3e37ab7255ce38b1158d8ff85803f6796cfe6867cc988fe74f8b7f51b645556b

Analysis

user interaction
yes
max time kernel
92s
max time network
94s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
31/08/2026, 16:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

Reason

Machine shutdown

General

Target
fortnite.txt
Size 98B
Sample260831-vbmbfsdl5s
SHA256 3e37ab7255ce38b1158d8ff85803f6796cfe6867cc988fe74f8b7f51b645556b
MD5 ca5edd54aba369b57ef419de5c7e3534
SHA1 ba4d14f35ccef539a55ce4e5e1dfd28c86c1ec1d
SHA512 6005bde27bd21c6ebbeb816b3f6bc33afaac81d855db56599609c5bc86a3b6b9b7afac14dfd5e7bba7b1fe2d8bca406573fc8ace80139f07222e92b8f68deb56
TLSH
T1D8B0120AD4F040440E1136D4CD1D753560334C08D480D07C17B10025D00E4740D23003
MD5 SHA1 SHA512 TLSH

Score

8^/10

defense_evasion discovery ransomware trojan

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
116	2624	msedge.exe

Executes dropped EXE 3 IoCs

pid	Process
2524	Retrac.Launcher_1.0.20_x64-setup.exe
5176	Retrac Launcher.exe
5332	Retrac Launcher.exe

Loads dropped DLL 6 IoCs

pid	Process
2524	Retrac.Launcher_1.0.20_x64-setup.exe
2524	Retrac.Launcher_1.0.20_x64-setup.exe
2524	Retrac.Launcher_1.0.20_x64-setup.exe
2524	Retrac.Launcher_1.0.20_x64-setup.exe
2524	Retrac.Launcher_1.0.20_x64-setup.exe
2524	Retrac.Launcher_1.0.20_x64-setup.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 2 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Retrac Launcher.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Retrac Launcher.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135
Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Retrac.Launcher_1.0.20_x64-setup.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2624	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 9 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe

Modifies data under HKEY_USERS 19 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271"	LogonUI.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "64"	LogonUI.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedgewebview2.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040"	LogonUI.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134326685676094949"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedgewebview2.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10"	LogonUI.exe

Modifies registry class 19 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\snow\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Retrac Launcher\\Retrac Launcher.exe,0"	Retrac Launcher.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2937465464-4167303362-2236413517-1000\{4F11BDE8-FE7F-47B3-B923-2F2206BAE3B8}	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\snow\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Retrac Launcher\\Retrac Launcher.exe \"%1\""	Retrac Launcher.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\snow\DefaultIcon	Retrac Launcher.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\snow\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Retrac Launcher\\Retrac Launcher.exe,0"	Retrac Launcher.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\snow\shell\open\command	Retrac Launcher.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\snow\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Retrac Launcher\\Retrac Launcher.exe \"%1\""	Retrac Launcher.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\snow\URL Protocol	Retrac Launcher.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\snow\DefaultIcon	Retrac Launcher.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\snow\ = "URL:rocks.snow"	Retrac Launcher.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\snow\URL Protocol	Retrac Launcher.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\snow\shell	Retrac Launcher.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\snow	Retrac Launcher.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\snow\ = "URL:rocks.snow"	Retrac Launcher.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\snow\shell\open\command	Retrac Launcher.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\snow	Retrac Launcher.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\snow\shell\open	Retrac Launcher.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
4460	NOTEPAD.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2524	Retrac.Launcher_1.0.20_x64-setup.exe
2524	Retrac.Launcher_1.0.20_x64-setup.exe
5176	Retrac Launcher.exe
5176	Retrac Launcher.exe
5176	Retrac Launcher.exe
5176	Retrac Launcher.exe
5176	Retrac Launcher.exe
5176	Retrac Launcher.exe
5176	Retrac Launcher.exe
5176	Retrac Launcher.exe
5176	Retrac Launcher.exe
5176	Retrac Launcher.exe
5176	Retrac Launcher.exe
5176	Retrac Launcher.exe
5176	Retrac Launcher.exe
5176	Retrac Launcher.exe
5176	Retrac Launcher.exe
5176	Retrac Launcher.exe
5176	Retrac Launcher.exe
5176	Retrac Launcher.exe
5176	Retrac Launcher.exe
5176	Retrac Launcher.exe
5176	Retrac Launcher.exe
5176	Retrac Launcher.exe
5176	Retrac Launcher.exe
5176	Retrac Launcher.exe
5332	Retrac Launcher.exe
5332	Retrac Launcher.exe
5332	Retrac Launcher.exe
5332	Retrac Launcher.exe
5332	Retrac Launcher.exe
5332	Retrac Launcher.exe
5332	Retrac Launcher.exe
5332	Retrac Launcher.exe
5332	Retrac Launcher.exe
5332	Retrac Launcher.exe
5332	Retrac Launcher.exe
5332	Retrac Launcher.exe
5332	Retrac Launcher.exe
5332	Retrac Launcher.exe
5332	Retrac Launcher.exe
5332	Retrac Launcher.exe
5332	Retrac Launcher.exe
5332	Retrac Launcher.exe
5332	Retrac Launcher.exe
5332	Retrac Launcher.exe
5332	Retrac Launcher.exe
5332	Retrac Launcher.exe
5332	Retrac Launcher.exe
5332	Retrac Launcher.exe
5332	Retrac Launcher.exe
5332	Retrac Launcher.exe
5332	Retrac Launcher.exe
5332	Retrac Launcher.exe
5332	Retrac Launcher.exe
5332	Retrac Launcher.exe
5332	Retrac Launcher.exe
5332	Retrac Launcher.exe
5332	Retrac Launcher.exe
5332	Retrac Launcher.exe
5332	Retrac Launcher.exe
5332	Retrac Launcher.exe
5332	Retrac Launcher.exe
5332	Retrac Launcher.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
5348	msedgewebview2.exe
5408	msedgewebview2.exe
1868	msedge.exe

Suspicious use of FindShellTrayWindow 15 IoCs

pid	Process
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
5176	Retrac Launcher.exe
5332	Retrac Launcher.exe
5332	Retrac Launcher.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2280	LogonUI.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3780 wrote to memory of 1868	3780	msedge.exe	92
PID 1868 wrote to memory of 1344	1868	msedge.exe	93
PID 1868 wrote to memory of 2624	1868	msedge.exe	94
PID 1868 wrote to memory of 2908	1868	msedge.exe	95
PID 1868 wrote to memory of 2908	1868	msedge.exe	95
PID 1868 wrote to memory of 2908	1868	msedge.exe	95
PID 1868 wrote to memory of 984	1868	msedge.exe	96
PID 1868 wrote to memory of 984	1868	msedge.exe	96
PID 1868 wrote to memory of 2968	1868	msedge.exe	98
PID 1868 wrote to memory of 2968	1868	msedge.exe	98
PID 1868 wrote to memory of 2968	1868	msedge.exe	98
PID 1868 wrote to memory of 1180	1868	msedge.exe	99
PID 1868 wrote to memory of 1180	1868	msedge.exe	99
PID 1868 wrote to memory of 1180	1868	msedge.exe	99
PID 1868 wrote to memory of 1924	1868	msedge.exe	100
PID 1868 wrote to memory of 1924	1868	msedge.exe	100
PID 1868 wrote to memory of 1924	1868	msedge.exe	100
PID 1868 wrote to memory of 2364	1868	msedge.exe	101
PID 1868 wrote to memory of 2364	1868	msedge.exe	101
PID 1868 wrote to memory of 2364	1868	msedge.exe	101
PID 1868 wrote to memory of 5004	1868	msedge.exe	103
PID 1868 wrote to memory of 5004	1868	msedge.exe	103
PID 1868 wrote to memory of 1128	1868	msedge.exe	105
PID 1868 wrote to memory of 1128	1868	msedge.exe	105
PID 1868 wrote to memory of 4792	1868	msedge.exe	106
PID 1868 wrote to memory of 4904	1868	msedge.exe	107
PID 1868 wrote to memory of 4792	1868	msedge.exe	106
PID 1868 wrote to memory of 4904	1868	msedge.exe	107
PID 1868 wrote to memory of 3368	1868	msedge.exe	108
PID 1868 wrote to memory of 3368	1868	msedge.exe	108
PID 1868 wrote to memory of 3368	1868	msedge.exe	108
PID 1868 wrote to memory of 4100	1868	msedge.exe	109
PID 1868 wrote to memory of 4100	1868	msedge.exe	109
PID 1868 wrote to memory of 2268	1868	msedge.exe	110
PID 1868 wrote to memory of 2268	1868	msedge.exe	110
PID 1868 wrote to memory of 2268	1868	msedge.exe	110
PID 1868 wrote to memory of 3200	1868	msedge.exe	111
PID 1868 wrote to memory of 3340	1868	msedge.exe	113
PID 1868 wrote to memory of 2524	1868	msedge.exe	114
PID 1868 wrote to memory of 2368	1868	msedge.exe	115
PID 1868 wrote to memory of 2368	1868	msedge.exe	115
PID 1868 wrote to memory of 3652	1868	msedge.exe	116
PID 1868 wrote to memory of 3652	1868	msedge.exe	116
PID 1868 wrote to memory of 1884	1868	msedge.exe	119
PID 1868 wrote to memory of 1884	1868	msedge.exe	119
PID 1868 wrote to memory of 3096	1868	msedge.exe	120
PID 1868 wrote to memory of 3096	1868	msedge.exe	120
PID 1868 wrote to memory of 5352	1868	msedge.exe	121
PID 1868 wrote to memory of 5352	1868	msedge.exe	121
PID 2524 wrote to memory of 5176	2524	Retrac.Launcher_1.0.20_x64-setup.exe	129
PID 5176 wrote to memory of 5348	5176	Retrac Launcher.exe	130
PID 5348 wrote to memory of 1224	5348	msedgewebview2.exe	131
PID 5348 wrote to memory of 6028	5348	msedgewebview2.exe	134
PID 5348 wrote to memory of 6028	5348	msedgewebview2.exe	134
PID 5348 wrote to memory of 6028	5348	msedgewebview2.exe	134
PID 5348 wrote to memory of 964	5348	msedgewebview2.exe	135
PID 5348 wrote to memory of 552	5348	msedgewebview2.exe	136
PID 5348 wrote to memory of 552	5348	msedgewebview2.exe	136
PID 5348 wrote to memory of 5516	5348	msedgewebview2.exe	137
PID 5348 wrote to memory of 5516	5348	msedgewebview2.exe	137
PID 5348 wrote to memory of 5516	5348	msedgewebview2.exe	137
PID 1868 wrote to memory of 5984	1868	msedge.exe	139
PID 1868 wrote to memory of 4556	1868	msedge.exe	140
PID 1868 wrote to memory of 1252	1868	msedge.exe	141

C:\Windows\system32\NOTEPAD.EXE
C:\Windows\system32\NOTEPAD.EXE C:\Users\Admin\AppData\Local\Temp\fortnite.txt
1⤵
- Opens file in notepad (likely ransom note)
PID:4460

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-skip-compat-layer-relaunch
  2⤵
  - Checks processor information in registry
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:1868
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x234,0x238,0x23c,0x230,0x2b0,0x7fffe307c188,0x7fffe307c194,0x7fffe307c1a0
    3⤵
    PID:1344
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1760,i,7544283402921054085,1355485132534187766,524288 --field-trial-handle=2320,i,18141278879153006607,11035348666114749224,262144 --variations-seed-version --mojo-platform-channel-handle=2360 /prefetch:3
    3⤵
    - Downloads MZ/PE file
    - System Time Discovery
    PID:2624
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1672,i,4595688547278254547,16381275028247966526,262144 --field-trial-handle=2320,i,18141278879153006607,11035348666114749224,262144 --variations-seed-version --mojo-platform-channel-handle=2316 /prefetch:2
    3⤵
    PID:2908
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1864,i,11154509142434484274,10524745356510155798,524288 --field-trial-handle=2320,i,18141278879153006607,11035348666114749224,262144 --variations-seed-version --mojo-platform-channel-handle=2768 /prefetch:8
    3⤵
    PID:984
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3428,i,16932777728192570934,1291935967110645689,2097152 --field-trial-handle=2320,i,18141278879153006607,11035348666114749224,262144 --variations-seed-version --mojo-platform-channel-handle=3484 /prefetch:1
    3⤵
    PID:2968
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3432,i,7072244157024405705,14250147349826310455,2097152 --field-trial-handle=2320,i,18141278879153006607,11035348666114749224,262144 --variations-seed-version --mojo-platform-channel-handle=3504 /prefetch:1
    3⤵
    PID:1180
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4272,i,7543977596721273262,9799238240543768301,2097152 --field-trial-handle=2320,i,18141278879153006607,11035348666114749224,262144 --variations-seed-version --mojo-platform-channel-handle=4284 /prefetch:1
    3⤵
    PID:1924
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4404,i,16747970706782083952,16199876944485886847,2097152 --field-trial-handle=2320,i,18141278879153006607,11035348666114749224,262144 --variations-seed-version --mojo-platform-channel-handle=4416 /prefetch:2
    3⤵
    PID:2364
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5112,i,2917812530407645053,18243604737035126192,524288 --field-trial-handle=2320,i,18141278879153006607,11035348666114749224,262144 --variations-seed-version --mojo-platform-channel-handle=5116 /prefetch:8
    3⤵
    PID:5004
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5316,i,16584942906324863250,12073916480364712184,524288 --field-trial-handle=2320,i,18141278879153006607,11035348666114749224,262144 --variations-seed-version --mojo-platform-channel-handle=5292 /prefetch:8
    3⤵
    PID:1128
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5472,i,10578458101647908289,9731067783574252469,524288 --field-trial-handle=2320,i,18141278879153006607,11035348666114749224,262144 --variations-seed-version --mojo-platform-channel-handle=5544 /prefetch:8
    3⤵
    PID:4792
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5480,i,6746542155779210354,6777618240099647515,524288 --field-trial-handle=2320,i,18141278879153006607,11035348666114749224,262144 --variations-seed-version --mojo-platform-channel-handle=5568 /prefetch:8
    3⤵
    PID:4904
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=5952,i,12135450681241689281,3827592522899824789,2097152 --field-trial-handle=2320,i,18141278879153006607,11035348666114749224,262144 --variations-seed-version --mojo-platform-channel-handle=5964 /prefetch:1
    3⤵
    PID:3368
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5092,i,15536927058979650989,17050742496712226538,524288 --field-trial-handle=2320,i,18141278879153006607,11035348666114749224,262144 --variations-seed-version --mojo-platform-channel-handle=5308 /prefetch:8
    3⤵
    PID:4100
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=5296,i,5310552956109378961,6103500761682131624,2097152 --field-trial-handle=2320,i,18141278879153006607,11035348666114749224,262144 --variations-seed-version --mojo-platform-channel-handle=5352 /prefetch:1
    3⤵
    PID:2268
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6708,i,17794400969953222310,5933596670671559925,524288 --field-trial-handle=2320,i,18141278879153006607,11035348666114749224,262144 --variations-seed-version --mojo-platform-channel-handle=3324 /prefetch:8
    3⤵
    PID:3200
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5184,i,6764142818006621333,10431300744178376655,524288 --field-trial-handle=2320,i,18141278879153006607,11035348666114749224,262144 --variations-seed-version --mojo-platform-channel-handle=6840 /prefetch:8
    3⤵
    PID:4172
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5184,i,6764142818006621333,10431300744178376655,524288 --field-trial-handle=2320,i,18141278879153006607,11035348666114749224,262144 --variations-seed-version --mojo-platform-channel-handle=6840 /prefetch:8
    3⤵
    PID:3340
- - C:\Users\Admin\Downloads\Retrac.Launcher_1.0.20_x64-setup.exe
    "C:\Users\Admin\Downloads\Retrac.Launcher_1.0.20_x64-setup.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:2524
  - - C:\Users\Admin\AppData\Local\Retrac Launcher\Retrac Launcher.exe
      "C:\Users\Admin\AppData\Local\Retrac Launcher\Retrac Launcher.exe"
      4⤵
      Executes dropped EXE
      Checks whether UAC is enabled
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of FindShellTrayWindow
      Suspicious use of WriteProcessMemory
      PID:5176
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name="Retrac Launcher.exe" --webview-exe-version=1.0.20 --user-data-dir="C:\Users\Admin\AppData\Local\site.retrac\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --lang=en-US --mojo-named-platform-channel-pipe=5176.5320.4645758609940394305
        5⤵
        Enumerates system info in registry
        Modifies data under HKEY_USERS
        Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        Suspicious use of WriteProcessMemory
        
        PID:5348
      - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\site.retrac\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\site.retrac\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0x15c,0x160,0x164,0x138,0x16c,0x7fffe03cb078,0x7fffe03cb084,0x7fffe03cb090
        6⤵
        
        PID:1224
      - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\site.retrac\EBWebView" --webview-exe-name="Retrac Launcher.exe" --webview-exe-version=1.0.20 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1712,i,9410717025688865876,2205399975385359303,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=1720 /prefetch:2
        6⤵
        
        PID:6028
      - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\site.retrac\EBWebView" --webview-exe-name="Retrac Launcher.exe" --webview-exe-version=1.0.20 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2040,i,9410717025688865876,2205399975385359303,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=2044 /prefetch:3
        6⤵
        
        PID:964
      - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\site.retrac\EBWebView" --webview-exe-name="Retrac Launcher.exe" --webview-exe-version=1.0.20 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2380,i,9410717025688865876,2205399975385359303,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=2388 /prefetch:8
        6⤵
        
        PID:552
      - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\site.retrac\EBWebView" --webview-exe-name="Retrac Launcher.exe" --webview-exe-version=1.0.20 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3588,i,9410717025688865876,2205399975385359303,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=3656 /prefetch:1
        6⤵
        
        PID:5516
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4280,i,4024508377451168056,13772454520332025392,524288 --field-trial-handle=2320,i,18141278879153006607,11035348666114749224,262144 --variations-seed-version --mojo-platform-channel-handle=6716 /prefetch:8
    3⤵
    PID:2368
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7228,i,2902024825059907049,17967986092204963869,524288 --field-trial-handle=2320,i,18141278879153006607,11035348666114749224,262144 --variations-seed-version --mojo-platform-channel-handle=7232 /prefetch:8
    3⤵
    PID:3652
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4372,i,18367941013725067654,16535388283773139475,524288 --field-trial-handle=2320,i,18141278879153006607,11035348666114749224,262144 --variations-seed-version --mojo-platform-channel-handle=7164 /prefetch:8
    3⤵
    PID:1884
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6724,i,18068859206966844868,5435056463635065252,524288 --field-trial-handle=2320,i,18141278879153006607,11035348666114749224,262144 --variations-seed-version --mojo-platform-channel-handle=4380 /prefetch:8
    3⤵
    PID:3096
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7048,i,17370069786483851883,1937866711531731858,524288 --field-trial-handle=2320,i,18141278879153006607,11035348666114749224,262144 --variations-seed-version --mojo-platform-channel-handle=7036 /prefetch:8
    3⤵
    PID:5352
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5936,i,1609781165709378640,3869104882076964388,524288 --field-trial-handle=2320,i,18141278879153006607,11035348666114749224,262144 --variations-seed-version --mojo-platform-channel-handle=6004 /prefetch:8
    3⤵
    PID:5984
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6560,i,4733205020975959037,9701883055181778144,524288 --field-trial-handle=2320,i,18141278879153006607,11035348666114749224,262144 --variations-seed-version --mojo-platform-channel-handle=5848 /prefetch:8
    3⤵
    PID:4556
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5964,i,14300179834763233124,1651200914786240794,524288 --field-trial-handle=2320,i,18141278879153006607,11035348666114749224,262144 --variations-seed-version --mojo-platform-channel-handle=5844 /prefetch:8
    3⤵
    PID:1252
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5320,i,2598692617407480734,16755553356770486914,524288 --field-trial-handle=2320,i,18141278879153006607,11035348666114749224,262144 --variations-seed-version --mojo-platform-channel-handle=5808 /prefetch:8
    3⤵
    PID:4124

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2656

C:\Users\Admin\AppData\Local\Retrac Launcher\Retrac Launcher.exe
"C:\Users\Admin\AppData\Local\Retrac Launcher\Retrac Launcher.exe"
1⤵
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
PID:5332
- C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name="Retrac Launcher.exe" --webview-exe-version=1.0.20 --user-data-dir="C:\Users\Admin\AppData\Local\site.retrac\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --lang=en-US --mojo-named-platform-channel-pipe=5332.3772.9845964509489791713
  2⤵
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  PID:5408
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\site.retrac\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\site.retrac\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0x17c,0x180,0x184,0x158,0x1b0,0x7fffe03cb078,0x7fffe03cb084,0x7fffe03cb090
    3⤵
    PID:5972
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\site.retrac\EBWebView" --webview-exe-name="Retrac Launcher.exe" --webview-exe-version=1.0.20 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1788,i,16822174160795664389,8120024461627226156,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=1784 /prefetch:2
    3⤵
    PID:3924
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\site.retrac\EBWebView" --webview-exe-name="Retrac Launcher.exe" --webview-exe-version=1.0.20 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2104,i,16822174160795664389,8120024461627226156,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=2116 /prefetch:3
    3⤵
    PID:5104
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\site.retrac\EBWebView" --webview-exe-name="Retrac Launcher.exe" --webview-exe-version=1.0.20 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2400,i,16822174160795664389,8120024461627226156,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=2416 /prefetch:8
    3⤵
    PID:4980
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\site.retrac\EBWebView" --webview-exe-name="Retrac Launcher.exe" --webview-exe-version=1.0.20 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3576,i,16822174160795664389,8120024461627226156,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=3584 /prefetch:1
    3⤵
    PID:5224

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa38c8055 /state1:0x41c64e6d
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:2280

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 dc3cbdc636712cd0ad246adb60e10a6c82511eff5067261c392024fae841e7a9
MD5 c1825e771385238aa2866582788cf8ff
SHA1 cdd34f1c740914ce98dfac6172ecd00fb2da9783
SHA512 33f14925d45545eb4c68af5b5b273b9724142601b0f5098ecd00afa7d2c73115a7bbfbde0f2118a5645868d8b32a69bd2a748d5d5a3d469656956f8af0313fdf
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7C:fwUQC5VwBIiElEd2K57P7C
TLSH
T14FB3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 3eacdfce7dc5d437b4447cf27ab297d2d39d13a22d53487691f060212cddb6b2
MD5 77a76342e47369b91c295856d0d136ad
SHA1 bac334fe99bd25a56aeb5cf09b273fd394730180
SHA512 5594ac61907f341c5e00a7e62a64d33fde684c855aa9b27d0c2756986334fbea5ebaf894d13dfedefe84d1f7ad65aaa17fb6b204714ed08460f06e4ed17ce733
TLSH
T1AAD012223A48F441DB4942709103CF453B26146024579A06E259D86D58B41D453D66C2
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7aa2bb81937fdcdafd5d33143cfe61093f5233469b36757de171e12cc0c6215f
MD5 6503f091cfa7258a2190ed65490b1bdd
SHA1 d722a7fd3cd82ec30e4846b9511ec1c22b9dacfd
SHA512 5f2a6a53348e4e1b7810b77abe2dd4c597357ba365cf029977f0efbbb203eab9dfb7771c9edb3561b6d22c8b7354c34611905cfbaab36c763b9d3334beb40b4c
TLSH
T1BAD012223A48F441DB4942709102CF453B26146024579A06E259D86D58B51D453D66C2
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 5KB
SHA256 959963de371f4ed7342eb9a0b8545315646f324746ed735ccf735ea22aaf3eac
MD5 524bcd912a3631c4b81f0a8eac997b80
SHA1 92b6192c6b7d95f88d3cdf3c8d0e0c97860a12f7
SHA512 ced757836f66aea8b261170686766ed97188604a3648bef615d3a159dbc5b48094b4c6d1f48fd396fe099d7b5e3d17bbcb88ac1869ca524c030f1f94fd356db4
SSDEEP 96:UfMU7dV0/3QL3fxA+YS8KC9hg/UgEBnllDUAyRN+vsyUbxiETwqXjOBkC0E:cMU7rO3QLv6pg/VEBjDUtN+syUbtTweS
TLSH
T1B2C1CD248781E79BFFF12930D5A00F1D3832C79DA566FA4A1194957C320B79AE07D24B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe590bce.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe590bce.TMP
Size 3KB
SHA256 c8eefa6844483b6d6ffb64ba39b95e4373b29e39b4ea69c018e54b883549b93b
MD5 551bad6ef91b88a1da6d3611c7b2119d
SHA1 46302f4f182daeee7bd708f683018f004db77efe
SHA512 2cc205489e3aa0596c79e4555de3cb4157c623417375f98643347fbfe1770e4e5008e97a1420a4dd8ede2d9ff155402de9c89f0f293a8217b3d03c993c475204
TLSH
T189612B340B526BADFBE11E72E8E14705B432C36DDA73FC2C606096BC6107727602621B
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 4KB
SHA256 1e26e1095be55fbf35c64aaa1f16f65855a4fe857690168d90073b561d4e7e10
MD5 cb03cc92e1eb6b0b31cd275d6c37da54
SHA1 9b0c93cb39cd8d151633bb603f18a16ad916ba55
SHA512 6f414729f82e0266b61cbf778a5aa27babb188f9a898228cb0bb29de473d9785f2ed6103f848ff2e0a368f80fd2ddc77c7074d0fc45624dd94671e35b1c7ce98
SSDEEP 48:YALlNSOCDOCDtzCDDgyJCsEzEsORsQfo7CnOCKmtCHYXfXKsyCKsVClCYCsfCjsp:DAOxEziaz6faGO5mtcP6GHNEDitjwQ
TLSH
T16681BBF7C3E5826DCA0196F0AA18AF1BCF2D0551436C3D5A84E4AF1B93F2871E151B8E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 dde3ea859874ceda7d45c812c6a78d3bca2d8b618373f1c3c9479151f96f7f13
MD5 c98fca3be02f6f69e02d20ccf86dd107
SHA1 54f8a25800d08732e2fddec5ec7c512affaacc91
SHA512 24f6e74d17e396c8ed966d92faa9a86f20201fb58cb8b135308b71cb9d2bc6b0eb0b00539818e842cff75f598714be6c17ec6f9c753e2187a9129bdf292e42d9
SSDEEP 192:sxZ2R/yM/jK1Ml8MqS/f2slOqbbGiGdpmKHW6+WNBih/YLBD3+jIg4J:sxZ2/CS/f2slOYzGtHbC/4Kc
TLSH
T1A862F811AF24593BCCDBD21DF9427B63D6F84462D6940E88AAFC8A1C04F6ADD2217C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 4b6a19cee3e70f987fcc46ae2690033fae3dbcd56a8e7e913af6dce7d2d4a9e7
MD5 ee550ee139333ced5f45fb920ae2725d
SHA1 81536b0d511676a204334d2b0c635998521537fc
SHA512 8a8ae20abbbe3aef122270e7245b81b7439c41ef7390fedfc5b3769476a537c55a10accd9c7955558ace02fc00d90c9333e8e2191d357c4916aad7426d0d83d3
SSDEEP 192:sxZ2R/yM/jK1Ml8MyS/f2sNPVI7bbbGi+dpmKHW6+WNBih/YLtP7+jIg5TJ:sxZ2/6S/f2sNPa7jzOtHbC/UKr
TLSH
T18462F811AE245977CCD7D219F9427B53E6F8546396840E48AAFCCA1C04E6BED3217C2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 38ac4f6dbce7067344bae52ad833f1cbc154dcc3afb02ba86746f4af41763035
MD5 d9ab6a58842c2bd8e4d9090244dd4b49
SHA1 42582ad5727ebb7bffebcf98d68237dbfc15773b
SHA512 7a52f5fa31714331505b0a8fb7deb050fd62af84559d3700b9778e2ccbe90444dfd44d3abf7a7ba513eff5fc56ddb069c3ea0ca2903cae6ae612dd26975859de
SSDEEP 768:Esxs6pY1WvxzWj8F1+UoAYDCx9Tuqh0VfUC9xbog/OV7ILlWwJNsCroLf/:Esxs6pY1WvxzWju1jaMILIsNsZLf/
TLSH
T19FE2FA3B680CCB7E4F841E5CEC2AAE976DD801CBAB94899447FA444C03C77EA512759B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\903a2be3-ab32-4cfa-b622-4e95ccd6e856\index-dir\the-real-index
Size 1KB
SHA256 fd2a0480c9d66b4149726186362ea864eb0b56839dd777f4e8c715c1de3c9c39
MD5 c09f30d739e396d0435ebc4454c3959f
SHA1 187faad252c3974175e02858a53f14094c116b96
SHA512 c8dcd981aa5de9e53d88e01a0fb0581ffa7da6739fa2cdeef8b1ce70aa64b45b9b371256cff470d6cf571146119a9e0cb7be99ac6c9bd66f5f4755f184a18234
TLSH
T14821508D4EA0898FF8A481B21532E1E4B371D9CC4B22A3135C2C31315E2334D3A476CC
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\903a2be3-ab32-4cfa-b622-4e95ccd6e856\index-dir\the-real-index
Size 3KB
SHA256 2211282624ca6d5a17b5bed7c451f1bd3a2d26c9588d5096fc5c392aa1c94563
MD5 c6bbd99ecb76c702a34c9c3d267abcd2
SHA1 2561916bef3a3b6a418ff5806d6685d22356a2cd
SHA512 98cc0239cd0e0f7008f5ebeb49fb1841d0267df7fbbbfcc016e21a17c406311d2e41638151aa425206147cff2e0eaf48484e7070fdf24b38f75ecea3b3429fb6
TLSH
T14B51FC1F4D491F69D99C567118FA1C82337858DE1748AC0753EE9335A8E33385E4D149
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5897e6.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\903a2be3-ab32-4cfa-b622-4e95ccd6e856\index-dir\the-real-index~RFe5897e6.TMP
Size 1KB
SHA256 3b73100fe3bb69310ba080aa5a262bda3752a9e745858b62b666390e8ce9bab9
MD5 6eced5f1c4e6ae0a391461dfea738ec0
SHA1 926bfdf27229758955ff78a5d29754d742f45a81
SHA512 778e90e8861f76ca5ecb9106594cce3f52708f3e2ca85fd8fee00b97a5226a9043fd6bdb6694115e27f3b00df3ad7dfd220cfd93d178e846aeaedefcb103910b
TLSH
T1D621049546D14E5BF994517B1A53B4F8B33189008322B393A93D217D8D25BCD1A4B0D9
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\c575eb0c-4021-4370-8d95-03811b891285\index-dir\the-real-index
Size 72B
SHA256 85593ac56ed26af7f1547df48704fd02eb75d044066072779e59bc54bdf101f4
MD5 75b40c49a828738ba53517ffc83a4bb6
SHA1 a695dcc2e0000df5c904bdba75369caa9ff7d51a
SHA512 782a50f89681cce9b643fa41060704b703b25202d7109023c469295dc4ef4832935047f0e0f3ae73aecb835924306036366b2c3cb797ad4bc3fd3bb5f5428882
TLSH
T17FA002118F810056C81352B2156303411700C8912140134784A11148DC555416D4904F
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\c575eb0c-4021-4370-8d95-03811b891285\index-dir\the-real-index
Size 72B
SHA256 47349172b949e8ec390f0fe6ef8e42b2b1e4dd9038367ec433cde31e3c6f9e6e
MD5 e93a2bd230cbcdb81602a15d774e840d
SHA1 2693e61419d9a8a19a637b2e9bd5a81dbb98e3d6
SHA512 4b06df44991cef7e29faec7811d78dfb183f4bb904a0869a9594f5821896ca4f60a3fa5848cb8d86ebe705221b99d0cffed209e288b05331d3ee42f86f74cf4d
TLSH
T1B1A0029407806101F50223F029E6165D2310C9105701538741D405BCDD509958F6328C
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 2a2ba0ca2227e54fbba37662592d024261eb485253cbb8ec69cfeebb7742d6fe
MD5 1c8e46558e16778b349541ccaab95bc8
SHA1 3950bae784ace38ea3242cf7c99ac762c8af9688
SHA512 d55f64160dba4e824353c333d91b40f653712918a0fe8128e1f091636cee4fa5f15a40b823bed2e4c52452ff57c660aed47a7c034748953c7d9b4abcd15b27c0
TLSH
T127E020BB6EF76820FDAFE3E7287054B50141381CC805BC4F946ED6C750B13557846C65
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 50468edcaa58f36e39c94dbc7bba009413ccd6e3733e44ed2255e5d036a8fd21
MD5 368a5e2f48e2744bd7e7c7265eed9912
SHA1 a02f10640829ead53f9191db26326a8d071f0134
SHA512 022b1dc57e5dc9b3bcb628e157dd22a9ea5132c48c9bbbc9e6a78bc5b6f42a80148cfe3b25e261535f95c499330ad243fe69648961b026b1958a74bad0f79e88
TLSH
T13BA002218D98C245C1C00BF1947509CC22108BBD9B49621394AD00D89E64244C3A6714
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58f037.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58f037.TMP
Size 48B
SHA256 f29a9f2451c5094b39a22eeb63adb33774fc7060220f56904ac9e2bb153f0d2b
MD5 38114adf2a217250cceb93a0a05c84ca
SHA1 a492782cf9b6ba4eb8a52cdb64b5164ad565061a
SHA512 d88fdb35663f9d0973d02d8973062a780db8f9ceaae26a1111fec8b5faa7c53a19e655aafc53a14f768097784ed6ac2172ce43beabd8c2d23e8a4ea2a953a2b9
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 5KB
SHA256 93d83050d23c1cb3e87e2a6c1ede4ca68db80ce2c0da97ab0ff7721aee4366cf
MD5 9bea6c5d6c05008c71c635a4f7aa900c
SHA1 8eee955932812c84549a3725c71bc4913175d75a
SHA512 7fe588daec7789711bcd516ff5e43cc632276e1bdf2da7ed4603320da081a89fc92fe392b28b3fbfbb6239d8fe9fbb6dfe0f8c04575d0fb9bbf091116996122b
SSDEEP 48:K0PY7/VpdktpmPImHkKzBb9k3f0oGVIyhoIrKVicPdIxK2cUjy4nIZKYIsv:KUAAKtePiogKVi2dqK2c6bneKYIY
TLSH
T15EB1061736B602423D3E3A4883D58BA78E8271533019A42B7BAC0475DE6AE21DDFDDDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7974caba-255b-424c-9be0-abc31d3999c7.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\7974caba-255b-424c-9be0-abc31d3999c7.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 60ede1937af3d4b00463f07461ff6cd19b83cfeff901190d86bc7384afab8462
MD5 d963beaa648f7513102d3e89590165e6
SHA1 4fa22ae30addb103127dcddd815920e654f26eae
SHA512 23678d9759f5bfe540651a2c475929d36ab254da7c5226d31bfa6b23f6fb1860ae679ebd56854cc768b7c6dac2696bb5e7fb60fd08b1d410b6a5019d6efa58e6
SSDEEP 192:qONQ6O7+3hQmiUyQMGttb0IO25h2sgGxv1U6:qONQ61QGt91O+MCV1U6
TLSH
T1FC02D8346C286CB75EF3AE45F68737239FA9112BE9952F84D6E81E0C00DB65C2347827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 efc3caddb4ba33026483c9216390df71b9753378d0fc3ebee0acb9cf54a8e4e4
MD5 b42625bd370c4bae6fef578678971422
SHA1 255f2241ca024e3b3c972a93208437fa60ec86be
SHA512 dc08ef7e5199c2c9b25d8eda61736d272c3931fa444f833c9685f0b5d21c2045487c534858b0b915358f71a9d6fd0344678df23cd895626fb707ad83ea469146
SSDEEP 384:ntZcIOsNdUBTZxVVCa91O+MzozJrgX0X1puLsyoT:1OPDHOZMhgXsyLPw
TLSH
T132925B71AD789C7664F2D185F68B36178FB88067A6C92F80E1DC9F1D01DF668230AC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 24KB
SHA256 ee1388c1bda5e1f98a91fde5ee5e2e7ab37283dc85a7ccd126149671e55ea227
MD5 440ecdac4538117b4b6e8f76c628279a
SHA1 0c7f9fd439ecfde694e514cbb2fcf05a9bf23abe
SHA512 655ef46c1d8da7a5b3c53fcb7415409cabc27389c67dea35c1930c47706a92f8e0de40a46da62ca72158a49b6c52f04c0e5f71c6698bdf012523382a4b2d4465
SSDEEP 384:nAhiFjZcIhsNO8TUNTUlIlwTZxnVC9Df4K91O+MzozJrQX0X1puLsyoT:AIF7hfwgOZKHOZMhQXsyLPw
TLSH
T1C3B20776DDA4CA3BA9F287C5F74B76478EF4416386CD9AC4E5C85E0C00DB6AD130AC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 22278a9037b9419f3a0f6138df59009e2cb6a108b7b3f7064e4744d5f3cc0e20
MD5 7c58c7813c0348c1945258c5b837c6a7
SHA1 d753cadce75a9f465f7aa856a6f2d25702d4dc30
SHA512 be2edb2599fa23c9b07fa83a2ab7749e4ac9875d71187232c790f315237d93940d6adf5c8fe13b45ef34782a439e3d5041880e1549cad4e82b0fbb0f8c19affd
SSDEEP 384:nUZcIOsNdUNTZxV5Ca91O+MzozJrgX0X1puLsyoT:SOnDHOZMhgXsyLPw
TLSH
T1EE825C71AD789C7625F2D145F68B36178EB88027A6C96F84E1DC9F1D00DF568234AC1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 703492609a31a3297a4caa000494e2ebdad69e1647660140efcabde03dbeddf1
MD5 3d208449bffeb5fc0ea160cd24dd9c0a
SHA1 aa69e51fe0011c64fc113dc8090430cf13629df7
SHA512 bf1b6c35c3eaa65ec75cc7c12a85d96b81a126afaa572ae6a027cf809df8a4d357f705dff66dac58fd01d5618c8571bc02bc9b210fd3623077ea872c9f0fee5a
SSDEEP 384:n1ZcIjsNdUwTZxnVCa91O+MzozJrlX0X1puLsyoT:NjODHOZMhlXsyLPw
TLSH
T1B8925B71AD789D7664F2D185F68B36178FB88067A6C92E80E1DC9F1D00DF668234BC1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 85923d9d66c4ebb38982dc073bfa7190f0443f1aef8af52470a8a0e6921d8f82
MD5 ea52a85fef45c5a0effe6aff0803bd5f
SHA1 5e04514fed28a5f9bee5dcc10bae34acdc1ed3a2
SHA512 bfa5f22e5e3633e0ad58fe9dfff54b567e9656af51623c8b1ad9e924304fbe2ee431df391f270cee1e0ef042da400e4ba35d823929dd848d4249d22682c98e82
SSDEEP 192:yONP6O7+3VQmiUyZMettb0IO25h2zMZF0SJrdcN+qMCU6:yONP6Fxet91O+MzozJr6XU6
TLSH
T12612F835A8289C771DE3A545F98735139EB5416BEA8A2F80D5DC2E1C01EF6AC238AC17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3b23f5fc-e1ae-43b4-900b-f940ab317ca0.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\3b23f5fc-e1ae-43b4-900b-f940ab317ca0.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 3f5f1343d9bdc9af963ccb231a4383b008ac39cc04054d257570d914113c5bec
MD5 fb4ce083f7c75cbe614c99a8524c7118
SHA1 c3a4c134c671a0b3ca72a6b37e5aca76963de7c3
SHA512 8e9fcd03986e8551c8bcc876f5a3040ef8ae8ff9eaae09875ba3935b7b530a8fcc7249ca7a22232ffdbc39764c80b79a785728baa690e506ef79d476b35b997f
TLSH
T1C841165CB6E91148B3B76F566BF6A86D487EBD772E0AD05D00110E4E0A62B00C8A1B33
MD5 SHA1 SHA512 TLSH

Submit Download

Retrac Launcher.exe

Path C:\Users\Admin\AppData\Local\Retrac Launcher\Retrac Launcher.exe
Size 13.6MB
SHA256 1c849dce609b4ef151a3cb352d4003f73a8a65c7f40d41ccb96af2b60c9814b9
MD5 5fb6c0788b7d173a412ccdad986d4a6e
SHA1 47e5f560c7580448c316c1fc6cb8393c66d24681
SHA512 7f26e381ef05a9e8d14306e623d7e84518a2b830df3b3e2f957421c9da9bef59daa7d944f7765c3832b29aa7125dfce3b169703cc11487a08adc8d17e5bd3d6c
SSDEEP 98304:MAoDQYuu/nz1UX3ldwAu6lDNHLigPdp+pDBPk0ibCunOCqIV7j3VuRuciNBzAVo8:M9uu/ZUMHSrigqf9ixOCLZuEchVbr
TLSH
T111E649217B8A99ADC05AC47482864B725A7170CB0F35BAFF45C486793FA9AF41F3C358
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d26b7604-fbfd-4537-a9d2-f24e63a2f333.tmp

Path C:\Users\Admin\AppData\Local\Temp\d26b7604-fbfd-4537-a9d2-f24e63a2f333.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ecd3e197-b3f5-46ac-a92c-6693496f6728.tmp

Path C:\Users\Admin\AppData\Local\Temp\ecd3e197-b3f5-46ac-a92c-6693496f6728.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

ApplicationID.dll

Path C:\Users\Admin\AppData\Local\Temp\nshB013.tmp\ApplicationID.dll
Size 198KB
SHA256 f6851dcbf0a39edecd8a46564bc455e5273736c3dbcb02b954c201c79ccdf117
MD5 91c2e2f34b5bba068e9a6178e13a4e5c
SHA1 affcac00894c9afd152e55d0bff7899349edcd6c
SHA512 ce7f629bc0e6e10eca9d671513062f353d8d47666df58c9ad7cc7f767df520b75b2da1f9d6551eae86c738455919463ec89a0c3dc2a8366fa021e6fa6e292000
SSDEEP 3072:/1RnVZfr2qLTV4U3fKHzy/s3fyitDJXqtZnyj80mAg0FubAPl/IJ:/Hnzfr7HU6ipJaLAOKy
TLSH
T1B8149F11B491C172D1BF16340979DAA65A3C7D600BA88AEFA7D84D3E4F781C06B31BB7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartMenu.dll

Path C:\Users\Admin\AppData\Local\Temp\nshB013.tmp\StartMenu.dll
Size 7KB
SHA256 42dd4dda3249a94e32e20f76eaffae784a5475ed00c60ef0197c8a2c1ccd2fb7
MD5 d070f3275df715bf3708beff2c6c307d
SHA1 93d3725801e07303e9727c4369e19fd139e69023
SHA512 fcaf625dac4684dad33d12e3a942b38489ecc90649eee885d823a932e70db63c1edb8614b9fa8904d1710e9b820e82c5a37aeb8403cf21cf1e3692f76438664d
SSDEEP 96:h8dPIKJhMuhik+CfoEwknt6io8zv+qy5/utta/H3lkCTcaqHCI:yZIKXgk+cx6QYFkAXlncviI
TLSH
T1CCF1C7B6F3D10673F9AB427428232F221B1AF5215765C1AB450316CE7661CE3FD34B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nshB013.tmp\System.dll
Size 12KB
SHA256 8dc562cda7217a3a52db898243de3e2ed68b80e62ddcb8619545ed0b4e7f65a8
MD5 cff85c549d536f651d4fb8387f1976f2
SHA1 d41ce3a5ff609df9cf5c7e207d3b59bf8a48530e
SHA512 531d6328daf3b86d85556016d299798fa06fefc81604185108a342d000e203094c8c12226a12bd6e1f89b0db501fb66f827b610d460b933bd4ab936ac2fd8a88
SSDEEP 192:Zjvco0qWTlt70m5Aj/lQ0sEWD/wtYbBHFNaDybC7y+XBz0QPi:FHQlt70mij/lQRv/9VMjzr
TLSH
T126426B129BB089F2F591583814667F2A6FBE9C5D27F50563CFE304D63D212CB983A283
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

modern-wizard.bmp

Path C:\Users\Admin\AppData\Local\Temp\nshB013.tmp\modern-wizard.bmp
Size 25KB
SHA256 3ad2dc318056d0a2024af1804ea741146cfc18cc404649a44610cbf8b2056cf2
MD5 cbe40fd2b1ec96daedc65da172d90022
SHA1 366c216220aa4329dff6c485fd0e9b0f4f0a7944
SHA512 62990cb16e37b6b4eff6ab03571c3a82dcaa21a1d393c3cb01d81f62287777fb0b4b27f8852b5fa71bc975feab5baa486d33f2c58660210e115de7e2bd34ea63
SSDEEP 24:Qwika6aSaaDaVYoG6abuJsnZs5GhI11BayNXPcDrSsUWcSphsWwlEWqCl6aHAX2x:Qoi47a5G8SddzKFIcsOz3Xz
TLSH
T139C29757DE6B6EA4BE0804EF1A0694931C71FE211AB0CD0561D2B767B4FC93B19A0B3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsDialogs.dll

Path C:\Users\Admin\AppData\Local\Temp\nshB013.tmp\nsDialogs.dll
Size 9KB
SHA256 56b96add1978b1abba286f7f8982b0efbe007d4a48b3ded6a4d408e01d753fe2
MD5 6c3f8c94d0727894d706940a8a980543
SHA1 0d1bcad901be377f38d579aafc0c41c0ef8dcefd
SHA512 2094f0e4bb7c806a5ff27f83a1d572a5512d979eefda3345baff27d2c89e828f68466d08c3ca250da11b01fc0407a21743037c25e94fbe688566dd7deaebd355
SSDEEP 96:o0svUu3Uy+sytcS8176b+XR8pCHFcMcxSgB5PKtAtgt+Nt+rnt3DVEB3YcNqkzfS:o0svWyNO81b8pCHFcM0PuAgkOyuIFc
TLSH
T17012F992E6A450B3C5D6533B35AA2F2DCBBD5325B0926C00C7738E4D39395B66E38353
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsis_tauri_utils.dll

Path C:\Users\Admin\AppData\Local\Temp\nshB013.tmp\nsis_tauri_utils.dll
Size 968KB
SHA256 2b454443f12806d9e531e18bf19933c0aad1cd8ae397c71b99e814566e6bb5fd
MD5 0ba06473cec3f0e72fc6865d870b6bd9
SHA1 16df1d1a5b4d5df3859447279c55be36d4109dfb
SHA512 42b3c4ce685afb43b8ba235b29919f7fdbc1997618b74d189817d14d1d80e52ea67f6e614d4097bce6ca53b90d46a6d6a54882cd2ea176134a308b64a2b882cc
SSDEEP 24576:v2zSi+70fdjsUD5Y/CjsS5NpIMDcuHeoPffPJT1Qn652hOfuvNwRnkYkN2IO:ivm0TYKw8DnVbTwbBInkYkN2F
TLSH
T1CE258C41FAC28BB5D90E1674105FE33B6B39540887A6CFD7DBA09E30BD623A15E3529C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a60df821-c759-4a82-93bb-9f35989b5760.tmp

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1868_1073425486\a60df821-c759-4a82-93bb-9f35989b5760.tmp
Size 154KB
SHA256 e56c9164b667ad97b0cefcb26e48bcb2b04d8cc1a362ee921f2119a6a8798000
MD5 a922bd2071b7aa9f2154c991d41885c7
SHA1 c88b22d16c951cbb0bfdab367232cf830e0464d1
SHA512 d8ed2d6b1c3a421a9771e3a5109eaea839bf64be7b7e672ed7b8aa47590ff35c6e78aa79712ce37801cedc56db552fc6a7c3ca55004295a438219ce4a8f007a0
SSDEEP 3072:Aj0amyoD1f5NQQHyR5nYbGnkBEGsvsq5UBkUM4RIJ+37HVeCsKkwQuBp/Z:AoHBD15HEYbQkovswoM4RIIzvXkwtBpB
TLSH
T12BF3F11D7EDAC952C40B92BD3C1AB18BC94B8F0A431674CF264D90248EA578E07E5EFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1868_1606551970\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\site.retrac\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 324e20cafe8eb7e675f8e9698ba628c0ae9ad8bea4744dae4632595744b4d2e2
MD5 ad2d4d86c941e8f5cefc82fd62e7e130
SHA1 669f0c3238feb0d8cf04788733c3e13ee26ec0f7
SHA512 b6db3ebdc29adffb0a026ebd756c48f1bf52ded663c9ae49fd8a94ef59b0716f7c59d6c6e0c86469778141cb44dc4c20773e157baf83b966077b298a0928c58b
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\site.retrac\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 bc10dd21eccdf938774cea71edbaa2240536b0a15df0a90c1349cd4c47e19faa
MD5 dc3ef2e413299d515ab59f3b502bed5e
SHA1 e958cb2b9024e299bc23c366e4df728e2b3f9fc8
SHA512 384d6a39148ffa01437f9e9a4e06ce57baaee367dbb1660af7de92351c29d064435985d1443f643fec7532ce7b223ad7d2e3c8ba757f953bdf50f3f6c45929cf
TLSH
T1D8D0122632010234CC1034731012760C1C00D12BC0098040A828C59D1B044B08906462
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\site.retrac\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 4d2b8c9847cbd5637bd29200b969778eef8ee2f9bdca02db77a0f50d49de40e5
MD5 14fd850d14da1f9f1bc265d3c1494b21
SHA1 8a60ed96fadebcb87464794075951ed5574cd6cc
SHA512 d32027dbcae574e07b82a53870d66c55dc981ccfec0b750a1333e14bf98225c78ae4244516c7171046dac7be76912e42ee26f8dd3fafc9829b817d1bea812f75
TLSH
T134D02BB632150630CE1431774081F65C2800C13F800A80406E35F99C0B404F24CC5952
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\site.retrac\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 c8e6fe7dbd3372826b02bd01ddb61c1543a648b6e75d09df407d3a0f52c167a4
MD5 e3259fdcefa5146a52f8f2650217c08b
SHA1 21ad0603711a84ed03d593634826b1ae95a1c3c2
SHA512 8c01eec7ac1b5a959a8431db6c383c2013daa38c6d6842e9758037c61615531657cb7c09a3a8cd1325689a80d245250286499d285822d783fe8d52f732c5d6ff
TLSH
T1D3D0C0F533051A31C7243533C0C1E4443940C12B508B81586D30EABC0EA5CF348DC8D1
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\site.retrac\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 4d72f4426d353cf42118e9158f1262adcf69144981826b64f1dcefcf89620b18
MD5 e16e266009fd40a679de59a48f46d953
SHA1 ff6db215c7bbc32404f702433faa726e85b34f9b
SHA512 39c325bf54eab6922aaaa22b4007d5d9ca8d2a3bd2c89a26a4f9612d3e1776b48d9759123181b1ad39b0419c7b9f5cdb300946dd3bcc5138ecb30b71a3a08bf5
TLSH
T1EBD0C0F533052631C7243632C0C0E4443A40C02A508B82586D30DABC0EA6CF388DC8D1
MD5 SHA1 SHA512 TLSH

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\site.retrac\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\site.retrac\EBWebView\Default\Cache\Cache_Data\data_0
Size 44KB
SHA256 468456974fd86b33647942820dce7284879acfab9e9e6eca008e1fdcf9006fb5
MD5 d1f604157b0745a40453afb93a6caa42
SHA1 3d5d77429b03674ebb0ba34d925ba1b09310df5e
SHA512 0644ce93724a57dedd8aec208e5a038e323a1b9871d5046d58a87c60479626693e6c8f25b7c7f7b60fd35aac133d2e660ecbd8f8d579ad1fc6703ae117a485a0
SSDEEP 3:MsFl/ll+l:/FE
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\site.retrac\EBWebView\Default\Cache\Cache_Data\data_1
Size 264KB
SHA256 eb461ac4b7b862c0fbbc9b43e93e8867ebab1c87b6eab7534e623afcb03174ae
MD5 07af65524b3e2a34fb6c38c300a47c02
SHA1 68501e0aaa1b62ae147212b66d5663d37031aa0d
SHA512 4c96a8bd1aa57d55c32df01ed52c433c7b0268c8c4c73bc255414c6edab73c992c96569101b3dbf28f26ea5cbe1a9c41df336923f4258abb7e65390cbb4fb2ab
SSDEEP 3:MsEllllkEthXllkl2zEHl:/M/xT02za
MD5 SHA1 SHA512 SSDEEP

Submit Download

index

Path C:\Users\Admin\AppData\Local\site.retrac\EBWebView\Default\Cache\Cache_Data\index
Size 256KB
SHA256 d025d3430f4141a835d5d4e72ed5779c2d8bf21bd2e01a11866f87b5f451acc7
MD5 53450d227a3588ad22c76c4be72fcc6a
SHA1 deab727a124fb8cd8ddef1b701cd613443b659b1
SHA512 7a66298df44c61552049bd4a0058ad6456aa7a7ea13a702ba80990e5ce130eaa1fe087ef7cf37736d08f9729ffa856c43868746d9a806a6522010201c1dac7c3
SSDEEP 3:LstlNllkll/l23+/l:LsX3lEt2O/
MD5 SHA1 SHA512 SSDEEP

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\site.retrac\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 96B
SHA256 2e1c0cfc999a1330e78e73aa0704f0dbf47bfcbd5c4b7c2422fb7b7d72d21cf2
MD5 76b0029cda008515bd18db9fed68b9c4
SHA1 f04aa322f85ca8edcde4c827bdfa779e3e288ab2
SHA512 ba1913e262ca81cd01059a609f3779352c87ea1edaf113baa3860b658343f744e01de56282b2c91e657311d0578a29d2a7b5f80ca7e43f4a7dec00ba846d8fd9
TLSH
T126B02220C00C000BC3AFABB800E22CC03030CC32AB038200A8A000B0EE23302CA330E3
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\site.retrac\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 72B
SHA256 fc230d2320602db0154b1cea24719b72fe7c51a855f53940884102c1f48d665a
MD5 cbba988521bd88216bd5c0d1dbccf36e
SHA1 58609e70fab257a0dfcf746b8571d30e0f9b1586
SHA512 4c88c9dbf6262b3c7a4b68e5c0ccf51ce7454deecf338adda0600794b5b8c84ae7c7137f8e08489896d0afe7105409bcad08d5d3c68ae35ff1f28b96febbb3ab
TLSH
T1ACA002248548151BC1CD9778558216543234CC6135136791C4A002A488A0B92D226112
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe592716.TMP

Path C:\Users\Admin\AppData\Local\site.retrac\EBWebView\Default\Code Cache\js\index-dir\the-real-index~RFe592716.TMP
Size 48B
SHA256 9c94727f920eeee8c63ed663e758a00f9d6d990bb6c72ee597ab6238c0362179
MD5 2967a4be801a698da6ff1d5462ba311e
SHA1 f28d9f09c2b1c0534f7f8b8343a050ae5072e1f0
SHA512 347a0713795143c0e1cbbe7cc2786da6edcd31fd5dfeedaa859c81cb76fab71b7cf824f193013daf182b41af4f36bbb8c54282a60479678a45a878bb73fa4bc8
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\site.retrac\EBWebView\Default\DawnWebGPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\site.retrac\EBWebView\Default\DawnWebGPUCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\site.retrac\EBWebView\Default\DawnWebGPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\site.retrac\EBWebView\Default\DawnWebGPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\site.retrac\EBWebView\Default\Extension Rules\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

History

Path C:\Users\Admin\AppData\Local\site.retrac\EBWebView\Default\History
Size 184KB
SHA256 e479811df84a81904de36ca9a668234e4defd9e853f1c260d608cd01ce89da16
MD5 b059217856b9a9c8babbf49a034d22b5
SHA1 6df4aad896bcf1d1da75563946175bece64ccc83
SHA512 a1da9b3d676fa28a45111a77c078891a25f891566a61c5dbfadb032171eaefc665709c55a55d1516ba9e11f65f1b430983c1f788b791d553570a5cc24b978755
SSDEEP 192:HB4wvgVPH+bF+UI3iWGVjWN3qL/GVgZQW31:h4LPIkUI3ijVjWN3qL/GWl
TLSH
T124043F2F5F343212CDBD917A68D744B3587DF02F8B2366D66C6148B1CEE2652A02C5BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9dbfb801-0ad2-4994-b635-c495640a1041.tmp

Path C:\Users\Admin\AppData\Local\site.retrac\EBWebView\Default\Network\9dbfb801-0ad2-4994-b635-c495640a1041.tmp
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Path C:\Users\Admin\AppData\Local\site.retrac\EBWebView\Default\Network\Cookies
Size 20KB
SHA256 e87b3d155c7582d4c1d889308b58f84e8fe90a1581014b21b785d6694bd156cc
MD5 a156bfab7f06800d5287d4616d6f8733
SHA1 8f365ec4db582dc519774dcbbfcc8001dd37b512
SHA512 6c8eeab3ae6fb0d5be7758cca521665b216f31aed1aeeeaf121c99dc9f0192b385de0da36e94f90dd4a9bbbac6be2c5a55d2f284a24ccb7dec2c5302fb9b027c
SSDEEP 24:TLekLbXYFpFNYbatqn1kweka6za6UwpQ9YH8PATZ6HfB:T66LopFMatSaw/auUOt8B
TLSH
T101928A4E5F346220C0F44B36EDD189672F7C212CD3A72699DE1420F3DE929ABF1095AA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State~RFe592754.TMP

Path C:\Users\Admin\AppData\Local\site.retrac\EBWebView\Default\Network\Network Persistent State~RFe592754.TMP
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\site.retrac\EBWebView\Default\Network\TransportSecurity
Size 186B
SHA256 c95ff26dd7c69233e7cb5a24bc46de8ff2e0dd4c4a1cd3eb84316f4c924f6419
MD5 e06f478973f51245159953da2fff3e9e
SHA1 b8805396e2338c586fd063a643b57521a2710651
SHA512 8a4aa9e3fa2e1e86ebf6fd5208e4308ce94ce65d6b89216f5965d3b9773f7dcf1c42b6308338f54c6f94bedf8056c3fec9e888755fd52ba0d62397a9478e1616
TLSH
T1D6C0126280BAE4B65078093519846D456F37F1340181A8F8DD57466A9194176B517617
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\site.retrac\EBWebView\Default\Network\TransportSecurity
Size 186B
SHA256 7f24b92586fc056b122f7e42b7d2c6a18b56060a5278656a7c5a5d8ac6e9cb62
MD5 724f6e8361c6ab46b9a14172abb334c9
SHA1 1f011ce411fa0708fea503d61b195e84eb703ddf
SHA512 c303d2c06422eb8469f5af3cbb818b046b38e6108b78f9eb85f7eee17860e0488041e58c22cd98fc8f6320eddbde41f1ef4e0fb08cdd5d9defdfb026aedcd2b4
TLSH
T1DBC0C0E2807EE47210380929ED807E406F77F0300041D8FCD183423CD4040766123433
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\site.retrac\EBWebView\Default\Preferences
Size 6KB
SHA256 cdc0da97c705b50cd67d73b7415c911eeab876c9b11d4c75f2d4467323efa2ca
MD5 bb4423989b70741ae00eac266ca05a3e
SHA1 98259cde64c0f9eb973f2c43cc34f8a3f0b4aad7
SHA512 208a943d322f5486125fbae1afd302170b0974e054de092668dba8cf08590fbbf6cfd689ccf4f88763b4a4265225429f03440604c6df5fe39061601a58a8bb9a
SSDEEP 96:stP05gZm8bDCnffqKZ8i0vhEckUem/7qx+WVHMSm+uecp2tEZdQjV+gdD3jLBoM8:stP06Wf7Z8pamL/S+Wi72tWd8zLBoM8
TLSH
T12FE195429F28A97B5CC7E219FA35BB43D2FA502265D51F48EBFC851C08E66CC620790B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\site.retrac\EBWebView\Default\Preferences
Size 6KB
SHA256 f0fe6883afa6c4d7ebb8f8f4e6ac9fb0429f640303218bb3b1f93783be6ecf8c
MD5 e96b3b5057ec08631311a9776abeeac5
SHA1 69b559a1415f3fc3115a3d7a360d8a2d13764841
SHA512 a509f03fd3b67c619256b8517b12965252ef1dfa6e24145ff1d1494c8d520eef64bf4218bb9ac61862c33c920901d152bea310f0fc01bd3c71e8f015a107a3ba
SSDEEP 96:stP05gZmwb9CnffqKZ8i0vhEHkUem/7qx+WVHMSm+uecp2CjMdQjV+gdrjLBhKEB:stP064f7Z8patL/S+Wi72Cod8zLBhK8
TLSH
T1C5E1B8429F28B97B4CC7E219F935BB53E2FA506265D41F88EBFC851C08E66DC620750B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\site.retrac\EBWebView\Default\Preferences
Size 7KB
SHA256 db50151ed2f2fee41aec7a73a657718a436b3ede79d2e67701622e3621264a6e
MD5 cfb8a4046124fb2faf764873be273b40
SHA1 6a5f813ef7831a8b086e278950bc1125ad942eff
SHA512 0ffe47cd8a046eea26deed3e7426131cb35c1cb957f33c4c9c070c447902fa6d8efad9ed55e4c4ec3d552776666e2e5260b1707a39640246502a3830f38d81c3
SSDEEP 96:stP05gZm8bDZnffqKZ8i0vhEckUem/7qx+WVHMSm+uecpIvjUdQjV+gdFbLBiMOB:stP06tf7Z8pamL/S+Wi7Iv4d8lLBiMC
TLSH
T197E1C8425F28697B5CC7E61DFA35BF53E2F6502226D50F48ABFC8A1C04E66CD620B50B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences~RFe592716.TMP

Path C:\Users\Admin\AppData\Local\site.retrac\EBWebView\Default\Preferences~RFe592716.TMP
Size 6KB
SHA256 edcff3de270249f504bb7d9c23d0c73a61a700d2db1fd88ab1401d801dd1daad
MD5 326e122d5fa13cdbc4eaec25125e6fa2
SHA1 43e5d4821919c3b50b8a9ecd20f2fce608fcbedd
SHA512 42bd629b1ebbf5870b0b8f49812067a47d0f713fe1df802e21fa82f4882f8e039ebec8279f1891b2a758b0ea2c8a41206d9ae8e9724e73bfba363e6f72ea5209
SSDEEP 192:stP064fMZ8patL/S+Wi73kD4wd8BbLB+M8:stM6474/Vzq4wyRv8
TLSH
T1E3D197425F28797B4CC7E219BA35BF47E2FA506165D40E58FBFC851C08E66DC620B90B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\site.retrac\EBWebView\Default\Secure Preferences
Size 6KB
SHA256 d29c776a8942c1c1cde6f9ee84c68066374cdf42bcb6641ed17d4a403d9477ea
MD5 ecf3b9de44fc322b701a6fbc8b29cd8a
SHA1 489f68542b9dc876b5300058a1b03b4e538d1204
SHA512 05f38f48575a5683eefd9de5bee15082dbef6841638f482fc20f63106c0ac63c33bf4711509feda79016653632c703c140a587ef7f23d34d679867f6e8f964db
SSDEEP 96:HlRiLPlf/ROoKOpkF5d1RiG7sMaTEv9V5h5pg5+eeAVy2jPgwXtDfgVi4v/:HyjWGJO9luy244tDsi4v/
TLSH
T130D1B6A3452DC535AF855BFAE82C3ECBDDAA408F98D9491697D1C04C07C2EFC21DA885
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index

Path C:\Users\Admin\AppData\Local\site.retrac\EBWebView\Default\Shared Dictionary\cache\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\site.retrac\EBWebView\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 48B
SHA256 d9d7c7f74a3bf95f8e7a92d95c92a204356ce300e66df3d031bb674679febe32
MD5 15b68cc029a43acf2fa76598d81eea53
SHA1 ad2fd8fb2982bf5dbb43a6898073ab55c8b7fead
SHA512 e7bc4b102625bf8a7c3b93eb55d4b278508f0bd97117bbb2f392073f58dec8020e72b633183fab582550786753427ac7f5bdb87cb6d42c900ed5fcd5b32887f9
MD5 SHA1 SHA512

Submit Download

Path C:\Users\Admin\AppData\Local\site.retrac\EBWebView\Default\Shared Dictionary\db
Size 44KB
SHA256 f8e7cd835195e4eff7855d20676484ca75f7e7e4fe5b13164fc926b365e1dea0
MD5 b581f0ff8f8aa3371ae47b48c95329e8
SHA1 4f588efadf3675f3526cbe762c50eb8e79d9f2e5
SHA512 e0a79452acb39838afea8ce34e05c7e5cde68f2a786fe4423ddf2588fc6047339e8e4c3140d7e0447f938b2266f52b9ddbdcc0f40c495d833b47b3f27d7996de
SSDEEP 24:TL6xgJhPwMuz6G0ZestjteX4yNQeYlv+1b3IeNS6+6Uwg89oIPq81fBG:TFOIy4m1b3fbUdSo2qSB
TLSH
T16513AA0F1E187551D1BD0235E9E64E6B2E7E204C9B8369D125F01AF24DE251C9D2F27F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\site.retrac\EBWebView\Default\Site Characteristics Database\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\site.retrac\EBWebView\Default\Sync Data\LevelDB\LOG
Size 279B
SHA256 46aed378f5e78fda2941eeaf0d7853a8e5b6fb636356c56f84a6c2ae7f005f3a
MD5 496c17f2b390d66ec7d46e4a1713d5cf
SHA1 44361c3b13772e04d99d86b19ed0e0716c935bf8
SHA512 ee920ba9a198633fb27716a5f70fba93d1440e523b613734c4ba7beef8acb61e8b590edc734185d5a443df0b14653bc5eeda5cf1f8256233a25d4d56f6801a98
TLSH
T1FDD02BB0B9C4C6764D448CDB9BB3772EC674BC05E7C5365E5F84B458B40F00872A5A81
MD5 SHA1 SHA512 TLSH

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\site.retrac\EBWebView\Last Version
Size 14B
SHA256 06205ebe5acf3073d12a4ac419377a3449e6d6b5fa7fa2b1c4201f007c4ddd91
MD5 96fb5f155aee0f8cd88274656c58ca83
SHA1 1fe86d9df188b0f86ae2d8da8f7c1ef663258baf
SHA512 fee0061ef23ef3fc35d050501b47db921f490c2aec2a016304c9f27228d3ecf7df9641fd681d9babd275ffd3dbd20e33e38fa5bf583c2852ffcd4b04bedf015c
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\site.retrac\EBWebView\Local State
Size 16KB
SHA256 d8ed221e83a73010ddeca99bc4030acc2190744c04afd5a8905823800e185604
MD5 cec8182de6c920f372bf257c29eae2c1
SHA1 19dc4ebaec8945259509c630cd3ed3f77bad5915
SHA512 f1ebf648ea0612ae08325b53dc2f56bf4243a140c7ac5b90c36ddd55e530b7a5ff97ae2a1e595977990b82a01dfc7418c07d530f376e5b2fbeb24441fabd75f7
SSDEEP 384:zo+aQikB+z/xvxjg/qhEe3NbyqPwmG9z+:D/UxvxjgC+eFomGF+
TLSH
T1EB729E3799787E3799F2F515F9490B4BCB7984B280C12FA88AED1F0906CB7941346D13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\site.retrac\EBWebView\Local State
Size 3KB
SHA256 05ddde786f0bdc93f67f501986062426f99c50202b78c04f01d2fbe2c40e09f8
MD5 a35ecffc967720ec18ac9d1133bc7de8
SHA1 22e3ab45b28a8a8c5ee6f1d3cd29873e82ec1d45
SHA512 66131ab260ecfbe4d7034e00f1438acc35e6cd37346f69a41a13b7e1ea206c3f08bbb08329b654e8d67c82b6b6bde0d7bad25d2fdcdb74a654413d79394aaa32
TLSH
T159718476A964BA378EE39A41F8C52F07A6755123D4D43FA5DAED0F1C01DB6882342C17
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\site.retrac\EBWebView\Local State
Size 1KB
SHA256 0568bdd48796088967530c9dce0c3e69b0d3cad48e6e847154e380bb7dfd93f5
MD5 fb552ee3c7da840a0e16166614c85698
SHA1 e599035dc8477911ac2623e7ae9c194fdc4f4145
SHA512 0b1ac7b6a589c43e20ba0b882a01975a978a08fda83c6b7d33b065f6d92e5159375a626eaa0142a0fd1f36f1b648d417092072182853ad5110feb99f69becb3d
TLSH
T1773185B1D8543F36ADC26652F586BA475E315062C0904F48B2DE0B2C21E75CCB56EC33
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\site.retrac\EBWebView\Local State
Size 16KB
SHA256 c269af3d35b4f101c9b232d39b966589fb4bfb29c5c8389c3383342927788c5b
MD5 ff48c0f2ace7e30b77f5096819d2e837
SHA1 63f786a9de35a88db692d2372baab868178c8a22
SHA512 0a1bf847566a20dd809cfeb56961dc77711d4380b0939ef0b769cd3f15e5b43048641afa9df8345901d702b7c816fe9d4134b8fa48724bb461ab91ccf65d4b10
SSDEEP 192:zt7DFOKH/2/aQWjYhwZ00i+z/kNWIU6ZwNj1Jfo/iVQ45hgj4kuNbCyIooDUhaWO:z5+aQikB+z/xvxjg/qhEaNbyuPwZG9z+
TLSH
T10E729E3699787E3795F2F614F9490B4BCB7984B280C12BB88AED1F0D16CB2941347D13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\site.retrac\EBWebView\Local State
Size 17KB
SHA256 2c71066c454d67cd6e342165fcc0068228edce97a9701390e6d4dd95587f9ade
MD5 a6a21080389e177a5b68938b9c368f2e
SHA1 94fc2c74b6359c7c92ff94739f9ece00b3b419a4
SHA512 76b181a394c3df2a25bd5847d4af000551d99fc634c79de9e92f8e019828fba361ca1029e5d7b43dee50445a4ae3655638a3d82cac9d64df7971a0b5ffec2fa4
SSDEEP 384:zY+aQikB+z/xvxjg/qhET3Nb5wPBuVukDzT9z1:j/UxvxjgC+TsZuzF1
TLSH
T19D729F3A98687E3359F3F554FA590F4BDBF984B280C02FB84AE91F0A168B3941347913
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\site.retrac\EBWebView\Local State
Size 2KB
SHA256 ab6e246839030931dcdfd102d0fbabbd2465e93301b892f30bacf1ab5c47ffb0
MD5 0ccf323f394abf804156ebde61f10275
SHA1 7e163df39638b6161e1e2f6c3e2f43d36c4a8495
SHA512 4f110050b6534348b816d38d06961e31742db2f4c36dc8a14eeab8d3493b1481aa96e40267645c4edc58d439ab8735d70b704621c48e5a5ee35cc3f936c41c9b
TLSH
T1EF51D8B2AC14BB3799E35655FD853F139E36906185E12F50AADD0F1C00DB59C3346C27
MD5 SHA1 SHA512 TLSH

Submit Download

Local State~RFe58f1be.TMP

Path C:\Users\Admin\AppData\Local\site.retrac\EBWebView\Local State~RFe58f1be.TMP
Size 1KB
SHA256 f97813902470e71e44ccaa97c133b85739b9af95f3da5e4d33ead78d995abd78
MD5 007a03fba0102d0972750900e8d000b2
SHA1 3cb4253c121fccd10d4ad1172fe2f4fa80069b9a
SHA512 ebe4a4083d702609dd5b63235ac0d35baf843e8fc57cc0b202284b8fd6efed9ede7145e7fefd6173421df8f84e397a4d7cc6a4eb2c8f8ecc65596d8a9db849ff
TLSH
T1D82135B2C4547F36A9C15552F542BA8B1E31516181545F19F2DE062C21D78DCA56FC33
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\site.retrac\EBWebView\ShaderCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

index

Path C:\Users\Admin\AppData\Local\site.retrac\EBWebView\ShaderCache\index
Size 256KB
SHA256 fa334cf4c1658dc2a78e0b4a5806499571b8616c18881050b98fa924371b32af
MD5 72ab9d5e0e1d729468d623e074bcc1db
SHA1 11f7f1f7229ba2727507bd98d6f231b6ce661db1
SHA512 bb3d48780c0e8cd44654dcd6e27f06e14fd8fa92df944cc7b02ae7bd0ebc503a6ea1edc8f3b1222fb2dc1c341eaebc82ab5b8a50fb66eb383c8b6afcf7ca80cf
SSDEEP 3:LsOllllklkXlM6+l:LsUlPM6+
MD5 SHA1 SHA512 SSDEEP

Submit Download

Variations

Path C:\Users\Admin\AppData\Local\site.retrac\EBWebView\Variations
Size 86B
SHA256 f7b24f2eb3d5eb0550527490395d2f61c3d2fe74bb9cb345197dad81b58b5fed
MD5 961e3604f228b0d10541ebf921500c86
SHA1 6e00570d9f78d9cfebe67d4da5efe546543949a7
SHA512 535f930afd2ef50282715c7e48859cc2d7b354ff4e6c156b94d5a2815f589b33189ffedfcaf4456525283e993087f9f560d84cfcf497d189ab8101510a09c472
TLSH
T196A02407C473C00FF4144051C45C034114FCC447011DD0015074D31314D40CF03F5435
MD5 SHA1 SHA512 TLSH

Submit Download

Retrac Launcher.lnk~RFe58cf90.TMP

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Retrac Launcher\Retrac Launcher.lnk~RFe58cf90.TMP
Size 1KB
SHA256 a286ddb918bd4586457b0d090e0807630dc760ae0c89f90f34c63dfa6b11c6f1
MD5 c4315d44316c7ee8affebc027c59c1f5
SHA1 75361e2f2d575dc7513026f8c547d2b08dd1863f
SHA512 350535d1a214250d61ee47e9ac89d5f41164154474bc569f7b588820ed25206389ee50cd8762f63607d499d5420709647bcfcbbd41e813158a403b19118ccccb
TLSH
T1DC21AA149AE53B16CB7B823886BA0632CB31FC56A6618F9E0020E34B0D38D914C05F2A
MD5 SHA1 SHA512 TLSH

Submit Download

~etrac Launcher.tmp

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Retrac Launcher\~etrac Launcher.tmp
Size 1KB
SHA256 974ed10d25b65925d1e593f0abe6821470baad44d5f8f2d9908615491bcf13f0
MD5 88de7adb44f2966e060578c47b2da27f
SHA1 ee7b6e2fbec96ba925749aa9d36f42cbfb003024
SHA512 5f72c09f16519b477b99af1c97181ace153b0e28c64676d981634df725f8677846182bd31de5d624824b6143cd0a2eaa81551ec8f97604863208fd54ca830db7
TLSH
T1BC21BB149AD53B16DB7B823846BE1636CB31FC56A6658FAE0024E34F1D38D914C09F2A
MD5 SHA1 SHA512 TLSH

Submit Download

Retrac Launcher.lnk

Path C:\Users\Admin\Desktop\Retrac Launcher.lnk
Size 1KB
SHA256 9a1b8ee72fff39f4795f477ad7ea2adc4fd52c9a6e59d03109b323560b6fb37b
MD5 297634028533dea75c068176a0fc7b10
SHA1 21c1f90c76ffb5abe168ed0ab21638eb701c4172
SHA512 1b18fdc986994b9ed43dd7c30fdd363de9346a4ad9be31b1bf82395c947a36e5045c968d55c537742caa20db70baa33d7a7b095ee11f9a423c99140db57c4a53
TLSH
T11821F0119FD6261AD67F823D46BF1733CB34F85666118EAE0064E30F1D38D954C09F2A
MD5 SHA1 SHA512 TLSH

Submit Download

Retrac Launcher.lnk~RFe58e3b4.TMP

Path C:\Users\Admin\Desktop\Retrac Launcher.lnk~RFe58e3b4.TMP
Size 1KB
SHA256 77e22ee8719d8f5d4a54bd6a022c21a32e07c8c364240c4bb41eac28cb048178
MD5 099e84cfc5f9a15dae0e49db12dad529
SHA1 2d1f194d21855d88a0dbda711f0423ea7ac7ac87
SHA512 ea552a253bdf793136f67ae19642cba8dcdd480066932a7e4de0ad36004c48e11a03e00db5c121fc0588db7c8b5b64b6dcf66328fba2fcfde9d15f1e6fa35103
TLSH
T16D21C9119AE6261ACA7F823D46BF1632CB24F85627118E9E0064E30F0D34D928C05F2A
MD5 SHA1 SHA512 TLSH

Submit Download

Retrac.Launcher_1.0.20_x64-setup.exe.crdownload

Path C:\Users\Admin\Downloads\Retrac.Launcher_1.0.20_x64-setup.exe.crdownload
Size 6.2MB
SHA256 615713405d850cc7ab6aa0d2d4278b1912b11195380c6bc5819269adf419cbd6
MD5 3b9ee922498bddef009118eb485f2b1d
SHA1 6f7764900ea2384610e928ae6c4cbc4974c15647
SHA512 40bfca5a62ce9c769f04e06b50960f966507a5cb90d9cb909119d13cd505235173648c28e042b435194d66e6413ffe3cef8134566964f618a44ef2d7312d2a30
SSDEEP 196608:Rxg2GSlkLOIpAILwdgKs6VUGsxqScIbNjUIY5yh:RS2OLOmy2KsFFxqSrbhUI6yh
TLSH
T181663355EA78D503F36E6336DC3B791EAE64A81747763A4B63227C80643122BF24F634
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/552-1416-0x00007FFFFF270000-0x00007FFFFF271000-memory.dmp

Download

memory/552-1415-0x00007FFFFF5F0000-0x00007FFFFF5F1000-memory.dmp

Download

memory/3924-1823-0x000001B6DB270000-0x000001B6DB30B000-memory.dmp

Download

memory/5224-1824-0x0000015AE3230000-0x0000015AE32CB000-memory.dmp

Download

memory/5516-1445-0x00007FFFFEDC0000-0x00007FFFFEDC1000-memory.dmp

Download

memory/5516-1577-0x000001E1E3940000-0x000001E1E39DB000-memory.dmp

Download

memory/6028-1343-0x00007FFFFEDC0000-0x00007FFFFEDC1000-memory.dmp

Download

memory/6028-1559-0x00000261D6770000-0x00000261D680B000-memory.dmp

Download

Analysis

Sharing

Errors

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads