Analysis
- max time kernel
149s - max time network
146s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
09/08/2026, 15:58
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Retrac_3.0.8_x64_en-US.msi
Resource
win10v2004-20260513-en
windows10-2004-x64
26 signatures
150 seconds
Behavioral task
behavioral2
Sample
Retrac_3.0.8_x64_en-US.msi
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
21 signatures
150 seconds
General
- Target Retrac_3.0.8_x64_en-US.msi
- Size 14.4MB
- Sample260809-tev74atycy
- SHA256 f25ac4aed0f36abdb2f0ea2cdb67e4249d7d70467718f718445559cf4e0ffd89
- MD5 965f3d0bff58a004b2642bf6d637dedc
- SHA1 1c65936cb7545559f090173a494ff1bc2839f1eb
- SHA512 68baec2ebd5d6b4eecc6190eb02265572ed952f609423399d5cb5e3f7dd43c8c0e005491bd52be72fdb289f700cfcadee33caea80ca30bf7f5cd5b60fcd2f28d
- SSDEEP 393216:Xgwqa+Wmti6d4hGDOQ1X0ADGK/pC6HuAhUO2bJRA:wwc1fdMvFADZ/pCJAhUFN+
- TLSH T151E633873D96DB11C8A21D7A44BBC3A822387D400624D9A777DCB82DDEF23C095769DE
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 1228 retrac.exe - Loads dropped DLL 1 IoCs
pid Process 4956 MsiExec.exe - Badlisted process makes network request 1 IoCs
Network request originating from process or tool commonly abused by malware.
flow pid Process 2 2716 msiexec.exe - Checks whether UAC is enabled 1 TTPs 1 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA retrac.exe - Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\D: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\D: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\M: msiexec.exe - Drops file in Program Files directory 2 IoCs
description ioc Process File created C:\Program Files\Retrac\retrac.exe msiexec.exe File created C:\Program Files\Retrac\Uninstall Retrac.lnk msiexec.exe - Drops file in Windows directory 14 IoCs
description ioc Process File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File created C:\Windows\SystemTemp\~DF596F4076B6631634.TMP msiexec.exe File created C:\Windows\Installer\SourceHash{F2567F58-5A4A-4F82-886D-ED5C11F380BE} msiexec.exe File created C:\Windows\SystemTemp\~DF8D04FF929A3B5EBD.TMP msiexec.exe File opened for modification C:\Windows\Installer\MSI65EF.tmp msiexec.exe File opened for modification C:\Windows\Installer\e5a5f48.msi msiexec.exe File created C:\Windows\Installer\{F2567F58-5A4A-4F82-886D-ED5C11F380BE}\ProductIcon msiexec.exe File opened for modification C:\Windows\Installer\{F2567F58-5A4A-4F82-886D-ED5C11F380BE}\ProductIcon msiexec.exe File created C:\Windows\Installer\e5a5f4a.msi msiexec.exe File created C:\Windows\SystemTemp\~DF3A34E2401EBF63C4.TMP msiexec.exe File created C:\Windows\SystemTemp\~DFF46E55258EFB2413.TMP msiexec.exe File created C:\Windows\Installer\e5a5f48.msi msiexec.exe - Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
pid Process 2716 msiexec.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe - Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 000000000400000067831fc6f5c7bf350000000000000000000000000000000000000000000000000000000000000000000000000000000000001071020000000000c012000000000000000000000000270101000088380167831fc60000000000001071020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d0830200000000006025c501000000000000000000000700010000e8410167831fc6000000000000d08302000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9c701000000000000050000000000000000000000070001000098d4e367831fc600000000000030a9c7010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9cc0100000000000005000000000000000000000007000100009854e667831fc600000000000030a9cc01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedgewebview2.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedgewebview2.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedgewebview2.exe - Modifies data under HKEY_USERS 3 IoCs
description ioc Process Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E msiexec.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27 msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28 msiexec.exe - Modifies registry class 46 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\retrac\shell\open msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\85F7652FA4A528F488D6DEC5113F08EB\ShortcutsFeature = "MainProgram" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\D39F67BF21D37C75581F63A03A3CC6BF\85F7652FA4A528F488D6DEC5113F08EB msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\85F7652FA4A528F488D6DEC5113F08EB\SourceList\Media msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\retrac\shell\open\command msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\85F7652FA4A528F488D6DEC5113F08EB\External msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\85F7652FA4A528F488D6DEC5113F08EB\ProductIcon = "C:\\Windows\\Installer\\{F2567F58-5A4A-4F82-886D-ED5C11F380BE}\\ProductIcon" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\85F7652FA4A528F488D6DEC5113F08EB\SourceList\PackageName = "Retrac_3.0.8_x64_en-US.msi" msiexec.exe Set value (str) \REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\retrac\DefaultIcon\ = "C:\\Program Files\\Retrac\\retrac.exe,0" retrac.exe Key created \REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\retrac\shell\open retrac.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\retrac\ = "URL: protocol" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\85F7652FA4A528F488D6DEC5113F08EB\DeploymentFlags = "3" msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\85F7652FA4A528F488D6DEC5113F08EB\Clients = 3a0000000000 msiexec.exe Set value (str) \REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\retrac\ = "URL:launcher.retrac.site protocol" retrac.exe Key created \REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\retrac\shell\open\command retrac.exe Key created \REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\retrac\shell retrac.exe Key created \REGISTRY\MACHINE\Software\Classes\retrac\shell\open\command msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\85F7652FA4A528F488D6DEC5113F08EB\SourceList msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\85F7652FA4A528F488D6DEC5113F08EB\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\85F7652FA4A528F488D6DEC5113F08EB\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\" msiexec.exe Key created \REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\retrac retrac.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\retrac\DefaultIcon\ = "\"C:\\PROGRA~1\\Retrac\\retrac.exe\",0" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\85F7652FA4A528F488D6DEC5113F08EB\Language = "0" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\85F7652FA4A528F488D6DEC5113F08EB\Version = "50331656" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\85F7652FA4A528F488D6DEC5113F08EB\Assignment = "1" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\retrac\URL Protocol msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\85F7652FA4A528F488D6DEC5113F08EB msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\85F7652FA4A528F488D6DEC5113F08EB\MainProgram msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\85F7652FA4A528F488D6DEC5113F08EB msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\85F7652FA4A528F488D6DEC5113F08EB\ProductName = "Retrac" msiexec.exe Key created \REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\retrac\DefaultIcon retrac.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\retrac\shell msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\85F7652FA4A528F488D6DEC5113F08EB\PackageCode = "6AFF5C71F42D1914DA5EF303DCA200A2" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\85F7652FA4A528F488D6DEC5113F08EB\AuthorizedLUAApp = "0" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\retrac msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\retrac\shell\open\command\ = "\"C:\\PROGRA~1\\Retrac\\retrac.exe\" \"%1\"" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\85F7652FA4A528F488D6DEC5113F08EB\Environment = "MainProgram" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\85F7652FA4A528F488D6DEC5113F08EB\AdvertiseFlags = "388" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\85F7652FA4A528F488D6DEC5113F08EB\SourceList\Net msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\85F7652FA4A528F488D6DEC5113F08EB\SourceList\Media\1 = ";" msiexec.exe Set value (str) \REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\retrac\URL Protocol retrac.exe Set value (str) \REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\retrac\shell\open\command\ = "\"C:\\Program Files\\Retrac\\retrac.exe\" \"%1\"" retrac.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\85F7652FA4A528F488D6DEC5113F08EB\InstanceType = "0" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\D39F67BF21D37C75581F63A03A3CC6BF msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\retrac\DefaultIcon msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\retrac msiexec.exe - Suspicious behavior: EnumeratesProcesses 40 IoCs
pid Process 2948 msiexec.exe 2948 msiexec.exe 1228 retrac.exe 1228 retrac.exe 1228 retrac.exe 1228 retrac.exe 1228 retrac.exe 1228 retrac.exe 1228 retrac.exe 1228 retrac.exe 1228 retrac.exe 1228 retrac.exe 1228 retrac.exe 1228 retrac.exe 1228 retrac.exe 1228 retrac.exe 1228 retrac.exe 1228 retrac.exe 1228 retrac.exe 1228 retrac.exe 1228 retrac.exe 1228 retrac.exe 1228 retrac.exe 1228 retrac.exe 1228 retrac.exe 1228 retrac.exe 1228 retrac.exe 1228 retrac.exe 1228 retrac.exe 1228 retrac.exe 1228 retrac.exe 1228 retrac.exe 1228 retrac.exe 1228 retrac.exe 1228 retrac.exe 1228 retrac.exe 1228 retrac.exe 1228 retrac.exe 1228 retrac.exe 1228 retrac.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs
pid Process 1464 msedgewebview2.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 2716 msiexec.exe Token: SeIncreaseQuotaPrivilege 2716 msiexec.exe Token: SeSecurityPrivilege 2948 msiexec.exe Token: SeCreateTokenPrivilege 2716 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 2716 msiexec.exe Token: SeLockMemoryPrivilege 2716 msiexec.exe Token: SeIncreaseQuotaPrivilege 2716 msiexec.exe Token: SeMachineAccountPrivilege 2716 msiexec.exe Token: SeTcbPrivilege 2716 msiexec.exe Token: SeSecurityPrivilege 2716 msiexec.exe Token: SeTakeOwnershipPrivilege 2716 msiexec.exe Token: SeLoadDriverPrivilege 2716 msiexec.exe Token: SeSystemProfilePrivilege 2716 msiexec.exe Token: SeSystemtimePrivilege 2716 msiexec.exe Token: SeProfSingleProcessPrivilege 2716 msiexec.exe Token: SeIncBasePriorityPrivilege 2716 msiexec.exe Token: SeCreatePagefilePrivilege 2716 msiexec.exe Token: SeCreatePermanentPrivilege 2716 msiexec.exe Token: SeBackupPrivilege 2716 msiexec.exe Token: SeRestorePrivilege 2716 msiexec.exe Token: SeShutdownPrivilege 2716 msiexec.exe Token: SeDebugPrivilege 2716 msiexec.exe Token: SeAuditPrivilege 2716 msiexec.exe Token: SeSystemEnvironmentPrivilege 2716 msiexec.exe Token: SeChangeNotifyPrivilege 2716 msiexec.exe Token: SeRemoteShutdownPrivilege 2716 msiexec.exe Token: SeUndockPrivilege 2716 msiexec.exe Token: SeSyncAgentPrivilege 2716 msiexec.exe Token: SeEnableDelegationPrivilege 2716 msiexec.exe Token: SeManageVolumePrivilege 2716 msiexec.exe Token: SeImpersonatePrivilege 2716 msiexec.exe Token: SeCreateGlobalPrivilege 2716 msiexec.exe Token: SeCreateTokenPrivilege 2716 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 2716 msiexec.exe Token: SeLockMemoryPrivilege 2716 msiexec.exe Token: SeIncreaseQuotaPrivilege 2716 msiexec.exe Token: SeMachineAccountPrivilege 2716 msiexec.exe Token: SeTcbPrivilege 2716 msiexec.exe Token: SeSecurityPrivilege 2716 msiexec.exe Token: SeTakeOwnershipPrivilege 2716 msiexec.exe Token: SeLoadDriverPrivilege 2716 msiexec.exe Token: SeSystemProfilePrivilege 2716 msiexec.exe Token: SeSystemtimePrivilege 2716 msiexec.exe Token: SeProfSingleProcessPrivilege 2716 msiexec.exe Token: SeIncBasePriorityPrivilege 2716 msiexec.exe Token: SeCreatePagefilePrivilege 2716 msiexec.exe Token: SeCreatePermanentPrivilege 2716 msiexec.exe Token: SeBackupPrivilege 2716 msiexec.exe Token: SeRestorePrivilege 2716 msiexec.exe Token: SeShutdownPrivilege 2716 msiexec.exe Token: SeDebugPrivilege 2716 msiexec.exe Token: SeAuditPrivilege 2716 msiexec.exe Token: SeSystemEnvironmentPrivilege 2716 msiexec.exe Token: SeChangeNotifyPrivilege 2716 msiexec.exe Token: SeRemoteShutdownPrivilege 2716 msiexec.exe Token: SeUndockPrivilege 2716 msiexec.exe Token: SeSyncAgentPrivilege 2716 msiexec.exe Token: SeEnableDelegationPrivilege 2716 msiexec.exe Token: SeManageVolumePrivilege 2716 msiexec.exe Token: SeImpersonatePrivilege 2716 msiexec.exe Token: SeCreateGlobalPrivilege 2716 msiexec.exe Token: SeCreateTokenPrivilege 2716 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 2716 msiexec.exe Token: SeLockMemoryPrivilege 2716 msiexec.exe - Suspicious use of FindShellTrayWindow 3 IoCs
pid Process 2716 msiexec.exe 2716 msiexec.exe 1228 retrac.exe - Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 2716 msiexec.exe 2948 msiexec.exe 4956 MsiExec.exe - Suspicious use of WriteProcessMemory 18 IoCs
description pid Process procid_target PID 2948 wrote to memory of 4956 2948 msiexec.exe 90 PID 2948 wrote to memory of 4308 2948 msiexec.exe 96 PID 2716 wrote to memory of 1228 2716 msiexec.exe 99 PID 1228 wrote to memory of 1464 1228 retrac.exe 100 PID 1464 wrote to memory of 4820 1464 msedgewebview2.exe 101 PID 1464 wrote to memory of 2772 1464 msedgewebview2.exe 102 PID 1464 wrote to memory of 2772 1464 msedgewebview2.exe 102 PID 1464 wrote to memory of 2772 1464 msedgewebview2.exe 102 PID 1464 wrote to memory of 2772 1464 msedgewebview2.exe 102 PID 1464 wrote to memory of 2440 1464 msedgewebview2.exe 103 PID 1464 wrote to memory of 4532 1464 msedgewebview2.exe 104 PID 1464 wrote to memory of 4532 1464 msedgewebview2.exe 104 PID 1464 wrote to memory of 4532 1464 msedgewebview2.exe 104 PID 1464 wrote to memory of 6092 1464 msedgewebview2.exe 105 PID 1464 wrote to memory of 6092 1464 msedgewebview2.exe 105 PID 1464 wrote to memory of 6092 1464 msedgewebview2.exe 105 PID 1464 wrote to memory of 6092 1464 msedgewebview2.exe 105 PID 1464 wrote to memory of 6092 1464 msedgewebview2.exe 105 - Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\Retrac_3.0.8_x64_en-US.msi1⤵
- Badlisted process makes network request
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2716 -
C:\Program Files\Retrac\retrac.exe"C:\Program Files\Retrac\retrac.exe"2⤵
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1228 -
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=retrac.exe --webview-exe-version=3.0.8 --user-data-dir="C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --enable-features=MojoIpcz --lang=en-US --accept-lang=en-US --mojo-named-platform-channel-pipe=1228.4248.11948482069883162803 /pfhostedapp:fd0de7e5cefc9f8a2e2a61a11d5c8b08aabc87ca3⤵
- Enumerates system info in registry
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of WriteProcessMemory
PID:1464 -
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView /prefetch:4 /pfhostedapp:fd0de7e5cefc9f8a2e2a61a11d5c8b08aabc87ca --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x184,0x188,0x18c,0x160,0x194,0x7ffc7d545fd8,0x7ffc7d545fe4,0x7ffc7d545ff04⤵PID:4820
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView" --webview-exe-name=retrac.exe --webview-exe-version=3.0.8 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1780 --field-trial-handle=1784,i,11149601395189548501,18391647757521757871,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:2 /pfhostedapp:fd0de7e5cefc9f8a2e2a61a11d5c8b08aabc87ca4⤵PID:2772
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView" --webview-exe-name=retrac.exe --webview-exe-version=3.0.8 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=1980 --field-trial-handle=1784,i,11149601395189548501,18391647757521757871,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:3 /pfhostedapp:fd0de7e5cefc9f8a2e2a61a11d5c8b08aabc87ca4⤵PID:2440
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView" --webview-exe-name=retrac.exe --webview-exe-version=3.0.8 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2300 --field-trial-handle=1784,i,11149601395189548501,18391647757521757871,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:fd0de7e5cefc9f8a2e2a61a11d5c8b08aabc87ca4⤵PID:4532
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView" --webview-exe-name=retrac.exe --webview-exe-version=3.0.8 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --autoplay-policy=no-user-gesture-required --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=2892 --field-trial-handle=1784,i,11149601395189548501,18391647757521757871,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /pfhostedapp:fd0de7e5cefc9f8a2e2a61a11d5c8b08aabc87ca /prefetch:14⤵PID:6092
-
-
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2948 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding B1CE6D7EB0F2DE0B4AB24E64C17EBF72 C2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4956
-
-
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵PID:4308
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
PID:236
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Config.Msi\e5a5f49.rbs
- Size 10KB
- SHA256 337a6683bad65e34ac86f930d429ab8957272351e02ab4ac20e349a6ad0df9cb
- MD5 5ad7d923d595276e0793578867524be9
- SHA1 811183e87c086ed68eee149ef4766d472bc15f1f
- SHA512 d6b506ffe2f19cb5f2e9f34733a3115d8b75bb8123fe782f97c692b7c7ceb981e0f3370929bc73482782b694ba1ef96f65419c005a8e0884a03b328b4e7963eb
- SSDEEP 192:c3mvcD7AyCMoOuGvOuuTLbiIM4oWRiMupBCv:cWvcD7APOhOnAbq
- TLSH T14C220E42B740C2D2F9831B74DB4717263BB2DA988315674B0BCE75248F833D85EAA1CB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Retrac\retrac.exe
- Size 26.0MB
- SHA256 2550eee702fb10f576042a913674938b4a4becdcf9b887853dbaef46d6f90bd2
- MD5 789fb187c94581916bd728ce786ce972
- SHA1 aaacb9eeca073c4a727ec0b7a5264db1479bd7ec
- SHA512 4e333b330dd94204694c2355521dad82fc01dab2acdd90453c7dccd3e8e1fe1b3fc389bd1a22a0671e871741c515a0d77301f62891eb49ac39a12189c6f60cc1
- SSDEEP 393216:WYq62DqPMcqO0BwUdrsPAQK1Jmii8l/RlpLFo:WYq/O7BfPW1JNl/1
- TLSH T128575B207B9AA96DD05AC47483878A724A7130DB0B35B9FF44D496783F6DBF42F38258
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Retrac\Retrac.lnk
- Size 1KB
- SHA256 5eac775cf8c67298b8d7cb631dab04e194ac84aac6a007603ceb9cf6d64040d5
- MD5 f120a278783c666d6d1c745366beaf02
- SHA1 11c7771dea46711d933db1832e73b16ba2feee06
- SHA512 4d6d220e446bf2ff66007be8d328895b2d9c3c98fbc1f30e32b391fabe82b88bd9f10c568fd5f45eb3a2e06865403bd4d24a8a24dc626cf22c77b2289718533b
- TLSH T186418B01A7E11726F3674639AEB90921DE32BC06F6258F2F42CA44CB0DB59419978F2F
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Retrac\Retrac.lnk~RFe5a6a73.TMP
- Size 1KB
- SHA256 0ead08b57dc78ee080fcebb698a4bcb967584ad0999e3194fd4acccb2c50e553
- MD5 c32df4ea274a03e1b03c8db6d4073458
- SHA1 f0c17192caabc98d15aaca0269e9afbf43dce65c
- SHA512 32716521338a7be6ae384cf0dffb3b4c30fdb8047c051f9c4c76516d8166651f425be9e3e417f9952632f8b06dc317b511cb51206b86fa17e1561d45e484e43d
- TLSH T1AE41AF0067F11726F3638639AEB90921DE32BC01B6214F2F02C645CB08755419978F3F
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\MSI9699.tmp
- Size 132KB
- SHA256 7f47d98ab25cfea9b3a2e898c3376cc9ba1cd893b4948b0c27caa530fd0e34cc
- MD5 cfbb8568bd3711a97e6124c56fcfa8d9
- SHA1 d7a098ae58bdd5e93a3c1b04b3d69a14234d5e57
- SHA512 860cbf3286ac4915580cefaf56a9c3d48938eb08e3f31b7f024c4339c037d7c8bdf16e766d08106505ba535be4922a87dc46bd029aae99a64ea2fc02cf3aec04
- SSDEEP 3072:Kx2YbpcgwmiTPJDnCO+DATkURBnrskNwPj2:XXgwmY1CPx2XG2
- TLSH T1DBD39D02B5D0C473D9BE09390870DB229F7EB930DF909EDB636856699E702C19E35A37
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView\Crashpad\settings.dat
- Size 280B
- SHA256 1e03ac59200536fecbe6e59489d7d9eafc6d0617dc0e68dffc53fedf71326317
- MD5 23cc0162d4c3dab7c67b26424f0ab90b
- SHA1 b908176774df649f930d5146e1c5cda853ad784e
- SHA512 87b1c44ffd88f2b0b26be0a9ad83e1b17af4a114679c921d5f046feaf789b32c9053032c8c9b2b0b4b7b0c0ccea8202dc0b5153132ba29df790f6c4f20b3d3cc
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView\Crashpad\settings.dat
- Size 280B
- SHA256 4e3c4671281065444e9f0490717d764a5e22b27e162b33bcddd8ca833bcb0084
- MD5 e1a252f983c62b30a74ee8fe6ae2f136
- SHA1 6cf41b5d92c0767c3cc140038766a7cd8ab9a34b
- SHA512 89138e953a894ccb6ed7154e82795fe9bda94ea2dda18151de00678c957e55c7394c59ca07fde2a563247bb89a30878229893a22a283e3749da910490b0b0881
- TLSH T13DD0121333054235C0102433060371080644C11F408649155838999D1E489920906442
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView\Crashpad\throttle_store.dat
- Size 20B
- SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
- MD5 9e4e94633b73f4a7680240a0ffd6cd2c
- SHA1 e68e02453ce22736169a56fdb59043d33668368f
- SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView\Default\Code Cache\js\index-dir\the-real-index
- Size 72B
- SHA256 241dc46827f342922df32b4c2abadcf32c7abd7f656f656b6e9f95b977ff637f
- MD5 027a266bb926d0a9bcda7bd61fd90a6c
- SHA1 57d8710bbfbbfec6748d0ed66e80ad7abb2a756e
- SHA512 202128cb684a2bc8f05cbf6154ae204f9840566074f8286bd780dd60ddfd302ff578112b155358e4607e847b274dd42f8b266d9e5b836871d7f54d0b8a925e2f
- TLSH T14BA002302A411802D1051BB130C10641B27E59B5429F2E8151AC06AADAD13616229140
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView\Default\Code Cache\js\index-dir\the-real-index~RFe5ae3aa.TMP
- Size 48B
- SHA256 024de17726da81e6e5a1888cf92bdd5914c524005b0c0ff02db89e310878b6c0
- MD5 9b46ba93ec892ddc9db412adcf811310
- SHA1 ae598244e173263abd26e35e5352235c5ef9c557
- SHA512 c9ad2081e6e076ffd48ffbed15fe8f1dced6aadc4ea472c93355f1fc75d5fee385aa34f878e03568bd4e03ee4add18953f13eff82b8f5ef0cc08b835f47d744a
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView\Default\Network\SCT Auditing Pending Reports
- Size 2B
- SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
- MD5 d751713988987e9331980363e24189ce
- SHA1 97d170e1550eee4afc0af065b78cda302a97674c
- SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView\Default\Site Characteristics Database\000001.dbtmp
- Size 16B
- SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
- MD5 46295cac801e5d4857d09837238a6394
- SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
- SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView\Default\c9dcf4cb-d4ee-4176-9ca9-08226ca73c9d.tmp
- Size 6KB
- SHA256 b12472ada80e69da93ae19a55f845c7a1db6d26a6ed715ecf97d660286dfcc97
- MD5 790701e9c421d5e4ee6fbc6aa6ac4e5c
- SHA1 63132cac1802e9fc96077e4a8071435366272606
- SHA512 5f2a72828a6d7b2bf4f1d2e237e7ba9a9db2825d3bb4d4e113ef0dda0eae5bce912ad70904b1ba3c08ad6fa4fe26e5377c1a7d40ceda3a0d72f610ec3ed09c53
- SSDEEP 96:stN/dgBZ2gIb9LkUo5h16Z0ys7/x+6MhmuecJrx1eje7DK+gpTg28XM1C7K:stRO+jHonysV+FdrxQjsuTgG6K
- TLSH T1E7D195015E28797F8CC6F109BA39BA13E2F6603264D52E58E7F8552C04DB6CD234790B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView\Default\shared_proto_db\metadata\MANIFEST-000001
- Size 41B
- SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
- MD5 5af87dfd673ba2115e2fcf5cfdb727ab
- SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
- SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView\GraphiteDawnCache\data_0
- Size 8KB
- SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
- MD5 cf89d16bb9107c631daabf0c0ee58efb
- SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
- SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
- SSDEEP 3:MsFl:/F
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView\GraphiteDawnCache\data_2
- Size 8KB
- SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
- MD5 0962291d6d367570bee5454721c17e11
- SHA1 59d10a893ef321a706a9255176761366115bedcb
- SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
- SSDEEP 3:MsHlDll:/H
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView\GraphiteDawnCache\data_3
- Size 8KB
- SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
- MD5 41876349cb12d6db992f1309f22df3f0
- SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
- SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
- SSDEEP 3:MsGl3ll:/y
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView\Local State
- Size 3KB
- SHA256 8ff22de820e9d159fa283cb1e4ef2340d82edca98c882db342582fb3ef339941
- MD5 9863d170824a6efed4d781e8c88f5b9f
- SHA1 33f3c522a41b8e4b3d5acd2504732a3670d3ac54
- SHA512 3d74f3018aecf32bce487c0c0a108f995ca51f9be92237a551f516787fd7be41a61ae3406a2bdc04591ae1d2801f30baf20d3a5ba87a6499c14613a83b7dbd0e
- TLSH T15B61A636A974AA3B8DF2E60479862B13A7A56133E9913FA4D6FC2F1C01D72980342C13
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView\Local State
- Size 15KB
- SHA256 298cc4c47661106996d330a88049780a6f494a847ea1f50a4896f7e91099953e
- MD5 bb9ee8ee001a6b485d76bf7302b339be
- SHA1 d941636db9238a9169beae3787b75bc3afd7d603
- SHA512 112854986a3b167377318d9e490f693742145cde5a792ccb9580aeb0eec3c5e982bc749096c782dfbbf0be4a118c12323256d4b7952d2a6dde71f055a1b240de
- SSDEEP 384:a+aQikB+z/xvxjg/qhEwNBS3hcwNY6AVdpj9z9:l/UxvxjgC+2l6UjF9
- TLSH T1B4729E2798693E23A9F3F605794D1B8BCAB994B294C16EB44ABC7F0D06D72980342C16
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView\Local State
- Size 2KB
- SHA256 484e7f1a3eb6112b78b00d122d93fe7b7ea08fabdeddf2de080448168c6547a3
- MD5 a54fbabc88feddd36ed50bcfd948c3be
- SHA1 f5cbc7cc5fe01e09adae82255e4b266dbf1ff9e8
- SHA512 1f62e3af5f958b39d7176f9bd607222d5a4fca89e0646e6ef268b8b08a035e6e47a83d8b9c425d11175274f079b22c54f1be2b46f18cedd261c78d391b04f4a9
- TLSH T152519833A8146F37DDF2A6087D8A7F239A7661729A612F60D6EC2B2C01D755C1342C37
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView\Local State~RFe5a906a.TMP
- Size 1KB
- SHA256 3f82853d1ff396dc1e60a9c8b7241165b624c1b8d4d92ac24a47fb1a79842f28
- MD5 af8b61936d2143107f3c5c75bdfde481
- SHA1 f826d7be38e7339dcfbc45cd611ff0cc0e3e23ce
- SHA512 ff9ce245a7b2fe37b33ff5d0c1773e709068c930bd15d3d87fe622d5081f87ed2c692f6b5e2719c7fa62195d5a383a35e80c9c85925dd2da4f5d65cb01fbc4b6
- TLSH T159219572E4645F33FCD1B2492196BF235E22217781614F0092EC672D05E309D8616C33
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\Installer\e5a5f48.msi
- Size 14.4MB
- SHA256 f25ac4aed0f36abdb2f0ea2cdb67e4249d7d70467718f718445559cf4e0ffd89
- MD5 965f3d0bff58a004b2642bf6d637dedc
- SHA1 1c65936cb7545559f090173a494ff1bc2839f1eb
- SHA512 68baec2ebd5d6b4eecc6190eb02265572ed952f609423399d5cb5e3f7dd43c8c0e005491bd52be72fdb289f700cfcadee33caea80ca30bf7f5cd5b60fcd2f28d
- SSDEEP 393216:Xgwqa+Wmti6d4hGDOQ1X0ADGK/pC6HuAhUO2bJRA:wwc1fdMvFADZ/pCJAhUFN+
- TLSH T151E633873D96DB11C8A21D7A44BBC3A822387D400624D9A777DCB82DDEF23C095769DE
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
- Size 26.1MB
- SHA256 e267dea9f86e4d996142b16ec8447b5f55eba6887335e7b848c665e8f59585ab
- MD5 544fd7b3df746179c5d9b580b79bb227
- SHA1 ab23102400990f4f4ec343f0bb2d0873d100e20f
- SHA512 a56a8800e8bbd7ba79cc621eb51e58c74aaf1edab3d6adeaa805c5a3c2a217f467953fc9abe4f60eacca992148ced953e3a2ea68bf555a7f6308977c46f64fa5
- SSDEEP 24576:WFo3DMPZdoO/vvTL/SwyiCFAvre45LFB0vkwN/8qUn8aZ1jS8Ih2ibYDGuw:iHM
- TLSH T18E57B42436F92100EBF7AE3CA8F06A274D397D57AC16DE8D45511B4D0822F71E872F6A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\Volume{c61f8367-0000-0000-0000-d08302000000}\System Volume Information\SPP\OnlineMetadataCache\{b64f90f5-1074-45ba-a15b-fd7c5c90d0aa}_OnDiskSnapshotProp
- Size 6KB
- SHA256 803ec80d7165b58468eff12ec3d3d3eac6442dc8a26a66714114febd64d12027
- MD5 b653e67e24511378b893b67d1bd52659
- SHA1 e62e4c350d4adc7ff9917b4765a070018cce13c3
- SHA512 1345e9a651e1c07ca332e8e49af118809a825b3edec3e022e5d0cc5b1df0493a9bf57f1c0ef4729a9f311bf8680cd20cc3a7fd64f7abb96eb18db81e56fbb4d1
- SSDEEP 96:Fb+lGvc6DD84LTHzbOHXOHBlBRQn8Sc9XE56tOSVQpu:xtb++uVm
- TLSH T158D178185AE54711E2B3AB3129F14557A877B911FF33CB8E0298238E6631910F935F6F
- MD5 SHA1 SHA512 SSDEEP TLSH