Analysis
- max time kernel
150s - max time network
150s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
24/07/2026, 03:44
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Retrac_3.0.3_x64_en-US (1).msi
Resource
win10v2004-20260513-en
windows10-2004-x64
19 signatures
150 seconds
Behavioral task
behavioral2
Sample
Retrac_3.0.3_x64_en-US (1).msi
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
20 signatures
150 seconds
General
- Target Retrac_3.0.3_x64_en-US (1).msi
- Size 14.0MB
- Sample260724-eaxg2asapc
- SHA256 921ccce853756f16dd75d1f6da6307218beca5f6bde82f8d524fcc7ebdb81620
- MD5 83ae3dae4ff8ceb1d9914f6ca6159da3
- SHA1 1525edd1e78aa3d6e1bd56429a5849034efc0cb9
- SHA512 1c64fb8039db7361237551f87f4757b6de7bdfd7a65455c4c103bb8a707989a928af475732509d40c96f41e82f75dd454813a1c0cedcf1eaa7a570cb6ff56459
- SSDEEP 393216:cQ09TbnSeDVNQs3b6+WvWCjYuPKDbAKhUS1Q1vaN:k9hDYsL7w2/hZQR
- TLSH T19EE633273E025B36C81B5FB754FBCB244279FC445AA0690333D8B81AF9F62C5157A9CA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 5948 retrac.exe - Loads dropped DLL 1 IoCs
pid Process 4916 MsiExec.exe - Badlisted process makes network request 1 IoCs
Network request originating from process or tool commonly abused by malware.
flow pid Process 4 2956 msiexec.exe - Checks whether UAC is enabled 1 TTPs 1 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA retrac.exe - Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\D: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\D: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\I: msiexec.exe - Drops file in Program Files directory 2 IoCs
description ioc Process File created C:\Program Files\Retrac\retrac.exe msiexec.exe File created C:\Program Files\Retrac\Uninstall Retrac.lnk msiexec.exe - Drops file in Windows directory 20 IoCs
description ioc Process File opened for modification C:\Windows\Installer\e59fe7b.msi msiexec.exe File created C:\Windows\SystemTemp\~DF614CA671B564D0A0.TMP msiexec.exe File created C:\Windows\Installer\SourceHash{B64341E3-8AF2-4B11-8395-8748AE7D1423} msiexec.exe File created C:\Windows\SystemTemp\~DFAD924DF116C0D4C7.TMP msiexec.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2704_1988303501\_metadata\verified_contents.json msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2704_1988303501\manifest.fingerprint msedgewebview2.exe File created C:\Windows\Installer\e59fe7b.msi msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File opened for modification C:\Windows\Installer\MSI66A.tmp msiexec.exe File created C:\Windows\Installer\{B64341E3-8AF2-4B11-8395-8748AE7D1423}\ProductIcon msiexec.exe File opened for modification C:\Windows\Installer\{B64341E3-8AF2-4B11-8395-8748AE7D1423}\ProductIcon msiexec.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2704_1988303501\manifest.json msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2704_903127616\manifest.json msedgewebview2.exe File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\Installer\e59fe7d.msi msiexec.exe File created C:\Windows\SystemTemp\~DF6BCCEA63A0A05081.TMP msiexec.exe File created C:\Windows\SystemTemp\~DFA2DA8BEDA796CBA2.TMP msiexec.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2704_1988303501\metadata.pb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2704_903127616\manifest.fingerprint msedgewebview2.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe - Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000ffbf1fc65d8bbf350000000000000000000000000000000000000000000000000000000000000000000000000000000000001071020000000000c0120000000000000000000000002701010000883801ffbf1fc60000000000001071020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d0830200000000006025c501000000000000000000000700010000e84101ffbf1fc6000000000000d08302000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9c701000000000000050000000000000000000000070001000098d4e3ffbf1fc600000000000030a9c7010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9cc0100000000000005000000000000000000000007000100009854e6ffbf1fc600000000000030a9cc01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedgewebview2.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedgewebview2.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedgewebview2.exe - Modifies data under HKEY_USERS 3 IoCs
description ioc Process Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E msiexec.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27 msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28 msiexec.exe - Modifies registry class 46 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3E14346B2FA811B438597884EAD74132\DeploymentFlags = "3" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3E14346B2FA811B438597884EAD74132\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\D39F67BF21D37C75581F63A03A3CC6BF msiexec.exe Set value (str) \REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\retrac\URL Protocol retrac.exe Key created \REGISTRY\MACHINE\Software\Classes\retrac msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\3E14346B2FA811B438597884EAD74132\ShortcutsFeature = "MainProgram" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\3E14346B2FA811B438597884EAD74132\MainProgram msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3E14346B2FA811B438597884EAD74132\AdvertiseFlags = "388" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3E14346B2FA811B438597884EAD74132\InstanceType = "0" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\D39F67BF21D37C75581F63A03A3CC6BF\3E14346B2FA811B438597884EAD74132 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3E14346B2FA811B438597884EAD74132\SourceList\Net msiexec.exe Key created \REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\retrac\DefaultIcon retrac.exe Key created \REGISTRY\MACHINE\Software\Classes\retrac\DefaultIcon msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\retrac msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\retrac\shell msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3E14346B2FA811B438597884EAD74132\ProductName = "Retrac" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3E14346B2FA811B438597884EAD74132\SourceList msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3E14346B2FA811B438597884EAD74132\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\" msiexec.exe Set value (str) \REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\retrac\DefaultIcon\ = "C:\\Program Files\\Retrac\\retrac.exe,0" retrac.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3E14346B2FA811B438597884EAD74132\SourceList\PackageName = "Retrac_3.0.3_x64_en-US (1).msi" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3E14346B2FA811B438597884EAD74132\SourceList\Media msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3E14346B2FA811B438597884EAD74132\SourceList\Media\1 = ";" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\retrac\URL Protocol msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\retrac\shell\open\command msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\3E14346B2FA811B438597884EAD74132\External msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3E14346B2FA811B438597884EAD74132\Language = "0" msiexec.exe Key created \REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\retrac retrac.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\retrac\ = "URL: protocol" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\retrac\shell\open msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3E14346B2FA811B438597884EAD74132\Assignment = "1" msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3E14346B2FA811B438597884EAD74132\Clients = 3a0000000000 msiexec.exe Set value (str) \REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\retrac\ = "URL:launcher.retrac.site protocol" retrac.exe Key created \REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\retrac\shell\open retrac.exe Set value (str) \REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\retrac\shell\open\command\ = "\"C:\\Program Files\\Retrac\\retrac.exe\" \"%1\"" retrac.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\retrac\DefaultIcon\ = "\"C:\\PROGRA~1\\Retrac\\retrac.exe\",0" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\retrac\shell\open\command msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\retrac\shell\open\command\ = "\"C:\\PROGRA~1\\Retrac\\retrac.exe\" \"%1\"" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3E14346B2FA811B438597884EAD74132\PackageCode = "5AF8DFF4402CB2D43B0C16EE2B44E2EE" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3E14346B2FA811B438597884EAD74132\ProductIcon = "C:\\Windows\\Installer\\{B64341E3-8AF2-4B11-8395-8748AE7D1423}\\ProductIcon" msiexec.exe Key created \REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\retrac\shell\open\command retrac.exe Key created \REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\retrac\shell retrac.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\3E14346B2FA811B438597884EAD74132 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\3E14346B2FA811B438597884EAD74132\Environment = "MainProgram" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3E14346B2FA811B438597884EAD74132 msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3E14346B2FA811B438597884EAD74132\Version = "50331651" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3E14346B2FA811B438597884EAD74132\AuthorizedLUAApp = "0" msiexec.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 244 msiexec.exe 244 msiexec.exe 5948 retrac.exe 5948 retrac.exe 5948 retrac.exe 5948 retrac.exe 5948 retrac.exe 5948 retrac.exe 5948 retrac.exe 5948 retrac.exe 5948 retrac.exe 5948 retrac.exe 5948 retrac.exe 5948 retrac.exe 5948 retrac.exe 5948 retrac.exe 5948 retrac.exe 5948 retrac.exe 5948 retrac.exe 5948 retrac.exe 5948 retrac.exe 5948 retrac.exe 5948 retrac.exe 5948 retrac.exe 5948 retrac.exe 5948 retrac.exe 5948 retrac.exe 5948 retrac.exe 5948 retrac.exe 5948 retrac.exe 5948 retrac.exe 5948 retrac.exe 5948 retrac.exe 5948 retrac.exe 5948 retrac.exe 5948 retrac.exe 5948 retrac.exe 5948 retrac.exe 5948 retrac.exe 5948 retrac.exe 5948 retrac.exe 5948 retrac.exe 5948 retrac.exe 5948 retrac.exe 5948 retrac.exe 5948 retrac.exe 5948 retrac.exe 5948 retrac.exe 5948 retrac.exe 5948 retrac.exe 5948 retrac.exe 5948 retrac.exe 5948 retrac.exe 5948 retrac.exe 5948 retrac.exe 5948 retrac.exe 5948 retrac.exe 5948 retrac.exe 5948 retrac.exe 5948 retrac.exe 5948 retrac.exe 5948 retrac.exe 5948 retrac.exe 5948 retrac.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs
pid Process 2704 msedgewebview2.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 2956 msiexec.exe Token: SeIncreaseQuotaPrivilege 2956 msiexec.exe Token: SeSecurityPrivilege 244 msiexec.exe Token: SeCreateTokenPrivilege 2956 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 2956 msiexec.exe Token: SeLockMemoryPrivilege 2956 msiexec.exe Token: SeIncreaseQuotaPrivilege 2956 msiexec.exe Token: SeMachineAccountPrivilege 2956 msiexec.exe Token: SeTcbPrivilege 2956 msiexec.exe Token: SeSecurityPrivilege 2956 msiexec.exe Token: SeTakeOwnershipPrivilege 2956 msiexec.exe Token: SeLoadDriverPrivilege 2956 msiexec.exe Token: SeSystemProfilePrivilege 2956 msiexec.exe Token: SeSystemtimePrivilege 2956 msiexec.exe Token: SeProfSingleProcessPrivilege 2956 msiexec.exe Token: SeIncBasePriorityPrivilege 2956 msiexec.exe Token: SeCreatePagefilePrivilege 2956 msiexec.exe Token: SeCreatePermanentPrivilege 2956 msiexec.exe Token: SeBackupPrivilege 2956 msiexec.exe Token: SeRestorePrivilege 2956 msiexec.exe Token: SeShutdownPrivilege 2956 msiexec.exe Token: SeDebugPrivilege 2956 msiexec.exe Token: SeAuditPrivilege 2956 msiexec.exe Token: SeSystemEnvironmentPrivilege 2956 msiexec.exe Token: SeChangeNotifyPrivilege 2956 msiexec.exe Token: SeRemoteShutdownPrivilege 2956 msiexec.exe Token: SeUndockPrivilege 2956 msiexec.exe Token: SeSyncAgentPrivilege 2956 msiexec.exe Token: SeEnableDelegationPrivilege 2956 msiexec.exe Token: SeManageVolumePrivilege 2956 msiexec.exe Token: SeImpersonatePrivilege 2956 msiexec.exe Token: SeCreateGlobalPrivilege 2956 msiexec.exe Token: SeCreateTokenPrivilege 2956 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 2956 msiexec.exe Token: SeLockMemoryPrivilege 2956 msiexec.exe Token: SeIncreaseQuotaPrivilege 2956 msiexec.exe Token: SeMachineAccountPrivilege 2956 msiexec.exe Token: SeTcbPrivilege 2956 msiexec.exe Token: SeSecurityPrivilege 2956 msiexec.exe Token: SeTakeOwnershipPrivilege 2956 msiexec.exe Token: SeLoadDriverPrivilege 2956 msiexec.exe Token: SeSystemProfilePrivilege 2956 msiexec.exe Token: SeSystemtimePrivilege 2956 msiexec.exe Token: SeProfSingleProcessPrivilege 2956 msiexec.exe Token: SeIncBasePriorityPrivilege 2956 msiexec.exe Token: SeCreatePagefilePrivilege 2956 msiexec.exe Token: SeCreatePermanentPrivilege 2956 msiexec.exe Token: SeBackupPrivilege 2956 msiexec.exe Token: SeRestorePrivilege 2956 msiexec.exe Token: SeShutdownPrivilege 2956 msiexec.exe Token: SeDebugPrivilege 2956 msiexec.exe Token: SeAuditPrivilege 2956 msiexec.exe Token: SeSystemEnvironmentPrivilege 2956 msiexec.exe Token: SeChangeNotifyPrivilege 2956 msiexec.exe Token: SeRemoteShutdownPrivilege 2956 msiexec.exe Token: SeUndockPrivilege 2956 msiexec.exe Token: SeSyncAgentPrivilege 2956 msiexec.exe Token: SeEnableDelegationPrivilege 2956 msiexec.exe Token: SeManageVolumePrivilege 2956 msiexec.exe Token: SeImpersonatePrivilege 2956 msiexec.exe Token: SeCreateGlobalPrivilege 2956 msiexec.exe Token: SeCreateTokenPrivilege 2956 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 2956 msiexec.exe Token: SeLockMemoryPrivilege 2956 msiexec.exe - Suspicious use of FindShellTrayWindow 3 IoCs
pid Process 2956 msiexec.exe 2956 msiexec.exe 5948 retrac.exe - Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 2956 msiexec.exe 244 msiexec.exe 4916 MsiExec.exe - Suspicious use of WriteProcessMemory 24 IoCs
description pid Process procid_target PID 244 wrote to memory of 4916 244 msiexec.exe 90 PID 244 wrote to memory of 1620 244 msiexec.exe 96 PID 2956 wrote to memory of 5948 2956 msiexec.exe 99 PID 5948 wrote to memory of 2704 5948 retrac.exe 100 PID 2704 wrote to memory of 5372 2704 msedgewebview2.exe 101 PID 2704 wrote to memory of 1920 2704 msedgewebview2.exe 102 PID 2704 wrote to memory of 1920 2704 msedgewebview2.exe 102 PID 2704 wrote to memory of 1920 2704 msedgewebview2.exe 102 PID 2704 wrote to memory of 1920 2704 msedgewebview2.exe 102 PID 2704 wrote to memory of 5724 2704 msedgewebview2.exe 103 PID 2704 wrote to memory of 3732 2704 msedgewebview2.exe 104 PID 2704 wrote to memory of 3732 2704 msedgewebview2.exe 104 PID 2704 wrote to memory of 3732 2704 msedgewebview2.exe 104 PID 2704 wrote to memory of 4080 2704 msedgewebview2.exe 105 PID 2704 wrote to memory of 4080 2704 msedgewebview2.exe 105 PID 2704 wrote to memory of 4080 2704 msedgewebview2.exe 105 PID 2704 wrote to memory of 4080 2704 msedgewebview2.exe 105 PID 2704 wrote to memory of 4080 2704 msedgewebview2.exe 105 PID 2704 wrote to memory of 2372 2704 msedgewebview2.exe 108 PID 2704 wrote to memory of 2372 2704 msedgewebview2.exe 108 PID 2704 wrote to memory of 2372 2704 msedgewebview2.exe 108 PID 2704 wrote to memory of 4272 2704 msedgewebview2.exe 109 PID 2704 wrote to memory of 4272 2704 msedgewebview2.exe 109 PID 2704 wrote to memory of 4272 2704 msedgewebview2.exe 109 - Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I "C:\Users\Admin\AppData\Local\Temp\Retrac_3.0.3_x64_en-US (1).msi"1⤵
- Badlisted process makes network request
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2956 -
C:\Program Files\Retrac\retrac.exe"C:\Program Files\Retrac\retrac.exe"2⤵
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:5948 -
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=retrac.exe --webview-exe-version=1.0.0 --user-data-dir="C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --enable-features=MojoIpcz --lang=en-US --accept-lang=en-US --mojo-named-platform-channel-pipe=5948.1276.16552450207309663555 /pfhostedapp:fd0de7e5cefc9f8a2e2a61a11d5c8b08aabc87ca3⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of WriteProcessMemory
PID:2704 -
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView /prefetch:4 /pfhostedapp:fd0de7e5cefc9f8a2e2a61a11d5c8b08aabc87ca --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x184,0x188,0x18c,0x160,0x194,0x7ffdcbe55fd8,0x7ffdcbe55fe4,0x7ffdcbe55ff04⤵PID:5372
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView" --webview-exe-name=retrac.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1788 --field-trial-handle=1792,i,10921911308808125766,5094465497633682173,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:2 /pfhostedapp:fd0de7e5cefc9f8a2e2a61a11d5c8b08aabc87ca4⤵PID:1920
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView" --webview-exe-name=retrac.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2176 --field-trial-handle=1792,i,10921911308808125766,5094465497633682173,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:3 /pfhostedapp:fd0de7e5cefc9f8a2e2a61a11d5c8b08aabc87ca4⤵PID:5724
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView" --webview-exe-name=retrac.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2272 --field-trial-handle=1792,i,10921911308808125766,5094465497633682173,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:fd0de7e5cefc9f8a2e2a61a11d5c8b08aabc87ca4⤵PID:3732
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView" --webview-exe-name=retrac.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --autoplay-policy=no-user-gesture-required --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3280 --field-trial-handle=1792,i,10921911308808125766,5094465497633682173,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /pfhostedapp:fd0de7e5cefc9f8a2e2a61a11d5c8b08aabc87ca /prefetch:14⤵PID:4080
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView" --webview-exe-name=retrac.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4436 --field-trial-handle=1792,i,10921911308808125766,5094465497633682173,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:fd0de7e5cefc9f8a2e2a61a11d5c8b08aabc87ca4⤵PID:2372
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView" --webview-exe-name=retrac.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4424 --field-trial-handle=1792,i,10921911308808125766,5094465497633682173,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:fd0de7e5cefc9f8a2e2a61a11d5c8b08aabc87ca4⤵PID:4272
-
-
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:244 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding D5C9440114744FA7D908F6D833749DE9 C2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4916
-
-
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵PID:1620
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
PID:4752
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Config.Msi\e59fe7c.rbs
- Size 10KB
- SHA256 a21bbf5cadbb2658bfe6ffcb6a087e5b8d5da300ea2786959db7d223e075a3c7
- MD5 ec4e4b2e1a2ae2ae2a66e74ac5f17f23
- SHA1 41bd6923ee2697ef00cccd55d93300b79f3e7900
- SHA512 ced9f1ac28e7352b856be8ef93e4cd4d61aa11980bce59d71d19320d79def1b89f8a6e01e8f2ec51ae1b88a66b6b9e866e4a2aaed2a9c721c6ce89e33e334389
- SSDEEP 192:M+CeQDQEQDPQIQ1XCZXORJAUdGZ3JAUduEjNhZsgjixj91jFhWjUiYDSUF53srp0:MpcTD4nGXWnan8EjNQ4il9hF4dYDSUFp
- TLSH T173224102BA4485C2FA576F31C7871B143BB3C7D85338678F17CDE0289E56BC82E9568A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Retrac\retrac.exe
- Size 25.0MB
- SHA256 c724f7f13ae4213190228cb63a25778ee26a14124ad61f6ea588e58f46f2a0fb
- MD5 70c648ec13e81d4d822c07b7152fcfe4
- SHA1 8600bbf1adcafe7c52e11965ed70bf08a6dd083d
- SHA512 f08ff5b89fd12c078b93e46c98a31ea0bf63603bb6122bfa1611359d04e8a6b25d576bebf6cd15f060e35e62c43f0603b09f340c8595ce6b62adb7d91931f711
- SSDEEP 393216:eWepOHw+Y8Avmii8lXqOedAMaCsPAwBxK7ifpIPC5:upOQ+Y8kNl/bdP47il5
- TLSH T151475A217B9A996CD19AC47483474AB24E7170DB0B35BAFF449492383F6DBF42F38258
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Retrac\Retrac.lnk
- Size 1KB
- SHA256 5d61f92918b9af5ccf842ffe6000aac335d62675c7aab94e5b2345abed4411d0
- MD5 a0eb6d780c9e98709b11cd87e8cfce4d
- SHA1 aab96b04dfac2646d3c32a1624d72626b1b48c0c
- SHA512 568679df84a6f54041ae38ad1ef15dd507292d87e28ebd17882c1d58bffd292d653498afb8fda721ed1dacebe8b214113829167ea8991237109c6b398282a857
- TLSH T115417D10D7D50B15F37347396EB90A619F36BC0AA5209FBF4288408F19B9800D96DF6F
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Retrac\Retrac.lnk~RFe5a0b5b.TMP
- Size 1KB
- SHA256 39e6091f2a665a480c3866c4d8acd1d8f89bf7f0665b3b8f2644a5c111c50dc5
- MD5 4ab05f64815e3c53a72218558e1124e3
- SHA1 df199d67fafd1fbbed95e170d56f2a1586e931af
- SHA512 2219728d729e3ad37363227f731e34cad7b1878b33b2b27ebecddc4dac944005a94a454bb78fe785176d21023c0272676120dfac9cdf546ee92e956416dee2f3
- TLSH T192417C10D7D10B19E37347396EB90A609F36BC09A520AFAF4288404B1579900D96DF6F
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\MSIA994.tmp
- Size 132KB
- SHA256 7f47d98ab25cfea9b3a2e898c3376cc9ba1cd893b4948b0c27caa530fd0e34cc
- MD5 cfbb8568bd3711a97e6124c56fcfa8d9
- SHA1 d7a098ae58bdd5e93a3c1b04b3d69a14234d5e57
- SHA512 860cbf3286ac4915580cefaf56a9c3d48938eb08e3f31b7f024c4339c037d7c8bdf16e766d08106505ba535be4922a87dc46bd029aae99a64ea2fc02cf3aec04
- SSDEEP 3072:Kx2YbpcgwmiTPJDnCO+DATkURBnrskNwPj2:XXgwmY1CPx2XG2
- TLSH T1DBD39D02B5D0C473D9BE09390870DB229F7EB930DF909EDB636856699E702C19E35A37
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView\Crashpad\settings.dat
- Size 280B
- SHA256 678fe4695c56ccd2394cff2667ce1b80c42ea03a5ef11b27c2090bd0da795d6f
- MD5 dd8a10966ee8d99542347d17f8a57569
- SHA1 e8f9cac1957b111d776a106f88c7409656f9c8ae
- SHA512 d138547feda7eea4025074510d1567cb77b46d9239f8298943abf0969390cb7a54251b8ab3ef05392fa39fd899786d256dec41fc4c1dc9cef4bf5a1dde2f61d4
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView\Crashpad\settings.dat
- Size 280B
- SHA256 9c84c350d8585c858cb91f35d7b42acaf4bb50306cd8ca1c103c0b435218780a
- MD5 68d4955b3f71f746f7fca0bfeb652816
- SHA1 1fe03f8392641b9fbcd4c9834323b404e32be26a
- SHA512 8734a8c7d120d055b96f09cbb06321fc19cbcd25a796d7d2b3f4319d199a477b961a570683bb10d6e065a40a238a79311566aa793c7d3e1406f6a00254390acb
- TLSH T1CFD0122233014534C41035730153A10C0401D60FC14540015C3C866D5A088900E02C53
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView\Crashpad\throttle_store.dat
- Size 20B
- SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
- MD5 9e4e94633b73f4a7680240a0ffd6cd2c
- SHA1 e68e02453ce22736169a56fdb59043d33668368f
- SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView\Default\37782686-57e4-4196-b3ee-4f57c9c9ae24.tmp
- Size 6KB
- SHA256 afd8db2273da9e7205b494fcc8dda31fa6560352baf9d8891daafc49452e23ec
- MD5 f3ab992d794317d3d97c68513bb9f813
- SHA1 4aabebf4efae3218e80fad16430886a53e748ee3
- SHA512 af1776d457816d41dbf90457751fe0f7e5c7de009631752d41c14e30fb007ccdcdf6c0f72d72cfb7d6b05374c21f57afe790e8e0b3fa11e00fc2f09f496c88b7
- SSDEEP 96:stg/dgnkNb92kro5h16Z0Ns7/x+6MhmuecJy41ejeDK+g928XM1C7K:stUOVgonNsV+Fdy4QjR3G6K
- TLSH T1F5D1B6065E6469BB4CC7E508BA39BA17E2F56072B1D51E58E7F8462C08EA6CC2307D0F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView\Default\Code Cache\js\index-dir\the-real-index
- Size 72B
- SHA256 e7aa365f73f61923552d74dfefb0847f25aaa63d9d8fc6931c2771e690b9627d
- MD5 37ed1821673bd7f96d6250fb8fdaa237
- SHA1 d1669783445233ee56a0c7916dfa844639a1e908
- SHA512 31a0ee514abf3af6a72e7fcc0c82357c9a308c693efbc5adb3752822966cc2d07a52ec8c968ba26a16586b29e9885c0f0cfab0df9094158e8354a7231763cc9a
- TLSH T19AA0029222901453D22113B171C35548B331582407535FB985E411A498D0380461AB15
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView\Default\Code Cache\js\index-dir\the-real-index~RFe5a7e0b.TMP
- Size 48B
- SHA256 fce461aab7079e1f1188c2826e082f5bc40ad3f198c6a766a63c4fbca6af9286
- MD5 559eae5df84b045380bffd1b047d15ac
- SHA1 71b2ecb49e9c21d688f417f5a30b8429d4892635
- SHA512 daa8214916441d87584e6c9dc89cfc3e9a8b8e15a14e56affeaed1452a82b468ded83f7f5c90603fb4de963e026526ecc4cd706d2f04e71dc2e8d29bc303866a
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView\Default\GPUCache\data_1
- Size 264KB
- SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
- MD5 f50f89a0a91564d0b8a211f8921aa7de
- SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
- SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
- SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView\Default\Network\Network Persistent State
- Size 821B
- SHA256 0f095797e1c642c2c015617e9b9b607867ff36973ca05ad31a3e0ecc15dc0b80
- MD5 5d64af867cd0418250b4a2d945b8195f
- SHA1 d7b7ab82c5ad9fc7a1aafe29b70f628394a01ecd
- SHA512 4b8b7d4a72657ee78e866602cf551aee73bc653fbcdbdeec8beb97af087628adbddd5d2412f9f5caca4775238fc87346a9ecf18633a1984d0a33d4dd243ae2e3
- TLSH T107016BA6C3D4C67D8A4127E026343C23CD2E051A92283D26CDEEEBDA67E2475D21060F
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView\Default\Network\Network Persistent State~RFe5b40ed.TMP
- Size 59B
- SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
- MD5 2800881c775077e1c4b6e06bf4676de4
- SHA1 2873631068c8b3b9495638c865915be822442c8b
- SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
- TLSH T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView\Default\Network\SCT Auditing Pending Reports
- Size 2B
- SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
- MD5 d751713988987e9331980363e24189ce
- SHA1 97d170e1550eee4afc0af065b78cda302a97674c
- SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView\Default\Site Characteristics Database\000001.dbtmp
- Size 16B
- SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
- MD5 46295cac801e5d4857d09837238a6394
- SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
- SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView\Default\Sync Data\LevelDB\MANIFEST-000001
- Size 41B
- SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
- MD5 5af87dfd673ba2115e2fcf5cfdb727ab
- SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
- SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView\GraphiteDawnCache\data_0
- Size 8KB
- SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
- MD5 cf89d16bb9107c631daabf0c0ee58efb
- SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
- SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
- SSDEEP 3:MsFl:/F
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView\GraphiteDawnCache\data_2
- Size 8KB
- SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
- MD5 0962291d6d367570bee5454721c17e11
- SHA1 59d10a893ef321a706a9255176761366115bedcb
- SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
- SSDEEP 3:MsHlDll:/H
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView\GraphiteDawnCache\data_3
- Size 8KB
- SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
- MD5 41876349cb12d6db992f1309f22df3f0
- SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
- SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
- SSDEEP 3:MsGl3ll:/y
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView\Local State
- Size 2KB
- SHA256 e1637a280ee52fca012f5a7d642107c6df52aaa3d0cfaf11fceefeac5a9cfd8d
- MD5 2f5d350f67180c3def22be41b1099b47
- SHA1 b0eb7ea7dd0fe2d590a5c87ea716270bf374d032
- SHA512 a7322c972b8ea1c1f7d3efdbbe5faf374f9e1f8ddb38d5045515ee4f6ed6eee11d99d8c9066f915f3b7c4fee849930f3050de82fc15e12a51553a4c413c6b2e2
- TLSH T16B51B537AC509A7389E24608794ABF67EE75A1A2EA622F1096DC0F0D11DB14C1303C7E
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView\Local State
- Size 3KB
- SHA256 52b26035030d0710792920df59b1f449c721103bbc3e42826becc93688153a3e
- MD5 7cd01c134e887955bb463e00d30304d0
- SHA1 4faccf847c037027032e7a6015fe8577fb2c5e5d
- SHA512 5d28bc59584290e54bc8cb36bfe7efe82674c99fdf65af409d2bfef6c618e5cd32959bfcd4b5a36f014d86f4ed826f946925c9e16c84e25586c635b590b4a0ff
- TLSH T11471A43F9DA0A9778DE28A0478867B1AFBA15177E9913F54D6EC0F0D11C728C1352C2B
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView\Local State
- Size 16KB
- SHA256 ab9ae75b87688e692cba8c4a8b3c82d530dcedfab4377688160c81c0b87eebaf
- MD5 6963a23869043079826cfd41c0b26393
- SHA1 9bed604206dfb335d61aa780f6724c31643a3eee
- SHA512 f0b71af7d0342bcc4c42d9342be0f0df04e71b7dd466f9a3fabe6998e39382f7dd3b2f5ff8ad2117c8f8a51b44c04a637e199006de52a33697a5cf0fbfea2924
- SSDEEP 384:c+aQikB+z/xvxjg/qhEwNBS351txOiK9zq:7/UxvxjgC+h3TKFq
- TLSH T13B72AE3F59687D3395F3E6047D494B8FEEF898B295C23DA489E85F0E16C72C8030281A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView\Local State~RFe5a2cbe.TMP
- Size 1KB
- SHA256 de6e4d2bfa9dd3e49a0500ef0926c0daa72802af5e798147e4a69586ef030fea
- MD5 60de4f2078c0f105d5ecea279b07881b
- SHA1 94a7c830a162ea8b6996f8eaedeba802c4750834
- SHA512 105d8e1429ecbb1c3aa80da87185459395cacc9f5c8f76f8e189b864e9a1e92faa84a39f5c69182c7a78665d6bef7a0b72d97776c1152668f9344c4bba9dd80c
- TLSH T17631747B98909A729CD2020A3406FFDBAE7161BB92510E0462DD8F0E22DB04D963BC36
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\Installer\e59fe7b.msi
- Size 14.0MB
- SHA256 921ccce853756f16dd75d1f6da6307218beca5f6bde82f8d524fcc7ebdb81620
- MD5 83ae3dae4ff8ceb1d9914f6ca6159da3
- SHA1 1525edd1e78aa3d6e1bd56429a5849034efc0cb9
- SHA512 1c64fb8039db7361237551f87f4757b6de7bdfd7a65455c4c103bb8a707989a928af475732509d40c96f41e82f75dd454813a1c0cedcf1eaa7a570cb6ff56459
- SSDEEP 393216:cQ09TbnSeDVNQs3b6+WvWCjYuPKDbAKhUS1Q1vaN:k9hDYsL7w2/hZQR
- TLSH T19EE633273E025B36C81B5FB754FBCB244279FC445AA0690333D8B81AF9F62C5157A9CA
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
- Size 26.1MB
- SHA256 ea2dc51856bf159f06c41b5d852a6d3f8a6f60d95f92f5c59a9f3adcb699e0ad
- MD5 6acb70d7c8636358cd95188db2fe17c8
- SHA1 f243bee11cf57b59b33b26539c3a1653813fe527
- SHA512 39c95b1693b5f083c39056b024e5b74f78bae51060e0b9df4ab491de3ccc8f844564ee8fe3ba0d33ec43c73b46441351478ad7cd574ce75f3796a57d229fe5af
- SSDEEP 24576:0Fo3DMP/doO/vvTL/yAsMilQPrOWX7rf0R6e9BCE65iqpLNMMoR2s12Noee:SHg
- TLSH T11957B51436F92100E7F79E3CA8F06A234D397D5BAC19DE8D45511B8E0922F71E872F6A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\Volume{c61fbfff-0000-0000-0000-d08302000000}\System Volume Information\SPP\OnlineMetadataCache\{707529ac-dfe9-4ebf-baaf-3c92371ba833}_OnDiskSnapshotProp
- Size 6KB
- SHA256 1842d40b8c4f633b7be911ef38c999c008a96bd4bdeea5bb257c38eeef5b96ab
- MD5 7ddc325ee52e7863aa55a31febd09c5f
- SHA1 3b1e58a21503c8226dbe61f2c2af94a11b084d72
- SHA512 1038ee67567928bdb9200f819c95a34a24f3a637b19174539b85418f4e28a2e8eb7c2d444bec545f56a3c2bf62c8f3a47dd1f3cf8cb0a5606a352c4abbbc5281
- SSDEEP 96:FG+W5m9DlDvc6DD84LTHzbOHXOHBlBRQn8Sc9XE56tOSVQpu:oBeDl/b++uVm
- TLSH T146D188081AE54311E2F3AB3229F58557A837B911EF33CB8E0198238E6671910F835F6B
- MD5 SHA1 SHA512 SSDEEP TLSH