6e33653352f7764213e8b385d8ecefefa042ed1751e87641cad991807e3a5be2

Analysis

user interaction
yes
max time kernel
48s
max time network
48s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260911-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260911-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
27/10/2026, 15:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
retrac-f11cb3cbda56f58c.exe.url
Size 225B
Sample261027-sd1kravtfw
SHA256 6e33653352f7764213e8b385d8ecefefa042ed1751e87641cad991807e3a5be2
MD5 c3f405833b9f22ca5f6024c17fc5fb74
SHA1 b150b91bb75fe4404b8510b38691cf722167df2e
SHA512 cf4261c0c67f9c078f5de77a54a2555854bb0f25a271e0e37383c965d73d862ebe9016cb5ba5c9c46138398f74606512f65d03e20e162646bbc10574649653ce
TLSH
T147D0233CB4C780C8D3031C0C970480A3810B2E2ABCF3E8C06200CFA82885370A1CCC69
MD5 SHA1 SHA512 TLSH

Score

8^/10

discovery execution persistence ransomware

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
24	4408	msedge.exe

Executes dropped EXE 2 IoCs

pid	Process
4944	retrac-f11cb3cbda56f58c.exe
228	retrac-f11cb3cbda56f58c.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1992	cmd.exe
2964	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	retrac-f11cb3cbda56f58c.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	retrac-f11cb3cbda56f58c.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	retrac-f11cb3cbda56f58c.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	retrac-f11cb3cbda56f58c.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4408	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1531437071-3039716239-3530695936-1000\{F5E46E6F-A2D8-4B99-857D-ADDBA6B5E801}	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
4176	msedge.exe
4176	msedge.exe
4176	msedge.exe
4176	msedge.exe
4176	msedge.exe

Suspicious use of FindShellTrayWindow 10 IoCs

pid	Process
4176	msedge.exe
4176	msedge.exe
4176	msedge.exe
4176	msedge.exe
4176	msedge.exe
4176	msedge.exe
4176	msedge.exe
4176	msedge.exe
4176	msedge.exe
4176	msedge.exe

Suspicious use of WriteProcessMemory 55 IoCs

description	pid	Process	procid_target
PID 2880 wrote to memory of 4304	2880	rundll32.exe	84
PID 4304 wrote to memory of 4176	4304	msedge.exe	86
PID 4176 wrote to memory of 1820	4176	msedge.exe	87
PID 4176 wrote to memory of 4408	4176	msedge.exe	88
PID 4176 wrote to memory of 4264	4176	msedge.exe	89
PID 4176 wrote to memory of 4264	4176	msedge.exe	89
PID 4176 wrote to memory of 4264	4176	msedge.exe	89
PID 4176 wrote to memory of 628	4176	msedge.exe	90
PID 4176 wrote to memory of 628	4176	msedge.exe	90
PID 4176 wrote to memory of 3752	4176	msedge.exe	91
PID 4176 wrote to memory of 3752	4176	msedge.exe	91
PID 4176 wrote to memory of 3012	4176	msedge.exe	92
PID 4176 wrote to memory of 3752	4176	msedge.exe	91
PID 4176 wrote to memory of 3012	4176	msedge.exe	92
PID 4176 wrote to memory of 3012	4176	msedge.exe	92
PID 4176 wrote to memory of 1072	4176	msedge.exe	93
PID 4176 wrote to memory of 1072	4176	msedge.exe	93
PID 4176 wrote to memory of 1072	4176	msedge.exe	93
PID 4176 wrote to memory of 4832	4176	msedge.exe	94
PID 4176 wrote to memory of 4832	4176	msedge.exe	94
PID 4176 wrote to memory of 4832	4176	msedge.exe	94
PID 4176 wrote to memory of 4740	4176	msedge.exe	97
PID 4176 wrote to memory of 4740	4176	msedge.exe	97
PID 4176 wrote to memory of 4144	4176	msedge.exe	100
PID 4176 wrote to memory of 1080	4176	msedge.exe	99
PID 4176 wrote to memory of 4144	4176	msedge.exe	100
PID 4176 wrote to memory of 1080	4176	msedge.exe	99
PID 4176 wrote to memory of 2324	4176	msedge.exe	101
PID 4176 wrote to memory of 2324	4176	msedge.exe	101
PID 4176 wrote to memory of 4532	4176	msedge.exe	102
PID 4176 wrote to memory of 4532	4176	msedge.exe	102
PID 4176 wrote to memory of 2488	4176	msedge.exe	103
PID 4176 wrote to memory of 2488	4176	msedge.exe	103
PID 4176 wrote to memory of 2488	4176	msedge.exe	103
PID 4176 wrote to memory of 3956	4176	msedge.exe	105
PID 4176 wrote to memory of 3780	4176	msedge.exe	106
PID 4176 wrote to memory of 3780	4176	msedge.exe	106
PID 4176 wrote to memory of 1292	4176	msedge.exe	125
PID 4176 wrote to memory of 2992	4176	msedge.exe	110
PID 4176 wrote to memory of 2992	4176	msedge.exe	110
PID 4176 wrote to memory of 3448	4176	msedge.exe	111
PID 4176 wrote to memory of 3448	4176	msedge.exe	111
PID 4176 wrote to memory of 2112	4176	msedge.exe	112
PID 4176 wrote to memory of 2112	4176	msedge.exe	112
PID 4176 wrote to memory of 2500	4176	msedge.exe	113
PID 4176 wrote to memory of 2500	4176	msedge.exe	113
PID 4176 wrote to memory of 3632	4176	msedge.exe	114
PID 4176 wrote to memory of 3632	4176	msedge.exe	114
PID 4176 wrote to memory of 4944	4176	msedge.exe	119
PID 4944 wrote to memory of 1992	4944	retrac-f11cb3cbda56f58c.exe	124
PID 4176 wrote to memory of 228	4176	msedge.exe	126
PID 4176 wrote to memory of 384	4176	msedge.exe	128
PID 4176 wrote to memory of 4652	4176	msedge.exe	129
PID 4176 wrote to memory of 972	4176	msedge.exe	130
PID 228 wrote to memory of 2964	228	retrac-f11cb3cbda56f58c.exe	131

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\System32\rundll32.exe
"C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL C:\Users\Admin\AppData\Local\Temp\retrac-f11cb3cbda56f58c.exe.url
1⤵
- Suspicious use of WriteProcessMemory
PID:2880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://cdn.discordapp.com/attachments/1548680519691010079/1564335820364845186/retrac-f11cb3cbda56f58c.exe?ex=6ae18d83&is=6ae03c03&hm=f1e22be3afafc52b2df3f1a3c42a0e1481f4b27e8b262ef9b5479f6c2f1df348&
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4304
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-skip-compat-layer-relaunch --single-argument https://cdn.discordapp.com/attachments/1548680519691010079/1564335820364845186/retrac-f11cb3cbda56f58c.exe?ex=6ae18d83&is=6ae03c03&hm=f1e22be3afafc52b2df3f1a3c42a0e1481f4b27e8b262ef9b5479f6c2f1df348&
    3⤵
    - Checks processor information in registry
    - Enumerates system info in registry
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:4176
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x25c,0x260,0x264,0x258,0x304,0x7fff205ec188,0x7fff205ec194,0x7fff205ec1a0
      4⤵
      PID:1820
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1860,i,2837961280903126535,16943396482998417988,524288 --field-trial-handle=2336,i,16793661895679979667,13220771951068613598,262144 --variations-seed-version --mojo-platform-channel-handle=2372 /prefetch:3
      4⤵
      Downloads MZ/PE file
      System Time Discovery
      PID:4408
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1728,i,1455436188825987191,4200467573891280669,262144 --field-trial-handle=2336,i,16793661895679979667,13220771951068613598,262144 --variations-seed-version --mojo-platform-channel-handle=2332 /prefetch:2
      4⤵
      PID:4264
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2664,i,5067805146554775639,7146267612954212897,524288 --field-trial-handle=2336,i,16793661895679979667,13220771951068613598,262144 --variations-seed-version --mojo-platform-channel-handle=2644 /prefetch:8
      4⤵
      PID:628
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3472,i,4722229561826845766,83481253994458297,2097152 --field-trial-handle=2336,i,16793661895679979667,13220771951068613598,262144 --variations-seed-version --mojo-platform-channel-handle=3532 /prefetch:1
      4⤵
      PID:3752
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3476,i,8255534134093124166,12719461693635396081,2097152 --field-trial-handle=2336,i,16793661895679979667,13220771951068613598,262144 --variations-seed-version --mojo-platform-channel-handle=3540 /prefetch:1
      4⤵
      PID:3012
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4196,i,13799331730851747656,13862302573262063265,2097152 --field-trial-handle=2336,i,16793661895679979667,13220771951068613598,262144 --variations-seed-version --mojo-platform-channel-handle=4256 /prefetch:1
      4⤵
      PID:1072
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4272,i,15260936470389220019,12245307148074723739,2097152 --field-trial-handle=2336,i,16793661895679979667,13220771951068613598,262144 --variations-seed-version --mojo-platform-channel-handle=4308 /prefetch:2
      4⤵
      PID:4832
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3672,i,1333724254807793687,17622274065466696584,524288 --field-trial-handle=2336,i,16793661895679979667,13220771951068613598,262144 --variations-seed-version --mojo-platform-channel-handle=3588 /prefetch:8
      4⤵
      PID:4740
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5420,i,17167359247725167466,7626674005093487511,524288 --field-trial-handle=2336,i,16793661895679979667,13220771951068613598,262144 --variations-seed-version --mojo-platform-channel-handle=5476 /prefetch:8
      4⤵
      PID:1080
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3700,i,14783228774879891215,1951526092531691471,524288 --field-trial-handle=2336,i,16793661895679979667,13220771951068613598,262144 --variations-seed-version --mojo-platform-channel-handle=5544 /prefetch:8
      4⤵
      PID:4144
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5832,i,14055018293093606596,1444926409895440738,524288 --field-trial-handle=2336,i,16793661895679979667,13220771951068613598,262144 --variations-seed-version --mojo-platform-channel-handle=5824 /prefetch:8
      4⤵
      PID:2324
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6208,i,3405629247870466420,13521951049119624328,524288 --field-trial-handle=2336,i,16793661895679979667,13220771951068613598,262144 --variations-seed-version --mojo-platform-channel-handle=6228 /prefetch:8
      4⤵
      PID:4532
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=6232,i,9350592418179230796,3558389650051164115,2097152 --field-trial-handle=2336,i,16793661895679979667,13220771951068613598,262144 --variations-seed-version --mojo-platform-channel-handle=6268 /prefetch:1
      4⤵
      PID:2488
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6488,i,15936582742060892667,18104128790544601673,524288 --field-trial-handle=2336,i,16793661895679979667,13220771951068613598,262144 --variations-seed-version --mojo-platform-channel-handle=6536 /prefetch:8
      4⤵
      PID:3956
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6808,i,17850142302631561459,12231647464129290459,524288 --field-trial-handle=2336,i,16793661895679979667,13220771951068613598,262144 --variations-seed-version --mojo-platform-channel-handle=6820 /prefetch:8
      4⤵
      PID:3780
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7076,i,16398610727024738441,3551305310040715528,524288 --field-trial-handle=2336,i,16793661895679979667,13220771951068613598,262144 --variations-seed-version --mojo-platform-channel-handle=7092 /prefetch:8
      4⤵
      PID:2740
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7076,i,16398610727024738441,3551305310040715528,524288 --field-trial-handle=2336,i,16793661895679979667,13220771951068613598,262144 --variations-seed-version --mojo-platform-channel-handle=7092 /prefetch:8
      4⤵
      PID:1292
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6892,i,3018412014166726530,7994318473407804518,524288 --field-trial-handle=2336,i,16793661895679979667,13220771951068613598,262144 --variations-seed-version --mojo-platform-channel-handle=6828 /prefetch:8
      4⤵
      PID:2992
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7324,i,6966249086149724882,725234029018496903,524288 --field-trial-handle=2336,i,16793661895679979667,13220771951068613598,262144 --variations-seed-version --mojo-platform-channel-handle=6520 /prefetch:8
      4⤵
      PID:3448
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7324,i,1000348323032080850,7973240921019098758,524288 --field-trial-handle=2336,i,16793661895679979667,13220771951068613598,262144 --variations-seed-version --mojo-platform-channel-handle=6548 /prefetch:8
      4⤵
      PID:2112
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5264,i,13611973650748261133,2134687782608166702,524288 --field-trial-handle=2336,i,16793661895679979667,13220771951068613598,262144 --variations-seed-version --mojo-platform-channel-handle=5348 /prefetch:8
      4⤵
      PID:2500
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7068,i,8445912048748435278,5506285903573429791,524288 --field-trial-handle=2336,i,16793661895679979667,13220771951068613598,262144 --variations-seed-version --mojo-platform-channel-handle=6872 /prefetch:8
      4⤵
      PID:3632
  - - C:\Users\Admin\Downloads\retrac-f11cb3cbda56f58c.exe
      "C:\Users\Admin\Downloads\retrac-f11cb3cbda56f58c.exe"
      4⤵
      Executes dropped EXE
      Reads the TCP/IP host and domain name from the registry
      Suspicious use of WriteProcessMemory
      PID:4944
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c pause
        5⤵
        Executes a command shell one-liner
        
        PID:1992
  - - C:\Users\Admin\Downloads\retrac-f11cb3cbda56f58c.exe
      "C:\Users\Admin\Downloads\retrac-f11cb3cbda56f58c.exe"
      4⤵
      Executes dropped EXE
      Reads the TCP/IP host and domain name from the registry
      Suspicious use of WriteProcessMemory
      PID:228
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c pause
        5⤵
        Executes a command shell one-liner
        
        PID:2964
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4352,i,18042022025596578915,7248563182083879572,524288 --field-trial-handle=2336,i,16793661895679979667,13220771951068613598,262144 --variations-seed-version --mojo-platform-channel-handle=5332 /prefetch:8
      4⤵
      PID:384
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5324,i,17089740940579980332,9795311154767401890,524288 --field-trial-handle=2336,i,16793661895679979667,13220771951068613598,262144 --variations-seed-version --mojo-platform-channel-handle=6684 /prefetch:8
      4⤵
      PID:4652
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4292,i,17880549766074752750,8534787935344302178,524288 --field-trial-handle=2336,i,16793661895679979667,13220771951068613598,262144 --variations-seed-version --mojo-platform-channel-handle=3564 /prefetch:8
      4⤵
      PID:972

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3372

C:\Windows\System32\sihclient.exe
C:\Windows\System32\sihclient.exe /cv mNGqb3v5z0aiJtm/OtX2OA.0.2
1⤵
PID:1292

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

8B2B9A00839EED1DFDCCC3BFC2F5DF12

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8B2B9A00839EED1DFDCCC3BFC2F5DF12
Size 1KB
SHA256 791735e52af30a1c6a750df3837784a34cfe763332e5b45acfd731ddaa159b83
MD5 937eade2963d309f04ad7c807ba17156
SHA1 b183c87c76481b1e153a6bdfdc71945a59542a84
SHA512 5760b7dcfdcb1f5cd481e3d3c183b9c21996542896c602a0bdb665420693d3c67d3cacf98a2e18e437e6f7abf9263e0a18501930e02dabf2d748f749351820c8
TLSH
T1FB31C14EA2103067D946BF72D9CF7E83CDB1324AB7CAC46B18445E4229AAFC25F840C5
MD5 SHA1 SHA512 TLSH

Submit Download

B46811C17859FFB409CF0E904A4AA8F8

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B46811C17859FFB409CF0E904A4AA8F8
Size 529B
SHA256 39c727d70b8bdf5fc324233d0823555eb66ce846119609a22d1cebedbc3cf80c
MD5 f0102d5ebee72932834506783a39ffbf
SHA1 d6bf07be7cc02a713e0f8f94c124da8a15a016db
SHA512 621caa36ba48c567a850166b85b65474e96f860eca78fd1d3967e017f89a2c7919c6e6a21fef38136a5ae5ecfaade5b686be7476ba95253bfd023f71c0ce78a5
TLSH
T138F0C90C80182262CC04FF91CFD6AC93EC3A33427AD492031B444A420882F855FC16E9
MD5 SHA1 SHA512 TLSH

Submit Download

D562252712CCEFC078D8EF49C99D1A7C

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\D562252712CCEFC078D8EF49C99D1A7C
Size 309B
SHA256 9f7b05d7b5a653790f7a177e326af5b2aea041536f96a9be17350ed276248cc2
MD5 b3820731699fec1ae20878bbc17f49c4
SHA1 8253813f116cc2a289bedb7dee79ffd484a209ab
SHA512 506eb24115bf7c9404f378c22447b65b45ba6a55b27d1c9ba2f751e48f63602205af7a76d61f37bf9b44ef25cd52cf349306dddd7a116378ef5094cb91da8d38
TLSH
T158E07D95E9BD36811668E3119A90C8572D7881D31A4FB5401780C7A50583FC9ECC51CD
MD5 SHA1 SHA512 TLSH

Submit Download

8B2B9A00839EED1DFDCCC3BFC2F5DF12

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8B2B9A00839EED1DFDCCC3BFC2F5DF12
Size 174B
SHA256 d1f8c05c557ed197cb54c8f080f60bc0c381052b4ff8c356894b75752ca65db9
MD5 945b094e400fb6ee4c9ba58937eaab3a
SHA1 c5f9ea1889fe6529e2688f1cc82d7953580c6822
SHA512 a567ac1db2c7ff333e482f8ba5e25cce41fb1264c999b157fb618778280566b3914b089b7a3d3df8c0b3899fc6300549c85d746b324dc327df7baa87aa9fcbbe
TLSH
T128C09B447739021DF475153F155141515BF7D104DE9653049FB01127551D94598F7E05
MD5 SHA1 SHA512 TLSH

Submit Download

B46811C17859FFB409CF0E904A4AA8F8

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B46811C17859FFB409CF0E904A4AA8F8
Size 170B
SHA256 1912a9f7baf34f663399dbd3ade62f449273266ac5bf7eaa3c0dae7899b91225
MD5 ec3646dbb018b6d041627aaf59d38e82
SHA1 728713e7509cce75225c79c5dd82d534213dd1c6
SHA512 9dfe807686283f1167e2333fca4be54b6149c9a88eb3381864d8e6d94c5d4e0cfbab4929cf48f9f80dea4e6ce6df999498a19675720cd0831d3757d3d41bac12
TLSH
T1BCC0926873638A9BF1A6013F09E557159BF68290F653931006F842AA466DB910CB6E42
MD5 SHA1 SHA512 TLSH

Submit Download

D562252712CCEFC078D8EF49C99D1A7C

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\D562252712CCEFC078D8EF49C99D1A7C
Size 192B
SHA256 10dbfb8e4d1bd3d741aac8900dcb4555f4d5fc2963c3e1563f30205df7116730
MD5 1598f6de291e4ad9255187608458fa88
SHA1 dae7d3a23cf1f23ac4595b461893a789a61d5386
SHA512 274107bf852fee23b42459241e21bb1c6f4a78e7d792af239278eee68fcb4f10c406933877841309b50d03fe9d20c056be61578023198eab2b110380b4791c6b
TLSH
T109C08C2422B60A14F220073E0E5242035BF8B306D6C383452BF80305080CE01EC72E01
MD5 SHA1 SHA512 TLSH

Submit Download

93464163-bdb7-4b12-833d-b4b3586ab726.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\93464163-bdb7-4b12-833d-b4b3586ab726.tmp
Size 18KB
SHA256 08119ff22ff57664826edd90a40d63decab39e1fd95da4ad7b3d870c4963d78d
MD5 40eb3d0e183bf4f1e17a666edb83710c
SHA1 635ff48b343aade132cd4b63d38868f8c8e4cb22
SHA512 b228af0a787dbaff2d29bd4eaca8ed7358e20adfe47e4b6e555e08dd6ac3b41cf19f7ef4af4880ba3b4587e35109c0352c94a1e1ea0be0f2fe27f1feff632212
SSDEEP 384:n/QkUSvTsNeAbcHHtIzCaX++r+yX+2wgK6vaTZc4H9IIlc9:BTjtTC++6OlwgK6vaTZc4H9LO9
TLSH
T12F826B32A8786C774AE3E651A14B3A039FA4D157D6C46F94EACD5B2C01DF28C334B91A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

acd8e6c9-8e06-473a-899a-faf2365ac16d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\acd8e6c9-8e06-473a-899a-faf2365ac16d.tmp
Size 105KB
SHA256 aa204e7f585c1f2b64ec2dfe226fcda3dd40e2d6c7acaecb8bc39c51bf5021a2
MD5 82ef5ef3fd97f3d79a47f09529d45307
SHA1 4d70248d33884063e95777b4e6e0d998931440a1
SHA512 a3e3e08187ec16facc64907edae849970f4fffaceb0ff69b6b9421c352de4ae4396f6c7d28c814160c616bf604747c73d4cf8a04f10f2fc8fa4a07c14210288d
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P73:fwUQC5VwBIiElEd2K57P73
TLSH
T1F8B3B931457E36BF26E93EE828CF1511B84F3912624895D4ABE1FE2C4945E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 3d55f2c99b845161db37b100a47911bb408c97298230373b32b80504c093bdac
MD5 8c772c59cfb695752e285fc03e7d22ef
SHA1 ff46f5b2251e7cc5c8e51640b09a38994028a644
SHA512 be52bbbac241192660826ed6b064f8e1f1b9d15d161649f6af945c26fd833decc6799a8da172d8dc1a18290617adcecb8499c61c274c41423022dd426cb064a6
TLSH
T120D02BB8C7781A70F0231035B7260244398DC5084A07100AC0B012EB0C813920200060
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 f584a210a80810dcf70390eb86fe52a56c51ec17c3dc5bdad617c5592045fbf3
MD5 3f81b351aa581c722c62b505045d7be4
SHA1 aee3577cce62b5fc7e839373f1bbc460a57709e4
SHA512 e189804c66664bd7981164d77ac00dcad8e4a021039a525920cfc7e66607550c4e3dab61b8edb330b231c90ec362bf990464188fa10869f34c8d8a72aea189a1
TLSH
T109D02BB887B81E70F0231035B7250244398DC5084A07510BC0B012EB0C823D20200060
MD5 SHA1 SHA512 TLSH

Submit Download

35efdc06-8296-463e-bf32-65b13cd40c86.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\35efdc06-8296-463e-bf32-65b13cd40c86.tmp
Size 32KB
SHA256 c0a8481b7fc07618c7fc03e40d2ee1c3b919e67e3a5499ee6739c7134011c6c1
MD5 c31aae0a3de9a17629ac49a357d364c5
SHA1 d41bad88af415f372a0dcc23400a31706cd5eb84
SHA512 8e9ebafa66df982a21f2a9b8beae341681c0f6454e28b84f65560e2c7786572954ef0afe3da69d0368b5f94f79e60526bc0c268caba5c329b365bb27183ee3a8
SSDEEP 768:0HG2P377pLuLjN5WvR3X/8F1+UoAYDCx9Tuqh0VfUC9xbog/OVQ4FtOMsLlCc57w:0HG2P3NEjN5WvR3X/u1ja94FtOMsLksE
TLSH
T11CE2E93B780CCB7E4FC00E9DDD1A7F9A6DA802CBA698894047F9945C02D67EE51274DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3fd34ece-10d8-4975-abf2-b3e9d15f7e8b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\3fd34ece-10d8-4975-abf2-b3e9d15f7e8b.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

42980547-8a9d-4257-9377-096975216275.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\42980547-8a9d-4257-9377-096975216275.tmp
Size 10KB
SHA256 203f7a71a70da5a1ee4ef9604ca9f02e0373b503efe4b761e0c9f40c657221ed
MD5 f3d760277565cb93902bf739c433cc8b
SHA1 aa9204f43a76cd413ec110fc202f602e175ffb51
SHA512 0e83e05cb247ce63589186a52c860f5afa8f0fc8a0267057be1fc09f1982b3edf0ecea70b06bcf595d5bf05512e159956192aaa7e5d4599cab232f964a44fccd
SSDEEP 192:sxZDRk8s/f+sm2+Q+fcJIdpJHW6+WNGYhG+ZvbIg5O4J:sxZDDs/f+sb+BECJHbGqrsc
TLSH
T16522EA517E34A97B8CCBE20DBA157F53E6FA503261D51E48AAFC861C05EA6DD130780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

962a8835-6d97-4453-bd88-ee3b673bca8e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\962a8835-6d97-4453-bd88-ee3b673bca8e.tmp
Size 10KB
SHA256 fc49a7f69c05e9400a3bcba9cfc1dbc12d62661af2686dbf29e929ea0908adf2
MD5 350f9ec838255125af10c5cabd03f34e
SHA1 dabf129f05bc275d4da5c5b3b55889dabbd7f131
SHA512 73da544691a7954cd86409957ab3397b474176ae53c3649c27055972b92825ed5895c139e72f1be57c5b17a054015dfc2f25f226ba6cdbae78ff8538100be432
SSDEEP 192:sxZDRk8s/f+sms+Q+fcJIdpJHW6+WNGYh0oZvbIg5OuJ:sxZDDs/f+sZ+BECJHbG2rs6
TLSH
T17432C8517E34A97B8CCBE20DBA157F53E6FA503261D51E48A6FC8A1C05EAADD130780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

993f3f13-67a4-4996-bf39-e601fba65498.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\993f3f13-67a4-4996-bf39-e601fba65498.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 3KB
SHA256 07757a71b067da82cf0f47430231abab6bb3edcf539262c888eff5c6867c5b64
MD5 8a52652daa29426f4315dc74eee0ff8c
SHA1 92153ff2cc2af1e043a241a37791098a13b309a4
SHA512 11bead6c45c8a40f249ae1ecdc139fd5d0ed57f825dfcd63ddfa29d91647b7d9dff6937a317b620f08f3f08d4bcf9efb5bc38f32d9b820d9290bcb67657d3b16
TLSH
T167615E4351008C76F75442B3BBC727B23638C7B070AB2E6D9DA5D8B96B063F51E08457
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 5e181050d70aae7938f5eb94c9fd032a1c693f9ab07c98752c7f00db99bf42d1
MD5 c8570c9631e973e9a1b1c5d335787daa
SHA1 cd244363d37040eccb210a8f6f8fded319e835b9
SHA512 8d338c4111f7ad6b3c3a3863dd0ae94daf905aeb312e140e0bfcf7505768587fa555741faca0bed00e21eaa6cca5653bcd1de7ebe3a4fb30e0c48185fbc19e90
TLSH
T178615E4351008C76F75442B3BBD727B63A38C7B0706B2E6E9DA5D8B92B063F51E08457
MD5 SHA1 SHA512 TLSH

Submit Download

a3cf9116-7350-4f70-8990-d4234deb67a2.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\a3cf9116-7350-4f70-8990-d4234deb67a2.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

dasherSettingSchema.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.111.1_0\dasherSettingSchema.json
Size 854B
SHA256 6c69ce0fe6fab14f1990a320d704fee362c175c00eb6c9224aa6f41108918ca6
MD5 4ec1df2da46182103d2ffc3b92d20ca5
SHA1 fb9d1ba3710cf31a87165317c6edc110e98994ce
SHA512 939d81e6a82b10ff73a35c931052d8d53d42d915e526665079eeb4820df4d70f1c6aebab70b59519a0014a48514833fefd687d5a3ed1b06482223a168292105d
TLSH
T1B1014C25C354799B04C7627ABCA95001E630818B027665707DDE4D7C6F2E8A700BF37E
MD5 SHA1 SHA512 TLSH

Submit Download

29f14dde-8c40-4044-a68d-dea5ff7bf090.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\29f14dde-8c40-4044-a68d-dea5ff7bf090.tmp
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

5f081d5a-82d7-4b27-a5f5-8b0dc1af467e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\5f081d5a-82d7-4b27-a5f5-8b0dc1af467e.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 59380f21b0746d5c7a8cd7f4e648edf43f5d9150dc1205e70a7edd92e0faecf2
MD5 b0f73a0009bb2e6955a3ccb54283f393
SHA1 c6701156fbd5a4a1b56c25d59002b5980204ceee
SHA512 b999d5dbe3ae9787cedf85fce2ef99d62a123d713aff7cb14c149352b6ef0b80baade9fd0223d9dc8926d0d07552ca2d9d33c741c0d6de004b8625633d5cb128
SSDEEP 24:KLIttW9kiL0k2C0mI9Ihq2KsVhkI21uSmSw8WFGKnyXvNI/kyxXuokTPUPViIMwr:KgzIhKIQUry9fIBKE48zyltIpKOEE5
TLSH
T12F91120070BB4254393E6A1982768B7E475635F73029E62F3FBD54A19E2BE080DFD8C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b9b595c5-4868-431b-abc2-65a34c131fef.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\b9b595c5-4868-431b-abc2-65a34c131fef.tmp
Size 10KB
SHA256 8210ee75bc72594d639d7075a02a1e915f37db951268f916239c7b9640f43356
MD5 0123c8ad600b4f7a93845bae0c7a431b
SHA1 8e1aaa5d2b0f1f3a1f86f11250250e4248f24cb7
SHA512 cfe40e07215658357829eac5ddb14a53125261c6571839de7a0fe367c06ccfea5bddd199bd4d7efe35cf6303dfb17f08f793ad7e96b42f618b985082e9c067bf
SSDEEP 192:sxZDRk8s/f+s92+Q+fcJIdpJHW6+WNGYhGPZvbIg4J:sxZDDs/f+sA+BECJHbGfrc
TLSH
T15822C8516E34A97B8CCBE209BA197F53D6FA503261D51E48AAFC861C05EA6DD130780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b6b3331c-eacf-4c1b-b9af-d60222b3ad5a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\b6b3331c-eacf-4c1b-b9af-d60222b3ad5a.tmp
Size 18KB
SHA256 91635bac164ffee1b49149b4f2111df1531da92cdb3e8aa3968619b4fdce3880
MD5 f89e944602b23ef23545481158a28e7f
SHA1 f125ffb2195190abecdae668965f0253a03868bc
SHA512 91c0e3d3f2bcbf161e47f1990e4e822ae9c9fefca25f3a5a740f1dd60566d36d626aff5627c2880a5eee981f3a508fe9cb82588fcc67501345a30e01e17e1b14
SSDEEP 384:ndQkUSvlsNeAucHftIzCaX++r+yX+2wAK6vaTZc4H9IIlc9:HlSVTC++6OlwAK6vaTZc4H9LO9
TLSH
T127826C32A8786C774AE7E651A14B3A03DFA4D117D6C46F94EACD5B2C01DF28C334B91A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bac78815-a5f7-475a-ace3-35d4db4c25de.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\bac78815-a5f7-475a-ace3-35d4db4c25de.tmp
Size 18KB
SHA256 8643c6efe6a9014aac63616885cdfba66c229a661710934c2d06e69c0c18077c
MD5 ea54ec480b96af885a108266663fb5f3
SHA1 e7a3e41aed62400fbf068682465935671aa5d974
SHA512 7abb04e9628367326712e995479b7cfa51664c5be96cc17c9fa786a19efbd6adda4e0931a5118daa9650f59a49e628f8dd2ee9baea9c99f619b42f10e694969d
SSDEEP 384:nCQkUSvTsNekbcHHtIzCaX++r+yX+2wgK6vaTZc4H9IIlc9:6TztTC++6OlwgK6vaTZc4H9LO9
TLSH
T1A2827C32A8786C774EE3E651A14B36039FA4D117D6C46F94EACD5B2C01DF28C334B91A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c6db00d1-4a5c-4e12-b079-f96be873bfb7.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\c6db00d1-4a5c-4e12-b079-f96be873bfb7.tmp
Size 8KB
SHA256 0962cbf6cf9cc5b406f772d7997077e4b2cce42ca6222e9ea1cf902a67f44d1d
MD5 ab2852b663c340ec16b37d843f9c1168
SHA1 b04bc43390fe916695ecd852d6af32e5a01cc7a6
SHA512 ddb32f96d22e9efb5345b6c85d2264105eac863f4c31126bb4d7dcebe48d61f0909fc0b08e8bedc6f5cba4353f453fcbb73463d2fc12d84249e6be3076797aab
SSDEEP 192:SONP68+7QmiUyLL1GCaX/W+VJY60Lx4FU6:SONP6BtO1GCaX++rACFU6
TLSH
T13D02CA35AC787C778EF3AE45B48B3A179FD4112BA6906F84DAE8161D01D724C3347927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d1a1f17e-3e7f-421d-9020-0a1c460e8f5f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\d1a1f17e-3e7f-421d-9020-0a1c460e8f5f.tmp
Size 8KB
SHA256 b9de07a19a20b613f9b300fc0b97a2f2295676d98885580fc65c82b964cc0c5b
MD5 c5564ff13d8de5db7685ecc2a8ed3fe4
SHA1 2de8478991bbbc5c65cae9fb588d4242f80f2231
SHA512 fecd0cd16c86d97d40e6435648e0873394d43fb5ca6c5462b22cec2949e4c957a3900eec38a3fc6a81400e757f045e38c54fcf944a46266138c45d5022922026
SSDEEP 192:oONn68+EQmiUyUL4GCaX/W+VJY7zy0ef+2wy+QY9qv6U6:oONn6BUH4GCaX++r+yX+2wFK6U6
TLSH
T1C812093598787C6B4EE3A945B48B35179ED98227D7C4AF94DADC1A2C01EF24C330B917
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e347bfb6-cd76-40fb-b050-631207270ba8.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\e347bfb6-cd76-40fb-b050-631207270ba8.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 a74f5799ef91e8e265b2e1829dc0fa2fb629c7974f7d89a64b1881ddc316d54c
MD5 1bcecf7bdb7e3760979fd373364b9aa1
SHA1 073d374f447a1c6821c1c3ccd2328111cf5dff06
SHA512 306285d8e66952c344f0b1bd716c1dbf073ca14cf69f92430e084cb1ca470b03901c7a84b9d9b908bc60e2a76608adfa48f30e253511b62fac4db0758fed371d
TLSH
T1B8412868BAF91148B3B77F1AAFF2B86E447A7D772E06D05E00110D4F0A66A40C961737
MD5 SHA1 SHA512 TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 6a859dbe4db15dd58283eebf883595f18cb4c2072bcc1303cb8cfd3b5aafbca9
MD5 0b1c34675b02474b3b8b00a2eb436f03
SHA1 ba5bfcea81a23354aff3167a39269ef16135ac2a
SHA512 94d7d87d6149130148f85efd8b3dfc24cc22f05f4cb809cfa646488d420a098358eef2553c75ebb93780c38f27dcabfb649913a747dac40d27894bb66321ee2c
TLSH
T103410A58BAEA1158B3B77F59ABF6A86D487F78772E06D45E00110D4F0A62B40C8B2737
MD5 SHA1 SHA512 TLSH

Submit Download

8b0d4544beb97a69dbb9583fca5575a9aba6e37d.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\8b0d4544beb97a69dbb9583fca5575a9aba6e37d.tbres
Size 2KB
SHA256 369a40cf9df03e476c8505cc107fb3faf700099b918cc33aae1cabbcb95ab760
MD5 1142c9c96a517a337fd19d8b8199fa28
SHA1 d8b6fd8ec4b7122ad442b63953c4b84741a546e9
SHA512 45952e3e61b3d195a02436d6ac090dfb0a0aec2743d18c02a0f8e814bc7275c3551dbb9369a5cd052773d543f7e253ee2a1a6aaf427dbb4450cd0537e32116ab
TLSH
T15B513B686AEA1018B3B76F599BF6799E487FB9333E06905E10110E4F4A23A41CD61B37
MD5 SHA1 SHA512 TLSH

Submit Download

1a0a3c0c-9e20-4840-b90d-781430ec14cb.tmp

Path C:\Users\Admin\AppData\Local\Temp\1a0a3c0c-9e20-4840-b90d-781430ec14cb.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

96d39255-b943-40f4-ad9e-73f7a7138709.tmp

Path C:\Users\Admin\AppData\Local\Temp\96d39255-b943-40f4-ad9e-73f7a7138709.tmp
Size 158KB
SHA256 3d0a40deb15b80333a0b152bac6856a3345cbfcd29fd6a5c33a6e4bd22c1b272
MD5 9c18c4721b560ec55f0d5de055144d5c
SHA1 6af37a3bda916cac276ad5879c9f61262d9ae523
SHA512 51466928eb8d3cf7b917919c98bd8168453583d2c3dc5836036d87ffd0d2c732ab8450212a880fc6de199ea569a96993ba0d250a5012160d2d72211880695f92
SSDEEP 3072:5ZwEurOxn8zXnHc2qHNYEU/rUHCVJWGdi0Ha5HnXk9TFzBsuht7yGik:5ZwPOx8D85UIHEI0HaZ09JzKStjik
TLSH
T1CFF3E13E7EDE891AD80B10BB7F16B18BD80D8E0B460AB44B769D80155B3668D1BD1CFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cd7d9dd2-ad36-4920-aed1-112bb119522c.tmp

Path C:\Users\Admin\AppData\Local\Temp\cd7d9dd2-ad36-4920-aed1-112bb119522c.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4176_1872581931\CRX_INSTALL\_locales\en_CA\messages.json
Size 711B
SHA256 2445cad863be47bb1c15b57a4960b7b0d01864e63cdfde6395f3b2689dc1444b
MD5 558659936250e03cc14b60ebf648aa09
SHA1 32f1ce0361bbfdff11e2ffd53d3ae88a8b81a825
SHA512 1632f5a3cd71887774bf3cb8a4d8b787ea6278271657b0f1d113dbe1a7fd42c4daa717cc449f157ce8972037572b882dc946a7dc2c0e549d71982dcdee89f727
TLSH
T1460197136240AF18470BF05BB9023442A0B44AC62384E0B775EC982C6656DAFB20B3B0
MD5 SHA1 SHA512 TLSH

Submit Download

content.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4176_712501159\CRX_INSTALL\content.js
Size 9KB
SHA256 0d40a5153cb66b5bde64906ca3ae750494098f68ad0b4d091256939eea243643
MD5 3d20584f7f6c8eac79e17cca4207fb79
SHA1 3c16dcc27ae52431c8cdd92fbaab0341524d3092
SHA512 315d1b4cc2e70c72d7eb7d51e0f304f6e64ac13ae301fd2e46d585243a6c936b2ad35a0964745d291ae9b317c316a29760b9b9782c88cc6a68599db531f87d59
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3zEScQZBMX:+ThBVq3npozftROQIyVfjRZGB365Ey97
TLSH
T16212B58DA568ED7D1980C952E10EA62E5D342435E6E7A303108B8D88026CFBAD955FFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

retrac-f11cb3cbda56f58c.exe.crdownload

Path C:\Users\Admin\Downloads\retrac-f11cb3cbda56f58c.exe.crdownload
Size 422KB
SHA256 7a0a67599cf96b0f51bf80f4967f5f220f4fb4f7783c0e4eebed2697684d6389
MD5 4773b8581dfd14708c75b2a0f8328c8d
SHA1 5dfbb92e1fbd46d6510c3e74f94d2ef68582c0ca
SHA512 2b389a4de003e4f67aac58b872bb78475f8fe16b883328792c65e8285d3c1863ea586568ef493359ca5b5df3a4cd1390fd813299a8f4926c32eed14e67d4d19f
SSDEEP 6144:pIxpL14dwKn2ldqYEyXBSvppRFdoPbXu9WRT7/C13S4s8pwA9tNM1buUG:WQn2ldqYEyXAxpRFdoq9WoSu1
TLSH
T1FD940888D0A315F7C6F6CE389B53A58AF471B8D8422E1EF717C9E4755006AE1F636E02
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads