Analysis
- max time kernel
150s - max time network
154s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
30/07/2026, 01:16
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Retrac_3.0.3_x64_en_US.msi
Resource
win10v2004-20260513-en
windows10-2004-x64
20 signatures
150 seconds
Behavioral task
behavioral2
Sample
Retrac_3.0.3_x64_en_US.msi
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
21 signatures
150 seconds
General
- Target Retrac_3.0.3_x64_en_US.msi
- Size 14.0MB
- Sample260730-bm6dxsar21
- SHA256 921ccce853756f16dd75d1f6da6307218beca5f6bde82f8d524fcc7ebdb81620
- MD5 83ae3dae4ff8ceb1d9914f6ca6159da3
- SHA1 1525edd1e78aa3d6e1bd56429a5849034efc0cb9
- SHA512 1c64fb8039db7361237551f87f4757b6de7bdfd7a65455c4c103bb8a707989a928af475732509d40c96f41e82f75dd454813a1c0cedcf1eaa7a570cb6ff56459
- SSDEEP 393216:cQ09TbnSeDVNQs3b6+WvWCjYuPKDbAKhUS1Q1vaN:k9hDYsL7w2/hZQR
- TLSH T19EE633273E025B36C81B5FB754FBCB244279FC445AA0690333D8B81AF9F62C5157A9CA
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 1088 retrac.exe - Loads dropped DLL 1 IoCs
pid Process 4476 MsiExec.exe - Badlisted process makes network request 1 IoCs
Network request originating from process or tool commonly abused by malware.
flow pid Process 3 2412 msiexec.exe - Checks whether UAC is enabled 1 TTPs 1 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA retrac.exe - Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\D: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\D: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\P: msiexec.exe - Drops file in Program Files directory 2 IoCs
description ioc Process File created C:\Program Files\Retrac\retrac.exe msiexec.exe File created C:\Program Files\Retrac\Uninstall Retrac.lnk msiexec.exe - Drops file in Windows directory 16 IoCs
description ioc Process File created C:\Windows\Installer\e59c2d9.msi msiexec.exe File created C:\Windows\SystemTemp\~DFC89CFDB12182B9DA.TMP msiexec.exe File opened for modification C:\Windows\Installer\MSIC75D.tmp msiexec.exe File opened for modification C:\Windows\Installer\{B64341E3-8AF2-4B11-8395-8748AE7D1423}\ProductIcon msiexec.exe File created C:\Windows\SystemTemp\~DF69DE8008AAE67276.TMP msiexec.exe File created C:\Windows\Installer\e59c2db.msi msiexec.exe File created C:\Windows\SystemTemp\~DFAEED6A7D89813DA4.TMP msiexec.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4712_1131469683\manifest.json msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4712_1131469683\manifest.fingerprint msedgewebview2.exe File opened for modification C:\Windows\Installer\e59c2d9.msi msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File created C:\Windows\SystemTemp\~DFB6C7D4D34F7CB36E.TMP msiexec.exe File created C:\Windows\Installer\SourceHash{B64341E3-8AF2-4B11-8395-8748AE7D1423} msiexec.exe File created C:\Windows\Installer\{B64341E3-8AF2-4B11-8395-8748AE7D1423}\ProductIcon msiexec.exe - Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
pid Process 2412 msiexec.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe - Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 000000000400000031a81fc62ba3bf350000000000000000000000000000000000000000000000000000000000000000000000000000000000001071020000000000c012000000000000000000000000270101000088380131a81fc60000000000001071020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d0830200000000006025c501000000000000000000000700010000e8410131a81fc6000000000000d08302000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9c701000000000000050000000000000000000000070001000098d4e331a81fc600000000000030a9c7010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9cc0100000000000005000000000000000000000007000100009854e631a81fc600000000000030a9cc01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr vssvc.exe - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedgewebview2.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedgewebview2.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedgewebview2.exe - Modifies data under HKEY_USERS 3 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28 msiexec.exe Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E msiexec.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27 msiexec.exe - Modifies registry class 46 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3E14346B2FA811B438597884EAD74132\PackageCode = "5AF8DFF4402CB2D43B0C16EE2B44E2EE" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3E14346B2FA811B438597884EAD74132\SourceList msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3E14346B2FA811B438597884EAD74132\SourceList\PackageName = "Retrac_3.0.3_x64_en_US.msi" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3E14346B2FA811B438597884EAD74132\SourceList\Media msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3E14346B2FA811B438597884EAD74132\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3E14346B2FA811B438597884EAD74132\ProductName = "Retrac" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3E14346B2FA811B438597884EAD74132\SourceList\Net msiexec.exe Key created \REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\retrac retrac.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3E14346B2FA811B438597884EAD74132 msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3E14346B2FA811B438597884EAD74132\Assignment = "1" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3E14346B2FA811B438597884EAD74132\InstanceType = "0" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3E14346B2FA811B438597884EAD74132\AuthorizedLUAApp = "0" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\D39F67BF21D37C75581F63A03A3CC6BF\3E14346B2FA811B438597884EAD74132 msiexec.exe Set value (str) \REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\retrac\ = "URL:launcher.retrac.site protocol" retrac.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\retrac\URL Protocol msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\retrac\DefaultIcon\ = "\"C:\\PROGRA~1\\Retrac\\retrac.exe\",0" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\retrac msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\retrac\shell\open msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\retrac\shell\open\command\ = "\"C:\\PROGRA~1\\Retrac\\retrac.exe\" \"%1\"" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\3E14346B2FA811B438597884EAD74132 msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3E14346B2FA811B438597884EAD74132\Language = "0" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3E14346B2FA811B438597884EAD74132\Version = "50331651" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\retrac\DefaultIcon msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\retrac\shell\open\command msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3E14346B2FA811B438597884EAD74132\ProductIcon = "C:\\Windows\\Installer\\{B64341E3-8AF2-4B11-8395-8748AE7D1423}\\ProductIcon" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3E14346B2FA811B438597884EAD74132\DeploymentFlags = "3" msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3E14346B2FA811B438597884EAD74132\Clients = 3a0000000000 msiexec.exe Set value (str) \REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\retrac\URL Protocol retrac.exe Key created \REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\retrac\shell retrac.exe Key created \REGISTRY\MACHINE\Software\Classes\retrac msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\retrac\shell msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\3E14346B2FA811B438597884EAD74132\External msiexec.exe Key created \REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\retrac\DefaultIcon retrac.exe Key created \REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\retrac\shell\open\command retrac.exe Set value (str) \REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\retrac\shell\open\command\ = "\"C:\\Program Files\\Retrac\\retrac.exe\" \"%1\"" retrac.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\3E14346B2FA811B438597884EAD74132\ShortcutsFeature = "MainProgram" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\3E14346B2FA811B438597884EAD74132\MainProgram msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\3E14346B2FA811B438597884EAD74132\Environment = "MainProgram" msiexec.exe Key created \REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\retrac\shell\open retrac.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\retrac\ = "URL: protocol" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3E14346B2FA811B438597884EAD74132\AdvertiseFlags = "388" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3E14346B2FA811B438597884EAD74132\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3E14346B2FA811B438597884EAD74132\SourceList\Media\1 = ";" msiexec.exe Set value (str) \REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\retrac\DefaultIcon\ = "C:\\Program Files\\Retrac\\retrac.exe,0" retrac.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\D39F67BF21D37C75581F63A03A3CC6BF msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\retrac\shell\open\command msiexec.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4164 msiexec.exe 4164 msiexec.exe 1088 retrac.exe 1088 retrac.exe 1088 retrac.exe 1088 retrac.exe 1088 retrac.exe 1088 retrac.exe 1088 retrac.exe 1088 retrac.exe 1088 retrac.exe 1088 retrac.exe 1088 retrac.exe 1088 retrac.exe 1088 retrac.exe 1088 retrac.exe 1088 retrac.exe 1088 retrac.exe 1088 retrac.exe 1088 retrac.exe 1088 retrac.exe 1088 retrac.exe 1088 retrac.exe 1088 retrac.exe 1088 retrac.exe 1088 retrac.exe 1088 retrac.exe 1088 retrac.exe 1088 retrac.exe 1088 retrac.exe 1088 retrac.exe 1088 retrac.exe 1088 retrac.exe 1088 retrac.exe 1088 retrac.exe 1088 retrac.exe 1088 retrac.exe 1088 retrac.exe 1088 retrac.exe 1088 retrac.exe 1088 retrac.exe 1088 retrac.exe 1088 retrac.exe 1088 retrac.exe 1088 retrac.exe 1088 retrac.exe 1088 retrac.exe 1088 retrac.exe 1088 retrac.exe 1088 retrac.exe 1088 retrac.exe 1088 retrac.exe 1088 retrac.exe 1088 retrac.exe 1088 retrac.exe 1088 retrac.exe 1088 retrac.exe 1088 retrac.exe 1088 retrac.exe 1088 retrac.exe 1088 retrac.exe 1088 retrac.exe 1088 retrac.exe 1088 retrac.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs
pid Process 4712 msedgewebview2.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 2412 msiexec.exe Token: SeIncreaseQuotaPrivilege 2412 msiexec.exe Token: SeSecurityPrivilege 4164 msiexec.exe Token: SeCreateTokenPrivilege 2412 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 2412 msiexec.exe Token: SeLockMemoryPrivilege 2412 msiexec.exe Token: SeIncreaseQuotaPrivilege 2412 msiexec.exe Token: SeMachineAccountPrivilege 2412 msiexec.exe Token: SeTcbPrivilege 2412 msiexec.exe Token: SeSecurityPrivilege 2412 msiexec.exe Token: SeTakeOwnershipPrivilege 2412 msiexec.exe Token: SeLoadDriverPrivilege 2412 msiexec.exe Token: SeSystemProfilePrivilege 2412 msiexec.exe Token: SeSystemtimePrivilege 2412 msiexec.exe Token: SeProfSingleProcessPrivilege 2412 msiexec.exe Token: SeIncBasePriorityPrivilege 2412 msiexec.exe Token: SeCreatePagefilePrivilege 2412 msiexec.exe Token: SeCreatePermanentPrivilege 2412 msiexec.exe Token: SeBackupPrivilege 2412 msiexec.exe Token: SeRestorePrivilege 2412 msiexec.exe Token: SeShutdownPrivilege 2412 msiexec.exe Token: SeDebugPrivilege 2412 msiexec.exe Token: SeAuditPrivilege 2412 msiexec.exe Token: SeSystemEnvironmentPrivilege 2412 msiexec.exe Token: SeChangeNotifyPrivilege 2412 msiexec.exe Token: SeRemoteShutdownPrivilege 2412 msiexec.exe Token: SeUndockPrivilege 2412 msiexec.exe Token: SeSyncAgentPrivilege 2412 msiexec.exe Token: SeEnableDelegationPrivilege 2412 msiexec.exe Token: SeManageVolumePrivilege 2412 msiexec.exe Token: SeImpersonatePrivilege 2412 msiexec.exe Token: SeCreateGlobalPrivilege 2412 msiexec.exe Token: SeCreateTokenPrivilege 2412 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 2412 msiexec.exe Token: SeLockMemoryPrivilege 2412 msiexec.exe Token: SeIncreaseQuotaPrivilege 2412 msiexec.exe Token: SeMachineAccountPrivilege 2412 msiexec.exe Token: SeTcbPrivilege 2412 msiexec.exe Token: SeSecurityPrivilege 2412 msiexec.exe Token: SeTakeOwnershipPrivilege 2412 msiexec.exe Token: SeLoadDriverPrivilege 2412 msiexec.exe Token: SeSystemProfilePrivilege 2412 msiexec.exe Token: SeSystemtimePrivilege 2412 msiexec.exe Token: SeProfSingleProcessPrivilege 2412 msiexec.exe Token: SeIncBasePriorityPrivilege 2412 msiexec.exe Token: SeCreatePagefilePrivilege 2412 msiexec.exe Token: SeCreatePermanentPrivilege 2412 msiexec.exe Token: SeBackupPrivilege 2412 msiexec.exe Token: SeRestorePrivilege 2412 msiexec.exe Token: SeShutdownPrivilege 2412 msiexec.exe Token: SeDebugPrivilege 2412 msiexec.exe Token: SeAuditPrivilege 2412 msiexec.exe Token: SeSystemEnvironmentPrivilege 2412 msiexec.exe Token: SeChangeNotifyPrivilege 2412 msiexec.exe Token: SeRemoteShutdownPrivilege 2412 msiexec.exe Token: SeUndockPrivilege 2412 msiexec.exe Token: SeSyncAgentPrivilege 2412 msiexec.exe Token: SeEnableDelegationPrivilege 2412 msiexec.exe Token: SeManageVolumePrivilege 2412 msiexec.exe Token: SeImpersonatePrivilege 2412 msiexec.exe Token: SeCreateGlobalPrivilege 2412 msiexec.exe Token: SeCreateTokenPrivilege 2412 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 2412 msiexec.exe Token: SeLockMemoryPrivilege 2412 msiexec.exe - Suspicious use of FindShellTrayWindow 3 IoCs
pid Process 2412 msiexec.exe 2412 msiexec.exe 1088 retrac.exe - Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 2412 msiexec.exe 4164 msiexec.exe 4476 MsiExec.exe - Suspicious use of WriteProcessMemory 21 IoCs
description pid Process procid_target PID 4164 wrote to memory of 4476 4164 msiexec.exe 90 PID 4164 wrote to memory of 4220 4164 msiexec.exe 96 PID 2412 wrote to memory of 1088 2412 msiexec.exe 99 PID 1088 wrote to memory of 4712 1088 retrac.exe 100 PID 4712 wrote to memory of 1744 4712 msedgewebview2.exe 101 PID 4712 wrote to memory of 1572 4712 msedgewebview2.exe 102 PID 4712 wrote to memory of 1572 4712 msedgewebview2.exe 102 PID 4712 wrote to memory of 1572 4712 msedgewebview2.exe 102 PID 4712 wrote to memory of 1572 4712 msedgewebview2.exe 102 PID 4712 wrote to memory of 2456 4712 msedgewebview2.exe 103 PID 4712 wrote to memory of 2444 4712 msedgewebview2.exe 104 PID 4712 wrote to memory of 2444 4712 msedgewebview2.exe 104 PID 4712 wrote to memory of 2444 4712 msedgewebview2.exe 104 PID 4712 wrote to memory of 3024 4712 msedgewebview2.exe 105 PID 4712 wrote to memory of 3024 4712 msedgewebview2.exe 105 PID 4712 wrote to memory of 3024 4712 msedgewebview2.exe 105 PID 4712 wrote to memory of 3024 4712 msedgewebview2.exe 105 PID 4712 wrote to memory of 3024 4712 msedgewebview2.exe 105 PID 4712 wrote to memory of 4920 4712 msedgewebview2.exe 108 PID 4712 wrote to memory of 4920 4712 msedgewebview2.exe 108 PID 4712 wrote to memory of 4920 4712 msedgewebview2.exe 108 - Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\Retrac_3.0.3_x64_en_US.msi1⤵
- Badlisted process makes network request
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2412 -
C:\Program Files\Retrac\retrac.exe"C:\Program Files\Retrac\retrac.exe"2⤵
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1088 -
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=retrac.exe --webview-exe-version=1.0.0 --user-data-dir="C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --enable-features=MojoIpcz --lang=en-US --accept-lang=en-US --mojo-named-platform-channel-pipe=1088.1720.4007591640725519993 /pfhostedapp:fd0de7e5cefc9f8a2e2a61a11d5c8b08aabc87ca3⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of WriteProcessMemory
PID:4712 -
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView /prefetch:4 /pfhostedapp:fd0de7e5cefc9f8a2e2a61a11d5c8b08aabc87ca --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x184,0x188,0x18c,0x160,0x194,0x7ffebb075fd8,0x7ffebb075fe4,0x7ffebb075ff04⤵PID:1744
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView" --webview-exe-name=retrac.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1764 --field-trial-handle=1768,i,7039651222104285708,10539979631966724312,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:2 /pfhostedapp:fd0de7e5cefc9f8a2e2a61a11d5c8b08aabc87ca4⤵PID:1572
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView" --webview-exe-name=retrac.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2156 --field-trial-handle=1768,i,7039651222104285708,10539979631966724312,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:3 /pfhostedapp:fd0de7e5cefc9f8a2e2a61a11d5c8b08aabc87ca4⤵PID:2456
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView" --webview-exe-name=retrac.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2276 --field-trial-handle=1768,i,7039651222104285708,10539979631966724312,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:fd0de7e5cefc9f8a2e2a61a11d5c8b08aabc87ca4⤵PID:2444
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView" --webview-exe-name=retrac.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --autoplay-policy=no-user-gesture-required --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3364 --field-trial-handle=1768,i,7039651222104285708,10539979631966724312,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /pfhostedapp:fd0de7e5cefc9f8a2e2a61a11d5c8b08aabc87ca /prefetch:14⤵PID:3024
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView" --webview-exe-name=retrac.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2060 --field-trial-handle=1768,i,7039651222104285708,10539979631966724312,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:fd0de7e5cefc9f8a2e2a61a11d5c8b08aabc87ca4⤵PID:4920
-
-
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4164 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 73947BD0F7838E12C67801CB38FE0E89 C2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4476
-
-
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵PID:4220
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
PID:5880
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Config.Msi\e59c2da.rbs
- Size 10KB
- SHA256 1e1dbeb8630b2094e469a86b5958a84fc658ae8d7a369953ee32b644ba4ce60e
- MD5 3a7c4f7aaba40409b04d982d159a0571
- SHA1 b323d28e2e59b0277f206ad75c93bba95f7db632
- SHA512 ed076282973c1a56294bb86f934ea81c0d66aee3de931e5db52da84ac13b27efe2139ea51d2e2841e054aa0992095ac7f3ef6ced2b3314bdeeb8561e58ba9d8a
- SSDEEP 192:q+meQDQEQDPQIQ1XC1iORaAUdGZ3aAUduEjNhZsgjixj91jFhWjUiYDSUF53srps:qhcTD4nqiWuau8EjNQ4il9hF4dYDSUFh
- TLSH T136223002BA4045C2FA576F35C7971B143BB3C7D84338678F17CDE0289E56BC92E5568A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Retrac\retrac.exe
- Size 25.0MB
- SHA256 c724f7f13ae4213190228cb63a25778ee26a14124ad61f6ea588e58f46f2a0fb
- MD5 70c648ec13e81d4d822c07b7152fcfe4
- SHA1 8600bbf1adcafe7c52e11965ed70bf08a6dd083d
- SHA512 f08ff5b89fd12c078b93e46c98a31ea0bf63603bb6122bfa1611359d04e8a6b25d576bebf6cd15f060e35e62c43f0603b09f340c8595ce6b62adb7d91931f711
- SSDEEP 393216:eWepOHw+Y8Avmii8lXqOedAMaCsPAwBxK7ifpIPC5:upOQ+Y8kNl/bdP47il5
- TLSH T151475A217B9A996CD19AC47483474AB24E7170DB0B35BAFF449492383F6DBF42F38258
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Retrac\Retrac.lnk
- Size 1KB
- SHA256 ab7c25c7a7de934846294d4eb7e8c3f85b147a8beb70890a47e99653fe0988c6
- MD5 f138df37878ccb9ce967d11924f08f8a
- SHA1 9fd2c4c072d73ece959983a3e0a38f58774cf754
- SHA512 694407628ecc7b913f730fadd1226a33dcbdd29266b66c4192da0cfb4f3a0c5ad345ef4bdd9e9d30daa1ceee70f4d1e819bd9b246d16d0c0d69e8dd7fc8379ff
- TLSH T11E41AD1097D00B1AF2734B396EB91E718F32FC0AA9259F2F4188008F0975541A96DF2E
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Retrac\Retrac.lnk~RFe59c896.TMP
- Size 1KB
- SHA256 f7a2f463aa368aff78a0d6cb914ef2f6dc760b081a7938a5a04bcbe8f4c606bb
- MD5 9d95e8e46d897fc4f7ec8215b12d8ceb
- SHA1 197b6d631c90615783911d910274430e61075de9
- SHA512 d763280487b78520a6c1d487820f30c50bc4953be9638005358420a0ceb94b1d3b206c3f1279df5ad5288891032cf0842ae5fa50d42cd6d38bb577df5d485f54
- TLSH T194416A1097D00B2AF2738B396EB91E708F36FC0AA9259F2B4188018F1575541A96DF6E
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\MSI65E4.tmp
- Size 132KB
- SHA256 7f47d98ab25cfea9b3a2e898c3376cc9ba1cd893b4948b0c27caa530fd0e34cc
- MD5 cfbb8568bd3711a97e6124c56fcfa8d9
- SHA1 d7a098ae58bdd5e93a3c1b04b3d69a14234d5e57
- SHA512 860cbf3286ac4915580cefaf56a9c3d48938eb08e3f31b7f024c4339c037d7c8bdf16e766d08106505ba535be4922a87dc46bd029aae99a64ea2fc02cf3aec04
- SSDEEP 3072:Kx2YbpcgwmiTPJDnCO+DATkURBnrskNwPj2:XXgwmY1CPx2XG2
- TLSH T1DBD39D02B5D0C473D9BE09390870DB229F7EB930DF909EDB636856699E702C19E35A37
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView\Crashpad\settings.dat
- Size 280B
- SHA256 85a7c90440662d772742d57bf631bca8d0b88d9ae75e24b78e0b8637935f7bb7
- MD5 9b3445f7a361ca7bf29dd2adb5bf22e0
- SHA1 2b0cf1a29e5ad8fa599f1a5ff784e51c16c083ac
- SHA512 91a8d3a55d739ce0780d6a70872907f541d595bb3be89fb9bceb794a3a07e22cdad79a935f2623ea1320c1193ba585b1b6e3227e7c95d39b94438cd8ad2978be
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView\Crashpad\settings.dat
- Size 280B
- SHA256 916870916b3b09473c6407801814be622c498ea91fb558a0cdca0970f10c569f
- MD5 0ee6249c85949ce1011c9aec9d17b478
- SHA1 6e1393eced4bc8b8294474d58475f203e6482979
- SHA512 ab01701f370f1b6447dff4a5795343c2e9b421e2e00b9801c59aae3c109a09c29bedabb0e23558a5b7bca2b4bc581a2634d457054c96b3270e2b3aba1c49b62f
- TLSH T175D012123E018634C02021730013630C0500C11B40094044952C961E3B28464090A441
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView\Crashpad\throttle_store.dat
- Size 20B
- SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
- MD5 9e4e94633b73f4a7680240a0ffd6cd2c
- SHA1 e68e02453ce22736169a56fdb59043d33668368f
- SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView\Default\Code Cache\js\index-dir\the-real-index
- Size 72B
- SHA256 53b7f2196c00c1b67c8404e1fcd2d4de873d5185503ad0892a7301d237fca160
- MD5 94c0c0471ac62e81f4fae18ccce757c1
- SHA1 4de5387036732acef216fbdce73ae0a42ff86eed
- SHA512 31002468ec75d6f5432634a3ff71b94fc8a51e07cc0200943353aff15654b34efe01b89ce7a4ec83df358b8a76e831282e73960925e13dcbb247a617280d0386
- TLSH T12BA0021009902843D2225B7464C11681763468204A370F92D0E8B164E8783854512512
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView\Default\Code Cache\js\index-dir\the-real-index~RFe5a2694.TMP
- Size 48B
- SHA256 610c08b7f7a3e16907f2c228f67ca4cb5f233af1f5121a8a932996f5dc8c7fda
- MD5 105eae1b7f65671a0fa3c96771954ffc
- SHA1 dd12e88a3a391f34fa2de95be2cd69cb316615b9
- SHA512 83df1f517d0e83ee2f30eaf50fb3b886326053f0bdd0bf762cddf1c72b690cf7f94d71859ae97de9a8e168a366e8626e5a391b9a9267a926ead5c38c968db199
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView\Default\Network\Network Persistent State
- Size 362B
- SHA256 26887834d4cde4f1f6a1f4d225141f9506fbf2edc5e8163b7632235d44791df0
- MD5 b9e90751f676834818192d28fe54bd16
- SHA1 fb2132c64c09d1c28ef406ed14fffc8005c25ddc
- SHA512 f291480ab7b134c8dc79e356132cfbbc1c6eb64a8f357be60b2bb1818b22985f0f35f507865a346b85464d3da119ddf6608f7337c20c004ff9db97f4afbe007e
- TLSH T1C3E0C0A2C3D4C9BE474043E02A347813C93F0806A3182E6ADDF9B7BE53E20B8911044B
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView\Default\Network\Network Persistent State~RFe5ae9a6.TMP
- Size 59B
- SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
- MD5 2800881c775077e1c4b6e06bf4676de4
- SHA1 2873631068c8b3b9495638c865915be822442c8b
- SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
- TLSH T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView\Default\Network\SCT Auditing Pending Reports
- Size 2B
- SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
- MD5 d751713988987e9331980363e24189ce
- SHA1 97d170e1550eee4afc0af065b78cda302a97674c
- SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView\Default\Site Characteristics Database\CURRENT
- Size 16B
- SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
- MD5 46295cac801e5d4857d09837238a6394
- SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
- SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView\Default\Site Characteristics Database\MANIFEST-000001
- Size 41B
- SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
- MD5 5af87dfd673ba2115e2fcf5cfdb727ab
- SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
- SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView\Default\cf6a92a9-8e30-4026-9264-5b037ea940d7.tmp
- Size 6KB
- SHA256 2e30378df597b1f98d02b322066a30ba2af02df86e999cb95ebdb38d78e148ae
- MD5 d9fdec968ae12e53a26a38d89f8fcd55
- SHA1 711862d811a02db50d7bed2572a93b91caf376a6
- SHA512 8677f2418cd29e6a378b0956e9084ee000f5470494b4ba8d8b658575cf44b0340e1431957b160659870c8233803cc7e8b4ee230669cdb4e801b4bc0f98957000
- SSDEEP 96:stb/dgC8k7b9QkUo5h16Z0Ls7/x+6MhmuecJiu1ejesK+gl28XM1C7K:stjOCs/onLsV+FdiuQjg3G6K
- TLSH T1D3D1B6125F24697B4CC6E109BB39BA17E3F5603265D41E48EBF9461C04EA6CC3307D0B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView\GraphiteDawnCache\data_0
- Size 8KB
- SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
- MD5 cf89d16bb9107c631daabf0c0ee58efb
- SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
- SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
- SSDEEP 3:MsFl:/F
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView\GraphiteDawnCache\data_1
- Size 264KB
- SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
- MD5 d0d388f3865d0523e451d6ba0be34cc4
- SHA1 8571c6a52aacc2747c048e3419e5657b74612995
- SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
- SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView\GraphiteDawnCache\data_2
- Size 8KB
- SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
- MD5 0962291d6d367570bee5454721c17e11
- SHA1 59d10a893ef321a706a9255176761366115bedcb
- SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
- SSDEEP 3:MsHlDll:/H
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView\GraphiteDawnCache\data_3
- Size 8KB
- SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
- MD5 41876349cb12d6db992f1309f22df3f0
- SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
- SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
- SSDEEP 3:MsGl3ll:/y
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView\Local State
- Size 3KB
- SHA256 202d331003c4fc7e8502d4455dbc394797044ad81ad8143a6f1bdd3f44b707fb
- MD5 58992445dab5ff1f5b076c549b74b9c3
- SHA1 4d83625d628603e292ae953e206a4b0941827f8c
- SHA512 85461983f45cf373facea4df76e203782d548f86c08f780994657f89f46d7127b67a33711237577fa8bea72c06d8ff1fd6a99be8e520e279b7cc3f751973fe7b
- TLSH T19171863BA97499374DF29905B98A3B03AB789037D6857F94C6ED0F0C42DB289134281B
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView\Local State
- Size 2KB
- SHA256 c26d53017469bae99aa73ecf0c7893e84b9bb9a04efb7bbc87a0b4289745cc52
- MD5 5438a866e0d7ce57f4640fb46a249156
- SHA1 8b6a44995768d66513f74bc51ee4e2b95a15346a
- SHA512 dc0b29f7eae070f467590aa9b826ffb9d8e4b434026a7111a4eb93a283526c9f110dd8ec273557538a6f2c9208e09a1a03bec6aff743d862cac5721497a484e8
- TLSH T1A0517533AD288A3795E25A05B59F3F639F389066EB925F5097DE0B0C42DB15D2342C3B
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView\Local State
- Size 3KB
- SHA256 078797750536fa83812995f9b92cdc3c4b3910443f693895929fce179f71cf1c
- MD5 6df5668bf43ee272a80e5e887b948a18
- SHA1 162d8c1faa5b6688452e242504a9b8d521bcbdcb
- SHA512 db507df7c304688234c069dc12d062239626b82e0965a4b143b6c3fa0a240f418c57d9dda32757285382337c16fc922ad7df7e096b5cd406f2a6beb11d31e265
- TLSH T1B761843BA93499374DE29A05B98B3B16AB749037E6C16F94C6ED0F0C42DB2981342C1B
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView\Local State
- Size 14KB
- SHA256 7e403826d147549fcb954abcf57d749640260206a150bab27285bfbfb78882ed
- MD5 0218ff64225ea92d4a51d3cded9b3443
- SHA1 394789f2abd81eca7de1620d3df694472026c12a
- SHA512 a1dd52b28c7dcba45d6291c2dcd8393b4901df9b0e6645fbe2fe6ddf59c5a7b40ad64692e2d05ec0d3042cf58124dbfb5a42599b7f25bf20ce27c9d43e7ff065
- SSDEEP 192:eDFOKH/2/aQWjYhwZ00i+z/kNWIU6ZwNj1Jfo/iVQ45hgj4k0NBSNLeeoDUh9Mse:g+aQikB+z/xvxjg/qhEwNBSo8T+iU9z/
- TLSH T1AF629F2B65786D3755F3FA04794E1B9BDBB8987295C26AB84AFD0F0D07C73980342817
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView\Local State~RFe59d363.TMP
- Size 1KB
- SHA256 8fe5008afc3d5ee0020e50278f1297b6bc2cdbf385be2497c8e36bcb93a1f9d8
- MD5 f83c5bba9ebebc9ea420f53cb9a5366f
- SHA1 355feb8d96787e01419fc29d349e60374ba2d5ca
- SHA512 e082cf29c24b175275069e77bf291670164412c00aa5ee64dce86dff5e3ca19e64616703b855acb3b65c0a6e5c7ce38f9c0cb6fbbb188ad486f6533e3f1be378
- TLSH T12A211277E9784B3268C16646729B7BA71F34606B93418F00A3CE0B0D53E619D662783B
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\Installer\e59c2d9.msi
- Size 14.0MB
- SHA256 921ccce853756f16dd75d1f6da6307218beca5f6bde82f8d524fcc7ebdb81620
- MD5 83ae3dae4ff8ceb1d9914f6ca6159da3
- SHA1 1525edd1e78aa3d6e1bd56429a5849034efc0cb9
- SHA512 1c64fb8039db7361237551f87f4757b6de7bdfd7a65455c4c103bb8a707989a928af475732509d40c96f41e82f75dd454813a1c0cedcf1eaa7a570cb6ff56459
- SSDEEP 393216:cQ09TbnSeDVNQs3b6+WvWCjYuPKDbAKhUS1Q1vaN:k9hDYsL7w2/hZQR
- TLSH T19EE633273E025B36C81B5FB754FBCB244279FC445AA0690333D8B81AF9F62C5157A9CA
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
- Size 26.1MB
- SHA256 45a399cdf53a3badc01ebb356faafe3e6599e614779f2a682e775635cd018d39
- MD5 ac374dbbf0c85fab772dc9d968e7305c
- SHA1 999d01dedc5275afba18c4f2981c97438d1a3031
- SHA512 31703808b44b4d537d44c5c2e2df1643e8e2012f2f81aa609547c800b783c5cc8475ac7708bf5067f68127c7b1cb7132b89af4883a6cd4823e99f0396214e33e
- SSDEEP 24576:+Fo3DMPmdoO/vvTL/yAjDilQP7eJY7Eg0+1xNudb1WtqJESTsIRmD6pin+z:hHI
- TLSH T18357B31436F92200E7B79E3DB8F06A234D397D5BAC15DE8D45511B8E0822F71E872F6A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\Volume{c61fa831-0000-0000-0000-d08302000000}\System Volume Information\SPP\OnlineMetadataCache\{5ad5e7e0-3005-4d8c-861c-83edd1e08eac}_OnDiskSnapshotProp
- Size 6KB
- SHA256 9d9431e40f4c61214d6435222e70bf9576d9884d527750788cea2b94e0bf5b8a
- MD5 c005902577ee4b50a1e718c6ef120928
- SHA1 c45a1b1c6fd9061e9e41b8fe0a2a7149986d588f
- SHA512 1fe397d8129bffa43e6d2ceccbebe1724b76a5af152c1afb13376c31764f3b59dff01a4a2437177d6a8e1359034c335f24b218519aecedbfafc87dac6024e86f
- SSDEEP 96:FXI+bWvc6DD84LTHzbOHXOHBlBRQn8Sc9XE56tOSVQpu:5Ibb++uVm
- TLSH T166D188085AF54711E2B3AB3228F14557A877B911EF33CB8E0198238E6671A10F835F6F
- MD5 SHA1 SHA512 SSDEEP TLSH