eeac210d8ec932ed9321d14894cc258b9ff1326269cf5b5f2a32f546b5bacb5d

Analysis

user interaction
yes
max time kernel
31s
max time network
54s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/11/2026, 22:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Retrac_3.0.13_x64_en-US.msi
Size 14.4MB
Sample261104-2cp73adx91
SHA256 eeac210d8ec932ed9321d14894cc258b9ff1326269cf5b5f2a32f546b5bacb5d
MD5 c5dcedf519425df5b725eb904500c0c4
SHA1 e8077f60735e924620bc3a276e26d1bc6ac80723
SHA512 290c0438a6c9f8b7ddecbb4b357625c9a86d61b7c734286bc9416314eb2a9cf283a956c74b1a9b6464f9c4e6189b429f07a8b8d7ed64ac6f6cb77e87dce786c8
SSDEEP 393216:6iT0PlLJ0/XBZtZW9a81kNBMUD19EFKEprsFDx+iTSH:PT0tG/Xbr6gE8ENeAiO
TLSH
T11BE63353BE45AB24C62D1FBE6472CB4C10363E146B95AC579294BE38ECFB2C04CB59D1
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery persistence privilege_escalation ransomware

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
628	MsiExec.exe

Badlisted process makes network request 1 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
4	6008	msiexec.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs

persistence privilege_escalation

Installer Packages

T1546.016

Msiexec

T1218.007

pid	Process
6008	msiexec.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000430d2ae4193eb5170000000000000000000000000000000000000000000000000000000000000000000000000000000000001071020000000000c0120000000000000000000000002701010000883801430d2ae40000000000001071020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d0830200000000006025c501000000000000000000000700010000e84101430d2ae4000000000000d08302000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9c701000000000000050000000000000000000000070001000098d4e3430d2ae400000000000030a9c7010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9cc0100000000000005000000000000000000000007000100009854e6430d2ae400000000000030a9cc01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	6008	msiexec.exe
Token: SeIncreaseQuotaPrivilege	6008	msiexec.exe
Token: SeSecurityPrivilege	3672	msiexec.exe
Token: SeCreateTokenPrivilege	6008	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	6008	msiexec.exe
Token: SeLockMemoryPrivilege	6008	msiexec.exe
Token: SeIncreaseQuotaPrivilege	6008	msiexec.exe
Token: SeMachineAccountPrivilege	6008	msiexec.exe
Token: SeTcbPrivilege	6008	msiexec.exe
Token: SeSecurityPrivilege	6008	msiexec.exe
Token: SeTakeOwnershipPrivilege	6008	msiexec.exe
Token: SeLoadDriverPrivilege	6008	msiexec.exe
Token: SeSystemProfilePrivilege	6008	msiexec.exe
Token: SeSystemtimePrivilege	6008	msiexec.exe
Token: SeProfSingleProcessPrivilege	6008	msiexec.exe
Token: SeIncBasePriorityPrivilege	6008	msiexec.exe
Token: SeCreatePagefilePrivilege	6008	msiexec.exe
Token: SeCreatePermanentPrivilege	6008	msiexec.exe
Token: SeBackupPrivilege	6008	msiexec.exe
Token: SeRestorePrivilege	6008	msiexec.exe
Token: SeShutdownPrivilege	6008	msiexec.exe
Token: SeDebugPrivilege	6008	msiexec.exe
Token: SeAuditPrivilege	6008	msiexec.exe
Token: SeSystemEnvironmentPrivilege	6008	msiexec.exe
Token: SeChangeNotifyPrivilege	6008	msiexec.exe
Token: SeRemoteShutdownPrivilege	6008	msiexec.exe
Token: SeUndockPrivilege	6008	msiexec.exe
Token: SeSyncAgentPrivilege	6008	msiexec.exe
Token: SeEnableDelegationPrivilege	6008	msiexec.exe
Token: SeManageVolumePrivilege	6008	msiexec.exe
Token: SeImpersonatePrivilege	6008	msiexec.exe
Token: SeCreateGlobalPrivilege	6008	msiexec.exe
Token: SeCreateTokenPrivilege	6008	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	6008	msiexec.exe
Token: SeLockMemoryPrivilege	6008	msiexec.exe
Token: SeIncreaseQuotaPrivilege	6008	msiexec.exe
Token: SeMachineAccountPrivilege	6008	msiexec.exe
Token: SeTcbPrivilege	6008	msiexec.exe
Token: SeSecurityPrivilege	6008	msiexec.exe
Token: SeTakeOwnershipPrivilege	6008	msiexec.exe
Token: SeLoadDriverPrivilege	6008	msiexec.exe
Token: SeSystemProfilePrivilege	6008	msiexec.exe
Token: SeSystemtimePrivilege	6008	msiexec.exe
Token: SeProfSingleProcessPrivilege	6008	msiexec.exe
Token: SeIncBasePriorityPrivilege	6008	msiexec.exe
Token: SeCreatePagefilePrivilege	6008	msiexec.exe
Token: SeCreatePermanentPrivilege	6008	msiexec.exe
Token: SeBackupPrivilege	6008	msiexec.exe
Token: SeRestorePrivilege	6008	msiexec.exe
Token: SeShutdownPrivilege	6008	msiexec.exe
Token: SeDebugPrivilege	6008	msiexec.exe
Token: SeAuditPrivilege	6008	msiexec.exe
Token: SeSystemEnvironmentPrivilege	6008	msiexec.exe
Token: SeChangeNotifyPrivilege	6008	msiexec.exe
Token: SeRemoteShutdownPrivilege	6008	msiexec.exe
Token: SeUndockPrivilege	6008	msiexec.exe
Token: SeSyncAgentPrivilege	6008	msiexec.exe
Token: SeEnableDelegationPrivilege	6008	msiexec.exe
Token: SeManageVolumePrivilege	6008	msiexec.exe
Token: SeImpersonatePrivilege	6008	msiexec.exe
Token: SeCreateGlobalPrivilege	6008	msiexec.exe
Token: SeCreateTokenPrivilege	6008	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	6008	msiexec.exe
Token: SeLockMemoryPrivilege	6008	msiexec.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
6008	msiexec.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
6008	msiexec.exe
3672	msiexec.exe
628	MsiExec.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3672 wrote to memory of 628	3672	msiexec.exe	90

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\Retrac_3.0.13_x64_en-US.msi
1⤵
- Badlisted process makes network request
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:6008
- C:\Program Files\Retrac\retrac.exe
  "C:\Program Files\Retrac\retrac.exe"
  2⤵
  PID:3068
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=retrac.exe --webview-exe-version=3.0.13 --user-data-dir="C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --enable-features=MojoIpcz --lang=en-US --accept-lang=en-US --mojo-named-platform-channel-pipe=3068.4724.8578924889026426071 /pfhostedapp:fd0de7e5cefc9f8a2e2a61a11d5c8b08aabc87ca
    3⤵
    PID:2520
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView /prefetch:4 /pfhostedapp:fd0de7e5cefc9f8a2e2a61a11d5c8b08aabc87ca --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x188,0x18c,0x190,0x184,0x198,0x7ff8624a5fd8,0x7ff8624a5fe4,0x7ff8624a5ff0
      4⤵
      PID:2372
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView" --webview-exe-name=retrac.exe --webview-exe-version=3.0.13 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1752 --field-trial-handle=1756,i,13342984230709510067,4188351470511080973,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:2 /pfhostedapp:fd0de7e5cefc9f8a2e2a61a11d5c8b08aabc87ca
      4⤵
      PID:4560
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView" --webview-exe-name=retrac.exe --webview-exe-version=3.0.13 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=1924 --field-trial-handle=1756,i,13342984230709510067,4188351470511080973,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:3 /pfhostedapp:fd0de7e5cefc9f8a2e2a61a11d5c8b08aabc87ca
      4⤵
      PID:5128
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView" --webview-exe-name=retrac.exe --webview-exe-version=3.0.13 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2304 --field-trial-handle=1756,i,13342984230709510067,4188351470511080973,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:fd0de7e5cefc9f8a2e2a61a11d5c8b08aabc87ca
      4⤵
      PID:3840
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView" --webview-exe-name=retrac.exe --webview-exe-version=3.0.13 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --autoplay-policy=no-user-gesture-required --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=2864 --field-trial-handle=1756,i,13342984230709510067,4188351470511080973,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /pfhostedapp:fd0de7e5cefc9f8a2e2a61a11d5c8b08aabc87ca /prefetch:1
      4⤵
      PID:4524

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3672
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding BA2EF961267D09961779D2C7A7923ED0 C
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:628
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:4520

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
PID:3364

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Installer Packages

T1546.016

Privilege Escalation

Event Triggered Execution

T1546

Installer Packages

T1546.016

Defense Evasion

System Binary Proxy Execution

T1218

Msiexec

T1218.007

Credential Access

Discovery

Network Share Discovery

T1135

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e59ac93.rbs

Path C:\Config.Msi\e59ac93.rbs
Size 10KB
SHA256 ec32d97b76a9d227ad6665d36a96d0f5b58c76cadd771102f0b7137704cfe611
MD5 fda54117d1dea6d4b3a751f6cd23c823
SHA1 c6e09e6a62749f0ace88970025ac173d190aaaee
SHA512 e5c2c86e6d71abd10d5deb6fb99f9fd1f7cb35cb55137622d0cdc8a27af2fbb4febfc8e798771ecf655fcf00e888c97df5d0ca458c2527f6e14799cbbab5ff38
SSDEEP 192:EqrEv2lD6BvCFJt8Grt8u6xc3PWiiNPpBK:vra2lD6BCtDtFQdK
TLSH
T160223001B205C3D3E9532734CB03272437A6F7E59B19234B07DE9568AE877C86F9628E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

retrac.exe

Path C:\Program Files\Retrac\retrac.exe
Size 26.1MB
SHA256 31f5fac8644a5803759edbd3e53e42bbcf4f8b2ba17b4dd8033582516c3a17f9
MD5 ddbff854e0044929e354a21327e4f720
SHA1 bd97e07b8b59b8f9bdaea7047f2623b2c5f09aa6
SHA512 ce4536e547820efe2021c4051220083a858390e7352690c1c80ca92ef52f9ad1ea686fff847e8bdfdc4cc3a6093971f9acc7da45d65d50c347864b2f3bb5bcb5
SSDEEP 393216:Ckmizc1w/McqO0BAsPAtdEYOK1Jmii8l+MMuM8MY+M/6sdkhjrB:Ckmi68cPlYx1JNl+MMuM8MY+M/4rB
TLSH
T1C05749217B5AA96DD19AC474834B4A725A7130DB0B35BAFF44C492383F6DBF42F38258
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Retrac.lnk

Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Retrac\Retrac.lnk
Size 1KB
SHA256 ab6da1eea95440d8c649fb0d99bc9b66037769788acbaa9e68310fd0da23911b
MD5 0125a94a7448175f2f24c3ce57fc4c9a
SHA1 31ea344090e1b9fd7e7e5e9ab61497729555a0ce
SHA512 c0d91b95590db158e740eb5616b99d9883a3ccc388a413874574b2125805136aeadaad69c70814dfb9cd540689aa82a41de0ae32dbd89208649df26a347aadef
TLSH
T1ED41941057E1072EF37356399CF54A21AB35FD06F5248F2F4289018A4AB95019D5DF7B
MD5 SHA1 SHA512 TLSH

Submit Download

~etrac.tmp

Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Retrac\~etrac.tmp
Size 1KB
SHA256 98e1de64e100573763dc549e14256852717b1bbd5573bb2527c84addf953b121
MD5 33261f592e6cd6ddf6d7acfee3028a48
SHA1 4a7c2e051b352b48c2db15f62a1e78968d8c8a56
SHA512 dd3a31d7fb89a15d0fd9c9f8f67b77483aa83edffc25c3092e65e6382505241d7ee04c15215365f428f9d28ebc3f9a33ab91b6deef301a8ac9fb647882c8fff8
TLSH
T19E41C2105BE1072EF27716399CF54A229A35FE06F9248F2F8289018A0AB95009D6DF7B
MD5 SHA1 SHA512 TLSH

Submit Download

MSI55E6.tmp

Path C:\Users\Admin\AppData\Local\Temp\MSI55E6.tmp
Size 132KB
SHA256 7f47d98ab25cfea9b3a2e898c3376cc9ba1cd893b4948b0c27caa530fd0e34cc
MD5 cfbb8568bd3711a97e6124c56fcfa8d9
SHA1 d7a098ae58bdd5e93a3c1b04b3d69a14234d5e57
SHA512 860cbf3286ac4915580cefaf56a9c3d48938eb08e3f31b7f024c4339c037d7c8bdf16e766d08106505ba535be4922a87dc46bd029aae99a64ea2fc02cf3aec04
SSDEEP 3072:Kx2YbpcgwmiTPJDnCO+DATkURBnrskNwPj2:XXgwmY1CPx2XG2
TLSH
T1DBD39D02B5D0C473D9BE09390870DB229F7EB930DF909EDB636856699E702C19E35A37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4f164492-9387-4ed1-b181-9855f3f4e502.tmp

Path C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView\4f164492-9387-4ed1-b181-9855f3f4e502.tmp
Size 3KB
SHA256 d7c434097c4e39c67e7b7bd5734269debdb1182d46c2c3687065140a368fb08e
MD5 84f6515dc4b4b374e5e1e0e774aa986b
SHA1 849a6e26cb6b1f290f4d9b6d198864eedb63e895
SHA512 78d5cc4faa1008a352ac885d264c48eb9e419d49dad06efa5f1f44e62ca5d8f9920bdc58394ca7e710b0e9744ed769fb6c4dcd15bd72263825532f37e1ba66f4
TLSH
T10081846268B4AD3B98F2D518BC467F07A6A4602798C56F95C9EC4F1E01DB2D92382827
MD5 SHA1 SHA512 TLSH

Submit Download

5098aa6e-d056-4af7-aad8-96cf05ce3c92.tmp

Path C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView\5098aa6e-d056-4af7-aad8-96cf05ce3c92.tmp
Size 2KB
SHA256 ad5f8f2350cc5d149f54c42e293f4185acf083dae3b9b9798c573be80ce54694
MD5 350653af2ae7387dde733972bd19e1ee
SHA1 111ef5ebf5d111b6a133d5b5d4b6c370777eb8f9
SHA512 21d1e929db1778c802c999fd6f70729748e50d4fb2041d6e7073de01ec54a5ca089d6e1277f30f89a0ee345aae33854e01697406903322406424abd7c2d8cdc1
TLSH
T16251B4B3B814AE3B99F25618BC477F23DA7960629E921F518ADE4B1D00D756C3382C33
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 7acc8068ce5148bf8fb933a288f66c4511cc8553f6cbfee5f72a62e9e168bd6a
MD5 d6d328039080e381baf477a27bfd8de1
SHA1 39056dd587b8f09d52fcda5ac0f1c10d51e3e49b
SHA512 a13ef11b670447cef01c5d21cd24ac9b662a863a83d116cdfd97af2795c6535e0e8a7c244236d84a85a2b75c58afb22b06d999b8a9f4175383645b9031558162
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 9f0551327a579aaf4c34f6f9cae55d70857e7fb5fcc32c34210d9b0832f91018
MD5 33da5f4f39a13845c1578ad8963de46a
SHA1 03501e31a2f30c1286db937c5cc203c7d8f4df31
SHA512 3c1756efd3147f827ccfa5bcc182efea780b6c76eae7bcf6e06f80fd729b6ba0c2c40158f8725d6fb1d3e1c379bd3cd1d439154e38ef435b1a6e4270f4239167
TLSH
T167D012B332030135C01420334082B20C0500C70B410580415428859D9E144A00B4AC81
MD5 SHA1 SHA512 TLSH

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView\Default\Code Cache\js\index-dir\temp-index
Size 72B
SHA256 c03508aab21d470511386530df2e0a9bef9f9aa634277b3372d102fefeb24d1a
MD5 69dd023c8fc729236b0d41578531031d
SHA1 aa7d5e57e41e0c94828ba06a258ddb072314754b
SHA512 8b7034f887b66f0236e9d44c58417975ce7bca63c464f0ce174c322fcfce801422c4dc247d4a3e983a3470dceaab4fa608b9fab05c02abdd53d7452717accd23
TLSH
T108A0022811968105C704167BB0C9D74837A44C25066A576181F514BCC8517A15556010
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView\Default\Code Cache\js\index-dir\temp-index
Size 48B
SHA256 bf82660cf8231f040fad06540e3d5dd3e95601ad8a7e031947924854b6feb984
MD5 09c9d74f991d0130b077168248e934f7
SHA1 60bd4ca7da137564b1fadf373dac943fd127149e
SHA512 430ad2187c80394109f17494ca02dfcab651a7ed98a7a46627814fa09400f7e92485a952b27be8ec619d4ca8a001d49d85c83c8ee883f468182fd55452ee0c18
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView\Default\Extension Rules\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView\Default\GPUCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView\Default\Sync Data\LevelDB\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView\GrShaderCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView\GrShaderCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView\GrShaderCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView\Local State
Size 1KB
SHA256 6936b9097e0f299fe59ee99be3d6b13e4bc4986ff824dfa0553838b15e16f095
MD5 7cda0dc0fcfe30c04e2276a81ab4e51e
SHA1 87940e20545d46939c8fcb8e301a7776ae625c5c
SHA512 4563fc4e7e67741bca3208af825039cd5e41cf3397b2520033bfcce7351605b8477442c7f684ce1ad39e0d47fe942696cd6c3ebb86355c72144b6b93be5d98c3
TLSH
T13C2172F3E4A45E33E8D221682543AF6BAE21207B85818D0515DF8A2E01E61AC7256833
MD5 SHA1 SHA512 TLSH

Submit Download

a418e64d-d52e-4a3a-acc2-52ad596414c6.tmp

Path C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView\a418e64d-d52e-4a3a-acc2-52ad596414c6.tmp
Size 3KB
SHA256 ad4cb4f030064168064a9746ea3fafe5211f95470bd2e85c83e33a93d633fdc8
MD5 b7e7d4cc52d17e7942a16817b571c065
SHA1 14e047ffb428d034dc7fafb0e02a87e28e7e2e6b
SHA512 17693f554bfea5fbececa57d414c2e215df2835fd3dc5d5ec19b8bdf4c02b9d2a02127c76f9aafdbbde8944d553c705a586bf669718af127268e78d2a59e75cc
TLSH
T18E6196736874AD3B8DF29A14BC863B16B7A56037D8C57F95C9ED0E1D00D72A82382C13
MD5 SHA1 SHA512 TLSH

Submit Download

e59ac94.msi

Path C:\Windows\Installer\e59ac94.msi
Size 14.4MB
SHA256 eeac210d8ec932ed9321d14894cc258b9ff1326269cf5b5f2a32f546b5bacb5d
MD5 c5dcedf519425df5b725eb904500c0c4
SHA1 e8077f60735e924620bc3a276e26d1bc6ac80723
SHA512 290c0438a6c9f8b7ddecbb4b357625c9a86d61b7c734286bc9416314eb2a9cf283a956c74b1a9b6464f9c4e6189b429f07a8b8d7ed64ac6f6cb77e87dce786c8
SSDEEP 393216:6iT0PlLJ0/XBZtZW9a81kNBMUD19EFKEprsFDx+iTSH:PT0tG/Xbr6gE8ENeAiO
TLSH
T11BE63353BE45AB24C62D1FBE6472CB4C10363E146B95AC579294BE38ECFB2C04CB59D1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata-2

Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
Size 26.1MB
SHA256 1a5908d5c585a4309f1c577d68847aec5bacb830fd9dce0598f99d79c4cebb77
MD5 58dd279025c9c0d7582ee9b50061c136
SHA1 ce8de4ea1e40800b29d66ab520a64cc78cc7b0c4
SHA512 fecfb1e33fb882ce83640e8454041d7ebf3d58d12870a02a86ad1a2d88b9943d9e8bd3c292593f62438af4032b5d6e07c405744bfb5ed57c7689febd082835dc
SSDEEP 24576:qFo3DMP3doO/vvTL/SgDTiFQ/Lu5oLUAEulh9ut7lGN6J0yzMYR2TKpCX+z:MHo
TLSH
T17857B32936F92201E7F79E3CACF06A23493A7D5B9C15DE8D45411B4E0822F71E872F66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{9d82977f-8024-4939-9aad-92f918105a5a}_OnDiskSnapshotProp

Path \??\Volume{e42a0d43-0000-0000-0000-d08302000000}\System Volume Information\SPP\OnlineMetadataCache\{9d82977f-8024-4939-9aad-92f918105a5a}_OnDiskSnapshotProp
Size 6KB
SHA256 96ceebdd6b467f9cc39da5cfea15769c31916b7413e9f7808f664badfa572ac1
MD5 08eda930d9c19fafe76f220e3eedcd33
SHA1 88efed959511346e64b7ec9114466c0c6efbae29
SHA512 1e6018fce5506d1d973e9950e6e72e57a3f5b4425273871c1ad7fddcdab24b6d3394527bd59cc35a285c05814b94051b9b51ce0683807f05b73acdc26e13821e
SSDEEP 96:FzP+Z9vc6DD84LTHzbOHXOHBlBRQn8Sc9XE56tOSVQpu:BPmb++uVm
TLSH
T155D187085AE54711E2B3AB3228F18557A877B811EF33CB8E0198238F6671910F975F6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3672-35-0x0000022611100000-0x0000022611AA4000-memory.dmp

Download

memory/4524-89-0x00007FF8855A0000-0x00007FF8855A1000-memory.dmp

Download

memory/4560-73-0x00007FF8855A0000-0x00007FF8855A1000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads