f25ac4aed0f36abdb2f0ea2cdb67e4249d7d70467718f718445559cf4e0ffd89

Analysis

user interaction
yes
max time kernel
83s
max time network
154s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
06/08/2026, 18:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Retrac_3.0.8_x64_en-US.msi
Size 14.4MB
Sample260806-w2pd6sgp21
SHA256 f25ac4aed0f36abdb2f0ea2cdb67e4249d7d70467718f718445559cf4e0ffd89
MD5 965f3d0bff58a004b2642bf6d637dedc
SHA1 1c65936cb7545559f090173a494ff1bc2839f1eb
SHA512 68baec2ebd5d6b4eecc6190eb02265572ed952f609423399d5cb5e3f7dd43c8c0e005491bd52be72fdb289f700cfcadee33caea80ca30bf7f5cd5b60fcd2f28d
SSDEEP 393216:Xgwqa+Wmti6d4hGDOQ1X0ADGK/pC6HuAhUO2bJRA:wwc1fdMvFADZ/pCJAhUFN+
TLSH
T151E633873D96DB11C8A21D7A44BBC3A822387D400624D9A777DCB82DDEF23C095769DE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery persistence privilege_escalation ransomware spyware trojan

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1280	retrac.exe

Loads dropped DLL 1 IoCs

pid	Process
5000	MsiExec.exe

Badlisted process makes network request 1 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
3	4528	msiexec.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	retrac.exe

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
1	discord.com
64	discord.com

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files\Retrac\Uninstall Retrac.lnk	msiexec.exe
File created	C:\Program Files\Retrac\retrac.exe	msiexec.exe

Drops file in Windows directory 14 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\MSIE98.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\{F2567F58-5A4A-4F82-886D-ED5C11F380BE}\ProductIcon	msiexec.exe
File created	C:\Windows\Installer\e5a0919.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e5a0919.msi	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\Installer\{F2567F58-5A4A-4F82-886D-ED5C11F380BE}\ProductIcon	msiexec.exe
File created	C:\Windows\Installer\e5a091b.msi	msiexec.exe
File created	C:\Windows\SystemTemp\~DF0F399911FE4D0F71.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DF18FE0385DEA5237A.TMP	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\SystemTemp\~DF5ECFF81D5B92F90F.TMP	msiexec.exe
File created	C:\Windows\Installer\SourceHash{F2567F58-5A4A-4F82-886D-ED5C11F380BE}	msiexec.exe
File created	C:\Windows\SystemTemp\~DFF4664354FE62A52A.TMP	msiexec.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs

persistence privilege_escalation

Installer Packages

T1546.016

Msiexec

T1218.007

pid	Process
4528	msiexec.exe

Modifies trusted root certificate store through registry 1 TTPs 2 IoCs

A root certificate was added, modified, or removed in the trusted certificate store registry paths.

defense_evasion

Install Root Certificate

T1553.004

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 6b000000010000002000000096bcec06264976f37460779acf28c5a7cfe8a3c0aae11a8ffcee05c0bddf08c61900000001000000100000002fe1f70bb05d7c92335bc5e05b984da6030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f6314000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e20000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	retrac.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 5c00000001000000040000000010000014000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e0f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f63030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e81900000001000000100000002fe1f70bb05d7c92335bc5e05b984da66b000000010000002000000096bcec06264976f37460779acf28c5a7cfe8a3c0aae11a8ffcee05c0bddf08c620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	retrac.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
916	chrome.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000cb7618cb91d4c6300000000000000000000000000000000000000000000000000000000000000000000000000000000000001071020000000000c0120000000000000000000000002701010000883801cb7618cb0000000000001071020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d0830200000000006025c501000000000000000000000700010000e84101cb7618cb000000000000d08302000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9c701000000000000050000000000000000000000070001000098d4e3cb7618cb00000000000030a9c7010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9cc0100000000000005000000000000000000000007000100009854e6cb7618cb00000000000030a9cc01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe

Modifies registry class 46 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\retrac\shell\open	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\85F7652FA4A528F488D6DEC5113F08EB\Environment = "MainProgram"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\85F7652FA4A528F488D6DEC5113F08EB\ProductIcon = "C:\\Windows\\Installer\\{F2567F58-5A4A-4F82-886D-ED5C11F380BE}\\ProductIcon"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\85F7652FA4A528F488D6DEC5113F08EB\SourceList\Net	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\85F7652FA4A528F488D6DEC5113F08EB\SourceList\Media	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\85F7652FA4A528F488D6DEC5113F08EB\DeploymentFlags = "3"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\retrac	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\retrac\ = "URL: protocol"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\retrac\DefaultIcon	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\85F7652FA4A528F488D6DEC5113F08EB\External	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\85F7652FA4A528F488D6DEC5113F08EB\Language = "0"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\85F7652FA4A528F488D6DEC5113F08EB\Version = "50331656"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\85F7652FA4A528F488D6DEC5113F08EB\SourceList\PackageName = "Retrac_3.0.8_x64_en-US.msi"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\85F7652FA4A528F488D6DEC5113F08EB	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\85F7652FA4A528F488D6DEC5113F08EB\ShortcutsFeature = "MainProgram"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\85F7652FA4A528F488D6DEC5113F08EB\InstanceType = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\85F7652FA4A528F488D6DEC5113F08EB\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\retrac	retrac.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\retrac\ = "URL:launcher.retrac.site protocol"	retrac.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\retrac\URL Protocol	retrac.exe
Key created	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\retrac\shell	retrac.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\85F7652FA4A528F488D6DEC5113F08EB\ProductName = "Retrac"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\D39F67BF21D37C75581F63A03A3CC6BF	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\retrac\shell\open\command\ = "\"C:\\PROGRA~1\\Retrac\\retrac.exe\" \"%1\""	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\85F7652FA4A528F488D6DEC5113F08EB\Clients = 3a0000000000	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\retrac\DefaultIcon	retrac.exe
Key created	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\retrac\shell\open\command	retrac.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\85F7652FA4A528F488D6DEC5113F08EB\AdvertiseFlags = "388"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\retrac\shell\open\command	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\retrac	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\retrac\URL Protocol	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\retrac\shell\open\command	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\85F7652FA4A528F488D6DEC5113F08EB\Assignment = "1"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\D39F67BF21D37C75581F63A03A3CC6BF\85F7652FA4A528F488D6DEC5113F08EB	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\85F7652FA4A528F488D6DEC5113F08EB\SourceList	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\85F7652FA4A528F488D6DEC5113F08EB\SourceList\Media\1 = ";"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\retrac\shell\open	retrac.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\retrac\shell\open\command\ = "\"C:\\Program Files\\Retrac\\retrac.exe\" \"%1\""	retrac.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\retrac\DefaultIcon\ = "\"C:\\PROGRA~1\\Retrac\\retrac.exe\",0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\85F7652FA4A528F488D6DEC5113F08EB\MainProgram	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\85F7652FA4A528F488D6DEC5113F08EB	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\85F7652FA4A528F488D6DEC5113F08EB\PackageCode = "6AFF5C71F42D1914DA5EF303DCA200A2"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\85F7652FA4A528F488D6DEC5113F08EB\AuthorizedLUAApp = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\85F7652FA4A528F488D6DEC5113F08EB\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\retrac\DefaultIcon\ = "C:\\Program Files\\Retrac\\retrac.exe,0"	retrac.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\retrac\shell	msiexec.exe

Modifies system certificate store 2 TTPs 1 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8	retrac.exe

Suspicious behavior: EnumeratesProcesses 30 IoCs

pid	Process
3316	msiexec.exe
3316	msiexec.exe
1280	retrac.exe
1280	retrac.exe
1280	retrac.exe
1280	retrac.exe
1280	retrac.exe
1280	retrac.exe
1280	retrac.exe
1280	retrac.exe
1280	retrac.exe
1280	retrac.exe
1280	retrac.exe
1280	retrac.exe
1280	retrac.exe
1280	retrac.exe
1280	retrac.exe
1280	retrac.exe
1280	retrac.exe
1280	retrac.exe
1280	retrac.exe
1280	retrac.exe
1280	retrac.exe
1280	retrac.exe
1280	retrac.exe
1280	retrac.exe
3304	chrome.exe
3304	chrome.exe
1280	retrac.exe
1280	retrac.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
6088	msedgewebview2.exe
3304	chrome.exe
3304	chrome.exe
3304	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4528	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4528	msiexec.exe
Token: SeSecurityPrivilege	3316	msiexec.exe
Token: SeCreateTokenPrivilege	4528	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	4528	msiexec.exe
Token: SeLockMemoryPrivilege	4528	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4528	msiexec.exe
Token: SeMachineAccountPrivilege	4528	msiexec.exe
Token: SeTcbPrivilege	4528	msiexec.exe
Token: SeSecurityPrivilege	4528	msiexec.exe
Token: SeTakeOwnershipPrivilege	4528	msiexec.exe
Token: SeLoadDriverPrivilege	4528	msiexec.exe
Token: SeSystemProfilePrivilege	4528	msiexec.exe
Token: SeSystemtimePrivilege	4528	msiexec.exe
Token: SeProfSingleProcessPrivilege	4528	msiexec.exe
Token: SeIncBasePriorityPrivilege	4528	msiexec.exe
Token: SeCreatePagefilePrivilege	4528	msiexec.exe
Token: SeCreatePermanentPrivilege	4528	msiexec.exe
Token: SeBackupPrivilege	4528	msiexec.exe
Token: SeRestorePrivilege	4528	msiexec.exe
Token: SeShutdownPrivilege	4528	msiexec.exe
Token: SeDebugPrivilege	4528	msiexec.exe
Token: SeAuditPrivilege	4528	msiexec.exe
Token: SeSystemEnvironmentPrivilege	4528	msiexec.exe
Token: SeChangeNotifyPrivilege	4528	msiexec.exe
Token: SeRemoteShutdownPrivilege	4528	msiexec.exe
Token: SeUndockPrivilege	4528	msiexec.exe
Token: SeSyncAgentPrivilege	4528	msiexec.exe
Token: SeEnableDelegationPrivilege	4528	msiexec.exe
Token: SeManageVolumePrivilege	4528	msiexec.exe
Token: SeImpersonatePrivilege	4528	msiexec.exe
Token: SeCreateGlobalPrivilege	4528	msiexec.exe
Token: SeCreateTokenPrivilege	4528	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	4528	msiexec.exe
Token: SeLockMemoryPrivilege	4528	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4528	msiexec.exe
Token: SeMachineAccountPrivilege	4528	msiexec.exe
Token: SeTcbPrivilege	4528	msiexec.exe
Token: SeSecurityPrivilege	4528	msiexec.exe
Token: SeTakeOwnershipPrivilege	4528	msiexec.exe
Token: SeLoadDriverPrivilege	4528	msiexec.exe
Token: SeSystemProfilePrivilege	4528	msiexec.exe
Token: SeSystemtimePrivilege	4528	msiexec.exe
Token: SeProfSingleProcessPrivilege	4528	msiexec.exe
Token: SeIncBasePriorityPrivilege	4528	msiexec.exe
Token: SeCreatePagefilePrivilege	4528	msiexec.exe
Token: SeCreatePermanentPrivilege	4528	msiexec.exe
Token: SeBackupPrivilege	4528	msiexec.exe
Token: SeRestorePrivilege	4528	msiexec.exe
Token: SeShutdownPrivilege	4528	msiexec.exe
Token: SeDebugPrivilege	4528	msiexec.exe
Token: SeAuditPrivilege	4528	msiexec.exe
Token: SeSystemEnvironmentPrivilege	4528	msiexec.exe
Token: SeChangeNotifyPrivilege	4528	msiexec.exe
Token: SeRemoteShutdownPrivilege	4528	msiexec.exe
Token: SeUndockPrivilege	4528	msiexec.exe
Token: SeSyncAgentPrivilege	4528	msiexec.exe
Token: SeEnableDelegationPrivilege	4528	msiexec.exe
Token: SeManageVolumePrivilege	4528	msiexec.exe
Token: SeImpersonatePrivilege	4528	msiexec.exe
Token: SeCreateGlobalPrivilege	4528	msiexec.exe
Token: SeCreateTokenPrivilege	4528	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	4528	msiexec.exe
Token: SeLockMemoryPrivilege	4528	msiexec.exe

Suspicious use of FindShellTrayWindow 37 IoCs

pid	Process
4528	msiexec.exe
4528	msiexec.exe
1280	retrac.exe
3304	chrome.exe
3304	chrome.exe
3304	chrome.exe
3304	chrome.exe
3304	chrome.exe
3304	chrome.exe
3304	chrome.exe
3304	chrome.exe
3304	chrome.exe
3304	chrome.exe
3304	chrome.exe
3304	chrome.exe
3304	chrome.exe
3304	chrome.exe
3304	chrome.exe
3304	chrome.exe
3304	chrome.exe
3304	chrome.exe
3304	chrome.exe
3304	chrome.exe
3304	chrome.exe
3304	chrome.exe
3304	chrome.exe
3304	chrome.exe
3304	chrome.exe
3304	chrome.exe
3304	chrome.exe
3304	chrome.exe
3304	chrome.exe
3304	chrome.exe
3304	chrome.exe
3304	chrome.exe
3304	chrome.exe
3304	chrome.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
3304	chrome.exe
3304	chrome.exe
3304	chrome.exe
3304	chrome.exe
3304	chrome.exe
3304	chrome.exe
3304	chrome.exe
3304	chrome.exe
3304	chrome.exe
3304	chrome.exe
3304	chrome.exe
3304	chrome.exe
3304	chrome.exe
3304	chrome.exe
3304	chrome.exe
3304	chrome.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
4528	msiexec.exe
3316	msiexec.exe
5000	MsiExec.exe

Suspicious use of WriteProcessMemory 32 IoCs

description	pid	Process	procid_target
PID 3316 wrote to memory of 5000	3316	msiexec.exe	90
PID 3316 wrote to memory of 2480	3316	msiexec.exe	96
PID 4528 wrote to memory of 1280	4528	msiexec.exe	99
PID 1280 wrote to memory of 6088	1280	retrac.exe	100
PID 6088 wrote to memory of 2684	6088	msedgewebview2.exe	101
PID 6088 wrote to memory of 5052	6088	msedgewebview2.exe	102
PID 6088 wrote to memory of 5052	6088	msedgewebview2.exe	102
PID 6088 wrote to memory of 5052	6088	msedgewebview2.exe	102
PID 6088 wrote to memory of 5052	6088	msedgewebview2.exe	102
PID 6088 wrote to memory of 4084	6088	msedgewebview2.exe	103
PID 6088 wrote to memory of 2716	6088	msedgewebview2.exe	104
PID 6088 wrote to memory of 2716	6088	msedgewebview2.exe	104
PID 6088 wrote to memory of 2716	6088	msedgewebview2.exe	104
PID 6088 wrote to memory of 5976	6088	msedgewebview2.exe	105
PID 6088 wrote to memory of 5976	6088	msedgewebview2.exe	105
PID 6088 wrote to memory of 5976	6088	msedgewebview2.exe	105
PID 6088 wrote to memory of 5976	6088	msedgewebview2.exe	105
PID 6088 wrote to memory of 5976	6088	msedgewebview2.exe	105
PID 3304 wrote to memory of 5776	3304	chrome.exe	107
PID 3304 wrote to memory of 916	3304	chrome.exe	108
PID 3304 wrote to memory of 4816	3304	chrome.exe	110
PID 3304 wrote to memory of 4708	3304	chrome.exe	109
PID 3304 wrote to memory of 4816	3304	chrome.exe	110
PID 3304 wrote to memory of 4708	3304	chrome.exe	109
PID 3304 wrote to memory of 3904	3304	chrome.exe	112
PID 3304 wrote to memory of 3904	3304	chrome.exe	112
PID 3304 wrote to memory of 3868	3304	chrome.exe	113
PID 3304 wrote to memory of 3868	3304	chrome.exe	113
PID 3304 wrote to memory of 1960	3304	chrome.exe	114
PID 3304 wrote to memory of 1960	3304	chrome.exe	114
PID 3304 wrote to memory of 4560	3304	chrome.exe	115
PID 3304 wrote to memory of 4560	3304	chrome.exe	115

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\Retrac_3.0.8_x64_en-US.msi
1⤵
- Badlisted process makes network request
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4528
- C:\Program Files\Retrac\retrac.exe
  "C:\Program Files\Retrac\retrac.exe"
  2⤵
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - Modifies trusted root certificate store through registry
  - Modifies registry class
  - Modifies system certificate store
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:1280
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=retrac.exe --webview-exe-version=3.0.8 --user-data-dir="C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --enable-features=MojoIpcz --lang=en-US --accept-lang=en-US --mojo-named-platform-channel-pipe=1280.3464.16202659838337540844 /pfhostedapp:fd0de7e5cefc9f8a2e2a61a11d5c8b08aabc87ca
    3⤵
    - Enumerates system info in registry
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of WriteProcessMemory
    PID:6088
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView /prefetch:4 /pfhostedapp:fd0de7e5cefc9f8a2e2a61a11d5c8b08aabc87ca --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x184,0x188,0x18c,0x160,0x194,0x7ff8e5145fd8,0x7ff8e5145fe4,0x7ff8e5145ff0
      4⤵
      PID:2684
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView" --webview-exe-name=retrac.exe --webview-exe-version=3.0.8 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1768 --field-trial-handle=1772,i,13445957497505729691,16065106860349683609,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:2 /pfhostedapp:fd0de7e5cefc9f8a2e2a61a11d5c8b08aabc87ca
      4⤵
      PID:5052
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView" --webview-exe-name=retrac.exe --webview-exe-version=3.0.8 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2112 --field-trial-handle=1772,i,13445957497505729691,16065106860349683609,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:3 /pfhostedapp:fd0de7e5cefc9f8a2e2a61a11d5c8b08aabc87ca
      4⤵
      PID:4084
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView" --webview-exe-name=retrac.exe --webview-exe-version=3.0.8 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2284 --field-trial-handle=1772,i,13445957497505729691,16065106860349683609,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:fd0de7e5cefc9f8a2e2a61a11d5c8b08aabc87ca
      4⤵
      PID:2716
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView" --webview-exe-name=retrac.exe --webview-exe-version=3.0.8 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --autoplay-policy=no-user-gesture-required --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3304 --field-trial-handle=1772,i,13445957497505729691,16065106860349683609,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /pfhostedapp:fd0de7e5cefc9f8a2e2a61a11d5c8b08aabc87ca /prefetch:1
      4⤵
      PID:5976

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3316
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 3B74486BA4E768B95BE04C2CF70D74C8 C
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:5000
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:2480

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
PID:2220

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3304
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x12c,0x130,0x134,0x108,0x138,0x7ff8df72c728,0x7ff8df72c734,0x7ff8df72c740
  2⤵
  PID:5776
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1732,i,17671063703190522274,12992165008108874417,524288 --field-trial-handle=2288,i,3114324948770914764,13600433717205870679,262144 --variations-seed-version --mojo-platform-channel-handle=2316 /prefetch:11
  2⤵
  - System Time Discovery
  PID:916
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1616,i,1102501068177518075,1181957350624781640,262144 --field-trial-handle=2288,i,3114324948770914764,13600433717205870679,262144 --variations-seed-version --mojo-platform-channel-handle=2284 /prefetch:2
  2⤵
  PID:4708
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=2016,i,10670757891435508977,14400295575538932423,524288 --field-trial-handle=2288,i,3114324948770914764,13600433717205870679,262144 --variations-seed-version --mojo-platform-channel-handle=2328 /prefetch:13
  2⤵
  PID:4816
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3256,i,10483566580771521577,11462897253181170869,2097152 --field-trial-handle=2288,i,3114324948770914764,13600433717205870679,262144 --variations-seed-version --mojo-platform-channel-handle=3520 /prefetch:1
  2⤵
  PID:3904
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3252,i,6855179942645507671,3665523800201342616,2097152 --field-trial-handle=2288,i,3114324948770914764,13600433717205870679,262144 --variations-seed-version --mojo-platform-channel-handle=3500 /prefetch:1
  2⤵
  PID:3868
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4560,i,450206396560475682,13534642539021490726,2097152 --field-trial-handle=2288,i,3114324948770914764,13600433717205870679,262144 --variations-seed-version --mojo-platform-channel-handle=4736 /prefetch:1
  2⤵
  PID:1960
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4868,i,13451499923242229486,5120362825859461421,524288 --field-trial-handle=2288,i,3114324948770914764,13600433717205870679,262144 --variations-seed-version --mojo-platform-channel-handle=3944 /prefetch:14
  2⤵
  PID:4560
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5432,i,1547272411546339986,10645045741857525350,524288 --field-trial-handle=2288,i,3114324948770914764,13600433717205870679,262144 --variations-seed-version --mojo-platform-channel-handle=5372 /prefetch:14
  2⤵
  PID:5728
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5464,i,1541251986941212741,15805180736829444874,2097152 --field-trial-handle=2288,i,3114324948770914764,13600433717205870679,262144 --variations-seed-version --mojo-platform-channel-handle=5508 /prefetch:1
  2⤵
  PID:4836
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5488,i,5492697702240979214,6016719834761134073,2097152 --field-trial-handle=2288,i,3114324948770914764,13600433717205870679,262144 --variations-seed-version --mojo-platform-channel-handle=5528 /prefetch:1
  2⤵
  PID:4368
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5680,i,6358052435138104541,14743692598894389419,2097152 --field-trial-handle=2288,i,3114324948770914764,13600433717205870679,262144 --variations-seed-version --mojo-platform-channel-handle=5704 /prefetch:1
  2⤵
  PID:2244
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5472,i,14064432435419484512,12592861969960291159,2097152 --field-trial-handle=2288,i,3114324948770914764,13600433717205870679,262144 --variations-seed-version --mojo-platform-channel-handle=5460 /prefetch:1
  2⤵
  PID:6504
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6032,i,13312690839047717457,10514134029178588411,524288 --field-trial-handle=2288,i,3114324948770914764,13600433717205870679,262144 --variations-seed-version --mojo-platform-channel-handle=5824 /prefetch:14
  2⤵
  PID:6512
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=6164,i,13813821290248505155,5084776131432863510,2097152 --field-trial-handle=2288,i,3114324948770914764,13600433717205870679,262144 --variations-seed-version --mojo-platform-channel-handle=6200 /prefetch:1
  2⤵
  PID:6520
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=5672,i,11303007930972101256,17580966555202641355,2097152 --field-trial-handle=2288,i,3114324948770914764,13600433717205870679,262144 --variations-seed-version --mojo-platform-channel-handle=5680 /prefetch:1
  2⤵
  PID:6528
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --metrics-shmem-handle=6580,i,15659866252077430223,2485051756233841545,524288 --field-trial-handle=2288,i,3114324948770914764,13600433717205870679,262144 --variations-seed-version --mojo-platform-channel-handle=4488 /prefetch:12
  2⤵
  PID:6784
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=5440,i,2978043317120533337,8672142232279450947,2097152 --field-trial-handle=2288,i,3114324948770914764,13600433717205870679,262144 --variations-seed-version --mojo-platform-channel-handle=6164 /prefetch:1
  2⤵
  PID:6776
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5748,i,7308921938808907762,14044429301742657100,524288 --field-trial-handle=2288,i,3114324948770914764,13600433717205870679,262144 --variations-seed-version --mojo-platform-channel-handle=5576 /prefetch:14
  2⤵
  PID:6744
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --metrics-shmem-handle=3492,i,11112076879213203655,10495395524636435183,2097152 --field-trial-handle=2288,i,3114324948770914764,13600433717205870679,262144 --variations-seed-version --mojo-platform-channel-handle=6616 /prefetch:1
  2⤵
  PID:7000
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3692,i,11847590853722517710,10619593353378165524,524288 --field-trial-handle=2288,i,3114324948770914764,13600433717205870679,262144 --variations-seed-version --mojo-platform-channel-handle=6260 /prefetch:14
  2⤵
  PID:7008
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=6492,i,16792720598072848761,11180311203326204998,2097152 --field-trial-handle=2288,i,3114324948770914764,13600433717205870679,262144 --variations-seed-version --mojo-platform-channel-handle=6344 /prefetch:1
  2⤵
  PID:7012
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3676,i,11074716273385196985,313692388586244674,524288 --field-trial-handle=2288,i,3114324948770914764,13600433717205870679,262144 --variations-seed-version --mojo-platform-channel-handle=5960 /prefetch:14
  2⤵
  PID:7024
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3680,i,16334385121422699687,3949674650413928802,524288 --field-trial-handle=2288,i,3114324948770914764,13600433717205870679,262144 --variations-seed-version --mojo-platform-channel-handle=5648 /prefetch:14
  2⤵
  PID:7032
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --metrics-shmem-handle=6588,i,7491499247665592191,978436949615733108,2097152 --field-trial-handle=2288,i,3114324948770914764,13600433717205870679,262144 --variations-seed-version --mojo-platform-channel-handle=5440 /prefetch:1
  2⤵
  PID:4828
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --metrics-shmem-handle=5352,i,11826023155185649856,8496449877984337360,2097152 --field-trial-handle=2288,i,3114324948770914764,13600433717205870679,262144 --variations-seed-version --mojo-platform-channel-handle=260 /prefetch:1
  2⤵
  PID:6296
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6900,i,1852688658410935698,6762906778571757643,524288 --field-trial-handle=2288,i,3114324948770914764,13600433717205870679,262144 --variations-seed-version --mojo-platform-channel-handle=6360 /prefetch:14
  2⤵
  PID:4544
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --metrics-shmem-handle=5508,i,10324327888994615760,3402131131852909393,2097152 --field-trial-handle=2288,i,3114324948770914764,13600433717205870679,262144 --variations-seed-version --mojo-platform-channel-handle=4484 /prefetch:1
  2⤵
  PID:3360
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=4832,i,17790600651594667649,12207547855383673587,524288 --field-trial-handle=2288,i,3114324948770914764,13600433717205870679,262144 --variations-seed-version --mojo-platform-channel-handle=3660 /prefetch:14
  2⤵
  PID:5948
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --metrics-shmem-handle=5736,i,1717589073425935435,12372101112502851852,2097152 --field-trial-handle=2288,i,3114324948770914764,13600433717205870679,262144 --variations-seed-version --mojo-platform-channel-handle=3736 /prefetch:9
  2⤵
  PID:6732

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4444

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:6236

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
PID:6284

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Installer Packages

T1546.016

Privilege Escalation

Event Triggered Execution

T1546

Installer Packages

T1546.016

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

System Binary Proxy Execution

T1218

Msiexec

T1218.007

Credential Access

Discovery

Browser Information Discovery

T1217

Network Share Discovery

T1135

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e5a091a.rbs

Path C:\Config.Msi\e5a091a.rbs
Size 10KB
SHA256 b73bb21010828ed5293c057885a355ee5b91a93e782a6f016db48e73224a9e0d
MD5 b55ef03d11f592257aa9c584b463d09c
SHA1 6667415ced61b6e7b8858a5381277cad59ada946
SHA512 6bd6b487e36958c47a09defa58fc320b4ea9b9290ae137495bb88fb750ddef0dc4cc327276e4884f22878506c7d169fe90a5aab779628f35433cdb4c3664c58d
SSDEEP 192:L3mvcD7AyC0onuGvnuuTLbiIM4oWRiMupBCv:LWvcD7AvnhnnAbq
TLSH
T1B0220E42B744C2D2E9931B74DB0717263BB2DA988315674B0BCE75248F833D95E9A1CB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

retrac.exe

Path C:\Program Files\Retrac\retrac.exe
Size 26.0MB
SHA256 2550eee702fb10f576042a913674938b4a4becdcf9b887853dbaef46d6f90bd2
MD5 789fb187c94581916bd728ce786ce972
SHA1 aaacb9eeca073c4a727ec0b7a5264db1479bd7ec
SHA512 4e333b330dd94204694c2355521dad82fc01dab2acdd90453c7dccd3e8e1fe1b3fc389bd1a22a0671e871741c515a0d77301f62891eb49ac39a12189c6f60cc1
SSDEEP 393216:WYq62DqPMcqO0BwUdrsPAQK1Jmii8l/RlpLFo:WYq/O7BfPW1JNl/1
TLSH
T128575B207B9AA96DD05AC47483878A724A7130DB0B35B9FF44D496783F6DBF42F38258
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Retrac.lnk

Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Retrac\Retrac.lnk
Size 1KB
SHA256 ed6b097663cc7aaf64628f656dd0a3bbbed5e8a21a7d6c15ae84d5e6a092c490
MD5 724e7135f2f00fcd72da45ca96066ad0
SHA1 eb54333b56d83d3fab6254037b10c66544b5ad22
SHA512 ec9221194077cf25c318588f3593c5aad2c93efa492d046a0ccc5f5b4a367a090241193f7bd5b221b9543c14d57f8853d64d03fca01fc1e1ce6472c360f847e0
TLSH
T14F41AD0057E51B05F3734639EEBA4A11DE31BD06A6308F2F42CB41CB19759819A6DF2F
MD5 SHA1 SHA512 TLSH

Submit Download

Retrac.lnk~RFe5a1241.TMP

Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Retrac\Retrac.lnk~RFe5a1241.TMP
Size 1KB
SHA256 2bdddf51f4ca5c6c777b99cb722fe6eac4f2dfabc75d980c9ac2d0161d4e0eaf
MD5 41f86d7775007d339922e3132d946530
SHA1 72a78a8c3ca2df65c5497816bb18b6f226572184
SHA512 132705db38bec04511aaf6fc6dbeadee003124e0322bd02f46ceefbf20085522677ec52ce89c59992e8c65aa358911cda9a9d8acc2df772a10645311eaccb308
TLSH
T159419A0057E51B05F3639639EEBA4A10DE31BD02A6308F2F42DB01CB09769819A69F2F
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\en\messages.json
Size 593B
SHA256 92f1246c21dd5fd7266ebfd65798c61e403d01a816cc3cf780db5c8aa2e3d9c9
MD5 91f5bc87fd478a007ec68c4e8adf11ac
SHA1 d07dd49e4ef3b36dad7d038b7e999ae850c5bef6
SHA512 fdc2a29b04e67ddbbd8fb6e8d2443e46badcb2b2fb3a850bbd6198cdccc32ee0bd8a9769d929feefe84d1015145e6664ab5fea114df5a864cf963bf98a65ffd9
TLSH
T109F09C8CD050E86F02B2411AB1647314FB51037A0751A59F393CDC0D9FB6DA751C6F4D
MD5 SHA1 SHA512 TLSH

Submit Download

craw_background.js

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\craw_background.js
Size 531KB
SHA256 04cd9494b0ed83924dad12202630b20d053d9e2819c8e826a386c814cc0a1697
MD5 6eebed29e6a6301e92a9b8b347807f5f
SHA1 65dfb69b650560551110b33dcba50b25e5b876de
SHA512 fede6db31f2ad242e7bc7b52a8859ba7f466a0b920a8dadcb32dcfb5b2a2742e98b767ff22e0c5bc5c11fec021240aa9e458486c9039eb4ebe5cf6af7be97bf2
SSDEEP 6144:abyfBNC2FRdjiRXqbe5Dq31IVlMqX+wd5/CcMMJcRULt0NjyTOEzZQ+h72W3GB0n:Ft/g
TLSH
T1B5C4F74C34C2E8CD6A623DA5247B9085A2319266F4479ED9F0EDECF21AF44641937F3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 ac7ddbb60ab6818030943126e141bb30b5f571d36361487104e2291d63ec3f0f
MD5 dd78827e26d0ce4a917ec78bfdf7a10c
SHA1 5e4343fd281df7b7b0136d391855452f37779482
SHA512 13d16bfe814d5566744e551b6bdbc4f4ef6a9c2559106e35a83b33e489afdbf26596605b5a01c8185cfd7c27090776198654b27652b4915908e64ad007de4b21
TLSH
T194416AF3C7D4E97D890156F4A7213F2ACE290D18521C3C27D8D8AE1F57E18B2D24015E
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 80fc6c1c7c6e1548fa85e86356a99d03d40d26e68acb3472117debf1cc5b4d40
MD5 970583c573503a836ca50cbedf1c87fd
SHA1 e31a65b1b658aa6c5a63ab3c8281771017df70b1
SHA512 0a9092c69a6d098deb19e5b008fe9ea56cf96c08b5b3c95108f4eb25d96f8897bfc1ea104ef39b1b003e34a0e33afc4596da5cf55db2811bbd8a1383adeb3745
SSDEEP 192:KRQYP2uv7c0PRpq5wy9ZHsb+WNnMmtDWqMuDem0I2yCQVyIsnAUgE:KRQYuKBXibwMQvMQ0I2yCUE
TLSH
T1BF42C66EB914697B6DCBD229F921BB53D3F5102225E02F84E6FC992C15E7ACC3227407
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 5d26c57ba04be504335dcb6097ae0f16c1217820ce7c58579ae041fa786d8a82
MD5 a6a877018fc39e4a7c4f875f18c4d8e6
SHA1 a66a2aa04241da55560f4f17c2bb29804fa1d1f2
SHA512 ad25830a4740c173bdd2e9b34be2e1b683ccc356bf9eabf9ffcc4afa1d8946e5fb5f1c7a7a3691e2e94cee3349f3fc722ddd09c77e0fa732f0c2ef3dfcb10fcb
SSDEEP 192:KRaYP2uv7jAPRp25wy9ZHsb+WNnMmtD9Gc2TGDem0I2yJQVyIsnAUgR:KRaYuKqXGbwMQJ92To0I2yJUR
TLSH
T1BE32A56EBA14793B6DCBD229F9217753E3F5102225E42E84E6FC992C15E79CC3227807
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 a4956e6261500fc51003e0da3e25c2d4f4604f0a7174c2c7ff02427ee767a903
MD5 dfbd523e1bdc476cf004a8dc85077451
SHA1 47d81d8616cc6e6f054f02fdc468b9164b88c8ca
SHA512 1ecc7d7cfb3f863a9ca66bb3fefbe1f8ba1430cd67ab5cdba0bd2ca37fea00450d58fa6031c0d9178e7c016783099f74c58b28e1624a6981d988bed6bd9ce197
SSDEEP 192:KREYP2uv7jAPRp25wy9ZHsb+WNnMmtDUkemDem0I2yJQVyIsnAUgR:KREYuKqXGbwMQveI0I2yJUR
TLSH
T12332A56EBA14693B6DCBD229F9217753E3F5102225E42E84E6FC992C15E79CC3227407
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 11KB
SHA256 dd1aa31c7890bf3b0f93c881e45559449879ee98a319314e4ba5298a836457be
MD5 e45673908e18851dd79f6fa65a759a39
SHA1 a4fbd21f0a3054d3feca454b3e7629a8bfcbe4e7
SHA512 ff1f530f0243afb92ee94c043f996070646c7e5d7d73f427d5ae40966463590f7763a6eba0d2ceba49302de09cdd4919a5c2ba50dec3beaffe255fa325c67a73
SSDEEP 192:ecv4K6WE7KxkXqK4I40pUZNCgVLHrKHfFKslEYUWXzKD/ls+ErUkKN9SBWepdsrN:ZvjNE7KxkXqKf/pUZNCgVLH2HfgslGWm
TLSH
T15532C627A88E9E3B4FD8D50CDC166F8BADA542937678092493FF9D0403A97CE114A1F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\wasm\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage\2\CacheStorage\index.txt
Size 91B
SHA256 e41495b59c1f200b9a537cc899a5dcb880615457e244a2fe1c2ed0578a4dce7e
MD5 932bcc9a9ea2f03d098538d3703ba523
SHA1 fa25865ad765c1ab0496e4d0f35f39ec25eb990b
SHA512 9fcb05f8bbd9a23ac13e13dfdaaaeede3d7ac981b3ca843886e8efad4ff71c176ed2d9f398f74c4430e898c42d1547e9c45e66574972ee541bbf55a6feb9bb49
TLSH
T198B002BB504259D55F7534F7014731DDC56633CC9C85DE8D94721058321457F2001CA5
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe5ba40c.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage\2\CacheStorage\index.txt~RFe5ba40c.TMP
Size 178B
SHA256 43560e98f1e85a5b791a4b7b81ad8ae66eeb138b50e8a6a2bd76235532f923c6
MD5 db12c85e097b89d95c5e7fba7733c8ba
SHA1 340c1f9d81418b61113c9cd3cf7609dc2b7fb13d
SHA512 91529941e8b5e3e5f23882543bed557046c99f9bba34083913ea3f89a09a6d52e8109601bd47c7ab3c99b3ae80f01986fb7335e9aed44cabf31f92a871ec53d3
TLSH
T1C8C0127760C196A13F7824EB816732CDC9363FC84CC8E64C44753015613486A2611960
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 228154add60ca95a632f4cb3b6b6f68d354d3736653e03c24dc96a4eb4ae4ab5
MD5 ae3f2fb58a6f8889818180b32528733f
SHA1 c2d6932007fd33159a32f2e35bf45c1c5e2100a3
SHA512 f6c484ceddad64444a505cb9a1b935caca0c6d1be1cb8d15eec2665cb0948c01b747642f3c5835ed2881d80cc13d15135ab6057bedcabfee393f965217571f7f
SSDEEP 96:0C0d+x7oIU1fXfBVMLHRDotok5G1dD0B6nGyvLlAZZbdOv4a:0C0G7/qffEDUDG74vcAZZbe
TLSH
T177A11B71A42D5C3759B6D489FA426A53DFB570A76920AF44EDDE1F0801FB1EC1343923
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 124KB
SHA256 35fc255edb9c7f3bacf8844786797affcbf705bccadd695a1fd8652f1c47edfb
MD5 f47d350320974b2026aaa6dc54105fb8
SHA1 c7427bf6b9b650cef9d198d0f4e2bd92672bccb1
SHA512 e866376300f30127e850f840e354c8aeafbfaf904132af473213e40ab58c6d5db0a5b2278ec7ea4501f93b317520e80f922c25151358d27f046adf1ab3f2bc01
SSDEEP 3072:kYSY9Ri0QlTJOFYLp2PFMiDQxvgUEDD1C3TKkIX0EF7XX:kYSFYJkxYXDY3TxIX0sXX
TLSH
T1A7C312B3F8B6076327AE9119031B1A6BAF61F28BCDD0A29DE9C5334B5B154691B00D3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 125KB
SHA256 460b14520fec4f31b9ceab2f87f33920250bdd3cf68904a3c3d8721a39004c50
MD5 c4589c2953b64ab2dbbe65670defe054
SHA1 80f066df9b23bba411eb04e3306173d8f1e38dcc
SHA512 7c86d28359d66c55cefcc95632f60bf796229809b4678f7a738fdd9d4059e56451e62d65755b0cbea289882226b01815507d2caa57fa4dbf23bb541ee909c5ce
SSDEEP 3072:IFSY9Ri0QlTJOFYLp2PFMiDQxvgUEDD1C3TKkIX0EF7XX:IFSFYJkxYXDY3TxIX0sXX
TLSH
T1F3C312B7F8660B531ABE951C02163927AEA1F39BCDD0F59DF9C8364B5B1A4694E00C3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 124KB
SHA256 2148638c40d73e34f75a2f38a5acea57a5918d5593ba5bf84c97fbb7636a4aa4
MD5 185d3daf4fd6a19fe89f8655418e7f96
SHA1 489f92f001f86febc6a36598e9a105298611dbb4
SHA512 df114a6ff53f8f4ee1f6d01db29716cc37b311778e8ba3cb6bdd94c5150650a6b8473f702ba9a8edfd916214fbe887e433dff8c56cbbae012a163e9c55faf353
SSDEEP 3072:nYSY9Ri0QlTJOFYLp2PFMiDQxvgUEDD1C3TKkIX0EF7XX:nYSFYJkxYXDY3TxIX0sXX
TLSH
T1E9C312B3F8B6076317AEA11903171A6BBF61F28BCDD0A29DE9C5334B5B154691B00D3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSIAD4D.tmp

Path C:\Users\Admin\AppData\Local\Temp\MSIAD4D.tmp
Size 132KB
SHA256 7f47d98ab25cfea9b3a2e898c3376cc9ba1cd893b4948b0c27caa530fd0e34cc
MD5 cfbb8568bd3711a97e6124c56fcfa8d9
SHA1 d7a098ae58bdd5e93a3c1b04b3d69a14234d5e57
SHA512 860cbf3286ac4915580cefaf56a9c3d48938eb08e3f31b7f024c4339c037d7c8bdf16e766d08106505ba535be4922a87dc46bd029aae99a64ea2fc02cf3aec04
SSDEEP 3072:Kx2YbpcgwmiTPJDnCO+DATkURBnrskNwPj2:XXgwmY1CPx2XG2
TLSH
T1DBD39D02B5D0C473D9BE09390870DB229F7EB930DF909EDB636856699E702C19E35A37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3304_455167428\CRX_INSTALL\_locales\en\messages.json
Size 450B
SHA256 c0945dd5fdecab40c45361bec068d1996e6ae01196dce524266d740808f753fe
MD5 dbedf86fa9afb3a23dbb126674f166d2
SHA1 5628affbcf6f897b9d7fd9c17deb9aa75036f1cc
SHA512 931d7ba6da84d4bb073815540f35126f2f035a71bfe460f3ccaed25ad7c1b1792ab36cd7207b99fddf5eaf8872250b54a8958cf5827608f0640e8aafe11e0071
TLSH
T1D3F055CB9000FC5E538BC00EB10072282BA603E01AD1726724EC1C0E67DFDAEB143F9A
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 3902fc0c91343f4fef21126da256695c9cd50a74e9d5e311462ead8d713079d5
MD5 91de1267b671028a757a94d789439be2
SHA1 997f05879f19bbe5f7ac10a0c37b8d84a392b8c5
SHA512 2f0c76c002793b9c11ad3e4298064d9fc60f4bee0245f4acadd62dd7c9aff813b019d1565bb28de440aa5fb412dc174420763d263f1bbed1f55e566e4f56a29d
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 9d47e9caa886801a360167ff9de53930119962f994c2ebb8b84fa4fb4e4f5f5d
MD5 6a5a0b895beaa0e6b89cfd3c3ebde852
SHA1 84606ed96734cb8f4fe29dff844265ed690f7dd3
SHA512 3368ca1af6e99259b7386c06a88c0e205e5c21edbda05d0452225d76a7ed35419a50febbb3838a497b19781e5ef75d1b6e7ee2a1fb0b303fc320626e3524d0e6
TLSH
T163D0122236512774C11024330003620C0400C10B41058042B42DDA5E2F050901926441
MD5 SHA1 SHA512 TLSH

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 72B
SHA256 1a639865b700abc4f147c481ab3dfd16195642060be4130392abf56e5910cd2e
MD5 288e31124f291535f76c761cc6796928
SHA1 4ee9d1902bf137177ad82b290420307dd38e58c9
SHA512 a63d308655ca691ab5fc936959dc1995ac631a6e9368aa1c5f767b5e8d7a23c1ecd781b5aaf2daa6400c51561b2e7927137d4d497374795f402c54b6c445abcf
TLSH
T1F2A002700D852D83E547177060C207A272748D30438B264641A067AFDC94351E5298D5
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5a7011.TMP

Path C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView\Default\Code Cache\js\index-dir\the-real-index~RFe5a7011.TMP
Size 48B
SHA256 5268a60e0570ea1943dc4dc1eb6bb02cc662575e197910c870b981eff537275d
MD5 ace49336766b7dbbc968e0db9e716143
SHA1 8b765ad0c61ef6ed0d62aa09ddeef823e9b7a250
SHA512 3a97dc92a4b80f66236f6f10a389aefc4c9b0858918ef1eba549502cf2e7e8d044ca109d0adecc707fd4615eb2b35ccc5b96bcf333d045ae47484bc950598ab1
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView\Default\Extension Rules\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView\Default\GPUCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView\Default\Network\Network Persistent State
Size 821B
SHA256 a234b72a1859647e71ff2a8f041decaebd477f7dc6b8450f67d77999c0cfb74f
MD5 e9097991c28c8cec612485c7a75d0189
SHA1 cc818400f95f28cc366cf4ef8da135538b47da89
SHA512 af11e1356043d6f95ebada27d035e7ebbcbea4b77d2468a913543a8199dd557f10262f1eaa602ee189e315e9eaabbc864385283e139186eaf76f475fcdba1c7a
TLSH
T160018EA2C3D4C67D8A4117F026347913CD2E091993282D2BDDE9EBEA57E2471D21154F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State~RFe5b4e6b.TMP

Path C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView\Default\Network\Network Persistent State~RFe5b4e6b.TMP
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView\Default\Site Characteristics Database\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

bee1b959-9c76-4f94-bc34-1b440ef6171b.tmp

Path C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView\Default\bee1b959-9c76-4f94-bc34-1b440ef6171b.tmp
Size 6KB
SHA256 836752c7962c32c2f1d63b0e1057e49a92cb01e0c0c9be97530783c70bc0132f
MD5 a61f812457c472653163db14ba5cd805
SHA1 c3e058edceb759e8342988726c44b8b66b8fd7b8
SHA512 b80b061f10a0b715186a99fba565117030e3e75a63e2c9817510a2aadf6b75825a14e7bf57c4b7cdc6aab1e7b4fab3fb43bd191b6e60fe2106a18979165b021e
SSDEEP 96:stq/dgKXeb9wkDo5h16Z0ys7/x+6MhmuecJqG91ejeJ5K+gLesZl28XM1C7K:stSOAIonysV+FdB9QjakDG6K
TLSH
T1F6D1A6055E28797B8CCAE519BA39BB17E2F5903275D51E68E7FA461C08DA6CC2307C0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView\GraphiteDawnCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView\GraphiteDawnCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView\GraphiteDawnCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView\Local State
Size 17KB
SHA256 c3b9490e05fdab3c7f8ca1d810d1abb77aa4b4d7195877fd5e493f44e7c3dd48
MD5 3fee4acf46cd1ca48002301c8a9999a4
SHA1 dc9d466dfcc19b3fe555023c9f7be857c7c57b42
SHA512 01f666a6a32071f63b400623bd39c249a1e336a1ce772fef5d5426b9f7e7f7d8842939f59e749547daa37e406595c96b06cc79ce6ecbf4e3d0684f44a00fab3b
SSDEEP 384:s+aQikB+z/xvxjg/qhEeNlonUIs0XTx4btuE4:L/UxvxjgC+BUIlTxP
TLSH
T1CF728E3AD865AE3799F7E6816A4E678BCAF4446255C65EE48DEA2F0D06C73CC0302C17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView\Local State
Size 2KB
SHA256 0d665473c4665ec8cf67aca826d2594b21522e0581e92a302fb91be288fc4b83
MD5 59098ca0084178896fede7e1e4944081
SHA1 d23a1083ac302e2a5729dcea7cc151ebe20415fa
SHA512 e53a0f97d118c2fbdabc858d771247a385a5fbb1465ae4a9f2a860fe4dbc9867be607bf8c8236a78c879722f14555d1dbebfae38f118d2a70a28db0de55c21fd
TLSH
T13A516373A820AB368DF2D649798B7B139E7590A69F521F60DAEF1B1C40D715C1302C3B
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView\Local State
Size 3KB
SHA256 110dd78a4a30d78ab3a3ba35a1dd645777ffe49efb906f8fb330ffc33a8d629f
MD5 27fa36441da57296186638de184f4800
SHA1 112c14a80e04d0daf9c269b895e2597fbacd95c8
SHA512 4ea916d0f4e1bfb735dd300198d92dcef444186f7a3984104089ceb1d72516f73517a5ba70e307356ae3f94e42bc7561858add618188211bf939fc4ee580cc84
TLSH
T1FC6179736970AA3B8DF2D60578863B17ABA55037DA823FA4D5EE1F1D01D72981341C17
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView\Local State
Size 15KB
SHA256 da5394d2f6e4ee48b8aba71cfbfea37762383ff8bfabaf485fb3ed1122d15bc8
MD5 cbdb6d69ffa9152c76d49a03f9ed2140
SHA1 5e3a82efc88abc3b3ed3caa971bd12e8bb708484
SHA512 a353cc361917904ba2aac9564be5f4d3d3f592f5db367b06cc27bec19ad8ad5ee5b943e331d5dadde0ce3034d7584784f9c0a784a75d2707dbb743948e4d8238
SSDEEP 384:9+aQikB+z/xvxjg/qhEwNBSoeUIsmx4btuE4:I/UxvxjgC+APIhxP
TLSH
T150729E2758797E279AF7E6456D4E074BCAB854B295C26EB48ABA5F0D06C73880302C17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView\Local State
Size 15KB
SHA256 562b82139042e804c612ae8440fac03614839e4566bd757b9af388c42b080370
MD5 3a038515a83c4ffd3aadd91e3d7077e7
SHA1 d4bfbbda913e3c4c5cf947c52a74803071aa9543
SHA512 f1ad214b582a31042f1516bdce8b92d725f8e7595309764b99724eecf29b5ef183b0a4fe49227dd0e48fa7c8371d397d5267884535042e8387968c039230a7db
SSDEEP 384:k+aQikB+z/xvxjg/qhEtNBSoeUIsmx4btuE4:D/UxvxjgC+XPIhxP
TLSH
T1B8729E2758797E379AF7E605695E074BCAB894A255C26EB48AFE5F0D06C73880302C17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView\Local State
Size 16KB
SHA256 7f0b47b48dec54ef69f20adf997ab3547b80e7345f8cdcb56cc665386c3c4d6d
MD5 f9bfe6192650d794306c598054e883d0
SHA1 bbfe84dd9f2779c078b2f7dbeb702bd8337fc743
SHA512 153774af7140275ba401d27e10d164d0d0874ae7202561ddd4b8405301392f7fcc8e2a2a8be85873c1adebc82303cf7b5fe20f3fa64557d5a6aa39cd8c2888f1
SSDEEP 384:0+aQikB+z/xvxjg/qhEeNlonUIs0XTx4btuE4:T/UxvxjgC+BUIlTxP
TLSH
T16F729E3AD875AE3799F7E6816A4E678BCAF4446255C65EE48DEA1F0D06C73CC0302C17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State~RFe5a1c92.TMP

Path C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView\Local State~RFe5a1c92.TMP
Size 1KB
SHA256 ec5cb7c6330a3f861367b48a86f6a51081083057d9724ca019e17be51e202406
MD5 05f91868949c5905d55d5dee1c5f691b
SHA1 604f4352da78ac69b75466e7b14d64c4c2e5a5c2
SHA512 d0178e760d14293f26bb074daab75624ce5b6eda3892eee03ee536ec71573f22c22c76c348a5931dc77d0b2e99b26e813e4e46643c2ace576287f3e41c99f80b
TLSH
T1942140B3E5705B32CCE5E24B218BAB5B6E31047B87024F40E5EF4B2D01E615C952AC3A
MD5 SHA1 SHA512 TLSH

Submit Download

e5a0919.msi

Path C:\Windows\Installer\e5a0919.msi
Size 14.4MB
SHA256 f25ac4aed0f36abdb2f0ea2cdb67e4249d7d70467718f718445559cf4e0ffd89
MD5 965f3d0bff58a004b2642bf6d637dedc
SHA1 1c65936cb7545559f090173a494ff1bc2839f1eb
SHA512 68baec2ebd5d6b4eecc6190eb02265572ed952f609423399d5cb5e3f7dd43c8c0e005491bd52be72fdb289f700cfcadee33caea80ca30bf7f5cd5b60fcd2f28d
SSDEEP 393216:Xgwqa+Wmti6d4hGDOQ1X0ADGK/pC6HuAhUO2bJRA:wwc1fdMvFADZ/pCJAhUFN+
TLSH
T151E633873D96DB11C8A21D7A44BBC3A822387D400624D9A777DCB82DDEF23C095769DE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata-2

Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
Size 26.1MB
SHA256 7bb5b3326ea8c2a90dcc322fe3fed36c7976bc091f1faa14a7faeb809871b846
MD5 4fe56405f8db9026f7cc79ef48ec032e
SHA1 08946815048b5cf4007b269c5085458df6e19e2c
SHA512 52642f78b7296094036797ffa3298863335cc6f976c3cae78b456ceec2d57456887fd65551362830a49c14686055086ef2405b1776ac7fb380e4de1807757f8a
SSDEEP 24576:TFo3DMPKdoO/vvTL/SAiCiVQ/LeIpbFREf0AdfMqUXsa5lzScYRWSrYj2+0:wHg
TLSH
T10C57E32432F92100E7B79E3CACF46A634D397D5BAC19DE8D45411B4E0822F71E972F6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{847f785d-4e53-43d7-a210-58a4604134b5}_OnDiskSnapshotProp

Path \??\Volume{cb1876cb-0000-0000-0000-d08302000000}\System Volume Information\SPP\OnlineMetadataCache\{847f785d-4e53-43d7-a210-58a4604134b5}_OnDiskSnapshotProp
Size 6KB
SHA256 e9454ec4507bdc088ddb4323f4b4fc5c6cab40628d76c922622ab625b72da37b
MD5 5fdc091938ada715b58f29f438303d93
SHA1 573ea92fc70cc850c975ecd929af1e362d3aebf2
SHA512 a734eb46bfa45e9c563da734a799878417852bff3e95ae540cc9a8baf127e6645e896d33441ef2ef1abeee566fd2c78b7f6bd1447260a865d4d35e04e338eb5d
SSDEEP 96:F4+QqjOvc6DD84LTHzbOHXOHBlBRQn8Sc9XE56tOSVQpu:+m2b++uVm
TLSH
T11CD177185AF54311E2B3AB7228F18557A877B811EF33CB8E0198238E6631910F975F6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/5052-247-0x0000025A6B2E0000-0x0000025A6B3B6000-memory.dmp

Download

memory/5052-71-0x00007FF907E70000-0x00007FF907E71000-memory.dmp

Download

memory/5976-248-0x00000255EA000000-0x00000255EA0D6000-memory.dmp

Download

memory/5976-94-0x00007FF907E70000-0x00007FF907E71000-memory.dmp

Download