f25ac4aed0f36abdb2f0ea2cdb67e4249d7d70467718f718445559cf4e0ffd89

Analysis

user interaction
yes
max time kernel
148s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
06/08/2026, 18:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Retrac_3.0.8_x64_en-US.msi
Size 14.4MB
Sample260806-w2pd6sgp21
SHA256 f25ac4aed0f36abdb2f0ea2cdb67e4249d7d70467718f718445559cf4e0ffd89
MD5 965f3d0bff58a004b2642bf6d637dedc
SHA1 1c65936cb7545559f090173a494ff1bc2839f1eb
SHA512 68baec2ebd5d6b4eecc6190eb02265572ed952f609423399d5cb5e3f7dd43c8c0e005491bd52be72fdb289f700cfcadee33caea80ca30bf7f5cd5b60fcd2f28d
SSDEEP 393216:Xgwqa+Wmti6d4hGDOQ1X0ADGK/pC6HuAhUO2bJRA:wwc1fdMvFADZ/pCJAhUFN+
TLSH
T151E633873D96DB11C8A21D7A44BBC3A822387D400624D9A777DCB82DDEF23C095769DE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery persistence privilege_escalation ransomware spyware trojan

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4540	retrac.exe

Loads dropped DLL 1 IoCs

pid	Process
2596	MsiExec.exe

Badlisted process makes network request 2 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
4	756	msiexec.exe
6	756	msiexec.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	retrac.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files\Retrac\retrac.exe	msiexec.exe
File created	C:\Program Files\Retrac\Uninstall Retrac.lnk	msiexec.exe

Drops file in Windows directory 10 IoCs

description	ioc	Process
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\Installer\{F2567F58-5A4A-4F82-886D-ED5C11F380BE}\ProductIcon	msiexec.exe
File created	C:\Windows\Installer\SourceHash{F2567F58-5A4A-4F82-886D-ED5C11F380BE}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI6155.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\{F2567F58-5A4A-4F82-886D-ED5C11F380BE}\ProductIcon	msiexec.exe
File created	C:\Windows\Installer\e585f24.msi	msiexec.exe
File created	C:\Windows\Installer\e585f22.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e585f22.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe

Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs

persistence privilege_escalation

Installer Packages

T1546.016

Msiexec

T1218.007

pid	Process
756	msiexec.exe

Modifies trusted root certificate store through registry 1 TTPs 2 IoCs

A root certificate was added, modified, or removed in the trusted certificate store registry paths.

defense_evasion

Install Root Certificate

T1553.004

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e14000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	retrac.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 5c0000000100000004000000001000001900000001000000100000002fe1f70bb05d7c92335bc5e05b984da60f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f63030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e814000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e20000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	retrac.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000aea20acdcfb7d9ac0000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000aea20acd0000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed35000000ffffffff000000000700010000680900aea20acd000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff350000000000000005000000ffffffff000000000700010000f8ff1aaea20acd000000000000f0ff350000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1daea20acd000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe

Modifies data under HKEY_USERS 5 IoCs

description	ioc	Process
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedgewebview2.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134305143994919125"	msedgewebview2.exe

Modifies registry class 46 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\retrac\DefaultIcon\ = "\"C:\\PROGRA~1\\Retrac\\retrac.exe\",0"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\85F7652FA4A528F488D6DEC5113F08EB\Version = "50331656"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\85F7652FA4A528F488D6DEC5113F08EB\AdvertiseFlags = "388"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\retrac\DefaultIcon	retrac.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\retrac\shell\open\command	retrac.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\retrac\shell	retrac.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\retrac\shell\open\command\ = "\"C:\\Program Files\\Retrac\\retrac.exe\" \"%1\""	retrac.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\retrac	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\85F7652FA4A528F488D6DEC5113F08EB\ProductName = "Retrac"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\85F7652FA4A528F488D6DEC5113F08EB\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\85F7652FA4A528F488D6DEC5113F08EB\SourceList\Media\1 = ";"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\retrac	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\85F7652FA4A528F488D6DEC5113F08EB\ShortcutsFeature = "MainProgram"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\D39F67BF21D37C75581F63A03A3CC6BF	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\85F7652FA4A528F488D6DEC5113F08EB\SourceList\PackageName = "Retrac_3.0.8_x64_en-US.msi"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\retrac\shell\open\command	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\85F7652FA4A528F488D6DEC5113F08EB	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\85F7652FA4A528F488D6DEC5113F08EB\DeploymentFlags = "3"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\D39F67BF21D37C75581F63A03A3CC6BF\85F7652FA4A528F488D6DEC5113F08EB	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\85F7652FA4A528F488D6DEC5113F08EB\SourceList\Media	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\retrac\URL Protocol	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\85F7652FA4A528F488D6DEC5113F08EB\Environment = "MainProgram"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\85F7652FA4A528F488D6DEC5113F08EB\Language = "0"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\85F7652FA4A528F488D6DEC5113F08EB\AuthorizedLUAApp = "0"	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\retrac\ = "URL:launcher.retrac.site protocol"	retrac.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\retrac\shell\open	retrac.exe
Key created	\REGISTRY\MACHINE\Software\Classes\retrac\DefaultIcon	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\retrac\shell\open	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\retrac\shell\open\command\ = "\"C:\\PROGRA~1\\Retrac\\retrac.exe\" \"%1\""	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\85F7652FA4A528F488D6DEC5113F08EB\External	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\85F7652FA4A528F488D6DEC5113F08EB\PackageCode = "6AFF5C71F42D1914DA5EF303DCA200A2"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\85F7652FA4A528F488D6DEC5113F08EB\Assignment = "1"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\85F7652FA4A528F488D6DEC5113F08EB\ProductIcon = "C:\\Windows\\Installer\\{F2567F58-5A4A-4F82-886D-ED5C11F380BE}\\ProductIcon"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\85F7652FA4A528F488D6DEC5113F08EB\InstanceType = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\retrac\ = "URL: protocol"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\retrac\shell	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\retrac\shell\open\command	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\85F7652FA4A528F488D6DEC5113F08EB\SourceList	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\85F7652FA4A528F488D6DEC5113F08EB\SourceList\Net	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\85F7652FA4A528F488D6DEC5113F08EB\Clients = 3a0000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\85F7652FA4A528F488D6DEC5113F08EB\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\retrac	retrac.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\85F7652FA4A528F488D6DEC5113F08EB\MainProgram	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\85F7652FA4A528F488D6DEC5113F08EB	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\retrac\URL Protocol	retrac.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\retrac\DefaultIcon\ = "C:\\Program Files\\Retrac\\retrac.exe,0"	retrac.exe

Modifies system certificate store 2 TTPs 1 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8	retrac.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2200	msiexec.exe
2200	msiexec.exe
4540	retrac.exe
4540	retrac.exe
4540	retrac.exe
4540	retrac.exe
4540	retrac.exe
4540	retrac.exe
4540	retrac.exe
4540	retrac.exe
4540	retrac.exe
4540	retrac.exe
4540	retrac.exe
4540	retrac.exe
4540	retrac.exe
4540	retrac.exe
4540	retrac.exe
4540	retrac.exe
4540	retrac.exe
4540	retrac.exe
4540	retrac.exe
4540	retrac.exe
4540	retrac.exe
4540	retrac.exe
4540	retrac.exe
4540	retrac.exe
4540	retrac.exe
4540	retrac.exe
4540	retrac.exe
4540	retrac.exe
4540	retrac.exe
4540	retrac.exe
4540	retrac.exe
4540	retrac.exe
4540	retrac.exe
4540	retrac.exe
4540	retrac.exe
4540	retrac.exe
4540	retrac.exe
4540	retrac.exe
4540	retrac.exe
4540	retrac.exe
4540	retrac.exe
4540	retrac.exe
4540	retrac.exe
4540	retrac.exe
4540	retrac.exe
4540	retrac.exe
4540	retrac.exe
4540	retrac.exe
4540	retrac.exe
4540	retrac.exe
4540	retrac.exe
4540	retrac.exe
4540	retrac.exe
4540	retrac.exe
4540	retrac.exe
4540	retrac.exe
4540	retrac.exe
4540	retrac.exe
4540	retrac.exe
4540	retrac.exe
4540	retrac.exe
4540	retrac.exe

Suspicious behavior: LoadsDriver 6 IoCs

pid	Process
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
672	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs

pid	Process
2636	msedgewebview2.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	756	msiexec.exe
Token: SeIncreaseQuotaPrivilege	756	msiexec.exe
Token: SeSecurityPrivilege	2200	msiexec.exe
Token: SeCreateTokenPrivilege	756	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	756	msiexec.exe
Token: SeLockMemoryPrivilege	756	msiexec.exe
Token: SeIncreaseQuotaPrivilege	756	msiexec.exe
Token: SeMachineAccountPrivilege	756	msiexec.exe
Token: SeTcbPrivilege	756	msiexec.exe
Token: SeSecurityPrivilege	756	msiexec.exe
Token: SeTakeOwnershipPrivilege	756	msiexec.exe
Token: SeLoadDriverPrivilege	756	msiexec.exe
Token: SeSystemProfilePrivilege	756	msiexec.exe
Token: SeSystemtimePrivilege	756	msiexec.exe
Token: SeProfSingleProcessPrivilege	756	msiexec.exe
Token: SeIncBasePriorityPrivilege	756	msiexec.exe
Token: SeCreatePagefilePrivilege	756	msiexec.exe
Token: SeCreatePermanentPrivilege	756	msiexec.exe
Token: SeBackupPrivilege	756	msiexec.exe
Token: SeRestorePrivilege	756	msiexec.exe
Token: SeShutdownPrivilege	756	msiexec.exe
Token: SeDebugPrivilege	756	msiexec.exe
Token: SeAuditPrivilege	756	msiexec.exe
Token: SeSystemEnvironmentPrivilege	756	msiexec.exe
Token: SeChangeNotifyPrivilege	756	msiexec.exe
Token: SeRemoteShutdownPrivilege	756	msiexec.exe
Token: SeUndockPrivilege	756	msiexec.exe
Token: SeSyncAgentPrivilege	756	msiexec.exe
Token: SeEnableDelegationPrivilege	756	msiexec.exe
Token: SeManageVolumePrivilege	756	msiexec.exe
Token: SeImpersonatePrivilege	756	msiexec.exe
Token: SeCreateGlobalPrivilege	756	msiexec.exe
Token: SeCreateTokenPrivilege	756	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	756	msiexec.exe
Token: SeLockMemoryPrivilege	756	msiexec.exe
Token: SeIncreaseQuotaPrivilege	756	msiexec.exe
Token: SeMachineAccountPrivilege	756	msiexec.exe
Token: SeTcbPrivilege	756	msiexec.exe
Token: SeSecurityPrivilege	756	msiexec.exe
Token: SeTakeOwnershipPrivilege	756	msiexec.exe
Token: SeLoadDriverPrivilege	756	msiexec.exe
Token: SeSystemProfilePrivilege	756	msiexec.exe
Token: SeSystemtimePrivilege	756	msiexec.exe
Token: SeProfSingleProcessPrivilege	756	msiexec.exe
Token: SeIncBasePriorityPrivilege	756	msiexec.exe
Token: SeCreatePagefilePrivilege	756	msiexec.exe
Token: SeCreatePermanentPrivilege	756	msiexec.exe
Token: SeBackupPrivilege	756	msiexec.exe
Token: SeRestorePrivilege	756	msiexec.exe
Token: SeShutdownPrivilege	756	msiexec.exe
Token: SeDebugPrivilege	756	msiexec.exe
Token: SeAuditPrivilege	756	msiexec.exe
Token: SeSystemEnvironmentPrivilege	756	msiexec.exe
Token: SeChangeNotifyPrivilege	756	msiexec.exe
Token: SeRemoteShutdownPrivilege	756	msiexec.exe
Token: SeUndockPrivilege	756	msiexec.exe
Token: SeSyncAgentPrivilege	756	msiexec.exe
Token: SeEnableDelegationPrivilege	756	msiexec.exe
Token: SeManageVolumePrivilege	756	msiexec.exe
Token: SeImpersonatePrivilege	756	msiexec.exe
Token: SeCreateGlobalPrivilege	756	msiexec.exe
Token: SeCreateTokenPrivilege	756	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	756	msiexec.exe
Token: SeLockMemoryPrivilege	756	msiexec.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
756	msiexec.exe
756	msiexec.exe
756	msiexec.exe
4540	retrac.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 2200 wrote to memory of 2596	2200	msiexec.exe	87
PID 2200 wrote to memory of 4928	2200	msiexec.exe	100
PID 756 wrote to memory of 4540	756	msiexec.exe	104
PID 4540 wrote to memory of 2636	4540	retrac.exe	105
PID 2636 wrote to memory of 2872	2636	msedgewebview2.exe	106
PID 2636 wrote to memory of 3024	2636	msedgewebview2.exe	107
PID 2636 wrote to memory of 3024	2636	msedgewebview2.exe	107
PID 2636 wrote to memory of 3024	2636	msedgewebview2.exe	107
PID 2636 wrote to memory of 2280	2636	msedgewebview2.exe	108
PID 2636 wrote to memory of 3572	2636	msedgewebview2.exe	109
PID 2636 wrote to memory of 3572	2636	msedgewebview2.exe	109
PID 2636 wrote to memory of 524	2636	msedgewebview2.exe	110
PID 2636 wrote to memory of 524	2636	msedgewebview2.exe	110
PID 2636 wrote to memory of 524	2636	msedgewebview2.exe	110

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\Retrac_3.0.8_x64_en-US.msi
1⤵
- Badlisted process makes network request
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:756
- C:\Program Files\Retrac\retrac.exe
  "C:\Program Files\Retrac\retrac.exe"
  2⤵
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - Modifies trusted root certificate store through registry
  - Modifies registry class
  - Modifies system certificate store
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:4540
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=retrac.exe --webview-exe-version=3.0.8 --user-data-dir="C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --lang=en-US --mojo-named-platform-channel-pipe=4540.3612.4857172120279773705
    3⤵
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of WriteProcessMemory
    PID:2636
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0x15c,0x160,0x164,0x138,0x16c,0x7ffbe879b078,0x7ffbe879b084,0x7ffbe879b090
      4⤵
      PID:2872
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView" --webview-exe-name=retrac.exe --webview-exe-version=3.0.8 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1700,i,5691595732764197836,2483432409604335991,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=1688 /prefetch:2
      4⤵
      PID:3024
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView" --webview-exe-name=retrac.exe --webview-exe-version=3.0.8 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2028,i,5691595732764197836,2483432409604335991,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=2052 /prefetch:3
      4⤵
      PID:2280
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView" --webview-exe-name=retrac.exe --webview-exe-version=3.0.8 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=1744,i,5691595732764197836,2483432409604335991,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=2388 /prefetch:8
      4⤵
      PID:3572
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView" --webview-exe-name=retrac.exe --webview-exe-version=3.0.8 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3648,i,5691595732764197836,2483432409604335991,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=3656 /prefetch:1
      4⤵
      PID:524

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2200
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 92255B78341D04723E0291853FEE0838 C
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:2596
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:4928

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
PID:3740

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Installer Packages

T1546.016

Privilege Escalation

Event Triggered Execution

T1546

Installer Packages

T1546.016

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

System Binary Proxy Execution

T1218

Msiexec

T1218.007

Credential Access

Discovery

Network Share Discovery

T1135

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e585f23.rbs

Path C:\Config.Msi\e585f23.rbs
Size 10KB
SHA256 b6a7519268c975984860aadcb24577189916b139d62bf756be596fcba0b89873
MD5 3601fb681124d29f3e60488fd424c5a8
SHA1 f028dd284bd454465436994f5e26a4de08abec62
SHA512 4d017b76ced9e7187c758f69a117ad6f0a5498b48fff69dc9069cdbae1f3f91f8be55a82abe2e07a68ac3c418bb7a0ccfa3d13b40b05142664ced7d3bedb6c9c
SSDEEP 192:WbvcD7AleLonuGvnuuTxbiIM4oWRiMupBCv:WbvcD7ADnhnnGbq
TLSH
T1E022FE42B740C2D2E9931B74DB4727263BB2DA988315674B1BCE74248F833D95E9A1CB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

retrac.exe

Path C:\Program Files\Retrac\retrac.exe
Size 26.0MB
SHA256 2550eee702fb10f576042a913674938b4a4becdcf9b887853dbaef46d6f90bd2
MD5 789fb187c94581916bd728ce786ce972
SHA1 aaacb9eeca073c4a727ec0b7a5264db1479bd7ec
SHA512 4e333b330dd94204694c2355521dad82fc01dab2acdd90453c7dccd3e8e1fe1b3fc389bd1a22a0671e871741c515a0d77301f62891eb49ac39a12189c6f60cc1
SSDEEP 393216:WYq62DqPMcqO0BwUdrsPAQK1Jmii8l/RlpLFo:WYq/O7BfPW1JNl/1
TLSH
T128575B207B9AA96DD05AC47483878A724A7130DB0B35B9FF44D496783F6DBF42F38258
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Retrac.lnk~RFe586359.TMP

Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Retrac\Retrac.lnk~RFe586359.TMP
Size 1KB
SHA256 3d83de50d7b51a3835a65e08591f29a50618727cb60e42070772b81ccc47b4c9
MD5 5af924e7e8666c3c37f82603913a64b6
SHA1 124396bb0d0686c8b88a01f91276af7d1eb5e15d
SHA512 e832eda97016cc83e2398a1371120e61287c9da048c5150e73972678dec52b4602e511a87228ca721f6e10d67ce0c7ce50c12a7f0107760e8aad7305058f8447
TLSH
T1A841AF0027E12715F3739735AEB51A21DE36BC02B6319F2B428741CB0472541993DF2F
MD5 SHA1 SHA512 TLSH

Submit Download

~etrac.tmp

Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Retrac\~etrac.tmp
Size 1KB
SHA256 acb98454f22d287e88cea02353dbc7b1726a73c6f9eba3e1286a29ac002b808c
MD5 6c25b46232fa34ba2a7dc3f044893ede
SHA1 38a02e55879d830053dac1bdcb4af93b12d64377
SHA512 2f6ed526fcc147fd347bd2ac2f3367e854e76be7ff50034e11e3e4bee07b0c86d936808a6b663ad7e8e09ff44cf593d2c848c4a1a7911df0e8067a2e75e3bc52
TLSH
T13C41BB0067E02705F3738635A9B91A229E36BC12F6358F3E428741CB09B6841993CF2F
MD5 SHA1 SHA512 TLSH

Submit Download

698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
Size 471B
SHA256 84bd2f8e8edf2c1e8faf64423787c6f281fd81bd2c2761a68bd507996b14de46
MD5 d1ed34b663b9e2877dc3495755dada78
SHA1 378c9565e5b414c335f917b661abd6604541540e
SHA512 b6e0d96315a3ddf142a70fbdb90bd4826ac2b290320cccd1e76183d871215028ad3080c9d3c740aca73977c370cf26d444dd9cd480dbaa49f682b7cf1a208422
TLSH
T1D5F0DC5F60ABA5B72413E71C02F848753560B90F05DA817B60347DF882072F5634A10A
MD5 SHA1 SHA512 TLSH

Submit Download

8EC9B1D0ABBD7F98B401D425828828CE_B989BB1CBF9ED0A18C88CA75EE4B928E

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EC9B1D0ABBD7F98B401D425828828CE_B989BB1CBF9ED0A18C88CA75EE4B928E
Size 727B
SHA256 013ac05190e50efdf5e4e84d0c9bbd5aee3d149d94cec0c2c5afe89caa3c4d2f
MD5 f1a8e465d797b6bd6ef341cabd950ce8
SHA1 10855be83e4a75f89732ae56192a66e21cea3725
SHA512 55f9be19501b1af4b8ad69bee20d3182d458098722450da338b0c790efa7684f3a550b2e5966ea6903d3acfd12475f7ff76d5dbef6512894fe0ada2cae7a3351
TLSH
T1AA011042581C8845A429AD59EFE0AB783E4102152EA601AF24371631E8E83E1AE47EB0
MD5 SHA1 SHA512 TLSH

Submit Download

C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
Size 727B
SHA256 31530c48d4b9d2903020d05bed553129a4d2c0b8df2d03b5bb4a961f28b95e15
MD5 595f943224a4fc59819f628db5fbb73b
SHA1 26f34a0db5aaef84be8bab25f1f0c095fc7717d3
SHA512 7f22b240f4d237f208dfaf0816e06ca52a4545c1d82b1d0e10369c07be85426953ae641357e0835ae29c4d4ce504c5474e0459f491cb7da0e69707853d173c72
TLSH
T13801659A487E17027823192BE7ACD0FFF33D95A6255801AD607401CEB3B9B644C19220
MD5 SHA1 SHA512 TLSH

Submit Download

698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
Size 400B
SHA256 8b6de17b6b0e99c1d7a098bac50b127c5892f527b355f1680d36bc2673e8f43d
MD5 4bedddf2f4ea9a89ca821fab7fbd9688
SHA1 af64495f63277d77c575193b74be045a297017dc
SHA512 e622d7ebd429f36a1d4c9bc7e95c19ad24f624ac9d1a758ffa0c868e4c1535a7e71c91741a19a47b8a3543a6d7309774e5c0e2906d5382515903ea2c22663d37
TLSH
T126E0203017FA516FF17097B403F690D76F29F1022D45A77D0E81552D9D1AA404D63D31
MD5 SHA1 SHA512 TLSH

Submit Download

8EC9B1D0ABBD7F98B401D425828828CE_B989BB1CBF9ED0A18C88CA75EE4B928E

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_B989BB1CBF9ED0A18C88CA75EE4B928E
Size 408B
SHA256 9db5fea9e9afbde7630e36afe7f389cce43e72d3bd333f1ce71204c35e978e8a
MD5 1355d019f0af540441f2f2919f319bf0
SHA1 ee251862dbdaaa6654023dcf1a18c257763e9be1
SHA512 24caccdd93b6b4b23892662fa118a0e9fa5fea85fb91317bdc0c7263c8d14639e1822d85c93c528d457c9b78f1e373977f0cc8dfc868dde43b349a6964ff60b1
TLSH
T182E0C03036FA851DF4F0D47502E56E23480FF20A0645937516403706AF15F404CB1534
MD5 SHA1 SHA512 TLSH

Submit Download

C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
Size 412B
SHA256 4ffe27cd9e159ff0d8613474dacba86071bcb6e4594f3919459aa5d35957936d
MD5 d24144b45085a0a35e494a8c5610a81b
SHA1 a8c018a503313020f00874524b4589f3d7668ca7
SHA512 2273f7bb578b32b2ed1f485505ad7210dd3e93f13eb3dc62dd1a841845387d889a9c758404b938b45c7e87bfbaf9a7e283bef856fffa5c145d4ba76cee1dd53d
TLSH
T147E0682822EBA41EF1508C3042FAA0B21D48F309640887790680430CB70EE00AC21BB4
MD5 SHA1 SHA512 TLSH

Submit Download

MSIB65.tmp

Path C:\Users\Admin\AppData\Local\Temp\MSIB65.tmp
Size 132KB
SHA256 7f47d98ab25cfea9b3a2e898c3376cc9ba1cd893b4948b0c27caa530fd0e34cc
MD5 cfbb8568bd3711a97e6124c56fcfa8d9
SHA1 d7a098ae58bdd5e93a3c1b04b3d69a14234d5e57
SHA512 860cbf3286ac4915580cefaf56a9c3d48938eb08e3f31b7f024c4339c037d7c8bdf16e766d08106505ba535be4922a87dc46bd029aae99a64ea2fc02cf3aec04
SSDEEP 3072:Kx2YbpcgwmiTPJDnCO+DATkURBnrskNwPj2:XXgwmY1CPx2XG2
TLSH
T1DBD39D02B5D0C473D9BE09390870DB229F7EB930DF909EDB636856699E702C19E35A37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 3662f1b04aaa907d18ac2bf7017354ad51d1627b85a2e9b59124725be36d9ca2
MD5 cfa59ea06607a6e26a5f5f2a32fea86e
SHA1 f59e2ce1c5b085b42cb4840d178f6e44785ee561
SHA512 34f9dc8dc4a321aa5e765e091e34db1572bce85dcae008d87747c7ec1388d125ed8d924df6bd95dc1c4d5c3ceb1483b7a624146d6c54b7183a88e67ab720eb36
TLSH
T14FD0122232014574C81031731102A50C1401C61B410980005429DA1D2E080904A1A451
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 080851f1234c835c22201ce232601c26cfa74130cfcdc091bb407bfcb9071ed6
MD5 dc00edfbed831cd6e0de7106be86adfa
SHA1 dd7b41a21dc03dac3e4688dd3ec70fb4f8785dd6
SHA512 7d62db8a7ac90e7701eb5c6fa7ad373f1d3737b96179fa4939069e8e9d838718f31bff610aae5baa9e77ea68f22c32751b1c20b8d6e4c19eaa74794a6ec47c25
MD5 SHA1 SHA512

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 72B
SHA256 c24fa32c31ec96455e73c31d9e579249f48e9f26890ce12effd8eaf23c83fe16
MD5 76d7451b54832a3777fc2b95a72aeab2
SHA1 18adaee473f1af8dc6a9ea901107ed36e2ad2356
SHA512 7860fc1f900dc945c42eeb6f392e5086ed0ae82efae9157beb145a754c2070b79e47137776690c5b3feb7d91e43b8bcc1355694e50f70f64be5e560e4efc227a
TLSH
T1BBA002240E455882F9770BB060C143517238EC348EEF66C140A1637BC9B0744E117161
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 48B
SHA256 b74f84aea8a38f4790d4ce5030c88b5443ed82b597d3a695818504c197b52a64
MD5 c1df83e720f13577bd4f27a067138ac0
SHA1 8ae270a37854d5fb85f2bf8934903efaf049d51a
SHA512 032f7410bd5f316ca62686cc72deae7391f5a778266572164201215f4043ed9a75c7f1325c377021f8daae8429dbb14ea722b29bed799a86fef9596c32e01ded
MD5 SHA1 SHA512

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView\Default\DawnGraphiteCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView\Default\DawnWebGPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView\Default\DawnWebGPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView\Default\DawnWebGPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView\Default\Extension Rules\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State~RFe599f82.TMP

Path C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView\Default\Network\Network Persistent State~RFe599f82.TMP
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView\Default\Preferences
Size 6KB
SHA256 3acf5e6727e4dd0dc8acbb607b7b5c6bd1fe6128a274aa4cb7c1ef7aa2a803dd
MD5 db7cf10dfe06e57ef898c0adf7575792
SHA1 5bf3599202fd3cfe625ccb93a3f51d6c4dd5df4a
SHA512 2bb9d10e5ea81b4ac9d56492df673e44509de9687e94b3e09a70cb3d0c527a76ab68034aa7d01c914a7a3adeb97fddd92a92118c4bd95f7c15cf8f9ff5be420e
SSDEEP 96:stv705qLBMb9CQffqXZ8i0vhEykt7m/7qx+WVHMSm+uecJmd1idQj0P+gGJ6tMOB:stT0YUf4Z8paRq/S+WiTmdwdXPQItMC
TLSH
T1AAE1E9429E2869774CCBF6197A35BF12E2F5606226C40F98EBFD861C05E66CC530BD0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView\Default\Preferences
Size 6KB
SHA256 80dcdf848fadeb099df2600cdc7278b077137b2cfbdfb6acde9e292fb8ac0f11
MD5 fd3990fecb8b2c66c60faf17fa5ae137
SHA1 5068a037cd71a5bd8806160132278ab870587a68
SHA512 bb03b40d7912c93af752f0bcb125d7a9b7db5152ded3e65fa7bf119807c2770bd455908bae22ebd98c0f4d9be5d491b4a23cc645d0bf0b84680c01d7e7fd4c77
SSDEEP 96:stv705qLBMb9DQffqXZ8i0vhEykt7m/7qx+WVHMSm+uecJmd1idQj0P+gG4stMEB:stT0YZf4Z8paRq/S+WiTmdwdXPQ9tM8
TLSH
T15FD1B9429E2869774CCBF2197E35BB12E2F9606267D40E98EBFD851C08D66CC530BD0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences~RFe58dfeb.TMP

Path C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView\Default\Preferences~RFe58dfeb.TMP
Size 6KB
SHA256 131bb6830465dd2685b3856f7af017cf6256582f4c1a7dc4d598ced29596e831
MD5 e6710706fed446bc1a39b34a5daa7f55
SHA1 7e5cef7b092360795ae440a9c02efee05e29ee44
SHA512 a43cef567fe3a1938f0fb951b14a8fe6b2610d2562d9d73739c2f03b106ba21ecac674ee51c137d0d5ec652ae2a8406451b47d9718729cca2839af4b106196ba
SSDEEP 96:stv705sLBMb9DQffwdZ8i0oEykt7m/7qx+WVHMSm+uecJmd1idQj0P+gGKtMEB:stT0eZfOZ8pFRq/S+WiTmdwdXPQKtM8
TLSH
T10AD1CA425E2879774CCBF20D7A36BB16D2F6506167D50E98EBFE852C08D55CC520BD0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView\Default\Site Characteristics Database\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView\Local State
Size 16KB
SHA256 44b60abb5bfd8b5adaa8cbc781c41a70447d7c1dd3c93eb4384fb7842489c95d
MD5 28d0f8caa7fe0b683332aceea21913bb
SHA1 7871c4e0d8bae52b3d8e5c9c2b1feba045ffb600
SHA512 b5860113ed579637d7b5d9410362709e0932c16286d35fa8fc820297384aaf1fec2a8c193e6b3a557ce9f736fe89aae03a6cf63c1575cdd89d46c3d94bdba335
SSDEEP 384:zJ+aQikB+z/xvxjg/qhENNb7vMWn2UqO5Q9zi:Y/UxvxjgC+DFn2UqO5QFi
TLSH
T1A8729D2B94A96E2398F3F904795D1B5BCAB484A291C12FF84EEE2F0D02C72D81702D16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView\Local State
Size 4KB
SHA256 04630b0dac2ae8e6edade42d0927e16b3213841cfb5d37362481bfe9f9552575
MD5 98771de7c5cddef1ee49f76f6470b9b3
SHA1 d48b770feecf2eeb51fcfc96ec777a22532e8872
SHA512 9e6c103986a619b50d795bc01cc2c0090efaa337dc318538e9c16649d0f8f41dbde20966335a68cf5f58d0e15de0ee2788ef89391b7b37b24e144c9ed7fe41bc
SSDEEP 96:zuTtrNkCE1fHD4ca/8Frh/cInURoDoto+5p4NDNBHZ26hQZavTslMa:zotrNbKs6ooDUhKTHZ/L4
TLSH
T10491A662A4A4A9374CF3E645B8463F17AA609023D9D53FE9CAEE0F1C02D72DC2742C17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView\Local State
Size 1KB
SHA256 0924a2a0339fa55681c58c1cb8ac3d4d8fb70fcc451cee652b9d12cae79beb05
MD5 b719d8e7b6055806272b462e9049340b
SHA1 cd29df808e85fd08b1d1d5648b010a3a3bf42833
SHA512 2da4c197962af6f17bcc66ee75505c1b3ce1598931cfe82b7e41891a9173d39311e0e28278a5ec0ea0b0e4c920aadaa800b0b4e3c8b3546a35397bbe90df9ea9
TLSH
T1E23162F2D0C06A3A1CD2B28579566B175D109126D2584F9892CF471C43D35DCAA2AC33
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView\Local State
Size 2KB
SHA256 0c822d891b4bae94b6419ee6675646cf3c07862efcfde9bda3cb5e4d54033963
MD5 99decb6886ba86c131e82422e24a750e
SHA1 5c41a671383788dbb0af2fae5a2a16e4fbdbaa37
SHA512 1c21d4bfe709a7b492723c864b7079b1700b56275276d5d186a3aae408d5c924fc2e1756b8a24cc1c030c5520d5b59ae890f5e67ac16b65497fe06c18ca56850
TLSH
T1B151D8B3A884AA3B4CE3A6447D4B3F239D359161DB552FA49ACF0B1C42D75AC2702C23
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView\Local State
Size 3KB
SHA256 d3154fa73d2e8f4e68fd1fdba9b09d96874847bf4b32ef6ecdb90edf5403f43d
MD5 c86cb69b8ae84dc9f1938ba15f0fe75a
SHA1 06e75e212629b2ba36a92950c0799ec70da78861
SHA512 5677715eea47f90af32e7c335c4d1736b557180ae584c51baf4223be3c238a7839c6cfd85e5e5aff9d21576cdabefd4a4395c9f927d338696549ea00e19b5a4d
TLSH
T14B71B976A494E93B0DE3EA44BC863B16BA559133D6D43FA8CADE0F1D02D72D82342C13
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView\Local State
Size 4KB
SHA256 23022a5a51ae98f94d0f70fdbad6e1b5e5c61c406ff4455bbf6ef685e88b7685
MD5 534aa558d88bf8548809937f7c79aa8d
SHA1 65dc2256bb7d78421b3ffae7850c309adef55ad8
SHA512 5942e6d00c9ea496a5574f2a8ceecd8790367c9187a815d4cb69079327559efbb07b3ef79a91f7083d9625477320f1744b3028f67b1ffd5c2d7b09517649d56b
SSDEEP 96:zuTtbNkCE1fHD4ca/8Frh/cInURoDoto+5p4NDNBHZ26hQZavTslMa:zotbNbKs6ooDUhKTHZ/L4
TLSH
T14B91A662A4A4A9374CF3EA45BD463F13AAA19023D5953FE9CADE0F1C42D72DC1342C17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State~RFe587829.TMP

Path C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView\Local State~RFe587829.TMP
Size 1KB
SHA256 c8cb307f73faf08f1a0ede6078f5f34a79f51a911539a6098a5772306ca8319b
MD5 cfec56d5b6ab76d5c8783df1f7a38656
SHA1 4cf5d23882470e4a26fe4d5056a1ecf6c3df353b
SHA512 8f82f2979d7c6c427aebbee4419660449f2c8685acd20e028b0673ace065dba9dae1a0954b4ebcef9b18f43e48e0d75c0705d41599166052fe5dcddd51081342
TLSH
T1D32142F3C0C4A97A2892B685B957AB061D10912692584B5CD1CF431D43D74ED9A26C33
MD5 SHA1 SHA512 TLSH

Submit Download

e585f22.msi

Path C:\Windows\Installer\e585f22.msi
Size 14.4MB
SHA256 f25ac4aed0f36abdb2f0ea2cdb67e4249d7d70467718f718445559cf4e0ffd89
MD5 965f3d0bff58a004b2642bf6d637dedc
SHA1 1c65936cb7545559f090173a494ff1bc2839f1eb
SHA512 68baec2ebd5d6b4eecc6190eb02265572ed952f609423399d5cb5e3f7dd43c8c0e005491bd52be72fdb289f700cfcadee33caea80ca30bf7f5cd5b60fcd2f28d
SSDEEP 393216:Xgwqa+Wmti6d4hGDOQ1X0ADGK/pC6HuAhUO2bJRA:wwc1fdMvFADZ/pCJAhUFN+
TLSH
T151E633873D96DB11C8A21D7A44BBC3A822387D400624D9A777DCB82DDEF23C095769DE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata-2

Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
Size 24.1MB
SHA256 e7ea6620f94017a9d4cd5369ff6618a6b8b10eb5f9433eec635fc527894f35e5
MD5 bdfcbae5461c2a19523444a00e4f4b7a
SHA1 6baeb2255bd361ebad6390fe2cc562618feda9b0
SHA512 526d9b05df04b65075725548b9414527a251371cec2165b0c3c59fa7fb017212fcf0480f8e578c6fe278d86074d30d6a32b872f9db5a7f71f7c248228358720f
SSDEEP 24576:Tu8m+1zxdoO/vvTLLWceJma49F0zEVsCwqmteTtlUU6tOrFhov1Fk63Rp:5
TLSH
T13E47C22836F92200F7F79E3D68F46A274D3A7D5B9C159E8D05811B4E0921FB0E872F5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{a07e3063-87c9-42c1-a1e2-80036efe63be}_OnDiskSnapshotProp

Path \??\Volume{cd0aa2ae-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{a07e3063-87c9-42c1-a1e2-80036efe63be}_OnDiskSnapshotProp
Size 6KB
SHA256 fcae898bc8fcf6806ca5aa10b3eea56a928789f2297f5e06a24b04b545427da3
MD5 23d946f21350135597f398032b899de5
SHA1 6e99f740ee9b9e381fb275f5c9221958a9073053
SHA512 b1e13dcd975d7c42c2dfdb21ca02827de8fffc408d116fe0b14b37fcedc52bd616cbcfd9892326b9ef4ad9e5588c898e458de78ee27d59f50a924314e37c556d
SSDEEP 96:F+DVctsnvc8DD84LTHzbOHXOHBlBRQ88Sc9XE56tOSVQpu:4DLb++ZVm
TLSH
T175D19A085AF54311E2B3AB3228F54557A877B911EF33CB8E0198238E6630A10F835F5F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/524-201-0x00007FFC087A0000-0x00007FFC087A1000-memory.dmp

Download

memory/3024-269-0x000001E002540000-0x000001E0025ED000-memory.dmp

Download

memory/3024-85-0x00007FFC087A0000-0x00007FFC087A1000-memory.dmp

Download

memory/3572-272-0x0000020002D30000-0x0000020002D60000-memory.dmp

Download

memory/3572-107-0x00007FFC06E60000-0x00007FFC06E61000-memory.dmp

Download

memory/3572-108-0x00007FFC06E70000-0x00007FFC06E71000-memory.dmp

Download