Analysis
- max time kernel
149s - max time network
153s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
22/07/2026, 19:40
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Retrac_3.0.3_x64_en-US.msi
Resource
win10v2004-20260513-en
windows10-2004-x64
19 signatures
150 seconds
Behavioral task
behavioral2
Sample
Retrac_3.0.3_x64_en-US.msi
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
21 signatures
150 seconds
General
- Target Retrac_3.0.3_x64_en-US.msi
- Size 14.0MB
- Sample260722-ydt1vsbe66
- SHA256 921ccce853756f16dd75d1f6da6307218beca5f6bde82f8d524fcc7ebdb81620
- MD5 83ae3dae4ff8ceb1d9914f6ca6159da3
- SHA1 1525edd1e78aa3d6e1bd56429a5849034efc0cb9
- SHA512 1c64fb8039db7361237551f87f4757b6de7bdfd7a65455c4c103bb8a707989a928af475732509d40c96f41e82f75dd454813a1c0cedcf1eaa7a570cb6ff56459
- SSDEEP 393216:cQ09TbnSeDVNQs3b6+WvWCjYuPKDbAKhUS1Q1vaN:k9hDYsL7w2/hZQR
- TLSH T19EE633273E025B36C81B5FB754FBCB244279FC445AA0690333D8B81AF9F62C5157A9CA
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 4652 retrac.exe - Loads dropped DLL 1 IoCs
pid Process 5996 MsiExec.exe - Badlisted process makes network request 1 IoCs
Network request originating from process or tool commonly abused by malware.
flow pid Process 2 2200 msiexec.exe - Checks whether UAC is enabled 1 TTPs 1 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA retrac.exe - Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\D: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\D: msiexec.exe - Drops file in Program Files directory 2 IoCs
description ioc Process File created C:\Program Files\Retrac\retrac.exe msiexec.exe File created C:\Program Files\Retrac\Uninstall Retrac.lnk msiexec.exe - Drops file in Windows directory 18 IoCs
description ioc Process File opened for modification C:\Windows\Installer\ msiexec.exe File opened for modification C:\Windows\Installer\MSID306.tmp msiexec.exe File created C:\Windows\Installer\e59cb66.msi msiexec.exe File created C:\Windows\SystemTemp\~DF71981B443C78B46E.TMP msiexec.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2404_1292647036\manifest.json msedgewebview2.exe File created C:\Windows\Installer\e59cb64.msi msiexec.exe File opened for modification C:\Windows\Installer\e59cb64.msi msiexec.exe File created C:\Windows\SystemTemp\~DFCA06C8B154CD2C84.TMP msiexec.exe File created C:\Windows\Installer\{B64341E3-8AF2-4B11-8395-8748AE7D1423}\ProductIcon msiexec.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2404_1292647036\metadata.pb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2404_1292647036\manifest.fingerprint msedgewebview2.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File created C:\Windows\Installer\SourceHash{B64341E3-8AF2-4B11-8395-8748AE7D1423} msiexec.exe File created C:\Windows\SystemTemp\~DF165C68D5073A55E0.TMP msiexec.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2404_1292647036\_metadata\verified_contents.json msedgewebview2.exe File opened for modification C:\Windows\Installer\{B64341E3-8AF2-4B11-8395-8748AE7D1423}\ProductIcon msiexec.exe File created C:\Windows\SystemTemp\~DF0AC9A37CEDE7B804.TMP msiexec.exe - Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
pid Process 2200 msiexec.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe - Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 000000000400000067831fc6f5c7bf350000000000000000000000000000000000000000000000000000000000000000000000000000000000001071020000000000c012000000000000000000000000270101000088380167831fc60000000000001071020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d0830200000000006025c501000000000000000000000700010000e8410167831fc6000000000000d08302000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9c701000000000000050000000000000000000000070001000098d4e367831fc600000000000030a9c7010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9cc0100000000000005000000000000000000000007000100009854e667831fc600000000000030a9cc01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr vssvc.exe - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedgewebview2.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedgewebview2.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedgewebview2.exe - Modifies data under HKEY_USERS 3 IoCs
description ioc Process Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E msiexec.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27 msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28 msiexec.exe - Modifies registry class 46 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\retrac\ = "URL: protocol" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\3E14346B2FA811B438597884EAD74132\Environment = "MainProgram" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3E14346B2FA811B438597884EAD74132\PackageCode = "5AF8DFF4402CB2D43B0C16EE2B44E2EE" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3E14346B2FA811B438597884EAD74132\Version = "50331651" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3E14346B2FA811B438597884EAD74132\Assignment = "1" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3E14346B2FA811B438597884EAD74132\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\" msiexec.exe Key created \REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\retrac retrac.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\retrac\DefaultIcon\ = "\"C:\\PROGRA~1\\Retrac\\retrac.exe\",0" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3E14346B2FA811B438597884EAD74132\DeploymentFlags = "3" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3E14346B2FA811B438597884EAD74132\SourceList\Net msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3E14346B2FA811B438597884EAD74132\Clients = 3a0000000000 msiexec.exe Set value (str) \REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\retrac\URL Protocol retrac.exe Key created \REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\retrac\DefaultIcon retrac.exe Set value (str) \REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\retrac\DefaultIcon\ = "C:\\Program Files\\Retrac\\retrac.exe,0" retrac.exe Set value (str) \REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\retrac\shell\open\command\ = "\"C:\\Program Files\\Retrac\\retrac.exe\" \"%1\"" retrac.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\retrac\shell\open msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\3E14346B2FA811B438597884EAD74132 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3E14346B2FA811B438597884EAD74132 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3E14346B2FA811B438597884EAD74132\SourceList\PackageName = "Retrac_3.0.3_x64_en-US.msi" msiexec.exe Key created \REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\retrac\shell retrac.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\retrac\shell msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\3E14346B2FA811B438597884EAD74132\MainProgram msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\3E14346B2FA811B438597884EAD74132\External msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3E14346B2FA811B438597884EAD74132\AdvertiseFlags = "388" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3E14346B2FA811B438597884EAD74132\InstanceType = "0" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3E14346B2FA811B438597884EAD74132\SourceList\Media msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3E14346B2FA811B438597884EAD74132\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\" msiexec.exe Set value (str) \REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\retrac\ = "URL:launcher.retrac.site protocol" retrac.exe Key created \REGISTRY\MACHINE\Software\Classes\retrac msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\retrac\DefaultIcon msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3E14346B2FA811B438597884EAD74132\ProductIcon = "C:\\Windows\\Installer\\{B64341E3-8AF2-4B11-8395-8748AE7D1423}\\ProductIcon" msiexec.exe Key created \REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\retrac\shell\open retrac.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\retrac\URL Protocol msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3E14346B2FA811B438597884EAD74132\Language = "0" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3E14346B2FA811B438597884EAD74132\AuthorizedLUAApp = "0" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\D39F67BF21D37C75581F63A03A3CC6BF\3E14346B2FA811B438597884EAD74132 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3E14346B2FA811B438597884EAD74132\SourceList msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\retrac\shell\open\command\ = "\"C:\\PROGRA~1\\Retrac\\retrac.exe\" \"%1\"" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\D39F67BF21D37C75581F63A03A3CC6BF msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3E14346B2FA811B438597884EAD74132\SourceList\Media\1 = ";" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\retrac\shell\open\command msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\retrac msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\retrac\shell\open\command msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\3E14346B2FA811B438597884EAD74132\ShortcutsFeature = "MainProgram" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3E14346B2FA811B438597884EAD74132\ProductName = "Retrac" msiexec.exe Key created \REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\retrac\shell\open\command retrac.exe - Suspicious behavior: EnumeratesProcesses 54 IoCs
pid Process 4068 msiexec.exe 4068 msiexec.exe 4652 retrac.exe 4652 retrac.exe 4652 retrac.exe 4652 retrac.exe 4652 retrac.exe 4652 retrac.exe 4652 retrac.exe 4652 retrac.exe 4652 retrac.exe 4652 retrac.exe 4652 retrac.exe 4652 retrac.exe 4652 retrac.exe 4652 retrac.exe 4652 retrac.exe 4652 retrac.exe 4652 retrac.exe 4652 retrac.exe 4652 retrac.exe 4652 retrac.exe 4652 retrac.exe 4652 retrac.exe 4652 retrac.exe 4652 retrac.exe 4652 retrac.exe 4652 retrac.exe 4652 retrac.exe 4652 retrac.exe 4652 retrac.exe 4652 retrac.exe 4652 retrac.exe 4652 retrac.exe 4652 retrac.exe 4652 retrac.exe 4652 retrac.exe 4652 retrac.exe 4652 retrac.exe 4652 retrac.exe 4652 retrac.exe 4652 retrac.exe 4652 retrac.exe 4652 retrac.exe 4652 retrac.exe 4652 retrac.exe 4652 retrac.exe 4652 retrac.exe 4652 retrac.exe 4652 retrac.exe 4652 retrac.exe 4652 retrac.exe 4652 retrac.exe 4652 retrac.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs
pid Process 2404 msedgewebview2.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 2200 msiexec.exe Token: SeIncreaseQuotaPrivilege 2200 msiexec.exe Token: SeSecurityPrivilege 4068 msiexec.exe Token: SeCreateTokenPrivilege 2200 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 2200 msiexec.exe Token: SeLockMemoryPrivilege 2200 msiexec.exe Token: SeIncreaseQuotaPrivilege 2200 msiexec.exe Token: SeMachineAccountPrivilege 2200 msiexec.exe Token: SeTcbPrivilege 2200 msiexec.exe Token: SeSecurityPrivilege 2200 msiexec.exe Token: SeTakeOwnershipPrivilege 2200 msiexec.exe Token: SeLoadDriverPrivilege 2200 msiexec.exe Token: SeSystemProfilePrivilege 2200 msiexec.exe Token: SeSystemtimePrivilege 2200 msiexec.exe Token: SeProfSingleProcessPrivilege 2200 msiexec.exe Token: SeIncBasePriorityPrivilege 2200 msiexec.exe Token: SeCreatePagefilePrivilege 2200 msiexec.exe Token: SeCreatePermanentPrivilege 2200 msiexec.exe Token: SeBackupPrivilege 2200 msiexec.exe Token: SeRestorePrivilege 2200 msiexec.exe Token: SeShutdownPrivilege 2200 msiexec.exe Token: SeDebugPrivilege 2200 msiexec.exe Token: SeAuditPrivilege 2200 msiexec.exe Token: SeSystemEnvironmentPrivilege 2200 msiexec.exe Token: SeChangeNotifyPrivilege 2200 msiexec.exe Token: SeRemoteShutdownPrivilege 2200 msiexec.exe Token: SeUndockPrivilege 2200 msiexec.exe Token: SeSyncAgentPrivilege 2200 msiexec.exe Token: SeEnableDelegationPrivilege 2200 msiexec.exe Token: SeManageVolumePrivilege 2200 msiexec.exe Token: SeImpersonatePrivilege 2200 msiexec.exe Token: SeCreateGlobalPrivilege 2200 msiexec.exe Token: SeCreateTokenPrivilege 2200 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 2200 msiexec.exe Token: SeLockMemoryPrivilege 2200 msiexec.exe Token: SeIncreaseQuotaPrivilege 2200 msiexec.exe Token: SeMachineAccountPrivilege 2200 msiexec.exe Token: SeTcbPrivilege 2200 msiexec.exe Token: SeSecurityPrivilege 2200 msiexec.exe Token: SeTakeOwnershipPrivilege 2200 msiexec.exe Token: SeLoadDriverPrivilege 2200 msiexec.exe Token: SeSystemProfilePrivilege 2200 msiexec.exe Token: SeSystemtimePrivilege 2200 msiexec.exe Token: SeProfSingleProcessPrivilege 2200 msiexec.exe Token: SeIncBasePriorityPrivilege 2200 msiexec.exe Token: SeCreatePagefilePrivilege 2200 msiexec.exe Token: SeCreatePermanentPrivilege 2200 msiexec.exe Token: SeBackupPrivilege 2200 msiexec.exe Token: SeRestorePrivilege 2200 msiexec.exe Token: SeShutdownPrivilege 2200 msiexec.exe Token: SeDebugPrivilege 2200 msiexec.exe Token: SeAuditPrivilege 2200 msiexec.exe Token: SeSystemEnvironmentPrivilege 2200 msiexec.exe Token: SeChangeNotifyPrivilege 2200 msiexec.exe Token: SeRemoteShutdownPrivilege 2200 msiexec.exe Token: SeUndockPrivilege 2200 msiexec.exe Token: SeSyncAgentPrivilege 2200 msiexec.exe Token: SeEnableDelegationPrivilege 2200 msiexec.exe Token: SeManageVolumePrivilege 2200 msiexec.exe Token: SeImpersonatePrivilege 2200 msiexec.exe Token: SeCreateGlobalPrivilege 2200 msiexec.exe Token: SeCreateTokenPrivilege 2200 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 2200 msiexec.exe Token: SeLockMemoryPrivilege 2200 msiexec.exe - Suspicious use of FindShellTrayWindow 3 IoCs
pid Process 2200 msiexec.exe 2200 msiexec.exe 4652 retrac.exe - Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 2200 msiexec.exe 4068 msiexec.exe 5996 MsiExec.exe - Suspicious use of WriteProcessMemory 21 IoCs
description pid Process procid_target PID 4068 wrote to memory of 5996 4068 msiexec.exe 90 PID 4068 wrote to memory of 3024 4068 msiexec.exe 96 PID 2200 wrote to memory of 4652 2200 msiexec.exe 99 PID 4652 wrote to memory of 2404 4652 retrac.exe 100 PID 2404 wrote to memory of 6120 2404 msedgewebview2.exe 101 PID 2404 wrote to memory of 2612 2404 msedgewebview2.exe 102 PID 2404 wrote to memory of 2612 2404 msedgewebview2.exe 102 PID 2404 wrote to memory of 2612 2404 msedgewebview2.exe 102 PID 2404 wrote to memory of 2612 2404 msedgewebview2.exe 102 PID 2404 wrote to memory of 3576 2404 msedgewebview2.exe 103 PID 2404 wrote to memory of 5452 2404 msedgewebview2.exe 104 PID 2404 wrote to memory of 5452 2404 msedgewebview2.exe 104 PID 2404 wrote to memory of 5452 2404 msedgewebview2.exe 104 PID 2404 wrote to memory of 2052 2404 msedgewebview2.exe 105 PID 2404 wrote to memory of 2052 2404 msedgewebview2.exe 105 PID 2404 wrote to memory of 2052 2404 msedgewebview2.exe 105 PID 2404 wrote to memory of 2052 2404 msedgewebview2.exe 105 PID 2404 wrote to memory of 2052 2404 msedgewebview2.exe 105 PID 2404 wrote to memory of 1660 2404 msedgewebview2.exe 108 PID 2404 wrote to memory of 1660 2404 msedgewebview2.exe 108 PID 2404 wrote to memory of 1660 2404 msedgewebview2.exe 108 - Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\Retrac_3.0.3_x64_en-US.msi1⤵
- Badlisted process makes network request
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2200 -
C:\Program Files\Retrac\retrac.exe"C:\Program Files\Retrac\retrac.exe"2⤵
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4652 -
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=retrac.exe --webview-exe-version=1.0.0 --user-data-dir="C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --enable-features=MojoIpcz --lang=en-US --accept-lang=en-US --mojo-named-platform-channel-pipe=4652.5420.2969288383298876943 /pfhostedapp:fd0de7e5cefc9f8a2e2a61a11d5c8b08aabc87ca3⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of WriteProcessMemory
PID:2404 -
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView /prefetch:4 /pfhostedapp:fd0de7e5cefc9f8a2e2a61a11d5c8b08aabc87ca --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x184,0x188,0x18c,0x160,0x194,0x7ffca8b95fd8,0x7ffca8b95fe4,0x7ffca8b95ff04⤵PID:6120
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView" --webview-exe-name=retrac.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1792 --field-trial-handle=1788,i,14260610520828854110,15299959938756917842,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:2 /pfhostedapp:fd0de7e5cefc9f8a2e2a61a11d5c8b08aabc87ca4⤵PID:2612
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView" --webview-exe-name=retrac.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2220 --field-trial-handle=1788,i,14260610520828854110,15299959938756917842,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:3 /pfhostedapp:fd0de7e5cefc9f8a2e2a61a11d5c8b08aabc87ca4⤵PID:3576
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView" --webview-exe-name=retrac.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2508 --field-trial-handle=1788,i,14260610520828854110,15299959938756917842,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:fd0de7e5cefc9f8a2e2a61a11d5c8b08aabc87ca4⤵PID:5452
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView" --webview-exe-name=retrac.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --autoplay-policy=no-user-gesture-required --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3328 --field-trial-handle=1788,i,14260610520828854110,15299959938756917842,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /pfhostedapp:fd0de7e5cefc9f8a2e2a61a11d5c8b08aabc87ca /prefetch:14⤵PID:2052
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView" --webview-exe-name=retrac.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4468 --field-trial-handle=1788,i,14260610520828854110,15299959938756917842,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:fd0de7e5cefc9f8a2e2a61a11d5c8b08aabc87ca4⤵PID:1660
-
-
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4068 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding C50E09C6015E59ECB911535267F1A39D C2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:5996
-
-
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵PID:3024
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
PID:1156
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Config.Msi\e59cb65.rbs
- Size 10KB
- SHA256 14892b8f58de72c142355038afffb413fe08fd292cd81ffe9739c61dd8e7d2db
- MD5 72bf3abd3e549d0c40fa62df788cadc4
- SHA1 b1383b6bde72d6c2f6384f9a3ac81132720d9e40
- SHA512 62a2c00c915df3e61e9a2dd7ccd0a415c3dffb68318c307f86b064f588b038722bb9474996b7e2c18ebc5a56a611c7cae946a86fde6a35722614431246ad473d
- SSDEEP 192:a+UeQDQEQDPQIQ1XC5sORbAUdGZ3bAUduEjNhZsgjixj91jFhWjUiYDSUF53srpG:a/cTD4n2sWdad8EjNQ4il9hF4dYDSUFf
- TLSH T1D7223002BA4485C2FA576F35C7871B143BB3C7D84338678F17CDE0289E56BC82E5568A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Retrac\retrac.exe
- Size 25.0MB
- SHA256 c724f7f13ae4213190228cb63a25778ee26a14124ad61f6ea588e58f46f2a0fb
- MD5 70c648ec13e81d4d822c07b7152fcfe4
- SHA1 8600bbf1adcafe7c52e11965ed70bf08a6dd083d
- SHA512 f08ff5b89fd12c078b93e46c98a31ea0bf63603bb6122bfa1611359d04e8a6b25d576bebf6cd15f060e35e62c43f0603b09f340c8595ce6b62adb7d91931f711
- SSDEEP 393216:eWepOHw+Y8Avmii8lXqOedAMaCsPAwBxK7ifpIPC5:upOQ+Y8kNl/bdP47il5
- TLSH T151475A217B9A996CD19AC47483474AB24E7170DB0B35BAFF449492383F6DBF42F38258
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Retrac\Retrac.lnk
- Size 1KB
- SHA256 e7a1d57a1e339bf2a0410fe9931fb3d4cdebfd422773d6dc9a57c6d2b8de0340
- MD5 f665f7e11fa6dc45971fae50d4ea1eec
- SHA1 c30ab31e5aed231ae6fd8ada9afdb8fbb1dc5cdc
- SHA512 969cf40781b81ad09c4eb32e54eae49a2441d5770eeb592821849e5279c78d3935386f0983e9a5942fc3ae34b1c72bcc96cba40fc47bc076ad572eb86eb3c882
- TLSH T15E419910DBD0171AF23747396EB90A618F72FD0AA5258F3F4288408B09B5500E96DF2E
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Retrac\Retrac.lnk~RFe59d78a.TMP
- Size 1KB
- SHA256 140592a8458f55e35d02c929af9dcbb1d9f60e3b5eab3255ad03e573b4d84042
- MD5 da8d81583944ee99530b0ce4db2a257c
- SHA1 ace6c01e5e30c4af574188f95e2194c4c98c123f
- SHA512 c7867ddcd22769cffb824c75b2e6fe253253af670832af50a492853993da46bf4dc7cd5a5538a3a11d1c3d5368e168abb74cc9473e02ca175784300c448aac3a
- TLSH T1C641AC10DBD0171AF33747396EB90AA18F76FC0AA6219F3F4288418F09B5500E96DF2E
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\MSI65F4.tmp
- Size 132KB
- SHA256 7f47d98ab25cfea9b3a2e898c3376cc9ba1cd893b4948b0c27caa530fd0e34cc
- MD5 cfbb8568bd3711a97e6124c56fcfa8d9
- SHA1 d7a098ae58bdd5e93a3c1b04b3d69a14234d5e57
- SHA512 860cbf3286ac4915580cefaf56a9c3d48938eb08e3f31b7f024c4339c037d7c8bdf16e766d08106505ba535be4922a87dc46bd029aae99a64ea2fc02cf3aec04
- SSDEEP 3072:Kx2YbpcgwmiTPJDnCO+DATkURBnrskNwPj2:XXgwmY1CPx2XG2
- TLSH T1DBD39D02B5D0C473D9BE09390870DB229F7EB930DF909EDB636856699E702C19E35A37
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView\Crashpad\settings.dat
- Size 280B
- SHA256 e0c2286fc35c83b5b38a31802210d79fd41c21f14a5cd0207578e54bb26fef3a
- MD5 7e0a66bba8e09119ab28d45f25b02a70
- SHA1 113114659e77dd436b08efc45c845f2cf45c7860
- SHA512 12dde5f508407d31bd45462faf2949f8540465a2854fc9c3809d7be9793b9f145fe9cdae852a579a8640a0aa75e5d20c8977b5b94674409d45a1674d6d67932e
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView\Crashpad\settings.dat
- Size 280B
- SHA256 110fcec37cf071a739e025a81219f837ad7ee7a756e58097d63819c01e0856d3
- MD5 bf34d0789adb88ec3d13d1cbf3508ddd
- SHA1 0ed45bb80982392c6336575e8781010ddb06a2b5
- SHA512 e369eefe483308ebc9f764fc426bd3c5a56b25038aeef451eb3b7eb641818955516f098b1c1773df81f5293bb16d96a5ed353961c0c92bde222210db5f33fbc1
- TLSH T1ABD0122233424A74C41520330102658D4400C52B410D4000D87CC51D1A040900907C82
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView\Crashpad\throttle_store.dat
- Size 20B
- SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
- MD5 9e4e94633b73f4a7680240a0ffd6cd2c
- SHA1 e68e02453ce22736169a56fdb59043d33668368f
- SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView\Default\Code Cache\js\index-dir\the-real-index
- Size 72B
- SHA256 7727ff05925d78ab65e59e7973854a4e4ae19085fe7a28d8e563782a3520588d
- MD5 67fc542f3a2104400b246433279418a9
- SHA1 b0e7195aff8930c25aa5ae0036c379aee04c9751
- SHA512 ce41b2ec49cb5ad93a72ce01e8b42451cd202496e28a3f903b75e4bb707ded4613578a7b6dc09325e4d93bc95c3b75287649fe2a3506d25c23591afa94b65357
- TLSH T170A00230619010D2D231377070C7574133344D2557136B6250DE1164DD707418522411
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView\Default\Code Cache\js\index-dir\the-real-index~RFe5a9607.TMP
- Size 48B
- SHA256 46dd0b056768db49769d4649c62eaa02857c72c0a1ac4bb06ad89bdbea41328e
- MD5 5e5c4c4ddbe7e193cefd7cf106c9169e
- SHA1 00af54569fac9b7cc4f1888c045fbcdff260c5d9
- SHA512 04e83fcf24650736710867cdb226675f5c349306575c2049156d7f1d57e4a1ed9bd6709942d2794713c44183733590c220e7489b397910d2555dee5e183d8404
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView\Default\GPUCache\data_1
- Size 264KB
- SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
- MD5 f50f89a0a91564d0b8a211f8921aa7de
- SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
- SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
- SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView\Default\Network\Network Persistent State
- Size 111B
- SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
- MD5 285252a2f6327d41eab203dc2f402c67
- SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
- SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
- TLSH T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView\Default\Network\Network Persistent State~RFe5b1847.TMP
- Size 59B
- SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
- MD5 2800881c775077e1c4b6e06bf4676de4
- SHA1 2873631068c8b3b9495638c865915be822442c8b
- SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
- TLSH T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView\Default\Network\SCT Auditing Pending Reports
- Size 2B
- SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
- MD5 d751713988987e9331980363e24189ce
- SHA1 97d170e1550eee4afc0af065b78cda302a97674c
- SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView\Default\Preferences
- Size 6KB
- SHA256 f1dc70b88a9d191062392a5295fbe9a4906502d80fe283e687e87c6f674f40d1
- MD5 d65a0d9e969421981379a2b05b29b722
- SHA1 77705ecbbaabd99dded00d9b03325bb326260cc4
- SHA512 f8157a481d632c4690beff3ead634da9898f81b2b373b5d3df12b56293b789054b19721e6e4842b18b4da639c81351de617ccca10e94c2f9d310a766d8c497d3
- SSDEEP 96:sts/dg5cBpQb9Ok+Iqo5h16Z0ws7/x+6MhmuecJ201ejegK+ghml28XM1C7K:stgOs8qonwsV+Fd20QjculG6K
- TLSH T155D1D9069E24A97F4DCBE208BA29BB03E2F5507171D61D98EBF8461C04DB6DC6307C1B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView\Default\Preferences~RFe5a6f07.TMP
- Size 5KB
- SHA256 99accd9950a3e452a5a2b69f4c2fdecd9720f68c52a63c843d1117f10319a52f
- MD5 fcebdf49b1246e8a446c831b5c4d485b
- SHA1 8d8c1f3a5eb2bdedce0e8519bf3f8dcf094d02f2
- SHA512 7bcde2c224a6cd33b04a891bc140cf81d9da28e02d992b471ac3ce13ca0c898f4d0b756a7276164d0b98351421d2236465dae9c1d7b8229db949e14a846ef25f
- SSDEEP 96:rs/dW5cBpQb9OkDdo616Z0ws7/x+6MhmuecJ201ejegK+ghNl28XM1C7K:rgIsAo6wsV+Fd20QjcVlG6K
- TLSH T1ECC1C8069F24697F4DCAE108BA397B07D2FA503175D62D98E7F8461C04DA9DC630BC1B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView\Default\Site Characteristics Database\CURRENT
- Size 16B
- SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
- MD5 46295cac801e5d4857d09837238a6394
- SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
- SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView\Default\shared_proto_db\metadata\MANIFEST-000001
- Size 41B
- SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
- MD5 5af87dfd673ba2115e2fcf5cfdb727ab
- SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
- SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView\GraphiteDawnCache\data_0
- Size 8KB
- SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
- MD5 cf89d16bb9107c631daabf0c0ee58efb
- SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
- SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
- SSDEEP 3:MsFl:/F
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView\GraphiteDawnCache\data_2
- Size 8KB
- SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
- MD5 0962291d6d367570bee5454721c17e11
- SHA1 59d10a893ef321a706a9255176761366115bedcb
- SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
- SSDEEP 3:MsHlDll:/H
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView\GraphiteDawnCache\data_3
- Size 8KB
- SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
- MD5 41876349cb12d6db992f1309f22df3f0
- SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
- SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
- SSDEEP 3:MsGl3ll:/y
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView\Local State
- Size 3KB
- SHA256 660cf2e0786918390871e46e695e6755c9e815bfd21ef55e7ae2bcba96cf6d89
- MD5 628cba5d83cbee685308684b4a563a0b
- SHA1 03d061de096586d260a0ad769d14280f8bd216f3
- SHA512 4715fe76f71e16a9ba56b6219abcb6032596ca08f215452ea1924af7e75bfc7bb2fe26bd5afdfd002dcb871694837eb8f03b66677ce5a1f9afbfebc979518b56
- TLSH T1E081756AA9B0A8774EF6D60979813F03A7A54027D5967FD4D9EC0F0C01DB68C1347C23
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView\Local State
- Size 2KB
- SHA256 f03265c776cc1fbe85fa401e06007f41889d875e76cdccd64b5bb4f7cae0040d
- MD5 c80e1bd40f0ad559236f3666b03fcd41
- SHA1 d038ba3c8a08cd5f9ad00b49152c5f5a555655cb
- SHA512 66740031b89f1deecfa0d5acfd2cb7fc3b70cdd68ff0c377dcf313d784fd9ff44744cfa137f7204f37cbc6a20b93b29d02e0979bc442aa036b26f6b153600273
- TLSH T1C3518573A8506A778BFA874979467F138A755066DB531FD0AADC1B0C00DA95C230BC36
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView\Local State
- Size 3KB
- SHA256 5acd57a7ff770a1dc894febffc5c751e3f78aa16d6c8fc47617c776592edb7de
- MD5 b93ea863377f5f5e83a2f0dd5da614f2
- SHA1 31e7adccf199f67276741304374bac0fa336f195
- SHA512 c88538f06ca42edaa09cce9f4f771fd187d35c0878e54571293793f12f1b95ed672323d5742ed5bcd698636d1ce5a92c0547c0bb2a26d1593cd3824eee4c6526
- TLSH T16E71967BA9A0A9774FF6D60978822B07A7A54037D6963FE4D9EC0F0C00DB6981347C23
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView\Local State
- Size 15KB
- SHA256 a8265d5f87a3b29beeae8b050488c577ecae09acf0d5cc57ef25dad8f4f3bc10
- MD5 0134d2ee9a7871bb30c83d75ea7c23ac
- SHA1 ac8d55f42776a1fc8618e81c84249e8bcaff9784
- SHA512 f2ca820311bc42a1b66c3540638492ce918ddd9f1400e825101dea1021d2db69d24374ca83d46d1bd98e11d6879ba8d55f227e281c13bd569637c7c82e3a1214
- SSDEEP 384:Zsrv+89zHqlDNP9oid6NBSztXbu7NQI3tNY:mrv+4UNbdRVsQIdNY
- TLSH T198729E33E478A6339EF69949B4867F073BB850A796C34AE0D8994B8C418F4D9230BD13
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView\Local State~RFe59f246.TMP
- Size 1KB
- SHA256 b8b2d2fdebff21eb7003ba7c890875a7f246d147e3d654d682446e764a336b88
- MD5 bbb51d01a96831c3ab2b04c8d800a739
- SHA1 4deb90de859692d606272924bb2f9c241e7c01c8
- SHA512 7dfcd5ccdcc735f5d67326705f27bfb52c524ae0e3b633929f57d5c7156e1e9e8008bb6658a6d540f5dbd9f2e4ffae5dbbf32dd734d7d632aa7aa33bee21edc0
- TLSH T1E33154B2D9A05E729EEAD34A3652BE474E61507AC3534FC07ADD4A0801DE54CA72FC32
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\Installer\e59cb64.msi
- Size 14.0MB
- SHA256 921ccce853756f16dd75d1f6da6307218beca5f6bde82f8d524fcc7ebdb81620
- MD5 83ae3dae4ff8ceb1d9914f6ca6159da3
- SHA1 1525edd1e78aa3d6e1bd56429a5849034efc0cb9
- SHA512 1c64fb8039db7361237551f87f4757b6de7bdfd7a65455c4c103bb8a707989a928af475732509d40c96f41e82f75dd454813a1c0cedcf1eaa7a570cb6ff56459
- SSDEEP 393216:cQ09TbnSeDVNQs3b6+WvWCjYuPKDbAKhUS1Q1vaN:k9hDYsL7w2/hZQR
- TLSH T19EE633273E025B36C81B5FB754FBCB244279FC445AA0690333D8B81AF9F62C5157A9CA
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
- Size 26.1MB
- SHA256 efbdb3664145596ad8e99a5d57b5a5df195bb78f42d1b10640bfda64c4d56768
- MD5 3e2c40a03a6124efac130a0cf8999c94
- SHA1 dd26f481348e386e66170abf8203f01343e56545
- SHA512 c6e5de552ff9020a7d9202de3846ceb9e13ba07ea6a5eb1b4340652c4e5a673009102025d7e5375bfc4c6d0a79528d489c9b071b048aafb86457199677fc3191
- SSDEEP 24576:aFo3DMPwdoO/vvTL/SwyiCFAvre45LFB0vkwN/8qUn8aZ1jS8Ih2ibYDGu0:bHA
- TLSH T1D657B42436F92100EBF7AE3CA8F06A274D397D57AC16DE8D45511B4D0822F71E872F6A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\Volume{c61f8367-0000-0000-0000-d08302000000}\System Volume Information\SPP\OnlineMetadataCache\{065fa1bd-60de-4810-babb-4c4b8666328d}_OnDiskSnapshotProp
- Size 6KB
- SHA256 d54120e29c5e16b43906fdb55f9de9c13af2cf4f260867e13c797b622ff4d447
- MD5 3131e2fedd778bfd87afa94babe6c208
- SHA1 0d2b0db937e68c0a4191e4256f747614b737056d
- SHA512 860ae3d4d3c1d98f866c9e14f94baf625a18ebdd9656f8c7ca491f27cdeab57bb21efd6276ab446b1e58bd243ba77a8db2584d70c7994234c18012b1973098ca
- SSDEEP 96:Fp+lRvc6DD84LTHzbOHXOHBlBRQn8Sc9XE56tOSVQpu:XSb++uVm
- TLSH T11CD188085AF54711E2B3AB3128F14557A877B911FF33CB8E0198238E2631910F875F6B
- MD5 SHA1 SHA512 SSDEEP TLSH