7ef021039fcc397f9cf378e995c448c4312f1f0ea13d05020d6f55a7749d12af

Analysis

user interaction
yes
max time kernel
15s
max time network
34s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
12/09/2026, 16:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Retrac_3.0.9_x64_en-US.msi
Size 14.4MB
Sample260912-ve4pxatsdy
SHA256 7ef021039fcc397f9cf378e995c448c4312f1f0ea13d05020d6f55a7749d12af
MD5 2b940d52c3090f57c5cb6065884792f8
SHA1 d33dacf38d0ef6de6af065e73e91806ee384da72
SHA512 dcb767833910252fe75546d370215dd15da9d0066be728db14592ab431612a42ae129b861529831fb1ea244aa3dc54e0c3e8ec049d6395b86436b6cb20ee24e7
SSDEEP 393216:hc6EI0Zn4/BgpsCIPRKeow3ujYOqXgTzkRNcIqP:+K0ZsqpEPweoTjYmkRKI
TLSH
T152E6330B7C859F20C8261D3786B7DB28076DBD206616F6633299B469FFF17C099328D9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery persistence privilege_escalation ransomware trojan

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
5384	retrac.exe

Loads dropped DLL 1 IoCs

pid	Process
2208	MsiExec.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	retrac.exe

Contacts third-party web service commonly abused for C2 1 TTPs 5 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
65	discord.com
50	discord.com
51	discord.com
53	discord.com
60	discord.com

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files\Retrac\retrac.exe	msiexec.exe
File created	C:\Program Files\Retrac\Uninstall Retrac.lnk	msiexec.exe

Drops file in Windows directory 14 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\SystemTemp\~DFC72CE9392A5DC9AF.TMP	msiexec.exe
File created	C:\Windows\Installer\{2B412EEC-4109-4D4E-A042-2CD347432CD3}\ProductIcon	msiexec.exe
File created	C:\Windows\Installer\e5987e5.msi	msiexec.exe
File created	C:\Windows\SystemTemp\~DF872ED2E28182239A.TMP	msiexec.exe
File created	C:\Windows\Installer\e5987e3.msi	msiexec.exe
File created	C:\Windows\SystemTemp\~DF0F856E9023E7BEBD.TMP	msiexec.exe
File created	C:\Windows\Installer\SourceHash{2B412EEC-4109-4D4E-A042-2CD347432CD3}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI8A83.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\{2B412EEC-4109-4D4E-A042-2CD347432CD3}\ProductIcon	msiexec.exe
File created	C:\Windows\SystemTemp\~DF5065278DFFA147F5.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\e5987e3.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe

Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs

persistence privilege_escalation

Installer Packages

T1546.016

Msiexec

T1218.007

pid	Process
3320	msiexec.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3824	msedge.exe
7456	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe

Modifies registry class 46 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CEE214B29014E4D40A24C23D7434C23D\InstanceType = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\D39F67BF21D37C75581F63A03A3CC6BF\CEE214B29014E4D40A24C23D7434C23D	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CEE214B29014E4D40A24C23D7434C23D\SourceList	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000_Classes\retrac\URL Protocol	retrac.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000_Classes\retrac\DefaultIcon\ = "C:\\Program Files\\Retrac\\retrac.exe,0"	retrac.exe
Key created	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000_Classes\retrac\shell\open\command	retrac.exe
Key created	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000_Classes\retrac\shell\open	retrac.exe
Key created	\REGISTRY\MACHINE\Software\Classes\retrac\DefaultIcon	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\retrac\DefaultIcon\ = "\"C:\\PROGRA~1\\Retrac\\retrac.exe\",0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\CEE214B29014E4D40A24C23D7434C23D\MainProgram	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\CEE214B29014E4D40A24C23D7434C23D\Environment = "MainProgram"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\CEE214B29014E4D40A24C23D7434C23D\External	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\D39F67BF21D37C75581F63A03A3CC6BF	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000_Classes\retrac\DefaultIcon	retrac.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\retrac\shell\open	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\retrac\shell\open\command\ = "\"C:\\PROGRA~1\\Retrac\\retrac.exe\" \"%1\""	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CEE214B29014E4D40A24C23D7434C23D\PackageCode = "A4C83CD460CAC744DA544CF3E1F1B387"	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000_Classes\retrac\shell\open\command\ = "\"C:\\Program Files\\Retrac\\retrac.exe\" \"%1\""	retrac.exe
Key created	\REGISTRY\MACHINE\Software\Classes\retrac\shell\open\command	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\retrac	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\retrac\shell\open\command	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CEE214B29014E4D40A24C23D7434C23D\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000_Classes\retrac	retrac.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000_Classes\retrac\ = "URL:launcher.retrac.site protocol"	retrac.exe
Key created	\REGISTRY\MACHINE\Software\Classes\retrac	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\retrac\shell	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CEE214B29014E4D40A24C23D7434C23D\AuthorizedLUAApp = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CEE214B29014E4D40A24C23D7434C23D\SourceList\Media	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CEE214B29014E4D40A24C23D7434C23D\Clients = 3a0000000000	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000_Classes\retrac\shell	retrac.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\CEE214B29014E4D40A24C23D7434C23D	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CEE214B29014E4D40A24C23D7434C23D\Version = "50331657"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CEE214B29014E4D40A24C23D7434C23D\AdvertiseFlags = "388"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CEE214B29014E4D40A24C23D7434C23D\SourceList\Net	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\retrac\URL Protocol	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CEE214B29014E4D40A24C23D7434C23D\DeploymentFlags = "3"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CEE214B29014E4D40A24C23D7434C23D\SourceList\PackageName = "Retrac_3.0.9_x64_en-US.msi"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CEE214B29014E4D40A24C23D7434C23D\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CEE214B29014E4D40A24C23D7434C23D\SourceList\Media\1 = ";"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\retrac\ = "URL: protocol"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\CEE214B29014E4D40A24C23D7434C23D\ShortcutsFeature = "MainProgram"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CEE214B29014E4D40A24C23D7434C23D	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CEE214B29014E4D40A24C23D7434C23D\ProductName = "Retrac"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CEE214B29014E4D40A24C23D7434C23D\Language = "0"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CEE214B29014E4D40A24C23D7434C23D\Assignment = "1"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CEE214B29014E4D40A24C23D7434C23D\ProductIcon = "C:\\Windows\\Installer\\{2B412EEC-4109-4D4E-A042-2CD347432CD3}\\ProductIcon"	msiexec.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4296	msiexec.exe
4296	msiexec.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs

pid	Process
2396	msedgewebview2.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3320	msiexec.exe
Token: SeIncreaseQuotaPrivilege	3320	msiexec.exe
Token: SeSecurityPrivilege	4296	msiexec.exe
Token: SeCreateTokenPrivilege	3320	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	3320	msiexec.exe
Token: SeLockMemoryPrivilege	3320	msiexec.exe
Token: SeIncreaseQuotaPrivilege	3320	msiexec.exe
Token: SeMachineAccountPrivilege	3320	msiexec.exe
Token: SeTcbPrivilege	3320	msiexec.exe
Token: SeSecurityPrivilege	3320	msiexec.exe
Token: SeTakeOwnershipPrivilege	3320	msiexec.exe
Token: SeLoadDriverPrivilege	3320	msiexec.exe
Token: SeSystemProfilePrivilege	3320	msiexec.exe
Token: SeSystemtimePrivilege	3320	msiexec.exe
Token: SeProfSingleProcessPrivilege	3320	msiexec.exe
Token: SeIncBasePriorityPrivilege	3320	msiexec.exe
Token: SeCreatePagefilePrivilege	3320	msiexec.exe
Token: SeCreatePermanentPrivilege	3320	msiexec.exe
Token: SeBackupPrivilege	3320	msiexec.exe
Token: SeRestorePrivilege	3320	msiexec.exe
Token: SeShutdownPrivilege	3320	msiexec.exe
Token: SeDebugPrivilege	3320	msiexec.exe
Token: SeAuditPrivilege	3320	msiexec.exe
Token: SeSystemEnvironmentPrivilege	3320	msiexec.exe
Token: SeChangeNotifyPrivilege	3320	msiexec.exe
Token: SeRemoteShutdownPrivilege	3320	msiexec.exe
Token: SeUndockPrivilege	3320	msiexec.exe
Token: SeSyncAgentPrivilege	3320	msiexec.exe
Token: SeEnableDelegationPrivilege	3320	msiexec.exe
Token: SeManageVolumePrivilege	3320	msiexec.exe
Token: SeImpersonatePrivilege	3320	msiexec.exe
Token: SeCreateGlobalPrivilege	3320	msiexec.exe
Token: SeCreateTokenPrivilege	3320	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	3320	msiexec.exe
Token: SeLockMemoryPrivilege	3320	msiexec.exe
Token: SeIncreaseQuotaPrivilege	3320	msiexec.exe
Token: SeMachineAccountPrivilege	3320	msiexec.exe
Token: SeTcbPrivilege	3320	msiexec.exe
Token: SeSecurityPrivilege	3320	msiexec.exe
Token: SeTakeOwnershipPrivilege	3320	msiexec.exe
Token: SeLoadDriverPrivilege	3320	msiexec.exe
Token: SeSystemProfilePrivilege	3320	msiexec.exe
Token: SeSystemtimePrivilege	3320	msiexec.exe
Token: SeProfSingleProcessPrivilege	3320	msiexec.exe
Token: SeIncBasePriorityPrivilege	3320	msiexec.exe
Token: SeCreatePagefilePrivilege	3320	msiexec.exe
Token: SeCreatePermanentPrivilege	3320	msiexec.exe
Token: SeBackupPrivilege	3320	msiexec.exe
Token: SeRestorePrivilege	3320	msiexec.exe
Token: SeShutdownPrivilege	3320	msiexec.exe
Token: SeDebugPrivilege	3320	msiexec.exe
Token: SeAuditPrivilege	3320	msiexec.exe
Token: SeSystemEnvironmentPrivilege	3320	msiexec.exe
Token: SeChangeNotifyPrivilege	3320	msiexec.exe
Token: SeRemoteShutdownPrivilege	3320	msiexec.exe
Token: SeUndockPrivilege	3320	msiexec.exe
Token: SeSyncAgentPrivilege	3320	msiexec.exe
Token: SeEnableDelegationPrivilege	3320	msiexec.exe
Token: SeManageVolumePrivilege	3320	msiexec.exe
Token: SeImpersonatePrivilege	3320	msiexec.exe
Token: SeCreateGlobalPrivilege	3320	msiexec.exe
Token: SeCreateTokenPrivilege	3320	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	3320	msiexec.exe
Token: SeLockMemoryPrivilege	3320	msiexec.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
3320	msiexec.exe
3320	msiexec.exe
5384	retrac.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
3320	msiexec.exe
4296	msiexec.exe
2208	MsiExec.exe

Suspicious use of WriteProcessMemory 17 IoCs

description	pid	Process	procid_target
PID 4296 wrote to memory of 2208	4296	msiexec.exe	88
PID 3320 wrote to memory of 5384	3320	msiexec.exe	92
PID 5384 wrote to memory of 2396	5384	retrac.exe	93
PID 2396 wrote to memory of 5496	2396	msedgewebview2.exe	94
PID 2396 wrote to memory of 4544	2396	msedgewebview2.exe	95
PID 2396 wrote to memory of 4544	2396	msedgewebview2.exe	95
PID 2396 wrote to memory of 4544	2396	msedgewebview2.exe	95
PID 2396 wrote to memory of 4544	2396	msedgewebview2.exe	95
PID 2396 wrote to memory of 5912	2396	msedgewebview2.exe	96
PID 2396 wrote to memory of 5396	2396	msedgewebview2.exe	97
PID 2396 wrote to memory of 5396	2396	msedgewebview2.exe	97
PID 2396 wrote to memory of 5396	2396	msedgewebview2.exe	97
PID 2396 wrote to memory of 1388	2396	msedgewebview2.exe	98
PID 2396 wrote to memory of 1388	2396	msedgewebview2.exe	98
PID 2396 wrote to memory of 1388	2396	msedgewebview2.exe	98
PID 2396 wrote to memory of 1388	2396	msedgewebview2.exe	98
PID 2396 wrote to memory of 1388	2396	msedgewebview2.exe	98

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\Retrac_3.0.9_x64_en-US.msi
1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3320
- C:\Program Files\Retrac\retrac.exe
  "C:\Program Files\Retrac\retrac.exe"
  2⤵
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - Modifies registry class
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:5384
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=retrac.exe --webview-exe-version=3.0.9 --user-data-dir="C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --enable-features=MojoIpcz --lang=en-US --accept-lang=en-US --mojo-named-platform-channel-pipe=5384.4844.13410457695899374225 /pfhostedapp:fd0de7e5cefc9f8a2e2a61a11d5c8b08aabc87ca
    3⤵
    - Enumerates system info in registry
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of WriteProcessMemory
    PID:2396
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView /prefetch:4 /pfhostedapp:fd0de7e5cefc9f8a2e2a61a11d5c8b08aabc87ca --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x184,0x188,0x18c,0x160,0x194,0x7fff3fa55fd8,0x7fff3fa55fe4,0x7fff3fa55ff0
      4⤵
      PID:5496
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView" --webview-exe-name=retrac.exe --webview-exe-version=3.0.9 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1816 --field-trial-handle=1660,i,14317646248910947091,15974844813870358003,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:2 /pfhostedapp:fd0de7e5cefc9f8a2e2a61a11d5c8b08aabc87ca
      4⤵
      PID:4544
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView" --webview-exe-name=retrac.exe --webview-exe-version=3.0.9 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2064 --field-trial-handle=1660,i,14317646248910947091,15974844813870358003,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:3 /pfhostedapp:fd0de7e5cefc9f8a2e2a61a11d5c8b08aabc87ca
      4⤵
      PID:5912
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView" --webview-exe-name=retrac.exe --webview-exe-version=3.0.9 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2308 --field-trial-handle=1660,i,14317646248910947091,15974844813870358003,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:fd0de7e5cefc9f8a2e2a61a11d5c8b08aabc87ca
      4⤵
      PID:5396
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView" --webview-exe-name=retrac.exe --webview-exe-version=3.0.9 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --autoplay-policy=no-user-gesture-required --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3436 --field-trial-handle=1660,i,14317646248910947091,15974844813870358003,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /pfhostedapp:fd0de7e5cefc9f8a2e2a61a11d5c8b08aabc87ca /prefetch:1
      4⤵
      PID:1388
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://discord.gg/6sNFtW4Hva
    3⤵
    PID:2652
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x318,0x7fff3b63c188,0x7fff3b63c194,0x7fff3b63c1a0
      4⤵
      PID:5584
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1940,i,12265662392630061,7201926464757377591,524288 --field-trial-handle=2912,i,3523254100070200405,452135887756173935,262144 --variations-seed-version --mojo-platform-channel-handle=2940 /prefetch:11
      4⤵
      System Time Discovery
      PID:3824
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1736,i,11944040546232543113,7019445625350406494,262144 --field-trial-handle=2912,i,3523254100070200405,452135887756173935,262144 --variations-seed-version --mojo-platform-channel-handle=2908 /prefetch:2
      4⤵
      PID:3156
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2008,i,1100369344364052404,3587932704784176597,524288 --field-trial-handle=2912,i,3523254100070200405,452135887756173935,262144 --variations-seed-version --mojo-platform-channel-handle=3036 /prefetch:13
      4⤵
      PID:2544
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3464,i,68584737557326066,1166437951980811032,2097152 --field-trial-handle=2912,i,3523254100070200405,452135887756173935,262144 --variations-seed-version --mojo-platform-channel-handle=3548 /prefetch:1
      4⤵
      PID:5160
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3468,i,2524583164235998569,3729877161134419127,2097152 --field-trial-handle=2912,i,3523254100070200405,452135887756173935,262144 --variations-seed-version --mojo-platform-channel-handle=3552 /prefetch:1
      4⤵
      PID:432
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4040,i,12570986552347679989,3016698053742265837,2097152 --field-trial-handle=2912,i,3523254100070200405,452135887756173935,262144 --variations-seed-version --mojo-platform-channel-handle=4632 /prefetch:1
      4⤵
      PID:3116
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4052,i,14921063185456319397,515833901209785101,2097152 --field-trial-handle=2912,i,3523254100070200405,452135887756173935,262144 --variations-seed-version --mojo-platform-channel-handle=3988 /prefetch:9
      4⤵
      PID:5036
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4216,i,11401019544645276644,14674251103489079690,2097152 --field-trial-handle=2912,i,3523254100070200405,452135887756173935,262144 --variations-seed-version --mojo-platform-channel-handle=4724 /prefetch:1
      4⤵
      PID:1492
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5344,i,17527706176696509730,5386737973093179361,524288 --field-trial-handle=2912,i,3523254100070200405,452135887756173935,262144 --variations-seed-version --mojo-platform-channel-handle=5328 /prefetch:14
      4⤵
      PID:4380
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=5484,i,15122054494299942756,7718529539740783538,2097152 --field-trial-handle=2912,i,3523254100070200405,452135887756173935,262144 --variations-seed-version --mojo-platform-channel-handle=5524 /prefetch:1
      4⤵
      PID:2620
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=5500,i,18391539678291073887,4859416849803140888,2097152 --field-trial-handle=2912,i,3523254100070200405,452135887756173935,262144 --variations-seed-version --mojo-platform-channel-handle=5528 /prefetch:1
      4⤵
      PID:5800
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5804,i,13034421401571042802,3972768704668310054,524288 --field-trial-handle=2912,i,3523254100070200405,452135887756173935,262144 --variations-seed-version --mojo-platform-channel-handle=4748 /prefetch:14
      4⤵
      PID:4896
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4040,i,7331460300922587055,16941504455724488937,524288 --field-trial-handle=2912,i,3523254100070200405,452135887756173935,262144 --variations-seed-version --mojo-platform-channel-handle=5532 /prefetch:14
      4⤵
      PID:4444
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5944,i,15979682555506427232,17637465238548058141,524288 --field-trial-handle=2912,i,3523254100070200405,452135887756173935,262144 --variations-seed-version --mojo-platform-channel-handle=5344 /prefetch:14
      4⤵
      PID:6156
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5932,i,12142710886572085803,10475396072526168620,524288 --field-trial-handle=2912,i,3523254100070200405,452135887756173935,262144 --variations-seed-version --mojo-platform-channel-handle=3084 /prefetch:12
      4⤵
      PID:1064
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
      4⤵
      PID:5160
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://discord.gg/6sNFtW4Hva
    3⤵
    PID:3908

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4296
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 0E7E9DC950F3F33AD17F3BE27BA7FBD3 C
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:2208

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
PID:2860

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:992

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:3312

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:2484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x32c,0x7fff3b63c188,0x7fff3b63c194,0x7fff3b63c1a0
  2⤵
  PID:6176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1976,i,4003398064446363505,15869785354711833979,524288 --field-trial-handle=2240,i,11023370808660124243,15806290691375004369,262144 --variations-seed-version --mojo-platform-channel-handle=2268 /prefetch:11
  2⤵
  - System Time Discovery
  PID:7456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1848,i,13781787831328184616,8311076187315886990,262144 --field-trial-handle=2240,i,11023370808660124243,15806290691375004369,262144 --variations-seed-version --mojo-platform-channel-handle=2236 /prefetch:2
  2⤵
  PID:6192

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Installer Packages

T1546.016

Privilege Escalation

Event Triggered Execution

T1546

Installer Packages

T1546.016

Defense Evasion

System Binary Proxy Execution

T1218

Msiexec

T1218.007

Credential Access

Discovery

Network Share Discovery

T1135

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e5987e4.rbs

Path C:\Config.Msi\e5987e4.rbs
Size 10KB
SHA256 154735d733963a4718a57bf33c0632874dedd9f36547edeba0127bd213788f64
MD5 965aa41a1a3cb4a270c002f92f751fcc
SHA1 c7edf16d051b6e6bbe22d14499c917f3c076da84
SHA512 63e45cef7f21a00d831ab127780fc9b0663c0b3945f7ac7197450163f6d4c4ee215ee097a91fbe65ead059f0f9d8aaa53c2f6f0b06cf032457791661f11eb497
SSDEEP 96:8mTTxf79CR9R9hxm9N9A7px4BhCn8qQUQ64r4COTl2TUQ64r4CgjjW7vhjTl2sjK:ZhZ47DMHZC3v8PG78PuuzoX3WOiigpBY
TLSH
T16B22EE02F70185D2E8835B38C7072B213F67D685C358634B07CDE834EE57BC66BA999A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

retrac.exe

Path C:\Program Files\Retrac\retrac.exe
Size 26.0MB
SHA256 8e659b326afa58276d95ae143af18786f3c47f9e45fa9f4bc9afdfcd10f99aef
MD5 274a0ba53a9c1bf4af8843978c680dd5
SHA1 b3006ef8c220ffa04308b4d58a8415c2b41e2d08
SHA512 3fccdcc36f31e161e19dcec092d2a8b9962e0cdbc94131d72548f396e4256043739574434ac0a4eb81743a926562d1e068e755d164c8bf0b905b197fdf9d31bf
SSDEEP 393216:+9hw3R8Vay7mii8lYMXKOsPAdaB+ld9qOwcB2U5:+9hr8y7NlIpPetxrp
TLSH
T17C575A207B9AA96CD19AC474834B4A725A7130DB1F35B9FF448492393F6DBF42F38258
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Retrac.lnk

Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Retrac\Retrac.lnk
Size 1KB
SHA256 89b76568427bb6a3e1d60f3d7f28fb4abacad92cddfaf8cc230a3ed7a3b3e509
MD5 fefa4fe953424fb0773b2e32ab218ac4
SHA1 001b56adafc835fd2b6b5877dcf7280748ab0f0f
SHA512 43f21d49c828301db34b98e3436a815200a8d4b97927696d1ce9aef5e773a1e4edfe1acedc03469778550afd7b36d6c2eabb9cad420c743d501625fe1aff217d
TLSH
T10E41C0085BD5071AF377567A2EA55A218E32FC12DA358F2F42E9418B0974900A66CF77
MD5 SHA1 SHA512 TLSH

Submit Download

Retrac.lnk~RFe598c29.TMP

Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Retrac\Retrac.lnk~RFe598c29.TMP
Size 1KB
SHA256 bbcde8f9dac68a3c711104aa6e26398db327612c59659b569a30f9e6647ff3ea
MD5 26e2ed834e71bfc5e126fbbfe36703f4
SHA1 c42ab445f102bdfddae0ba573be99cd6da07258f
SHA512 81df3215026c3e1e5713fdc04aca27ddf5ce22f4a0ac8b3b4054811a7915a5e4b5192703322244cc4337ec3aaa413cc65a2df9941ec6ad6e10ea9267c8beaa08
TLSH
T17E41CE085BD5071AF377967A2EA65A21CE32FC02DA358F1F42E9014B0974910E66CFB7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 a9db3b181fe23d2da858b764c2d3bc2baae4a7e217d8cc5885ed34c7b21166b7
MD5 c2e18a2143bb27e5b37e2d5b65c09643
SHA1 43bb7d235630acc17d81e04e37f3cd25e299ecc7
SHA512 08f1e7fa966122b22bea5e316c89298987fac4c53be675ad48a1c1c8a784dc7b1d8789be8d1abdb8cdb59c14d6757e0f1934d0a56d919c8fb08e311621fe4d9c
TLSH
T109D02BB0B77DCCD3D00310FE0015AE0421A370159E0402802302885844001041101358
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 2664448b8ab4f4edce89a8c875c31ed1e748ff3060fa1567c434149210bb4fc5
MD5 35b0bc3bbbf168c9b6c74d3bc119d3eb
SHA1 3dde0e79982d9dbcf2dbd3045bae0a5bc63e14cd
SHA512 9c5f83f731b8e4bf7f7e64c2e51191192b13fa5260950a1fcade843318dbf7d5b99057f3ca893e35cb6c19942f5b5852e7124ed01f7c46e7de9bcea70152fc0d
TLSH
T173D02BB4B76DCDD3D00310FE0014AE0421B37015EE040280230248484400104110236C
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 9b1a6f438d8ddc469be921b1f73fbbce386236a76815dca59da3d7d0be180b39
MD5 e078a76c4867c41f7bedd77650e53623
SHA1 a9d4a4bfe3ba531a671ed87980dadb2802ed613e
SHA512 bd026ffaf3751775943ed8450dee4c93bc1fe552b24e0d169ebddafe2005afd594cb72297e9a999fe8a1726d3f8e3de5219144193ab5c5b6025d25c7d911542e
TLSH
T1EDD0C070B93DDFE3E02610FE01204D0021B53003EF00038033018C08C8201411402FEC
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 9KB
SHA256 4226506f813cb6271db9802de690a6eca1415511cc22c081d58f393ad9173eae
MD5 98ca9bf5303a4ddc35769f757505716c
SHA1 96b95d1986856fb2b2f4693179223088bde93a46
SHA512 1b247c12479a1f2eb1c20384dc2002b5af153caf0f5cc83fc1ae5d085e40821f488d1efe9548292bdd772dddd6346f6ffa061de4a097ea7fb6d37c32d3199199
SSDEEP 96:ZTG4eenEvMJLMi2Xx5nSXmAogMopWfBV2LqXxS0hNVldOmqEAjJIYFzXM9s5GVsY:De9wLmh5nN5zfVDhN9hu5FJGOEW8eqb
TLSH
T1E312404F4B593492C7ACC3B648DAD4CF37368A78133B9D132270F4BA26DA3B92D86014
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe59e4c8.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59e4c8.TMP
Size 3KB
SHA256 efc9b7f73944e9cf7dc25599018495c25b0ac481e65a056e4e4e5f4cd5af20a1
MD5 9eed9a9ffa93ef60d633e6386258c0a8
SHA1 06bac84ef452dec9e4d0353b93b6b1dbd7ffd25f
SHA512 8460cf9f898f1ad9d053c4c3fbba9d180efca939eef0dfc51ec0b59337128afa5c888104ac709994604225e7708d5e232f47a9da1e2cb6e0984e9e70b2587def
TLSH
T1726193845F6A78A5DBCC01F689D194CB3A339EBC147B2E121355E97F2B8732C329C464
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 c4cb3f95ed35aec4649c4ef7c4ee8133b211bec3a8edd930a4b050ce6cedf1d2
MD5 1668a3d6fec75e34f0c8eb7c4e3f8c48
SHA1 f74845d504f509f3c3788151e6453326b9728ea8
SHA512 7a7ef67dcd3178ade9cf23d1b59f34a599b1cde640b959f1bdf3212e7342cdf0ce603197b1890b236fd74bc6144e1968504cd3f430d0550d2c3a118323a3a91c
TLSH
T162519CF7C7E8866DCA1156F0AB186E1BCE2D0914431C3D2AC8E4AF1B93E34B2E14195F
MD5 SHA1 SHA512 TLSH

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 6805fddee8f509da170560b9c4bb895313ed1c040ccd1facdf93fd055b055ca9
MD5 d7027c53f40ad7b05fc9fbd6ef4b3d31
SHA1 19a38094fc3e4ae535ae16a6feb94304dd9605a4
SHA512 5e9fa7eb7d4d761c76b3f60ceca18979b0d3aceb188ad93ebaeb625fe3683d17c8e506a2c8bc1fb23d1abccf8daa15978098183cc849142c997cd690031584d6
SSDEEP 192:sxRLRtuC3/feqsYzWpVlqrVitzoA8plB/g6+WNOT6IfYnudqUdgYIgFJ:sxRLTZ3/frsYzWvleigr/5qfuUjv
TLSH
T1ED429515AD28A93B8CD7D25DFB65BF23D2FD1026A1D55E44A6FC8A1C00EB6DD220380B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 ecf4d7ed7ff3d161e88968adc2958df3c6fb9627d2a9c81fa03afd79278ad982
MD5 f2f1bd0b97082c638200a5a5d998eff9
SHA1 ceff8a2d5df8a4286834728eb151eb014c0ee2c0
SHA512 10f70417984109b34dedeb4a1bea858e46c08536f25890b304719d4e94c75f13f804671ba6223741724c0159fc74cf497c6843c826dec6e1a6b1bd5d5d9b422e
SSDEEP 768:zBDnLx7pLuLbYFWgbjfAW8F1+UoAYDCx9Tuqh0VfUC9xbog/OViBK3yrobTX:zBDnLnEbYFWgbjfAWu1jaZ03pfX
TLSH
T1E3C2C87B740CCA7F4F804A9D98197E9E6DA802CB9A98CD4047FE945C03C7BEE51264DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\4a2c8a7a-7642-4fbb-a9ad-e89ec2795866\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\index.txt
Size 233B
SHA256 ae1dc8fefab904b0edb8a6fbd2a9bc5ec8cc6e5bc7a1dc950c817021170f66b2
MD5 ea11571969dfa7b9d5c4bd161ec7d584
SHA1 cd23f56127a6ca762f8243724eab511056448bde
SHA512 df3f67acb315134a50f7b80f4e465655d3d87bdf54927e442b9466f3701a70da7fd26f186597e1b1d941911951c4b68d5047762b1c83252457268700365780cf
TLSH
T1DCD09783D0A2258AEFBA4B41267354898A242C849482958CF402303A6478F8B9223FA3
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\index.txt
Size 226B
SHA256 12e55a7cb252b1b3cb23aba2636cd1978a22df40936dd997f0854fb0b0e2bd77
MD5 40c771210461f9e1c6c6e19c03203a62
SHA1 5ef14cfe7bc86b58f360dfbfc483d59b3fc8116c
SHA512 d951ff397baaf97d1bf352ed0477e6f6fc77a6b6641e28c91645c95955fb8604732d1ee9de274e363736997cc58e176f9ac058c95661c3a9e520fc5dbac6cafc
TLSH
T145D09783E045268AEEBE8F40266314998A243884908A954CF40200268888F9B9223FA3
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe59d5d4.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\index.txt~RFe59d5d4.TMP
Size 138B
SHA256 dba167e62066ba732e6447dd2927a6680e9be41d3ddac7f7e6ca5cd6286da2fd
MD5 b858ee50ddbb07d678116f62431fe5da
SHA1 31466bd8e2bc7310b6c4290e0834adeb71209ba0
SHA512 b0866da3d13774f527873d6292025a61ae9eabebb4eeeb95974037ab3a184b8dd102e750f275ab9f2d1d717bc15d4f3a960488b6220f407ec06d0a16b489957b
TLSH
T1B2C02BE3E18106168F2446501333004C470C3CCC89C7E94D742330952134F6F3213FE2
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 42KB
SHA256 9d80f53e18d635616b3a3f36b02296ecd1648d020777326cf699633e745bf439
MD5 b771d56df759811ef78dc478f801909c
SHA1 c83d190d2094387f3cd827d0b2d6d52498f2e7e2
SHA512 0f4362b078b5b3848a8deadfddf25a2f631589571ff0bb3d63fd748159c05afcd3575993fd2d196324d96d3117a9eecc9397ad23dae26b43214d947656f2637f
SSDEEP 768:b/UxvxjgC+i3yNv9TOfqfxfitMQyJYe1ELsAvC8/YE8El9gr06J:OZj3+i37fqfxf1Ye1EQujY3EAA6J
TLSH
T1C9138C3DDC64983E49BEB748720E1A27AEB44233D0B459A8C7C91B0DC5B76ADF307859
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 37KB
SHA256 1c332043904b86416bb53019e3abc3dfd782a31d4a73e40d2e6c164b72d3bf41
MD5 2e3a9387da7b4e05918708c1dac11787
SHA1 bab4fcaa26cb67a2aebd317c049ef5958eb502e4
SHA512 d9577c0db40c17215e8a4d0c1cfc882aabaeff8fe55c7aa564031fd05070f0185bd68f02b1f9b2b1b937fef4e5dcc79f0fb37c3140d82f664700750cf69ebe6d
SSDEEP 768:h/UxvxjgC+i33L9TOfqf6KJYe1ELsAvC8/YMW3SHrkw:0Zj3+i3cfqf7Ye1EQujYrS4w
TLSH
T1C203CF32ECA48D375DF2A388774A5B57FEF4811395C42AA486DD2B0D16C73AC630F85A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 71af1341dec1907c5f8e05131321c7a278cf8c01dee17de0d45212d048096c07
MD5 9d1b15e40a5271c52a5f3a5336a0b64a
SHA1 6c8d8a6e23b0ad735c7ab01f6fd479db39084405
SHA512 9a918f0f5b2fa805abbbf36246b3dc1b902f5a7a522eec0678cb4463c1bc0642cb3946d9d84dea388389781f756e456395eab769f7e63806967be401e8f81c60
SSDEEP 768:0/UxvxjgC+i3NZ9TOfqfxfitMgyJYe1ELsAvC8/YN2SHrkT:hZj3+i3Ufqfxf1Ye1EQujYkS4T
TLSH
T1D203BF31EC659D335EF2A298768A5797FEF8412394C45E6896DD2B0D05C33AC230F85A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_1
Size 264KB
SHA256 8bee1d108733155a3f6876abb44ca58fd05a3f1700a6bcbdc9ddbd6218598948
MD5 1667ca175931dfdd83c7fa67b4117e57
SHA1 2bf1f650e5f34fe8afc17fb7069d17433c81128e
SHA512 0490eef84855fc8fbadbb9a5c495ee9dadf4c5e5c18aeebaa6d70d5d62a23a8c8b8d9c9b258ed3934a002e7ec9fabbbef4bff5961e957adede190c87d0b549e8
SSDEEP 3:MsEllllkEthXllkl2zEflQ+c:/M/xT02zxj
TLSH
T1974404047FC00405C50030304451C3501770D410451157C334D54437DFC77440C00004
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Variations

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Variations
Size 86B
SHA256 f7b24f2eb3d5eb0550527490395d2f61c3d2fe74bb9cb345197dad81b58b5fed
MD5 961e3604f228b0d10541ebf921500c86
SHA1 6e00570d9f78d9cfebe67d4da5efe546543949a7
SHA512 535f930afd2ef50282715c7e48859cc2d7b354ff4e6c156b94d5a2815f589b33189ffedfcaf4456525283e993087f9f560d84cfcf497d189ab8101510a09c472
TLSH
T196A02407C473C00FF4144051C45C034114FCC447011DD0015074D31314D40CF03F5435
MD5 SHA1 SHA512 TLSH

Submit Download

ab9dfe16-9fc4-456c-a560-12fdc6626ef7.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\ab9dfe16-9fc4-456c-a560-12fdc6626ef7.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

MSI82C3.tmp

Path C:\Users\Admin\AppData\Local\Temp\MSI82C3.tmp
Size 132KB
SHA256 7f47d98ab25cfea9b3a2e898c3376cc9ba1cd893b4948b0c27caa530fd0e34cc
MD5 cfbb8568bd3711a97e6124c56fcfa8d9
SHA1 d7a098ae58bdd5e93a3c1b04b3d69a14234d5e57
SHA512 860cbf3286ac4915580cefaf56a9c3d48938eb08e3f31b7f024c4339c037d7c8bdf16e766d08106505ba535be4922a87dc46bd029aae99a64ea2fc02cf3aec04
SSDEEP 3072:Kx2YbpcgwmiTPJDnCO+DATkURBnrskNwPj2:XXgwmY1CPx2XG2
TLSH
T1DBD39D02B5D0C473D9BE09390870DB229F7EB930DF909EDB636856699E702C19E35A37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 7765dfae88e42bbafa5b77361e54d484778c051ed7e46f5764ef723e3d1db66d
MD5 c82e5fcff1dc71d19fe5531ee443df98
SHA1 7b9b9c4c39903b7f5cb4ae94d35de114060d9b87
SHA512 311f7ba45e269012d8e1ce397354a767430eee5ef4c424787e4b240deeaf2076c01a951058b6bd890c398e8e4a4e7bccbf983a1d22dd68461c9d25ff95b8fa86
TLSH
T134D0045051000000C30511331754454457447D0500710D007150040404F345041555C4
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 7ec596a086bd7eac842c98238d51f1419dbae492e7ef166904db435dd2207f24
MD5 387afc84db14e1a509d37704296e0dc1
SHA1 accfb207242c25b9b5674c9dc9b0deeaf59a3c08
SHA512 c88dd42c094437c0b73eff4ae368c399c9668f088b7ce4e7c90591140b6e86a8f187631c3f03d4c018ad16ef1174d8ff3a9ae1ae2544e5e1cc5571c82566ab92
TLSH
T141D0121232010134C11021331642654C1940EE0F40554400B428891D1AA54A00A168C1
MD5 SHA1 SHA512 TLSH

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView\Default\GPUCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView\Default\Site Characteristics Database\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView\Default\shared_proto_db\metadata\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView\GraphiteDawnCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView\GraphiteDawnCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView\GraphiteDawnCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView\Local State
Size 16KB
SHA256 fa5754757ec1c8985df4be3b6e8d8dcd00781d2767259cc906988871f69dd0cc
MD5 a70ffaf5660c44c616501f56e3fb10ca
SHA1 e73767c85018a7228365a8044631f539081ce9b1
SHA512 df444c78277a83aec45ab015c41b09ef0f272e10c07a690a41192647eae35f21c19fd16c1bb95070d5c593c30f73f6012964e131f2ed90077fb0ceda44ca1138
SSDEEP 384:N+aQikB+z/xvxjg/qhE1NBSXhzyohNIIg9z2:Y/UxvxjgC+WlhqF2
TLSH
T180729D2B59653D2355F7F6147A19074FCFFD98A294C26EB44ABC5F0E0AC72981343D12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView\Local State
Size 2KB
SHA256 9b5211f8ccf7e60fbdc666211e9690e64d69d6ecbaad88334bc9389af6ec19cf
MD5 52506c9ff11f4d50ba0071c55d37cce3
SHA1 7fd45e3de537378029d1bd90e0d96dc82935b164
SHA512 8e99d555faebb6ff196af8229cce76411f9ac65ba5fef6c222a9073c0f1c1e424a9ea3e2ccc1e9a9e0df1cdd550e060dad21d0df560ae5385a9a286d6f05dffe
TLSH
T1FB51953368257E7B99F297447D166F57DE7980A6AA922F50AADC0B0C01DB14C1383C77
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView\Local State
Size 3KB
SHA256 5674e443691503d2a24badb91d0eb5ce676a341ea23d49b2f8b2afb15d11d807
MD5 b924cb20324c16db426666c9d36c1d07
SHA1 daad2285f168e8c2d4755f4030698d87a2bb1266
SHA512 c1cb9a35ae01ce7db0a8f53df296429737b9ca197d6896e335c88a45763d1fdb2a4776027a898a368c05b32ed7a543bc1c8e6dec7c7e58caa7c12a7f33992d54
TLSH
T1FB71963A5974A93B4DF39A05BD462F0BEBA94067A9D57F94DAEC0E0C01C72881393C27
MD5 SHA1 SHA512 TLSH

Submit Download

Local State~RFe59afce.TMP

Path C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView\Local State~RFe59afce.TMP
Size 1KB
SHA256 e6b289bc713737384ba616ccb175cea68cb2c86fa70c65c8e166fcbd072ace8d
MD5 e1350c36ad96bd8037ff7682c32ab04d
SHA1 2271f691f0ef88dd3bcfd95c570dd94e1c671236
SHA512 24b337191e090746d009559f290c46b8faa402cf41fb5f1ae499a2e528c9bad1608ff153f955e2cda399d6bc11bdf8985284c69f5570f38e31873b23db38379d
TLSH
T1B631B97694743E726CA663463A21AF8FAFB584BB55524F00B6DC460D06DB04C57FBC32
MD5 SHA1 SHA512 TLSH

Submit Download

e5987e3.msi

Path C:\Windows\Installer\e5987e3.msi
Size 14.4MB
SHA256 7ef021039fcc397f9cf378e995c448c4312f1f0ea13d05020d6f55a7749d12af
MD5 2b940d52c3090f57c5cb6065884792f8
SHA1 d33dacf38d0ef6de6af065e73e91806ee384da72
SHA512 dcb767833910252fe75546d370215dd15da9d0066be728db14592ab431612a42ae129b861529831fb1ea244aa3dc54e0c3e8ec049d6395b86436b6cb20ee24e7
SSDEEP 393216:hc6EI0Zn4/BgpsCIPRKeow3ujYOqXgTzkRNcIqP:+K0ZsqpEPweoTjYmkRKI
TLSH
T152E6330B7C859F20C8261D3786B7DB28076DBD206616F6633299B469FFF17C099328D9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1388-142-0x00007FFF5F900000-0x00007FFF5F901000-memory.dmp

Download

memory/4544-66-0x00007FFF5F900000-0x00007FFF5F901000-memory.dmp

Download