31f5fac8644a5803759edbd3e53e42bbcf4f8b2ba17b4dd8033582516c3a17f9

Analysis

user interaction
yes
max time kernel
148s
max time network
132s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
23/10/2026, 16:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
retrac.exe
Size 26.1MB
Sample261023-ttnfssdb97
SHA256 31f5fac8644a5803759edbd3e53e42bbcf4f8b2ba17b4dd8033582516c3a17f9
MD5 ddbff854e0044929e354a21327e4f720
SHA1 bd97e07b8b59b8f9bdaea7047f2623b2c5f09aa6
SHA512 ce4536e547820efe2021c4051220083a858390e7352690c1c80ca92ef52f9ad1ea686fff847e8bdfdc4cc3a6093971f9acc7da45d65d50c347864b2f3bb5bcb5
SSDEEP 393216:Ckmizc1w/McqO0BAsPAtdEYOK1Jmii8l+MMuM8MY+M/6sdkhjrB:Ckmi68cPlYx1JNl+MMuM8MY+M/4rB
TLSH
T1C05749217B5AA96DD19AC474834B4A725A7130DB0B35BAFF44C492383F6DBF42F38258
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

defense_evasion discovery trojan

Malware Config

Signatures

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	retrac.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	retrac.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	retrac.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe

Modifies registry class 9 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000_Classes\retrac\URL Protocol	retrac.exe
Key created	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000_Classes\retrac\DefaultIcon	retrac.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000_Classes\retrac\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\retrac.exe,0"	retrac.exe
Key created	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000_Classes\retrac\shell	retrac.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000_Classes\retrac\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\retrac.exe\" \"%1\""	retrac.exe
Key created	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000_Classes\retrac	retrac.exe
Key created	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000_Classes\retrac\shell\open\command	retrac.exe
Key created	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000_Classes\retrac\shell\open	retrac.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000_Classes\retrac\ = "URL:launcher.retrac.site protocol"	retrac.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3024	retrac.exe
3024	retrac.exe
3024	retrac.exe
3024	retrac.exe
3024	retrac.exe
3024	retrac.exe
3024	retrac.exe
3024	retrac.exe
3024	retrac.exe
3024	retrac.exe
3024	retrac.exe
3024	retrac.exe
3024	retrac.exe
3024	retrac.exe
3024	retrac.exe
3024	retrac.exe
3024	retrac.exe
3024	retrac.exe
3024	retrac.exe
3024	retrac.exe
3024	retrac.exe
3024	retrac.exe
3024	retrac.exe
3024	retrac.exe
3024	retrac.exe
3024	retrac.exe
3024	retrac.exe
3024	retrac.exe
3024	retrac.exe
3024	retrac.exe
3024	retrac.exe
3024	retrac.exe
3024	retrac.exe
3024	retrac.exe
3024	retrac.exe
3024	retrac.exe
3024	retrac.exe
3024	retrac.exe
3024	retrac.exe
3024	retrac.exe
3024	retrac.exe
3024	retrac.exe
3024	retrac.exe
3024	retrac.exe
3024	retrac.exe
3024	retrac.exe
3024	retrac.exe
3024	retrac.exe
3024	retrac.exe
3024	retrac.exe
3024	retrac.exe
3024	retrac.exe
3024	retrac.exe
3024	retrac.exe
3024	retrac.exe
3024	retrac.exe
3024	retrac.exe
3024	retrac.exe
3024	retrac.exe
3024	retrac.exe
3024	retrac.exe
3024	retrac.exe
3024	retrac.exe
3024	retrac.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs

pid	Process
1184	msedgewebview2.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3024	retrac.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 3024 wrote to memory of 1184	3024	retrac.exe	86
PID 1184 wrote to memory of 2532	1184	msedgewebview2.exe	87
PID 1184 wrote to memory of 2520	1184	msedgewebview2.exe	88
PID 1184 wrote to memory of 2520	1184	msedgewebview2.exe	88
PID 1184 wrote to memory of 2520	1184	msedgewebview2.exe	88
PID 1184 wrote to memory of 3508	1184	msedgewebview2.exe	89
PID 1184 wrote to memory of 4028	1184	msedgewebview2.exe	90
PID 1184 wrote to memory of 4028	1184	msedgewebview2.exe	90
PID 1184 wrote to memory of 4832	1184	msedgewebview2.exe	91
PID 1184 wrote to memory of 4832	1184	msedgewebview2.exe	91
PID 1184 wrote to memory of 4832	1184	msedgewebview2.exe	91
PID 1184 wrote to memory of 4216	1184	msedgewebview2.exe	102

C:\Users\Admin\AppData\Local\Temp\retrac.exe
"C:\Users\Admin\AppData\Local\Temp\retrac.exe"
1⤵
- Checks whether UAC is enabled
- Reads the TCP/IP host and domain name from the registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:3024
- C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=retrac.exe --webview-exe-version=3.0.13 --user-data-dir="C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --lang=en-US --mojo-named-platform-channel-pipe=3024.2356.9485958581743839110
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of WriteProcessMemory
  PID:1184
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0x160,0x164,0x168,0x13c,0x118,0x7ffb925cb078,0x7ffb925cb084,0x7ffb925cb090
    3⤵
    PID:2532
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView" --webview-exe-name=retrac.exe --webview-exe-version=3.0.13 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1720,i,879424783322836770,10315760585620298959,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=1716 /prefetch:2
    3⤵
    PID:2520
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView" --webview-exe-name=retrac.exe --webview-exe-version=3.0.13 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2032,i,879424783322836770,10315760585620298959,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=2044 /prefetch:3
    3⤵
    PID:3508
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView" --webview-exe-name=retrac.exe --webview-exe-version=3.0.13 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2368,i,879424783322836770,10315760585620298959,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=1700 /prefetch:8
    3⤵
    PID:4028
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView" --webview-exe-name=retrac.exe --webview-exe-version=3.0.13 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3580,i,879424783322836770,10315760585620298959,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=3588 /prefetch:1
    3⤵
    PID:4832
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView" --webview-exe-name=retrac.exe --webview-exe-version=3.0.13 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=4364,i,879424783322836770,10315760585620298959,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=1188 /prefetch:8
    3⤵
    PID:4216

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

33123532-c057-4733-a83a-e83f14851734.tmp

Path C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView\33123532-c057-4733-a83a-e83f14851734.tmp
Size 3KB
SHA256 fc69d0cec56a73a7de6a8dc9af91d0c6a9cc93942bea616a0e4ae0c89caad85c
MD5 bc4f9f8f2393eac937c02afd32697f2d
SHA1 e170d0434b47411a21203663cd9c793474dca9a1
SHA512 ff7f765cf1dbcf6117dad7d1d23bbffad3b87b35b918d29bbea46b191160f2de7d048663f51eba74943a8c610cbb7b6cc8a23032734089e717f606ae12737cf3
TLSH
T19071963699A4AA274DE2F904F88A3F46B7665137D5A13F98D5ED0F0C01DB7D82342C13
MD5 SHA1 SHA512 TLSH

Submit Download

44dc36c9-8148-44c0-87ad-302040cd0616.tmp

Path C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView\44dc36c9-8148-44c0-87ad-302040cd0616.tmp
Size 3KB
SHA256 ec778c58dbad35a50eb6ac6622f4a843bdf201494140bb10f947d5a5e9e87918
MD5 245f36918b23906323d2fc5fded30dff
SHA1 9874297d3a2a5cae984b2aaa984dd1e2e57ff4eb
SHA512 735d33c700265a42648dc36d2e4deb5ec59a0c71ee624d812119e5454f5fc2e307621bfe127985f06296a25e580afed4aa091a3f5dc0b3de240c576a785b4f15
TLSH
T15981B636A464AA774DE2E948F88A3F43A7A55037D4A13F98D9ED0F0C02DB6C82342C17
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 68bc76dfb2dcbb0d867b44c5a33d7593c76aa09482a11f45ed91e76709e0b243
MD5 eb4eda9d7f2eb60f84e5513f510d6223
SHA1 994840b52b2a9ccb5da7ffab7a950b4b17810a35
SHA512 80c8f2cbd09b887fdabda8035ccee9c1d4e1bf29d1ff118c875d119589fc2c025b8e7d228e278c071b71b8d983630ce9a8961c15fc6a7986d1797c80fa949c4e
TLSH
T1C9D0047477510010C00151F10355C54411105C301015411110D00C445C5C4144545401
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 d48ff5a7e35c7bd8e84d20793f422599532951d140aae9609b1523400195a056
MD5 20a2691f9f531539bfe90588c7c85b99
SHA1 b10ff6ba468589df3fff2c1151729805be534e4b
SHA512 17c48ca1f9f84498eb9c5486bc106f3f62b23ba10f2bbbd505c5180b60b6c1c79e113436a092ad664445fc7a368d1a51a4bf63f5187a4364004ac17b8a404574
TLSH
T1D4D0122637520134C01021B30343A54C1400D92B4009800164688D5D6E1C4640E06842
MD5 SHA1 SHA512 TLSH

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView\Default\Code Cache\js\index-dir\temp-index
Size 48B
SHA256 22399adc3c11fe181213522e37244ec058bfd8a3c8f2604c714e23ffdb7126d7
MD5 2ba75a1f1b3fb60593b7113a3a2cfa62
SHA1 16b3f84bfb4bd0438d3d68108627157213a8a5a9
SHA512 32fd42ebea2891ff8ad61993be0ac67443eb1f397cef1475bc70bc330f87ff3da685551a8493fc6f6c5e653abae050aad9b77623b22d77724d75ea593e33191d
MD5 SHA1 SHA512

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView\Default\Code Cache\js\index-dir\temp-index
Size 72B
SHA256 9db848376f1d2b9298e155a38fe3b8066fc6574138a1da586773794eef9ba457
MD5 198eb8137016e66e51ac777840cacaeb
SHA1 edd54ee710d1161c28cc95c6b67c35f1cfebfd8c
SHA512 c71159ae566480a3f8723ccf3e7976fc2554c1270912fc39b1a45c46827b962369aa7ac16a10a1f3cda0d239ba07efe42ead3b84f8f9a92ddefbf095c8e6e786
TLSH
T10AA00260A1951902D1C0DFF46AC6065B72704862524B060260B84D7DCD51386E1360A0
MD5 SHA1 SHA512 TLSH

Submit Download

index

Path C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView\Default\DawnWebGPUCache\index
Size 256KB
SHA256 2c996696e87f7b334c503a963dc5d314f5d91a93b5ca3ae49918200a689dad05
MD5 6b55a8fdd1fbbf5f8d8b445b7d7b5f87
SHA1 6c909f4675f600bdc3c0a4c721c489052cb39e48
SHA512 40392c4b56bd3f37fcd11d47ce44320c6bb1ca29763d247a22743c7ef8429268eaf4856cd95abb0a6799ae0f7a3cb94f1d6b288ef9edaafde6fe91a798744fa5
SSDEEP 3:LstlNllkll/lK/l:LsX3lEtK/l
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView\Default\GPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView\Default\GPUCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView\Default\GPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView\Default\GPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView\Default\Preferences
Size 6KB
SHA256 a89fef042905c5134af9ff5d0b0dacab70bf7bc4acded9be877a3d478316da33
MD5 a3c7e9649e9db1e14014af1a3fa48895
SHA1 26ffbfbea79b648473da6e8f78db57fc9ac6a260
SHA512 174b4c61e8c91d824dde6797103b93fb0b868bcc64db71cb7b63d17c179753bfa5be1362d3e3e9d91843601f099b6d4b677ec3c44adda0d3e2495aada2597802
SSDEEP 96:stvLY05sUfsb99ffvdZ8i0oEdktam/7qx+WVHMSm+uecJJO1idQjR+g8oIR+MEB:stjY0exfdZ8pF83/S+WiTJOwdg6rR+M8
TLSH
T1D5D1B8025F68697B4CC7F20D7A39BB52D2FF116162D50E58EBFC862C08E56CC220790B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView\Default\Site Characteristics Database\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView\Default\Sync Data\LevelDB\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

c9f42474-2ca1-4e93-b2a5-3f6c4a69764c.tmp

Path C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView\Default\c9f42474-2ca1-4e93-b2a5-3f6c4a69764c.tmp
Size 6KB
SHA256 c7eb0ad6a928bc03b9dfd160e230d6c7c8181246ebe9ce3b935f203a1b5d3d71
MD5 8663aceda05a30153393ad244affe869
SHA1 be5d38cd1ac124bbdd9ba1e1066a136093b8e08b
SHA512 359cf8c73c52b8ea82446a028133ac5facb0084726b4f3dd753baa6bbc00a963db2b2d930397e8a1a95ee851547c7ea4ceee2dd46a0fe27a9f2fa995aae3d3bb
SSDEEP 96:stvLY05qUfsb9gffqiZ8i0vhEdktam/7qx+WVHMSm+uecJJO1idQjR+g8obR+MOB:stjY0YEflZ8pa83/S+WiTJOwdg64R+MC
TLSH
T1BFE1DA025E6869774CC7F60D7A39BF52E2FE512262D50E58EBFC861C04E66CD630790B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView\Local State
Size 4KB
SHA256 110acd7643f13b060cb456b920d797520e4e63ca311a107036ba6a057fc8aa0d
MD5 a05d2872c4d375948f7062c2cedaf3b5
SHA1 19c0facaf1ec008fe0f8aa815a47b45a95ba8d8b
SHA512 ac2a1dd09192c4e97d58f8e17e7b4cee2125a3cda859ae5c538ecc3ba517bee04671bee26682790e9880685e048c97adf14919b02bf4ab989d13ad80443158c8
SSDEEP 96:zu6bNkCbTfuqe8Frh/cInURoDoto+5+DDBB5sQ6iemZ8ZrT3lHa:zFbNbeYooDUhG35sI+3g
TLSH
T1E78195369464AA775CE2F945F88A3F47A7A55027D5A13F98D9ED0F0C02DB6C82342C17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView\Local State
Size 1KB
SHA256 bd3cba351bff27401fd53ba557da8cd4d885d1f8ec9277eb5e66f16f2ad4978b
MD5 920d65e10b28043e38c54feb69e1991b
SHA1 f0c72c3d8742744d48779a1bece276f277f9701c
SHA512 af8a9976f9520ea26e92b99fd4594ba687b329c620d632d7c788a07a2b14f7ef29cc402f7414e9f49e283d04af9b57577bad0ce2ba8a5b618828ae40f627eda3
TLSH
T15921F076C4996B756581B958F16ABBCB1E21502A91324F48A0ED031902DB9ECD166C73
MD5 SHA1 SHA512 TLSH

Submit Download

a0a94e11-2546-4809-bac6-0c74f9bff063.tmp

Path C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView\a0a94e11-2546-4809-bac6-0c74f9bff063.tmp
Size 1KB
SHA256 b4786cece3968955751e11fa0d54bb70afeb3c5d83c63a58ee8028c6323c384d
MD5 707ca2764673ab3ac0800ade0c76ec30
SHA1 9730268362ab40c26e4a52c28ba9c4e8c15b18eb
SHA512 47f4b63971bbc6fb5a2a4df2478d64a4ed52e449d8c3198bf4081184fd6d4a41641c360e7ceb69f5b742d49fc1e96435e38ff6042cfa41d3062c70f5a3652285
TLSH
T165314272D4956B366881B649B19ABF875E31102A81724F48A0ED071902EBADCE126C33
MD5 SHA1 SHA512 TLSH

Submit Download

d750e897-019a-4677-9b8f-e0297f9fcb2c.tmp

Path C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView\d750e897-019a-4677-9b8f-e0297f9fcb2c.tmp
Size 4KB
SHA256 defae99c51cee76de5ca36a74fbd31876098f02c57fd46f2221b8ecc2f45fe9c
MD5 962b406722c65b0871b142a68b4b6410
SHA1 fc3b8319aa893de964d5f416054a48201c5d5a72
SHA512 b02a52d60131a68180174ee9e7085630608684ed547b44f943365a5a78083f06bfdd319b37bd5a8f0dba97908dcee9bad49d54453539342e84d4013d9a4b2af4
SSDEEP 96:zu6bNkCbTfuqe8Frh/cInURoDoto+5+DDBB5sQ6ietRYNqaZ8ZrT3lHa:zFbNbeYooDUhG35sIoRYU3g
TLSH
T168A1A531E865AA375CF2E684B94B3B82B7B5512799952F98C9ED0F0C029B7DC2343C17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e4cfbcd2-f9af-4443-86e4-84d46be6121b.tmp

Path C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView\e4cfbcd2-f9af-4443-86e4-84d46be6121b.tmp
Size 2KB
SHA256 0b3c61f8b403bc09ef6d3307ffd43022fff626753e33ba56583858fe172bfba4
MD5 b9f7e653cfd2845694020027284acb02
SHA1 5350fa7f6865ac6f6dde9a9aa4e451007ad3590c
SHA512 60dace463d1d102455d0c1ef42e291773f5346b56a43c90f16e3bd365c1e8422c6093114ab3242b4e1b545ae2a535f5baac86c5b39b777914acc6180167a5201
TLSH
T10D51C533A858AB7745D2FA48F84E3F53DA3A50259A722F9495ED071C01DBA9C7302C33
MD5 SHA1 SHA512 TLSH

Submit Download

f789f37c-245d-4e0a-a425-640c9fbfc7c2.tmp

Path C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView\f789f37c-245d-4e0a-a425-640c9fbfc7c2.tmp
Size 5KB
SHA256 ff6d32133df3e56e01dadb7c9edcb7749616fc7c28b0e74edfc512513a5243b9
MD5 36d8e8b9082d6cd5606b8f9583634753
SHA1 4b3b1b50e7dea39ae394c69aa397b650f95fa49f
SHA512 ef70a221060eb15124f48292ddb70c65c0a0a704f89003d837c95dfa3326754425e825b39c9a4957eb555c85d063ce242d0d50ad1e752b8d056c635b813de2ab
SSDEEP 96:zu6bNkEIbTfuqe8Frh/cInURoDoto+5+DDBB5sQ6ietRYNqFlGKaIjZ8ZrT3lHa:zFbNgeYooDUhG35sIoRY+az3g
TLSH
T18DB1C631E865E6335CF2E684B9473B82A7B1512799952F98C9ED0F0C028B7DC2347C17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2520-26-0x00007FFBAE370000-0x00007FFBAE371000-memory.dmp

Download

memory/4028-52-0x00007FFBADA30000-0x00007FFBADA31000-memory.dmp

Download

memory/4028-51-0x00007FFBADD80000-0x00007FFBADD81000-memory.dmp

Download

memory/4216-299-0x00000202465C0000-0x00000202465C1000-memory.dmp

Download

memory/4216-298-0x00000202465C0000-0x00000202465C1000-memory.dmp

Download

memory/4216-297-0x00000202465C0000-0x00000202465C1000-memory.dmp

Download

memory/4216-303-0x00000202465C0000-0x00000202465C1000-memory.dmp

Download

memory/4216-305-0x00000202465C0000-0x00000202465C1000-memory.dmp

Download

memory/4216-309-0x00000202465C0000-0x00000202465C1000-memory.dmp

Download

memory/4216-308-0x00000202465C0000-0x00000202465C1000-memory.dmp

Download

memory/4216-307-0x00000202465C0000-0x00000202465C1000-memory.dmp

Download

memory/4216-306-0x00000202465C0000-0x00000202465C1000-memory.dmp

Download

memory/4216-304-0x00000202465C0000-0x00000202465C1000-memory.dmp

Download

memory/4832-150-0x00007FFBAE370000-0x00007FFBAE371000-memory.dmp

Download