f25ac4aed0f36abdb2f0ea2cdb67e4249d7d70467718f718445559cf4e0ffd89

Analysis

user interaction
yes
max time kernel
39s
max time network
76s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/08/2026, 12:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Retrac_3.0.8_x64_en-US.msi
Size 14.4MB
Sample260810-pl3hjaydma
SHA256 f25ac4aed0f36abdb2f0ea2cdb67e4249d7d70467718f718445559cf4e0ffd89
MD5 965f3d0bff58a004b2642bf6d637dedc
SHA1 1c65936cb7545559f090173a494ff1bc2839f1eb
SHA512 68baec2ebd5d6b4eecc6190eb02265572ed952f609423399d5cb5e3f7dd43c8c0e005491bd52be72fdb289f700cfcadee33caea80ca30bf7f5cd5b60fcd2f28d
SSDEEP 393216:Xgwqa+Wmti6d4hGDOQ1X0ADGK/pC6HuAhUO2bJRA:wwc1fdMvFADZ/pCJAhUFN+
TLSH
T151E633873D96DB11C8A21D7A44BBC3A822387D400624D9A777DCB82DDEF23C095769DE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery persistence privilege_escalation ransomware

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
4452	MsiExec.exe

Badlisted process makes network request 1 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
2	5676	msiexec.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\Installer\e599eb7.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e599eb7.msi	msiexec.exe

Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs

persistence privilege_escalation

Installer Packages

T1546.016

Msiexec

T1218.007

pid	Process
5676	msiexec.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000ad3b1fc6af0fc0350000000000000000000000000000000000000000000000000000000000000000000000000000000000001071020000000000c0120000000000000000000000002701010000883801ad3b1fc60000000000001071020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d0830200000000006025c501000000000000000000000700010000e84101ad3b1fc6000000000000d08302000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9c701000000000000050000000000000000000000070001000098d4e3ad3b1fc600000000000030a9c7010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9cc0100000000000005000000000000000000000007000100009854e6ad3b1fc600000000000030a9cc01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	5676	msiexec.exe
Token: SeIncreaseQuotaPrivilege	5676	msiexec.exe
Token: SeSecurityPrivilege	4368	msiexec.exe
Token: SeCreateTokenPrivilege	5676	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	5676	msiexec.exe
Token: SeLockMemoryPrivilege	5676	msiexec.exe
Token: SeIncreaseQuotaPrivilege	5676	msiexec.exe
Token: SeMachineAccountPrivilege	5676	msiexec.exe
Token: SeTcbPrivilege	5676	msiexec.exe
Token: SeSecurityPrivilege	5676	msiexec.exe
Token: SeTakeOwnershipPrivilege	5676	msiexec.exe
Token: SeLoadDriverPrivilege	5676	msiexec.exe
Token: SeSystemProfilePrivilege	5676	msiexec.exe
Token: SeSystemtimePrivilege	5676	msiexec.exe
Token: SeProfSingleProcessPrivilege	5676	msiexec.exe
Token: SeIncBasePriorityPrivilege	5676	msiexec.exe
Token: SeCreatePagefilePrivilege	5676	msiexec.exe
Token: SeCreatePermanentPrivilege	5676	msiexec.exe
Token: SeBackupPrivilege	5676	msiexec.exe
Token: SeRestorePrivilege	5676	msiexec.exe
Token: SeShutdownPrivilege	5676	msiexec.exe
Token: SeDebugPrivilege	5676	msiexec.exe
Token: SeAuditPrivilege	5676	msiexec.exe
Token: SeSystemEnvironmentPrivilege	5676	msiexec.exe
Token: SeChangeNotifyPrivilege	5676	msiexec.exe
Token: SeRemoteShutdownPrivilege	5676	msiexec.exe
Token: SeUndockPrivilege	5676	msiexec.exe
Token: SeSyncAgentPrivilege	5676	msiexec.exe
Token: SeEnableDelegationPrivilege	5676	msiexec.exe
Token: SeManageVolumePrivilege	5676	msiexec.exe
Token: SeImpersonatePrivilege	5676	msiexec.exe
Token: SeCreateGlobalPrivilege	5676	msiexec.exe
Token: SeCreateTokenPrivilege	5676	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	5676	msiexec.exe
Token: SeLockMemoryPrivilege	5676	msiexec.exe
Token: SeIncreaseQuotaPrivilege	5676	msiexec.exe
Token: SeMachineAccountPrivilege	5676	msiexec.exe
Token: SeTcbPrivilege	5676	msiexec.exe
Token: SeSecurityPrivilege	5676	msiexec.exe
Token: SeTakeOwnershipPrivilege	5676	msiexec.exe
Token: SeLoadDriverPrivilege	5676	msiexec.exe
Token: SeSystemProfilePrivilege	5676	msiexec.exe
Token: SeSystemtimePrivilege	5676	msiexec.exe
Token: SeProfSingleProcessPrivilege	5676	msiexec.exe
Token: SeIncBasePriorityPrivilege	5676	msiexec.exe
Token: SeCreatePagefilePrivilege	5676	msiexec.exe
Token: SeCreatePermanentPrivilege	5676	msiexec.exe
Token: SeBackupPrivilege	5676	msiexec.exe
Token: SeRestorePrivilege	5676	msiexec.exe
Token: SeShutdownPrivilege	5676	msiexec.exe
Token: SeDebugPrivilege	5676	msiexec.exe
Token: SeAuditPrivilege	5676	msiexec.exe
Token: SeSystemEnvironmentPrivilege	5676	msiexec.exe
Token: SeChangeNotifyPrivilege	5676	msiexec.exe
Token: SeRemoteShutdownPrivilege	5676	msiexec.exe
Token: SeUndockPrivilege	5676	msiexec.exe
Token: SeSyncAgentPrivilege	5676	msiexec.exe
Token: SeEnableDelegationPrivilege	5676	msiexec.exe
Token: SeManageVolumePrivilege	5676	msiexec.exe
Token: SeImpersonatePrivilege	5676	msiexec.exe
Token: SeCreateGlobalPrivilege	5676	msiexec.exe
Token: SeCreateTokenPrivilege	5676	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	5676	msiexec.exe
Token: SeLockMemoryPrivilege	5676	msiexec.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
5676	msiexec.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
5676	msiexec.exe
4368	msiexec.exe
4452	MsiExec.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4368 wrote to memory of 4452	4368	msiexec.exe	90
PID 4368 wrote to memory of 1020	4368	msiexec.exe	96

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\Retrac_3.0.8_x64_en-US.msi
1⤵
- Badlisted process makes network request
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:5676
- C:\Program Files\Retrac\retrac.exe
  "C:\Program Files\Retrac\retrac.exe"
  2⤵
  PID:4344
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=retrac.exe --webview-exe-version=3.0.8 --user-data-dir="C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --enable-features=MojoIpcz --lang=en-US --accept-lang=en-US --mojo-named-platform-channel-pipe=4344.2996.5627970781317726227 /pfhostedapp:fd0de7e5cefc9f8a2e2a61a11d5c8b08aabc87ca
    3⤵
    PID:488
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView /prefetch:4 /pfhostedapp:fd0de7e5cefc9f8a2e2a61a11d5c8b08aabc87ca --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x184,0x188,0x18c,0x160,0x194,0x7ffcf40f5fd8,0x7ffcf40f5fe4,0x7ffcf40f5ff0
      4⤵
      PID:3852
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView" --webview-exe-name=retrac.exe --webview-exe-version=3.0.8 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=2116 --field-trial-handle=2132,i,4579765493486279454,17450551483517840349,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:2 /pfhostedapp:fd0de7e5cefc9f8a2e2a61a11d5c8b08aabc87ca
      4⤵
      PID:5720
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView" --webview-exe-name=retrac.exe --webview-exe-version=3.0.8 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2328 --field-trial-handle=2132,i,4579765493486279454,17450551483517840349,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:3 /pfhostedapp:fd0de7e5cefc9f8a2e2a61a11d5c8b08aabc87ca
      4⤵
      PID:4480
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView" --webview-exe-name=retrac.exe --webview-exe-version=3.0.8 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2388 --field-trial-handle=2132,i,4579765493486279454,17450551483517840349,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:fd0de7e5cefc9f8a2e2a61a11d5c8b08aabc87ca
      4⤵
      PID:4624
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView" --webview-exe-name=retrac.exe --webview-exe-version=3.0.8 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --autoplay-policy=no-user-gesture-required --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3316 --field-trial-handle=2132,i,4579765493486279454,17450551483517840349,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /pfhostedapp:fd0de7e5cefc9f8a2e2a61a11d5c8b08aabc87ca /prefetch:1
      4⤵
      PID:3532

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4368
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 70B6588F12F3A14133F7EDA1200164B5 C
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:4452
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:1020

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
PID:2104

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Installer Packages

T1546.016

Privilege Escalation

Event Triggered Execution

T1546

Installer Packages

T1546.016

Defense Evasion

System Binary Proxy Execution

T1218

Msiexec

T1218.007

Credential Access

Discovery

Network Share Discovery

T1135

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e599eb8.rbs

Path C:\Config.Msi\e599eb8.rbs
Size 10KB
SHA256 c51155c0f30d99ea8f6fa3e01de9b08bc49ec67062f81cb83ac55b12cf26ff4b
MD5 7a9f0e8ca3ce80867ba05d99f4dcfda0
SHA1 ffd9bf5048d2170588ab47fe6907e0a55f431ff1
SHA512 5ddd723b3d2d0a31689acf26f107e91ff5aa07804116b49adca49d1d9cd194068f408e5bfef19ff489a814a6070d6901e928329f21c31ce58361a75af9fae9e2
SSDEEP 192:b3mvcD7AyCNoAuGvAuuTLbiIM4oWRiMupBCv:bWvcD7AcAhAnAbq
TLSH
T15E220E42B740C2D2E9931B74DB0717263BB2DA988315674B0BCE75248F837D95E9A1CB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

retrac.exe

Path C:\Program Files\Retrac\retrac.exe
Size 26.0MB
SHA256 2550eee702fb10f576042a913674938b4a4becdcf9b887853dbaef46d6f90bd2
MD5 789fb187c94581916bd728ce786ce972
SHA1 aaacb9eeca073c4a727ec0b7a5264db1479bd7ec
SHA512 4e333b330dd94204694c2355521dad82fc01dab2acdd90453c7dccd3e8e1fe1b3fc389bd1a22a0671e871741c515a0d77301f62891eb49ac39a12189c6f60cc1
SSDEEP 393216:WYq62DqPMcqO0BwUdrsPAQK1Jmii8l/RlpLFo:WYq/O7BfPW1JNl/1
TLSH
T128575B207B9AA96DD05AC47483878A724A7130DB0B35B9FF44D496783F6DBF42F38258
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Retrac.lnk

Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Retrac\Retrac.lnk
Size 1KB
SHA256 1a2697f15c87434c97f2a9d188ae8ca1a9ef9d6a1d3b2cf378b7807911e9d36b
MD5 87fabfca1192945572ca022c7dcfd212
SHA1 c0e3534af8cc2d70d795b4cd56f308c49d064108
SHA512 db2cad884d161d71ffad2c68613db2c71bd4243500b52c39e2ba0d0838987faea8205205215953445cb3b64f6ccf1d7a3ce5c0596d3fc7fd4d4f1090c8251da8
TLSH
T1ED41BB0167E00715F363463AAEB80A219E32BC06F5348F2F428A808B4DB6541DA28F2F
MD5 SHA1 SHA512 TLSH

Submit Download

Retrac.lnk~RFe59a9f2.TMP

Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Retrac\Retrac.lnk~RFe59a9f2.TMP
Size 1KB
SHA256 686ef0ecdf0ef27048538d911e419a9d3ef385fa4b566436c8317bc255058cdd
MD5 72a733885d2b194927eab6925023e1e1
SHA1 0a34e4f73472d468b5b048d8d293ffa061c450b7
SHA512 fdc0de21133b9808df0a56730f27cba4884e55edc6f1a62ab0315716c207debc79eb7d3813d22b9dd26059e5170e2637156e14ca8ce9378d3f62443c07f14870
TLSH
T14741AF0167F00B15F363463AAEAD4A21DE36BC01F5348F2F429A808B4976541DA29F2F
MD5 SHA1 SHA512 TLSH

Submit Download

MSI1BEB.tmp

Path C:\Users\Admin\AppData\Local\Temp\MSI1BEB.tmp
Size 132KB
SHA256 7f47d98ab25cfea9b3a2e898c3376cc9ba1cd893b4948b0c27caa530fd0e34cc
MD5 cfbb8568bd3711a97e6124c56fcfa8d9
SHA1 d7a098ae58bdd5e93a3c1b04b3d69a14234d5e57
SHA512 860cbf3286ac4915580cefaf56a9c3d48938eb08e3f31b7f024c4339c037d7c8bdf16e766d08106505ba535be4922a87dc46bd029aae99a64ea2fc02cf3aec04
SSDEEP 3072:Kx2YbpcgwmiTPJDnCO+DATkURBnrskNwPj2:XXgwmY1CPx2XG2
TLSH
T1DBD39D02B5D0C473D9BE09390870DB229F7EB930DF909EDB636856699E702C19E35A37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 26b3c0e44f756f665b2c8df3a25e9127dbde27a2417b2f0303c53043936f699e
MD5 fe070e760470a7791e5057645680fa4b
SHA1 229cf54b88b4779c6f6f5cb4a17e07ad514021bf
SHA512 466535c81843544e5c09e969543888b761d144f6bd7e3a302c7ef9aa43c78f104e5404bd78b7c840b76245c68c273548999609746e254465ea758f6b480cd18a
TLSH
T1B2D00470F1445141CC741035741047C4010144141D514130403C01543F451011401440
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 08f94083fb0f3788cf959b8001e03c28052e670e57cb7764e07dc48feced0e33
MD5 054b93d06f1d20ce757d74cedd4f6c36
SHA1 1b3fc1784fbf33a7f2af7395949956ceafcc2d4d
SHA512 9f50597fb6420bced2173913ffaa05b92931874c93b3ae01f6d361e045c08b148f7c60292b3c386afd4d26209f8a72a5c0b0660700f57101e9a0143f7cba78bd
TLSH
T149D0122272414274C83020332402678C0401C11F45458010943C866D3F080501D02881
MD5 SHA1 SHA512 TLSH

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView\Default\Extension Rules\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView\Default\GPUCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView\Default\Sync Data\LevelDB\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView\GraphiteDawnCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView\GraphiteDawnCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView\GraphiteDawnCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView\Local State
Size 15KB
SHA256 fe1718a5062f2b73c27b941f56c98bbda3f0c797e6f873b91834c36414f8d3a3
MD5 491307abd66d3a42ed910d98c259324e
SHA1 1f4e40a5fa7486963dd6848241437f85b371b800
SHA512 618856ed4f7ab4c1d0f2afa3a0d95544747b8d386c05bba03e3b6d042e76bb11683af077848562e78d3ae43ab64bac68919cd56565afd168cf75a0bb7f093eeb
SSDEEP 384:T+aQikB+z/xvxjg/qhEwNBS6btHWF/sAVdp9/9z8:y/UxvxjgC+y4VsURF8
TLSH
T12B728E2B943A7E6395B7EA05794D078BCBB888B294C17EB84ABD5F0D06C72D81342816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView\Local State
Size 2KB
SHA256 46ccf05fd885331e829e6f8e6be7273f24193a5d0869e0d3de5e51cad88f318d
MD5 a6b6a21a6f95bf49579735912a3d93fc
SHA1 7f38f3e7f21fdeffe468a0168df1c47419156bbb
SHA512 d647fd9f501fe43969b0a644e9e20da80ed63c30c4b7324de709f32a0d49487354ef0ffcf21a593a9cbb9e908eec07c3d6671f1bb2a5e798c7c837cda1d5eb1b
TLSH
T1F451A733AC25AF7389E74609BD462B57DE3990669E522F6496EC1B1C01D769C2303C3B
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView\Local State
Size 3KB
SHA256 265b0eebb2e827c59659c6164f6600d54b30f8c2c8e36a579eb3b40f181ddde3
MD5 ff2c688b4a0f9b7c266bccaccdec1392
SHA1 7bbfce697b9428cdee0bb43c6689b2e5ec1004a6
SHA512 df2f64033db96996201608855abae557f7d5af007e81c2dd73276d9105a1ca58c603d5ce17284f3c5baeef1aedad1c12afef83604a1e8a9455cd456cd3722b81
TLSH
T1236198379975AA774DF39A05B8862756A7695027E9813FA8C6FC0F1C01D73DC1302C2B
MD5 SHA1 SHA512 TLSH

Submit Download

Local State~RFe59dbdf.TMP

Path C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView\Local State~RFe59dbdf.TMP
Size 1KB
SHA256 37fcee3684dc875b08e5cd1a035b0d040a02f519ba3049a8520716ac17d5c82c
MD5 4b193f5afe5fafc8b1236893cd7149fc
SHA1 a1f0a2f784dad11875ba4570f48421dd9b8ec079
SHA512 dbde3e305144daa6b925878740f351e45797d09bef5727f1d87cec7c3149596554927449ba61797e48547013949fb6c4724a0d4b3b626e1595f9d3e0eda6acca
TLSH
T1242195B3D8356F739D97164B744267DBAE20106B81508F4450ED0B2C02E72CCA31BD3A
MD5 SHA1 SHA512 TLSH

Submit Download

e599eb7.msi

Path C:\Windows\Installer\e599eb7.msi
Size 14.4MB
SHA256 f25ac4aed0f36abdb2f0ea2cdb67e4249d7d70467718f718445559cf4e0ffd89
MD5 965f3d0bff58a004b2642bf6d637dedc
SHA1 1c65936cb7545559f090173a494ff1bc2839f1eb
SHA512 68baec2ebd5d6b4eecc6190eb02265572ed952f609423399d5cb5e3f7dd43c8c0e005491bd52be72fdb289f700cfcadee33caea80ca30bf7f5cd5b60fcd2f28d
SSDEEP 393216:Xgwqa+Wmti6d4hGDOQ1X0ADGK/pC6HuAhUO2bJRA:wwc1fdMvFADZ/pCJAhUFN+
TLSH
T151E633873D96DB11C8A21D7A44BBC3A822387D400624D9A777DCB82DDEF23C095769DE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata-2

Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
Size 26.1MB
SHA256 0a5fce4423705f3734b20e3394d02530ac421953e725e5e54f20fe941bf62717
MD5 2eece1a534ab546a9f87176d6b81369f
SHA1 15dcbea866249fd7c4711f3177ad835e1901f05b
SHA512 84d4baf1970df334636de12d1024c1f48807e583d1abb3629d2bc8631cf463110592f6c8db92a71359e524b53af8e25daecd1ed29f73846acdf247ddf2adf892
SSDEEP 24576:SFo3DMPFdoO/vvTL/Sg88iFQvrumHb7P0BKudxSUKpyKpb9cMoRWclmd4+2:aHY
TLSH
T1E357B42436F92200E7F79E3DA8F06A234D397D5BAC15DE8D45511B4E0822F71E872F6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{81eb4a75-9e77-4f6e-ab3c-1f844f94daff}_OnDiskSnapshotProp

Path \??\Volume{c61f3bad-0000-0000-0000-d08302000000}\System Volume Information\SPP\OnlineMetadataCache\{81eb4a75-9e77-4f6e-ab3c-1f844f94daff}_OnDiskSnapshotProp
Size 6KB
SHA256 e0f9180fe3f99f85ff7d4f360e255cff39d36696caaa991bea2eb0cfba70ab68
MD5 131903cf898ea8fa92859613dc2ae7be
SHA1 b555d76431104f6f8aa984edda7a0fe852064e50
SHA512 acb95e948d5693c71d832c077e94a865a214f8a309ad656b611dacf55793a99c77776dab2de06e011aa05c0254fe03d88df15fdb2e237a5662e99155231edbe3
SSDEEP 96:F4+7dfeCvc6DD84LTHzbOHXOHBlBRQn8Sc9XE56tOSVQpu:C2feeb++uVm
TLSH
T176D179085AF54711E2B3AB3129F14557A877B811EF33CB8E0198238E6671A10F935F6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3532-81-0x00007FFD17540000-0x00007FFD17541000-memory.dmp

Download

memory/5720-73-0x00007FFD17540000-0x00007FFD17541000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads