Analysis
- user interaction
yes - max time kernel
149s - max time network
153s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
30/07/2026, 01:44
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Retrac_3.0.3_x64_en-US.msi
Resource
win10v2004-20260513-en
windows10-2004-x64
22 signatures
150 seconds
Behavioral task
behavioral2
Sample
Retrac_3.0.3_x64_en-US.msi
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
21 signatures
150 seconds
General
- Target Retrac_3.0.3_x64_en-US.msi
- Size 14.0MB
- Sample260730-b6bcwsbk31
- SHA256 921ccce853756f16dd75d1f6da6307218beca5f6bde82f8d524fcc7ebdb81620
- MD5 83ae3dae4ff8ceb1d9914f6ca6159da3
- SHA1 1525edd1e78aa3d6e1bd56429a5849034efc0cb9
- SHA512 1c64fb8039db7361237551f87f4757b6de7bdfd7a65455c4c103bb8a707989a928af475732509d40c96f41e82f75dd454813a1c0cedcf1eaa7a570cb6ff56459
- SSDEEP 393216:cQ09TbnSeDVNQs3b6+WvWCjYuPKDbAKhUS1Q1vaN:k9hDYsL7w2/hZQR
- TLSH T19EE633273E025B36C81B5FB754FBCB244279FC445AA0690333D8B81AF9F62C5157A9CA
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 2784 retrac.exe - Loads dropped DLL 1 IoCs
pid Process 2060 MsiExec.exe - Badlisted process makes network request 2 IoCs
Network request originating from process or tool commonly abused by malware.
flow pid Process 4 4136 msiexec.exe 9 4136 msiexec.exe - Checks whether UAC is enabled 1 TTPs 1 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA retrac.exe - Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\D: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\D: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\A: msiexec.exe - Drops file in Program Files directory 2 IoCs
description ioc Process File created C:\Program Files\Retrac\retrac.exe msiexec.exe File created C:\Program Files\Retrac\Uninstall Retrac.lnk msiexec.exe - Drops file in Windows directory 14 IoCs
description ioc Process File opened for modification C:\Windows\Installer\MSIC54A.tmp msiexec.exe File created C:\Windows\Installer\{B64341E3-8AF2-4B11-8395-8748AE7D1423}\ProductIcon msiexec.exe File opened for modification C:\Windows\Installer\{B64341E3-8AF2-4B11-8395-8748AE7D1423}\ProductIcon msiexec.exe File created C:\Windows\SystemTemp\~DF398B4CB52C54448B.TMP msiexec.exe File created C:\Windows\Installer\e59c01a.msi msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File created C:\Windows\SystemTemp\~DFB2B33C3F8BC5607B.TMP msiexec.exe File created C:\Windows\Installer\e59c01c.msi msiexec.exe File created C:\Windows\SystemTemp\~DF092C991E8C8A1D37.TMP msiexec.exe File opened for modification C:\Windows\Installer\e59c01a.msi msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File created C:\Windows\SystemTemp\~DF5F946893CF416D16.TMP msiexec.exe File created C:\Windows\Installer\SourceHash{B64341E3-8AF2-4B11-8395-8748AE7D1423} msiexec.exe - Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
pid Process 4136 msiexec.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe - Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000940e18cbc83cc7300000000000000000000000000000000000000000000000000000000000000000000000000000000000001071020000000000c0120000000000000000000000002701010000883801940e18cb0000000000001071020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d0830200000000006025c501000000000000000000000700010000e84101940e18cb000000000000d08302000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9c701000000000000050000000000000000000000070001000098d4e3940e18cb00000000000030a9c7010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9cc0100000000000005000000000000000000000007000100009854e6940e18cb00000000000030a9cc01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedgewebview2.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedgewebview2.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedgewebview2.exe - Modifies data under HKEY_USERS 3 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28 msiexec.exe Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E msiexec.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27 msiexec.exe - Modifies registry class 46 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\retrac\ = "URL: protocol" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\retrac\DefaultIcon msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\retrac\DefaultIcon\ = "\"C:\\PROGRA~1\\Retrac\\retrac.exe\",0" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\retrac\shell\open\command\ = "\"C:\\PROGRA~1\\Retrac\\retrac.exe\" \"%1\"" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3E14346B2FA811B438597884EAD74132 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3E14346B2FA811B438597884EAD74132\SourceList msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3E14346B2FA811B438597884EAD74132\Clients = 3a0000000000 msiexec.exe Key created \REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000_Classes\retrac\shell\open\command retrac.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\retrac\URL Protocol msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\retrac msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3E14346B2FA811B438597884EAD74132\ProductIcon = "C:\\Windows\\Installer\\{B64341E3-8AF2-4B11-8395-8748AE7D1423}\\ProductIcon" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3E14346B2FA811B438597884EAD74132\InstanceType = "0" msiexec.exe Key created \REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000_Classes\retrac\shell\open retrac.exe Set value (str) \REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000_Classes\retrac\shell\open\command\ = "\"C:\\Program Files\\Retrac\\retrac.exe\" \"%1\"" retrac.exe Key created \REGISTRY\MACHINE\Software\Classes\retrac\shell\open\command msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\retrac\shell\open msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3E14346B2FA811B438597884EAD74132\DeploymentFlags = "3" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\D39F67BF21D37C75581F63A03A3CC6BF msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3E14346B2FA811B438597884EAD74132\SourceList\Media msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\retrac\shell msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\3E14346B2FA811B438597884EAD74132\Environment = "MainProgram" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3E14346B2FA811B438597884EAD74132\Assignment = "1" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3E14346B2FA811B438597884EAD74132\AuthorizedLUAApp = "0" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3E14346B2FA811B438597884EAD74132\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3E14346B2FA811B438597884EAD74132\SourceList\Media\1 = ";" msiexec.exe Set value (str) \REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000_Classes\retrac\URL Protocol retrac.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\3E14346B2FA811B438597884EAD74132 msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3E14346B2FA811B438597884EAD74132\Version = "50331651" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3E14346B2FA811B438597884EAD74132\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\" msiexec.exe Key created \REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000_Classes\retrac retrac.exe Set value (str) \REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000_Classes\retrac\ = "URL:launcher.retrac.site protocol" retrac.exe Key created \REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000_Classes\retrac\DefaultIcon retrac.exe Key created \REGISTRY\MACHINE\Software\Classes\retrac msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\3E14346B2FA811B438597884EAD74132\External msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3E14346B2FA811B438597884EAD74132\ProductName = "Retrac" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3E14346B2FA811B438597884EAD74132\AdvertiseFlags = "388" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\D39F67BF21D37C75581F63A03A3CC6BF\3E14346B2FA811B438597884EAD74132 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3E14346B2FA811B438597884EAD74132\SourceList\PackageName = "Retrac_3.0.3_x64_en-US.msi" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\3E14346B2FA811B438597884EAD74132\MainProgram msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3E14346B2FA811B438597884EAD74132\Language = "0" msiexec.exe Set value (str) \REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000_Classes\retrac\DefaultIcon\ = "C:\\Program Files\\Retrac\\retrac.exe,0" retrac.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\retrac\shell\open\command msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\3E14346B2FA811B438597884EAD74132\ShortcutsFeature = "MainProgram" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3E14346B2FA811B438597884EAD74132\PackageCode = "5AF8DFF4402CB2D43B0C16EE2B44E2EE" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3E14346B2FA811B438597884EAD74132\SourceList\Net msiexec.exe Key created \REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000_Classes\retrac\shell retrac.exe - Suspicious behavior: EnumeratesProcesses 46 IoCs
pid Process 2796 msiexec.exe 2796 msiexec.exe 2784 retrac.exe 2784 retrac.exe 2784 retrac.exe 2784 retrac.exe 2784 retrac.exe 2784 retrac.exe 2784 retrac.exe 2784 retrac.exe 2784 retrac.exe 2784 retrac.exe 2784 retrac.exe 2784 retrac.exe 2784 retrac.exe 2784 retrac.exe 2784 retrac.exe 2784 retrac.exe 2784 retrac.exe 2784 retrac.exe 2784 retrac.exe 2784 retrac.exe 2784 retrac.exe 2784 retrac.exe 2784 retrac.exe 2784 retrac.exe 2784 retrac.exe 2784 retrac.exe 2784 retrac.exe 2784 retrac.exe 2784 retrac.exe 2784 retrac.exe 2784 retrac.exe 2784 retrac.exe 2784 retrac.exe 2784 retrac.exe 2784 retrac.exe 2784 retrac.exe 2784 retrac.exe 2784 retrac.exe 2784 retrac.exe 2784 retrac.exe 2784 retrac.exe 2784 retrac.exe 2784 retrac.exe 2784 retrac.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs
pid Process 3240 msedgewebview2.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 4136 msiexec.exe Token: SeIncreaseQuotaPrivilege 4136 msiexec.exe Token: SeSecurityPrivilege 2796 msiexec.exe Token: SeCreateTokenPrivilege 4136 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 4136 msiexec.exe Token: SeLockMemoryPrivilege 4136 msiexec.exe Token: SeIncreaseQuotaPrivilege 4136 msiexec.exe Token: SeMachineAccountPrivilege 4136 msiexec.exe Token: SeTcbPrivilege 4136 msiexec.exe Token: SeSecurityPrivilege 4136 msiexec.exe Token: SeTakeOwnershipPrivilege 4136 msiexec.exe Token: SeLoadDriverPrivilege 4136 msiexec.exe Token: SeSystemProfilePrivilege 4136 msiexec.exe Token: SeSystemtimePrivilege 4136 msiexec.exe Token: SeProfSingleProcessPrivilege 4136 msiexec.exe Token: SeIncBasePriorityPrivilege 4136 msiexec.exe Token: SeCreatePagefilePrivilege 4136 msiexec.exe Token: SeCreatePermanentPrivilege 4136 msiexec.exe Token: SeBackupPrivilege 4136 msiexec.exe Token: SeRestorePrivilege 4136 msiexec.exe Token: SeShutdownPrivilege 4136 msiexec.exe Token: SeDebugPrivilege 4136 msiexec.exe Token: SeAuditPrivilege 4136 msiexec.exe Token: SeSystemEnvironmentPrivilege 4136 msiexec.exe Token: SeChangeNotifyPrivilege 4136 msiexec.exe Token: SeRemoteShutdownPrivilege 4136 msiexec.exe Token: SeUndockPrivilege 4136 msiexec.exe Token: SeSyncAgentPrivilege 4136 msiexec.exe Token: SeEnableDelegationPrivilege 4136 msiexec.exe Token: SeManageVolumePrivilege 4136 msiexec.exe Token: SeImpersonatePrivilege 4136 msiexec.exe Token: SeCreateGlobalPrivilege 4136 msiexec.exe Token: SeCreateTokenPrivilege 4136 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 4136 msiexec.exe Token: SeLockMemoryPrivilege 4136 msiexec.exe Token: SeIncreaseQuotaPrivilege 4136 msiexec.exe Token: SeMachineAccountPrivilege 4136 msiexec.exe Token: SeTcbPrivilege 4136 msiexec.exe Token: SeSecurityPrivilege 4136 msiexec.exe Token: SeTakeOwnershipPrivilege 4136 msiexec.exe Token: SeLoadDriverPrivilege 4136 msiexec.exe Token: SeSystemProfilePrivilege 4136 msiexec.exe Token: SeSystemtimePrivilege 4136 msiexec.exe Token: SeProfSingleProcessPrivilege 4136 msiexec.exe Token: SeIncBasePriorityPrivilege 4136 msiexec.exe Token: SeCreatePagefilePrivilege 4136 msiexec.exe Token: SeCreatePermanentPrivilege 4136 msiexec.exe Token: SeBackupPrivilege 4136 msiexec.exe Token: SeRestorePrivilege 4136 msiexec.exe Token: SeShutdownPrivilege 4136 msiexec.exe Token: SeDebugPrivilege 4136 msiexec.exe Token: SeAuditPrivilege 4136 msiexec.exe Token: SeSystemEnvironmentPrivilege 4136 msiexec.exe Token: SeChangeNotifyPrivilege 4136 msiexec.exe Token: SeRemoteShutdownPrivilege 4136 msiexec.exe Token: SeUndockPrivilege 4136 msiexec.exe Token: SeSyncAgentPrivilege 4136 msiexec.exe Token: SeEnableDelegationPrivilege 4136 msiexec.exe Token: SeManageVolumePrivilege 4136 msiexec.exe Token: SeImpersonatePrivilege 4136 msiexec.exe Token: SeCreateGlobalPrivilege 4136 msiexec.exe Token: SeCreateTokenPrivilege 4136 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 4136 msiexec.exe Token: SeLockMemoryPrivilege 4136 msiexec.exe - Suspicious use of FindShellTrayWindow 3 IoCs
pid Process 4136 msiexec.exe 4136 msiexec.exe 2784 retrac.exe - Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 4136 msiexec.exe 2796 msiexec.exe 2060 MsiExec.exe - Suspicious use of WriteProcessMemory 18 IoCs
description pid Process procid_target PID 2796 wrote to memory of 2060 2796 msiexec.exe 90 PID 2796 wrote to memory of 4932 2796 msiexec.exe 96 PID 4136 wrote to memory of 2784 4136 msiexec.exe 99 PID 2784 wrote to memory of 3240 2784 retrac.exe 100 PID 3240 wrote to memory of 2584 3240 msedgewebview2.exe 101 PID 3240 wrote to memory of 1104 3240 msedgewebview2.exe 102 PID 3240 wrote to memory of 1104 3240 msedgewebview2.exe 102 PID 3240 wrote to memory of 1104 3240 msedgewebview2.exe 102 PID 3240 wrote to memory of 1104 3240 msedgewebview2.exe 102 PID 3240 wrote to memory of 4304 3240 msedgewebview2.exe 103 PID 3240 wrote to memory of 2428 3240 msedgewebview2.exe 104 PID 3240 wrote to memory of 2428 3240 msedgewebview2.exe 104 PID 3240 wrote to memory of 2428 3240 msedgewebview2.exe 104 PID 3240 wrote to memory of 5676 3240 msedgewebview2.exe 105 PID 3240 wrote to memory of 5676 3240 msedgewebview2.exe 105 PID 3240 wrote to memory of 5676 3240 msedgewebview2.exe 105 PID 3240 wrote to memory of 5676 3240 msedgewebview2.exe 105 PID 3240 wrote to memory of 5676 3240 msedgewebview2.exe 105 - Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\Retrac_3.0.3_x64_en-US.msi1⤵
- Badlisted process makes network request
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4136 -
C:\Program Files\Retrac\retrac.exe"C:\Program Files\Retrac\retrac.exe"2⤵
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2784 -
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=retrac.exe --webview-exe-version=1.0.0 --user-data-dir="C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --enable-features=MojoIpcz --lang=en-US --accept-lang=en-US --mojo-named-platform-channel-pipe=2784.5968.18396181795219658956 /pfhostedapp:fd0de7e5cefc9f8a2e2a61a11d5c8b08aabc87ca3⤵
- Enumerates system info in registry
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of WriteProcessMemory
PID:3240 -
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView /prefetch:4 /pfhostedapp:fd0de7e5cefc9f8a2e2a61a11d5c8b08aabc87ca --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x188,0x18c,0x190,0x164,0x198,0x7ffff7a15fd8,0x7ffff7a15fe4,0x7ffff7a15ff04⤵PID:2584
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView" --webview-exe-name=retrac.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1776 --field-trial-handle=1728,i,2773007960728379964,2106655278899618885,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:2 /pfhostedapp:fd0de7e5cefc9f8a2e2a61a11d5c8b08aabc87ca4⤵PID:1104
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView" --webview-exe-name=retrac.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2212 --field-trial-handle=1728,i,2773007960728379964,2106655278899618885,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:3 /pfhostedapp:fd0de7e5cefc9f8a2e2a61a11d5c8b08aabc87ca4⤵PID:4304
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView" --webview-exe-name=retrac.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2268 --field-trial-handle=1728,i,2773007960728379964,2106655278899618885,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:fd0de7e5cefc9f8a2e2a61a11d5c8b08aabc87ca4⤵PID:2428
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView" --webview-exe-name=retrac.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --autoplay-policy=no-user-gesture-required --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3316 --field-trial-handle=1728,i,2773007960728379964,2106655278899618885,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /pfhostedapp:fd0de7e5cefc9f8a2e2a61a11d5c8b08aabc87ca /prefetch:14⤵PID:5676
-
-
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2796 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 2E637D5DC08D35EE0BCCF65B15D27D94 C2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2060
-
-
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵PID:4932
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
PID:4424
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Config.Msi\e59c01b.rbs
- Size 10KB
- SHA256 3f6d446dae47acfb22a03d84e96f1088d72dfba361f708ef05c7fc5939e78d23
- MD5 b15ffb502c63b48f90a62422da302fec
- SHA1 c245e8c5617ee6671cf1474988f784b432043065
- SHA512 51fdd08b17e211173823015d5855fb8a3393012f4add257cd1048e6a9f61b00f87fdf83fef1acacc67d06723de043165e50d6ce8360d8a9f0321b1df5dd74c37
- SSDEEP 192:++UeQDQEQDPQIQ1XCVqORaAUdGZ3aAUduEjNhZsgjixj91jFhWjUiYDSUF53srpG:+/cTD4nKqWuau8EjNQ4il9hF4dYDSUFf
- TLSH T1AA223F02BA4085C2FA576F31C7871B143BB3C7D84338678F17CDE0289E56BC92E9568A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Retrac\retrac.exe
- Size 25.0MB
- SHA256 c724f7f13ae4213190228cb63a25778ee26a14124ad61f6ea588e58f46f2a0fb
- MD5 70c648ec13e81d4d822c07b7152fcfe4
- SHA1 8600bbf1adcafe7c52e11965ed70bf08a6dd083d
- SHA512 f08ff5b89fd12c078b93e46c98a31ea0bf63603bb6122bfa1611359d04e8a6b25d576bebf6cd15f060e35e62c43f0603b09f340c8595ce6b62adb7d91931f711
- SSDEEP 393216:eWepOHw+Y8Avmii8lXqOedAMaCsPAwBxK7ifpIPC5:upOQ+Y8kNl/bdP47il5
- TLSH T151475A217B9A996CD19AC47483474AB24E7170DB0B35BAFF449492383F6DBF42F38258
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Retrac\Retrac.lnk
- Size 1KB
- SHA256 107bda9c529087b3d18a6cb942db8beec69fc5dbb445642234b84f06ca302fc9
- MD5 892110fa8d3d640e513c98f3a377eef0
- SHA1 0210ca1fa54709d8109365b58a1cd2807167b607
- SHA512 4aecbbd1ff8543dd0ac0665436f3a005d6b954421cf9edf631662fe948bf9bf3d87940042f5a3022c7930c60bece0cf34ff91b840e8eb49320df643d4906d94a
- TLSH T10D417D20A7D0072AF3735639ADB91B248F32FC0AA5219F3F4289418F167551199ADF2F
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Retrac\Retrac.lnk~RFe59c8c5.TMP
- Size 1KB
- SHA256 eb76f24532c6b175ca30c1e0a94ecbf61e34320970d1a7831544c34be5529710
- MD5 b9062f73e4c2a352b6002fcd2a9145bb
- SHA1 59e250deed09893da881432c0b7bd28eee8cd792
- SHA512 576d4fa1484a6959f2ed0d3d2246d94f9aae4356a60b580e2213629292ad733f7467912ce22c6319d1636abec9718721b02b4570a013b52af79f6594c49c68d8
- TLSH T1D4417F20A7D0072AE3335739ADF51B648F32FC06A5619F3F4289018F1675511A99DF2F
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\MSI7B9F.tmp
- Size 132KB
- SHA256 7f47d98ab25cfea9b3a2e898c3376cc9ba1cd893b4948b0c27caa530fd0e34cc
- MD5 cfbb8568bd3711a97e6124c56fcfa8d9
- SHA1 d7a098ae58bdd5e93a3c1b04b3d69a14234d5e57
- SHA512 860cbf3286ac4915580cefaf56a9c3d48938eb08e3f31b7f024c4339c037d7c8bdf16e766d08106505ba535be4922a87dc46bd029aae99a64ea2fc02cf3aec04
- SSDEEP 3072:Kx2YbpcgwmiTPJDnCO+DATkURBnrskNwPj2:XXgwmY1CPx2XG2
- TLSH T1DBD39D02B5D0C473D9BE09390870DB229F7EB930DF909EDB636856699E702C19E35A37
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView\Crashpad\settings.dat
- Size 280B
- SHA256 9f93fc8ab5ef86c710b260101aa330c60e3180cef7aa82e73a31c2ca36ea4b4a
- MD5 e312acd6e395429c47e5a4c87b32bd75
- SHA1 538c49b35788e2ef13569457f5960e0bea7feb0c
- SHA512 bd8774f4c9b47750f306a9a00e80cc3d87ed7a370e3f37c9d67740a607cdc753890597a2b7abdf86a26cc2c32f7855f160a14c8e96ff46ec0236c9a14bd220fb
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView\Crashpad\settings.dat
- Size 280B
- SHA256 3ff3f033e526fcc429bdd4f2937ff1f1e58030ecbd0c074e200801d43e7dad14
- MD5 b3126d9bcf69f1c4caee04853ad3550d
- SHA1 0ebe4faa97baddaaccdf74a0e3ae6370b7ebf268
- SHA512 5cbd314fdc17bdca87c20f98a6535fb038cd44815aa3c1ed796a8d4875b75d901634e5fc90c830083e9da9874eba37ab7520cd138a3395ba3980818dd251fc67
- TLSH T1DCD01212B2024274C41020334503A20C1401C30B8005C1045428CD2E5E8C0541916442
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView\Crashpad\throttle_store.dat
- Size 20B
- SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
- MD5 9e4e94633b73f4a7680240a0ffd6cd2c
- SHA1 e68e02453ce22736169a56fdb59043d33668368f
- SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView\Default\Code Cache\js\index-dir\the-real-index
- Size 72B
- SHA256 bb59658c90c873668c7d553507fa56a9dec0fb2b5c6a2bae46d3efa9b0fd17e6
- MD5 a4b437b9a906c2fb615e3ea253b0cd52
- SHA1 592eabf0c9257dde2e730b477418953d4c94bf90
- SHA512 13625620aeb037e299f4fbe1d7b34b90ed12ec5c56b0e72455b3690eb10a30c1c1fe08e9186d7dad9c62a482eca362b61f24304cbc98a738768a5a5436ad16ab
- TLSH T1ECA0026111D11052D270737178C22641B37189101A134BC2C2DC1164CCA978941A3955
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView\Default\Code Cache\js\index-dir\the-real-index~RFe5ad4b6.TMP
- Size 48B
- SHA256 dc713bb94cee155a5c69b85aef1d31091d2611f8ef3aa2d754a15f325c5e12b9
- MD5 f3ded7baffe4d94efc9a04340f58e877
- SHA1 01a1f5d12dae4538d6ebe054d3ac27fce13e2672
- SHA512 3e3aadeec97a9b06501329377a8faa6b6b25cdd063d359667ffa1dbf9b13221ae5d9a5c2b4a08b6284d20f82c50a1d2196d572584ce03e22a33f6f750f8cfa3a
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView\Default\GPUCache\data_1
- Size 264KB
- SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
- MD5 f50f89a0a91564d0b8a211f8921aa7de
- SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
- SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
- SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView\Default\Network\Network Persistent State
- Size 111B
- SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
- MD5 285252a2f6327d41eab203dc2f402c67
- SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
- SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
- TLSH T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView\Default\Network\Network Persistent State~RFe5b5ee5.TMP
- Size 59B
- SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
- MD5 2800881c775077e1c4b6e06bf4676de4
- SHA1 2873631068c8b3b9495638c865915be822442c8b
- SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
- TLSH T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView\Default\Network\SCT Auditing Pending Reports
- Size 2B
- SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
- MD5 d751713988987e9331980363e24189ce
- SHA1 97d170e1550eee4afc0af065b78cda302a97674c
- SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView\Default\Preferences
- Size 6KB
- SHA256 28df27e7716fa7c07edd4b1e8acef28807c4b47901777b4d465f77d56bc0e8c8
- MD5 996574d7dda0ad5f94ab256a43e8fa0e
- SHA1 0dce44213882c735f3f294230c1913a18bdacc23
- SHA512 d3d6fb8548bc9d351685c0d8e4789d7ae108547279d4297d571d42428e232434d05480f32174c5e8bacab1785cddb6161f5252424dfe8856646368f97713c3b6
- SSDEEP 96:stf/dgVc3bb90k+Ico5h16Z0ts7/x+6MhmuecJo/1ejehK+g2L28XM1C7K:stnOV8contsV+Fdo/QjnuG6K
- TLSH T11CD1A6066F24A97B4CC7E509FA35BB17E2F9903261D12E58E7F8861C04DB6DC630780B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView\Default\Preferences~RFe5aadb6.TMP
- Size 5KB
- SHA256 269dfaa4f371dd874819e2b7d39cd95b47625aef03d1f09446cb3200dc3a7440
- MD5 4592338f1f588674d40a1ec72cbc115a
- SHA1 320602f729000c441f8306c70750f80607a723b3
- SHA512 9efcb639755756c50257cd768812967b207f1d50bc4accb3148bfee9d90778cb0861c0e80a259b87fe25c7391207abe230f218367076b0ca22d6df279ac02f31
- SSDEEP 96:rf/dWVc3bb90kpdo616Z0ts7/x+6MhmuecJo/1ejehK+gXL28XM1C7K:rnIVqo6tsV+Fdo/QjnpG6K
- TLSH T116C1A6066F24697B4CD6E108FA357A17E2FA903275D62E58E7F8861C04DA5DC7317C0B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView\Default\Sync Data\LevelDB\CURRENT
- Size 16B
- SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
- MD5 46295cac801e5d4857d09837238a6394
- SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
- SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView\Default\Sync Data\LevelDB\MANIFEST-000001
- Size 41B
- SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
- MD5 5af87dfd673ba2115e2fcf5cfdb727ab
- SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
- SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView\GraphiteDawnCache\data_0
- Size 8KB
- SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
- MD5 cf89d16bb9107c631daabf0c0ee58efb
- SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
- SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
- SSDEEP 3:MsFl:/F
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView\GraphiteDawnCache\data_2
- Size 8KB
- SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
- MD5 0962291d6d367570bee5454721c17e11
- SHA1 59d10a893ef321a706a9255176761366115bedcb
- SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
- SSDEEP 3:MsHlDll:/H
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView\GraphiteDawnCache\data_3
- Size 8KB
- SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
- MD5 41876349cb12d6db992f1309f22df3f0
- SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
- SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
- SSDEEP 3:MsGl3ll:/y
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView\Local State
- Size 2KB
- SHA256 8e4e57f3b36c63f9922059f1852f1d0f6733f1bf4eaf27ac38bb8094e7cfda55
- MD5 87f2d1da8ee166b754952b63d4f6ca50
- SHA1 e08b46b15db41db580393206b57b673efcf0bb3b
- SHA512 21ba496d724cf3fae08d4d497698781bd0205455006ba6e8dd20a1e8be4e2668a326288ce8b361cd7850f26347c204c508ff625be767d68fff2bf6c2bbf66b60
- TLSH T1DA51973379159B77C5F65A44F94A3F238E369166DB522F1096DD4B0C01D756C4302C3B
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView\Local State
- Size 3KB
- SHA256 408e868afd0fffeddd71a64e0304e391735ec0fe5cf06d663f2409f89c866de3
- MD5 04702c3757e1bc53d134260808988252
- SHA1 d6bc7900c4c2416db69738ce7f79c52b4014b286
- SHA512 2a816e630c5f7db3ae0566f8b0b2e3ef1ffa8744e23282bbb1da1a16209043c263ee8339c1f8deebd0d36de117501d672781fe404fd9677a517d3eb03bb32f61
- TLSH T17961853B6A749A378DF29A04F9863B17AB665137E6913F55D6EC0F0C01D729C4302C17
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView\Local State
- Size 3KB
- SHA256 9d4c3b11ae1853f4b00e0b3d5f781c764b35a41f9a23549b24bda19f3adb9d9e
- MD5 67ca485ec30c617acd1b72682aea35d8
- SHA1 ea821fca9d716de9afa364febf95172b6c973683
- SHA512 8fcbad2b634095b557c21df316ddebd29fc2a66ad75e5951e56980103c6c88cac55c0927ed9ca375e51b4900193c9bd3719b0a9056944df0f1f86157060e8b45
- TLSH T178719537AA7499378DF6DA04B9463F13AA658037E6917F99D6EC0F0C01D729D0342C17
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView\Local State
- Size 15KB
- SHA256 07afa6f638781f7ff7f05db0cd61c7c890bd4a0abe4ed306fcb6717f89d09e8a
- MD5 b69ad30d6c1223a1c109f6cfc8256353
- SHA1 7e2fecd9150876344519e97d8369efdee048d015
- SHA512 112b50dcc0faafc4606fdad6519f6ddab5c23466575543d2b62ace37eaaccf8322cd9889fded510f40180fb2c1c2ccf61fd025f91343b761dde3cf174d9dcb39
- SSDEEP 384:0+aQikB+z/xvxjg/qhEwNBS4pn3ikeisdQz9zq:T/UxvxjgC+gVxeisyzFq
- TLSH T14A729E3B55393E2395F6EA05B94D175BDBB9847391C27EB84AED9F0D06C72A80342C07
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView\Local State~RFe5a30b6.TMP
- Size 1KB
- SHA256 dc053a5846405c298b271c67addaa9087d22ada6311b837c4d4f1d58d08ed45e
- MD5 7f88af03734ecb8696801a641c58e74b
- SHA1 a87f801a86857957b44bcc7d874033ab839ea76c
- SHA512 b2907c6a274761100cfbb415e11b609e8ace6e29c3fbb9ce9d9dec21b8a3f091ef11a5d59a81c7604a5247badccc2f6a726f3f7ec23e7bb2b7ab48de98dba057
- TLSH T1632165B2E6644B32D8E66785B156BE671D22456BC2514F0062DE8B0D02F715DC717C37
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\Installer\e59c01a.msi
- Size 14.0MB
- SHA256 921ccce853756f16dd75d1f6da6307218beca5f6bde82f8d524fcc7ebdb81620
- MD5 83ae3dae4ff8ceb1d9914f6ca6159da3
- SHA1 1525edd1e78aa3d6e1bd56429a5849034efc0cb9
- SHA512 1c64fb8039db7361237551f87f4757b6de7bdfd7a65455c4c103bb8a707989a928af475732509d40c96f41e82f75dd454813a1c0cedcf1eaa7a570cb6ff56459
- SSDEEP 393216:cQ09TbnSeDVNQs3b6+WvWCjYuPKDbAKhUS1Q1vaN:k9hDYsL7w2/hZQR
- TLSH T19EE633273E025B36C81B5FB754FBCB244279FC445AA0690333D8B81AF9F62C5157A9CA
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
- Size 26.1MB
- SHA256 a84ebd4ac38953375c353e6ef2d97906c7ec83c950f4deb1434f81554f42b7ad
- MD5 ad4d84f6889aa4e271630fa8f5d44c12
- SHA1 f177e6aa98bdcb1e74bd9fc0fc39eee5933f41c3
- SHA512 007efc7d9d148006011f59b044fc21c23ac014d66a31b51e4af8469050243e6c70f56924db26e6cb0dc5d9b590961b2f0bf19979978c0f6cb85075d004df546a
- SSDEEP 24576:FFo3DMPudoO/vvTL/iQSCy1w/7uoZ7lhkvUAtvsqUnc65lTicoxGSr4j2+k:uHA
- TLSH T11C57F41436F92210E7F39E3CA8F46A234D397D5B9C1ADE8C45411B4E0922F71E972F6A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\Volume{cb180e94-0000-0000-0000-d08302000000}\System Volume Information\SPP\OnlineMetadataCache\{2c85e4e9-df87-4c7a-8407-79dcc6da14a6}_OnDiskSnapshotProp
- Size 6KB
- SHA256 86067d332b74fda2778d0c95c2b750cd5c742a17d4237bd44d8e4b5644730244
- MD5 898972018642e9762d2ce8fa81aeb84a
- SHA1 87924c2c00eddc00c7c4d90da36435d1474c95a7
- SHA512 91cc9b495d2fb02f0bd6c9d2540b0f30d761e78ffad9b8d406465df6d3af8a9808fb1b7ada9fea8f96064cfc42588c96e16f440df96652484c80832e0b69d523
- SSDEEP 96:FHNa+7wW9vc6DD84LTHzbOHXOHBlBRQn8Sc9XE56tOSVQpu:6Fyb++uVm
- TLSH T151D186085AF54711E2B3AB7128F18557A877B811EF33CB8E0298238E6671910F935F6F
- MD5 SHA1 SHA512 SSDEEP TLSH