c0d7fac095b714977073dcf0f9b2a1f218654eeb5b1f7fa94cbfcc3db97953d21c90948348396dc744242db0d55138a3614cc62dbe39cc920b28729a18a81e51
SSDEEP 768:Ob4YZx7pLuL7yTWg1NfuB8F1+UoAYDCx9Tuqh0VfUC9xbog/OVCobbDwzrou4S:Ob4YZnE7yTWg1NfuBu1jaJobHwApS
TLSH
T17FE2FC3B280CCB7E4F804ADDEC29BD9A6DA801CF5AD8C95447FA850C03C6BEB55165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\ffb67ebb-bef1-43df-9047-d10f6453b01e\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\index.txt
Size 233B
SHA256 79e9110143419777f7fc56db33c9754b9c57346b998d4c97df598ddb72ac83b7
MD5 83e46db41b63ae420558b7656e6b9ee1
SHA1 7b8bada9ffc6c77209ec05923a73ce830a15a55e
SHA512 ff94a725881e939350e8b2f5ae78ea6147551a7d0d2da8e01a6fdb701e97be4797cf76f7e9790d59f940a678ea1834b15c852d04dc9f466e10e2a2d44d5ded42
TLSH
T13DD097BBF0A00280FB670BC10A31041682202CC92482A08CD103392C8039B43A207E92
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\index.txt
Size 226B
SHA256 884e616e972391e5c9680ce190d354d5d0ba44cb6e7391604056a5606f06c14c
MD5 0388cc4b48ccc60c8a92b3e5061b5e65
SHA1 ba1bac4410d45e0055f3958ccac3431188685037
SHA512 4c79ef63bc8bd487a17a0e687b467bf0593539268acb7e244d00f94fc23a8cfa4a75ccc917e81cd9c90b090e05dd0c0a193c800ac0cd2623bc3aa247bab4a32f
TLSH
T1C9D0A7ABF1940794FBAB4FD11A21042682142CC564D6A0CD911349698865B57A247F92
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe5ab48c.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\index.txt~RFe5ab48c.TMP
Size 138B
SHA256 1f0322a8c7a7896ba3f482ed106924f9e6c6412b0aec07cd30db75fd55b20383
MD5 f045bcfbe253dce3ca5c53123a422b0e
SHA1 6c5640117185f38f4d6b08c6c8be4f5ef5b984f0
SHA512 98679e6fce56faecd0b7549699da20e11e5a024f235c75c2bf7ba41e38ad9ddbb4766315e886591fc6aef6f6986c97cc74375d7a2a8b0027fc72f650274137cf
TLSH
T179C02BF3B2D003449F1506C04332051DC3052CCD8CC1848EA02374682032F13720BFD2
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 2d9d0cf69014832a823c0074b5b9d5f849d01d8f92deca927153331a3f3d0077
MD5 810ab849cca42ba94df1b6cf09203220
SHA1 3bc1b6270c77ee37f4bbda02ddc88bfa693d4a05
SHA512 44e999e6188aca4596a558df8dabe3db501fb13ad873f2a372d6adf1ec219664b54f7aa1eaf15a55d26c3af44bd91000151089ac039b5e6b5b186a080f8dc7fa
SSDEEP 384:yv+Rp0nYrnhZZuJCXHnbB1S/HqlcDDRPbIhJ9pF8:yv+Rp0nYrnhZZuJCXHnbB1S/HqlcDDRZ
TLSH
T1BAB26B11713F4290387EB90C91B9981F86C2B4633119E53F7BA802A65F67E139DFE8C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 f6b5204dc445f2130af7e87bf7bf322add3cbcd59e72efdf45b358bc3d219cb2
MD5 427e48bc7ca8d7e66b924fabae03d355
SHA1 830bbd5455082ba8c3502fe8c9ce1ba3c0c9cbdd
SHA512 c18dc190de08173b5ede53f063464a5c33f6e11da1fda27c162f7e95f4c0f1872f532bef74dd5d52ba85fb808de558d0edaf6c6f508d58d45b147d95633f37fe
SSDEEP 384:nQiF1tNn/s3n9Sn8NgP8TUNTUlIRiPvuTu2Renf+GGeuXFLqOObjI9G6w7tr8LEk:rF1j+9SXPwgUuHyGeuhq29MZM
TLSH
T1BDC24A36EC59DEB7EDE68FD8B70A7A16EEE0126785D85AD4DAD85D0C00871EC0307C16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 24KB
SHA256 20014ca5846c9b05d7938803e4cd2db73d02d7281bbb9ec5727e6e8e042418f6
MD5 45a1c6b16cc412476b0d91b749569fb7
SHA1 19f264023a38b65efb200c62dc516380c1c2741e
SHA512 1d0f1887f9324822ec8e9f54c821be2c1a98484c3c4451c7f427f90e061087a68250e21e5fb4cf11b19ab811635ba2e8f36a54292df4ef75da7b23127b721f94
SSDEEP 384:n2iF1tNn/s3n9Sn8NLN8TUNTUlIRZPvuTMMOenf+GGeuXkdLdgjyAtkhF8LEEIz/:dF1j+9SQNwgju7jGeuUoj3Eoy
TLSH
T188B23A32D855DE77ACEB8FC8B70A7656EEE0526388C95AD4E6D85D0C00C72DD070BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 56f96baee0d9e7ed5252a088d4184d7ccb548fb0388fa4fc7b8070ff528514e1
MD5 69d76a0860632ca5526cd2899809c829
SHA1 e329fff0af257cc650bcdab2ba37dfa3f1ecc7d5
SHA512 3e5720e13932a20149746c54d0d095b33ba7e7a48df6f39b89fa3a4c292658ae16eb52996af21ddbcb9f15b9e45419adc59d96784376a1f41ca1eedfbe776711
SSDEEP 384:nsiFiZcI58NLN8TUNTUlIRWPvuTMMOenf+GGeuXkdLdgjyANXoz5s/IkhrfWTv8R:XFQ5QNwgUu7jGeuUoj3+zmZhretBu5
TLSH
T195D25C31DC65DEB7ACEA8FC5BB497642DEE4516388CC9AD4EAD85E0C00871ED070BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 00a260d6f11ab921512146b713ccf01fae5b3f896c10bf0084aeb32e18d39c46
MD5 92dbb451f5aecc551bacc67ca1512aa3
SHA1 327a09ab2c7f3acbbb72537d852c3ab8d8d00970
SHA512 2ab509a5f0a988b6185a767c075091eb0a093c684e68591f25f9fdda976ccad1c247f8e1a0bbfb9faf5ed59b58961bb30339fdb5c748ec4b7d567c4166e6d222
SSDEEP 384:n2iFiZcI58NLN8TUNTUlIRWPvuTMMOenf+GGeuXkdLdgjyANXoz5s/IkhrfWTv8R:dFQ5QNwgUu7jGeuUoj3+zmZhretBu5
TLSH
T1D8D25C31DC65DEB7ACEA8FC5BB497642DEE4516389CC9AD4EAD85E0C00871ED070BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
Size 153KB
SHA256 299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
MD5 c4a20d073fe58488935da829aae6fa17
SHA1 dbd31aa3dcd1abd3d554d29a9bca83bab02709d5
SHA512 61f74480d3471180f14e2171be6f5e33ab0a03a7a4837334695556a9484da1a862cc059969834d4950a038ec97f192805e5e718cd2a280aba675bdc9cee5d976
SSDEEP 3072:C0qfZ9r+hy+exmKhRts8o7SYbyqNDri8EBalnQt9RaBoAkaX2Ns:C0qfZ9r5msvoOGi8QQQbRwxmNs
TLSH
T126F3E02D6EDEC956CC0F61F96F29724BC50A4F0B818B648B624E881958F434E17E29FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 132B
SHA256 ea13d57b11af249f90704dbcafd354c5e80b10358db7edb9eaf8f6fd597eb1d4
MD5 ae3a19c226264ff6cb64877f1e7e7243
SHA1 f993431dbd09200fd92b7a04ee6711a54ad95cc9
SHA512 97e5dbf0663585afbb5e0f2b5a36192624eb2c898462abef65225987df632d30f74f05ac5a71175c4c59f75d9ae6d2e640d168e479cb26b9a6857c71efda029a
TLSH
T1C1C02B85CB1E0C854E78153D48420B2727819F0030508534445A490C41741CE00888CF
MD5 SHA1 SHA512 TLSH

Submit Download

MSI70A2.tmp

Path C:\Users\Admin\AppData\Local\Temp\MSI70A2.tmp
Size 132KB
SHA256 7f47d98ab25cfea9b3a2e898c3376cc9ba1cd893b4948b0c27caa530fd0e34cc
MD5 cfbb8568bd3711a97e6124c56fcfa8d9
SHA1 d7a098ae58bdd5e93a3c1b04b3d69a14234d5e57
SHA512 860cbf3286ac4915580cefaf56a9c3d48938eb08e3f31b7f024c4339c037d7c8bdf16e766d08106505ba535be4922a87dc46bd029aae99a64ea2fc02cf3aec04
SSDEEP 3072:Kx2YbpcgwmiTPJDnCO+DATkURBnrskNwPj2:XXgwmY1CPx2XG2
TLSH
T1DBD39D02B5D0C473D9BE09390870DB229F7EB930DF909EDB636856699E702C19E35A37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 bd8f0d47a413a25e11c087bd29387489f084ea0e29a8a2a541a1f4e1053cbcd8
MD5 fe8add5d57c90971c17ffe82af9f4b88
SHA1 00263f572ab561c698613b07b27e2ba2dca17f55
SHA512 5913a59321a461805884ffddc11e8aa42536e16ac4da6c57e584dac6a3f1e0a335e3c5d28d6fc7deb142501ea3643bc9844e66878e331e990a99c19facab1c65
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 c4b28021d83155a29607d8458d48084e801d5e47c51885a283b3c0ce44ade7dd
MD5 3763e7a96c08e3e17ad78e4af709a725
SHA1 f7ccbc3a4c48845d339f4b5c0864cc37a49f7ff5
SHA512 07d7d2da5ade375941227b2d94e2db3e8c0e815ab0ecd70cc42b6c31eb96a4f38a152aef517f3b43a892407bced71eeda55c2198036bd1f13cab3f6360be4fee
TLSH
T184D0123633810734C05020330103754C0410C11BC009C101543AD51D5B0589C2D46451
MD5 SHA1 SHA512 TLSH

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 72B
SHA256 820d4655c9b5553e27494c691bb7749fee4ff5ccf023c6ec13bcb8b019d439a9
MD5 8a6f43e3a020544ca50e251b71b82b6f
SHA1 5e9b17317b43fdfb0ac431918904ccce3a3c38ac
SHA512 95122ce708a70ee13d3a51591dca6275304947db772d6176ce34e9b45f37b6dad60fa95e5788803d4d4ea20309b1e173e75103f72ae91c66b689921206fa18a2
TLSH
T1DDA00224C9CC156AD219277120D20681B276AC70E28B5B4280A822AAC8513D06925200
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5ac8b0.TMP

Path C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView\Default\Code Cache\js\index-dir\the-real-index~RFe5ac8b0.TMP
Size 48B
SHA256 d1a30ec77c596aae90224e7fd54b69ed3949513a52a6b29ed56021cd9e1dee3c
MD5 88556178233ef2382568a934371b27cb
SHA1 8e07d310dd984ce7e2e1c97f027f8b3a36116b12
SHA512 7c400065cd11aaab93afe63b0269d0c02ca1598514e5fd90cc2d2ce07ada245f412bebe25af2d7bfa3eb163e258826c6f4916badd8a4f99d508a95a92960e1e4
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView\Default\Extension Rules\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView\Default\Site Characteristics Database\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

bf94e084-5283-4f8f-a1a5-59d0aee6bcec.tmp

Path C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView\Default\bf94e084-5283-4f8f-a1a5-59d0aee6bcec.tmp
Size 6KB
SHA256 286934d4154440fef9fe533fd63ecd8ec190f52b973fdb2394dc67889b51b768
MD5 04d4bd1311df053240cd70bfae615dde
SHA1 2a83e184c03e5bc42a2c30ae24ea22a16c8ba337
SHA512 1c48c26e3dee67f2118edea2a088ac7fcdc241cdb5f17862157c3dc5e0d7a20d741395a72a3ccbc0d0dc84ccac866708823ca9abb94a2a347d16d5c11714cfaa
SSDEEP 96:stk/dg+y0b9eJkeo5h16Z0ys7/x+6MhmuecJ/oS1ejeAK+gEH28XM1C7K:stoO7BonysV+Fd/nQjYUG6K
TLSH
T17CD196429E247D7B4CC6F109BA35BA57E3F5907265D01E58E7F8862C04D66DC2307D0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView\GraphiteDawnCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView\GraphiteDawnCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView\GraphiteDawnCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView\Local State
Size 15KB
SHA256 713d4e2249a84ef659b101c6e9d5827782a741baa97846c92313c5c03f29a8ea
MD5 44444cabac7e37d96580ec79ac602366
SHA1 d382066d5cf7199b5d3986d927fd39656ae73e2e
SHA512 f7416b2936782fd7d0e12abb445832d2878d865499046934308b7a6cf129ea1a57b3db202b588264a5eeb67f25411239eb92f0876ae8f3927d144057ac784ca0
SSDEEP 384:d+aQikB+z/xvxjg/qhEzNBS+JobWYP4N8uEK:o/UxvxjgC+VorPu
TLSH
T1CA729D2A58697E2799F7E501BA5E178BCBF8C4A390C26EB54EFC5F0D06973981302C12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView\Local State
Size 15KB
SHA256 f19256b1f83c2b75dc4f3141e3d075a4421590e371b32c34174114f575c6d0e7
MD5 7ba846b0f650be77e2ff1987472f57ad
SHA1 560212f4127e6012bcc76ad00925466035640d2d
SHA512 e5461571e852dd25103416c09ddfddff0b38fa1b6a556f4ffbeb959c3c0838b320bef9a549af74aafcebd582f122c858c1f232dc54edb403acfc42cd4c061160
SSDEEP 384:2+aQikB+z/xvxjg/qhEzNBS+JobWYP4N8uEK:B/UxvxjgC+VorPu
TLSH
T13A728E2A58797E2799F7E501BA5E178BCBF8C4A390C26EB54EFC5F0D06973981302C12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView\Local State
Size 2KB
SHA256 8d61f3047786c40068e50701dc3e88e10b04ac95dcd8a719d7aea35bfcc3d0da
MD5 fba50ae6e0f337a2dc6dcbdd947eeed4
SHA1 58c917b3231bcbdfbaa1339d332f7f0c300c2716
SHA512 e4736598fd816cf57831be93c0fb0003dbd0d5188c79056ce9830e75bc054121d7ed998105d9d2575d71a614510a79d3623c876a6f2c997db36b5abd26a24d7e
TLSH
T1935167326815AE378DF3D604BA4B3B779FB5D0929A621F109AEC0F1C01D765C1702877
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView\Local State
Size 3KB
SHA256 ea574956c3c96653366056c5f5c6c17837fbbf2d71a5d9119eb9097fe1e500b1
MD5 036cf71346c228296fb4fc421c220ba8
SHA1 8279c077ea9a0336f4a431633632c8cfbb2bbb87
SHA512 e0485378499a5b06511d165945da8bee14e05a4f39dc1fe9fba33222f464c2a8dd99a9997a9c047a9cd6122bd0d33e978330a70018898dfa6217328781c0c823
TLSH
T1326163326865AD374DF3DA04B9873B26ABE59063E5913F65DAEC0F0C01D73981342C27
MD5 SHA1 SHA512 TLSH

Submit Download

Local State~RFe5a7560.TMP

Path C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView\Local State~RFe5a7560.TMP
Size 1KB
SHA256 b284a7970e8547669bdde23c50609e978ec8a24bebb8c710711b29a070a6acc6
MD5 646cffa1679253ccd2b09c4613fd575b
SHA1 2dbb75a78db5243dd607f27c62238c792a838754
SHA512 5dc0d5194466ec686327ed0b79fc77be9b416c6ee2393b24b3da2eb93311d71d684d6c5fc7b1c539fd57864ef907bacfcaa6c80286b620951677af38cc69a28a
TLSH
T1D3216571D4256F339CE6F2057247776B1F6190A781914E04A9ED4F1D02E615CEA26832
MD5 SHA1 SHA512 TLSH

Submit Download

e59c1ef.msi

Path C:\Windows\Installer\e59c1ef.msi
Size 14.4MB
SHA256 f25ac4aed0f36abdb2f0ea2cdb67e4249d7d70467718f718445559cf4e0ffd89
MD5 965f3d0bff58a004b2642bf6d637dedc
SHA1 1c65936cb7545559f090173a494ff1bc2839f1eb
SHA512 68baec2ebd5d6b4eecc6190eb02265572ed952f609423399d5cb5e3f7dd43c8c0e005491bd52be72fdb289f700cfcadee33caea80ca30bf7f5cd5b60fcd2f28d
SSDEEP 393216:Xgwqa+Wmti6d4hGDOQ1X0ADGK/pC6HuAhUO2bJRA:wwc1fdMvFADZ/pCJAhUFN+
TLSH
T151E633873D96DB11C8A21D7A44BBC3A822387D400624D9A777DCB82DDEF23C095769DE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata-2

Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
Size 26.1MB
SHA256 37e8e88638b1937e98c4d75c593d221b969f7699b71a4fb9b7803916e9f7bbde
MD5 eb2c64b18ad9c7a0487be88b90826169
SHA1 c171d5302efbf2219950e19c2c80e264e25458e3
SHA512 1f7fb715e94ba166d382ecd84c7501f0ee1199a154819672ceaf54b43c349cd5b4b2836a41303ed468a628146ea8cad342c64712113f73402be4a25f32786cff
SSDEEP 24576:FFo3DMPRdoO/vvTL/yAQQiVQfL+a77XDkNmSdNe4mlea53hg8YxWA5KRE+e:RHM
TLSH
T1F657E42436F92111E7F79E3CA8F06A274D397D979C19DE8D05811B4E0822F71E872F6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{decf3e24-c461-432c-bb51-73711be20213}_OnDiskSnapshotProp

Path \??\Volume{c4492839-0000-0000-0000-d08302000000}\System Volume Information\SPP\OnlineMetadataCache\{decf3e24-c461-432c-bb51-73711be20213}_OnDiskSnapshotProp
Size 6KB
SHA256 0a67b160aa8055ea786ba62e8bea13c69f86e76b1af03c9bb7a52a077ec2acc3
MD5 ec436f6edbb02e536e1650610c2fe51d
SHA1 38430a948ecbd0905be8c06acec6be7c6a1d9131
SHA512 3e1f684895087f863e43308aa3410d57e9f72fdbcd2be6e73635e69bf625789f878f51d1fc6f348f63823394e1b453537603b4712ce4bebde727f5f82c729d39
SSDEEP 96:FazE+cQGvc6DD84LTHzbOHXOHBlBRQn8Sc9XE56tOSVQpu:MzE3b++uVm
TLSH
T191D198185AF54711E2B3AB3129F18557A877B852EF33CB8E0198238E6631910F835F6F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1796-292-0x000001FAAA610000-0x000001FAAA6E6000-memory.dmp

Download

memory/1796-90-0x00007FF957060000-0x00007FF957061000-memory.dmp

Download

memory/3652-291-0x000002BBD4310000-0x000002BBD43E6000-memory.dmp

Download

memory/3652-77-0x00007FF957060000-0x00007FF957061000-memory.dmp

Download

memory/7056-44-0x0000016B46300000-0x0000016B46CA4000-memory.dmp

Download