Analysis
- max time kernel
149s - max time network
153s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
11/08/2026, 01:33
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Retrac_3.0.8_x64_en-US.msi
Resource
win10v2004-20260513-en
windows10-2004-x64
22 signatures
150 seconds
Behavioral task
behavioral2
Sample
Retrac_3.0.8_x64_en-US.msi
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
23 signatures
150 seconds
General
- Target Retrac_3.0.8_x64_en-US.msi
- Size 14.4MB
- Sample260811-byjpassgph
- SHA256 f25ac4aed0f36abdb2f0ea2cdb67e4249d7d70467718f718445559cf4e0ffd89
- MD5 965f3d0bff58a004b2642bf6d637dedc
- SHA1 1c65936cb7545559f090173a494ff1bc2839f1eb
- SHA512 68baec2ebd5d6b4eecc6190eb02265572ed952f609423399d5cb5e3f7dd43c8c0e005491bd52be72fdb289f700cfcadee33caea80ca30bf7f5cd5b60fcd2f28d
- SSDEEP 393216:Xgwqa+Wmti6d4hGDOQ1X0ADGK/pC6HuAhUO2bJRA:wwc1fdMvFADZ/pCJAhUFN+
- TLSH T151E633873D96DB11C8A21D7A44BBC3A822387D400624D9A777DCB82DDEF23C095769DE
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 5016 retrac.exe - Loads dropped DLL 1 IoCs
pid Process 2080 MsiExec.exe - Badlisted process makes network request 1 IoCs
Network request originating from process or tool commonly abused by malware.
flow pid Process 3 4060 msiexec.exe - Checks whether UAC is enabled 1 TTPs 1 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA retrac.exe - Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\D: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\D: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\R: msiexec.exe - Drops file in Program Files directory 2 IoCs
description ioc Process File created C:\Program Files\Retrac\retrac.exe msiexec.exe File created C:\Program Files\Retrac\Uninstall Retrac.lnk msiexec.exe - Drops file in Windows directory 19 IoCs
description ioc Process File created C:\Windows\SystemTemp\~DF8382B3C773D03D21.TMP msiexec.exe File opened for modification C:\Windows\Installer\MSIB2D.tmp msiexec.exe File created C:\Windows\SystemTemp\~DF320C75516E73AA00.TMP msiexec.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4488_1410031713\manifest.fingerprint msedgewebview2.exe File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File created C:\Windows\SystemTemp\~DFE710479A06C1B9A9.TMP msiexec.exe File created C:\Windows\Installer\SourceHash{F2567F58-5A4A-4F82-886D-ED5C11F380BE} msiexec.exe File created C:\Windows\Installer\{F2567F58-5A4A-4F82-886D-ED5C11F380BE}\ProductIcon msiexec.exe File opened for modification C:\Windows\Installer\{F2567F58-5A4A-4F82-886D-ED5C11F380BE}\ProductIcon msiexec.exe File created C:\Windows\SystemTemp\~DF83423D36B4AF2FC0.TMP msiexec.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4488_1410031713\kp_pinslist.pb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4488_1410031713\manifest.json msedgewebview2.exe File created C:\Windows\Installer\e5a0408.msi msiexec.exe File opened for modification C:\Windows\Installer\e5a0408.msi msiexec.exe File created C:\Windows\Installer\e5a040a.msi msiexec.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4488_1410031713\crs.pb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4488_1410031713\ct_config.pb msedgewebview2.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe - Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
pid Process 4060 msiexec.exe - Modifies trusted root certificate store through registry 1 TTPs 2 IoCs
A root certificate was added, modified, or removed in the trusted certificate store registry paths.
description ioc Process Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 5c0000000100000004000000001000001900000001000000100000002fe1f70bb05d7c92335bc5e05b984da60f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f63030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e814000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e6b000000010000002000000096bcec06264976f37460779acf28c5a7cfe8a3c0aae11a8ffcee05c0bddf08c620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827 retrac.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 6b000000010000002000000096bcec06264976f37460779acf28c5a7cfe8a3c0aae11a8ffcee05c0bddf08c614000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827 retrac.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe - Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 000000000400000031a81fc62ba3bf350000000000000000000000000000000000000000000000000000000000000000000000000000000000001071020000000000c012000000000000000000000000270101000088380131a81fc60000000000001071020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d0830200000000006025c501000000000000000000000700010000e8410131a81fc6000000000000d08302000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9c701000000000000050000000000000000000000070001000098d4e331a81fc600000000000030a9c7010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9cc0100000000000005000000000000000000000007000100009854e631a81fc600000000000030a9cc01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedgewebview2.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedgewebview2.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedgewebview2.exe - Modifies data under HKEY_USERS 3 IoCs
description ioc Process Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E msiexec.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27 msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28 msiexec.exe - Modifies registry class 46 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\Classes\retrac\DefaultIcon msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\retrac\shell\open\command msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\85F7652FA4A528F488D6DEC5113F08EB\AdvertiseFlags = "388" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\85F7652FA4A528F488D6DEC5113F08EB\SourceList\Media\1 = ";" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\retrac\shell msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\85F7652FA4A528F488D6DEC5113F08EB msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\85F7652FA4A528F488D6DEC5113F08EB\SourceList msiexec.exe Key created \REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\retrac\shell\open\command retrac.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\D39F67BF21D37C75581F63A03A3CC6BF msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\retrac\shell\open\command msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\85F7652FA4A528F488D6DEC5113F08EB msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\85F7652FA4A528F488D6DEC5113F08EB\Environment = "MainProgram" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\85F7652FA4A528F488D6DEC5113F08EB\External msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\85F7652FA4A528F488D6DEC5113F08EB\ProductName = "Retrac" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\85F7652FA4A528F488D6DEC5113F08EB\ProductIcon = "C:\\Windows\\Installer\\{F2567F58-5A4A-4F82-886D-ED5C11F380BE}\\ProductIcon" msiexec.exe Set value (str) \REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\retrac\ = "URL:launcher.retrac.site protocol" retrac.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\retrac\ = "URL: protocol" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\retrac\DefaultIcon\ = "\"C:\\PROGRA~1\\Retrac\\retrac.exe\",0" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\retrac\shell\open msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\85F7652FA4A528F488D6DEC5113F08EB\ShortcutsFeature = "MainProgram" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\85F7652FA4A528F488D6DEC5113F08EB\Language = "0" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\85F7652FA4A528F488D6DEC5113F08EB\AuthorizedLUAApp = "0" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\D39F67BF21D37C75581F63A03A3CC6BF\85F7652FA4A528F488D6DEC5113F08EB msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\85F7652FA4A528F488D6DEC5113F08EB\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\retrac msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\retrac msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\85F7652FA4A528F488D6DEC5113F08EB\Version = "50331656" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\85F7652FA4A528F488D6DEC5113F08EB\Assignment = "1" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\85F7652FA4A528F488D6DEC5113F08EB\InstanceType = "0" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\85F7652FA4A528F488D6DEC5113F08EB\SourceList\Media msiexec.exe Key created \REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\retrac retrac.exe Set value (str) \REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\retrac\DefaultIcon\ = "C:\\Program Files\\Retrac\\retrac.exe,0" retrac.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\retrac\URL Protocol msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\85F7652FA4A528F488D6DEC5113F08EB\PackageCode = "6AFF5C71F42D1914DA5EF303DCA200A2" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\85F7652FA4A528F488D6DEC5113F08EB\SourceList\Net msiexec.exe Set value (str) \REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\retrac\URL Protocol retrac.exe Key created \REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\retrac\DefaultIcon retrac.exe Key created \REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\retrac\shell retrac.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\retrac\shell\open\command\ = "\"C:\\PROGRA~1\\Retrac\\retrac.exe\" \"%1\"" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\85F7652FA4A528F488D6DEC5113F08EB\DeploymentFlags = "3" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\85F7652FA4A528F488D6DEC5113F08EB\SourceList\PackageName = "Retrac_3.0.8_x64_en-US.msi" msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\85F7652FA4A528F488D6DEC5113F08EB\Clients = 3a0000000000 msiexec.exe Key created \REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\retrac\shell\open retrac.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\85F7652FA4A528F488D6DEC5113F08EB\MainProgram msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\85F7652FA4A528F488D6DEC5113F08EB\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\" msiexec.exe Set value (str) \REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\retrac\shell\open\command\ = "\"C:\\Program Files\\Retrac\\retrac.exe\" \"%1\"" retrac.exe - Modifies system certificate store 2 TTPs 1 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8 retrac.exe - Suspicious behavior: EnumeratesProcesses 58 IoCs
pid Process 3244 msiexec.exe 3244 msiexec.exe 5016 retrac.exe 5016 retrac.exe 5016 retrac.exe 5016 retrac.exe 5016 retrac.exe 5016 retrac.exe 5016 retrac.exe 5016 retrac.exe 5016 retrac.exe 5016 retrac.exe 5016 retrac.exe 5016 retrac.exe 5016 retrac.exe 5016 retrac.exe 5016 retrac.exe 5016 retrac.exe 5016 retrac.exe 5016 retrac.exe 5016 retrac.exe 5016 retrac.exe 5016 retrac.exe 5016 retrac.exe 5016 retrac.exe 5016 retrac.exe 5016 retrac.exe 5016 retrac.exe 5016 retrac.exe 5016 retrac.exe 5016 retrac.exe 5016 retrac.exe 5016 retrac.exe 5016 retrac.exe 5016 retrac.exe 5016 retrac.exe 5016 retrac.exe 5016 retrac.exe 5016 retrac.exe 5016 retrac.exe 5016 retrac.exe 5016 retrac.exe 5016 retrac.exe 5016 retrac.exe 5016 retrac.exe 5016 retrac.exe 5016 retrac.exe 5016 retrac.exe 5016 retrac.exe 5016 retrac.exe 5016 retrac.exe 5016 retrac.exe 5016 retrac.exe 5016 retrac.exe 5016 retrac.exe 5016 retrac.exe 5016 retrac.exe 5016 retrac.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs
pid Process 4488 msedgewebview2.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 4060 msiexec.exe Token: SeIncreaseQuotaPrivilege 4060 msiexec.exe Token: SeSecurityPrivilege 3244 msiexec.exe Token: SeCreateTokenPrivilege 4060 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 4060 msiexec.exe Token: SeLockMemoryPrivilege 4060 msiexec.exe Token: SeIncreaseQuotaPrivilege 4060 msiexec.exe Token: SeMachineAccountPrivilege 4060 msiexec.exe Token: SeTcbPrivilege 4060 msiexec.exe Token: SeSecurityPrivilege 4060 msiexec.exe Token: SeTakeOwnershipPrivilege 4060 msiexec.exe Token: SeLoadDriverPrivilege 4060 msiexec.exe Token: SeSystemProfilePrivilege 4060 msiexec.exe Token: SeSystemtimePrivilege 4060 msiexec.exe Token: SeProfSingleProcessPrivilege 4060 msiexec.exe Token: SeIncBasePriorityPrivilege 4060 msiexec.exe Token: SeCreatePagefilePrivilege 4060 msiexec.exe Token: SeCreatePermanentPrivilege 4060 msiexec.exe Token: SeBackupPrivilege 4060 msiexec.exe Token: SeRestorePrivilege 4060 msiexec.exe Token: SeShutdownPrivilege 4060 msiexec.exe Token: SeDebugPrivilege 4060 msiexec.exe Token: SeAuditPrivilege 4060 msiexec.exe Token: SeSystemEnvironmentPrivilege 4060 msiexec.exe Token: SeChangeNotifyPrivilege 4060 msiexec.exe Token: SeRemoteShutdownPrivilege 4060 msiexec.exe Token: SeUndockPrivilege 4060 msiexec.exe Token: SeSyncAgentPrivilege 4060 msiexec.exe Token: SeEnableDelegationPrivilege 4060 msiexec.exe Token: SeManageVolumePrivilege 4060 msiexec.exe Token: SeImpersonatePrivilege 4060 msiexec.exe Token: SeCreateGlobalPrivilege 4060 msiexec.exe Token: SeCreateTokenPrivilege 4060 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 4060 msiexec.exe Token: SeLockMemoryPrivilege 4060 msiexec.exe Token: SeIncreaseQuotaPrivilege 4060 msiexec.exe Token: SeMachineAccountPrivilege 4060 msiexec.exe Token: SeTcbPrivilege 4060 msiexec.exe Token: SeSecurityPrivilege 4060 msiexec.exe Token: SeTakeOwnershipPrivilege 4060 msiexec.exe Token: SeLoadDriverPrivilege 4060 msiexec.exe Token: SeSystemProfilePrivilege 4060 msiexec.exe Token: SeSystemtimePrivilege 4060 msiexec.exe Token: SeProfSingleProcessPrivilege 4060 msiexec.exe Token: SeIncBasePriorityPrivilege 4060 msiexec.exe Token: SeCreatePagefilePrivilege 4060 msiexec.exe Token: SeCreatePermanentPrivilege 4060 msiexec.exe Token: SeBackupPrivilege 4060 msiexec.exe Token: SeRestorePrivilege 4060 msiexec.exe Token: SeShutdownPrivilege 4060 msiexec.exe Token: SeDebugPrivilege 4060 msiexec.exe Token: SeAuditPrivilege 4060 msiexec.exe Token: SeSystemEnvironmentPrivilege 4060 msiexec.exe Token: SeChangeNotifyPrivilege 4060 msiexec.exe Token: SeRemoteShutdownPrivilege 4060 msiexec.exe Token: SeUndockPrivilege 4060 msiexec.exe Token: SeSyncAgentPrivilege 4060 msiexec.exe Token: SeEnableDelegationPrivilege 4060 msiexec.exe Token: SeManageVolumePrivilege 4060 msiexec.exe Token: SeImpersonatePrivilege 4060 msiexec.exe Token: SeCreateGlobalPrivilege 4060 msiexec.exe Token: SeCreateTokenPrivilege 4060 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 4060 msiexec.exe Token: SeLockMemoryPrivilege 4060 msiexec.exe - Suspicious use of FindShellTrayWindow 3 IoCs
pid Process 4060 msiexec.exe 4060 msiexec.exe 5016 retrac.exe - Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 4060 msiexec.exe 3244 msiexec.exe 2080 MsiExec.exe - Suspicious use of WriteProcessMemory 21 IoCs
description pid Process procid_target PID 3244 wrote to memory of 2080 3244 msiexec.exe 90 PID 3244 wrote to memory of 5840 3244 msiexec.exe 96 PID 4060 wrote to memory of 5016 4060 msiexec.exe 99 PID 5016 wrote to memory of 4488 5016 retrac.exe 100 PID 4488 wrote to memory of 4056 4488 msedgewebview2.exe 101 PID 4488 wrote to memory of 828 4488 msedgewebview2.exe 102 PID 4488 wrote to memory of 828 4488 msedgewebview2.exe 102 PID 4488 wrote to memory of 828 4488 msedgewebview2.exe 102 PID 4488 wrote to memory of 828 4488 msedgewebview2.exe 102 PID 4488 wrote to memory of 1372 4488 msedgewebview2.exe 103 PID 4488 wrote to memory of 4832 4488 msedgewebview2.exe 104 PID 4488 wrote to memory of 4832 4488 msedgewebview2.exe 104 PID 4488 wrote to memory of 4832 4488 msedgewebview2.exe 104 PID 4488 wrote to memory of 2756 4488 msedgewebview2.exe 105 PID 4488 wrote to memory of 2756 4488 msedgewebview2.exe 105 PID 4488 wrote to memory of 2756 4488 msedgewebview2.exe 105 PID 4488 wrote to memory of 2756 4488 msedgewebview2.exe 105 PID 4488 wrote to memory of 2756 4488 msedgewebview2.exe 105 PID 4488 wrote to memory of 6116 4488 msedgewebview2.exe 108 PID 4488 wrote to memory of 6116 4488 msedgewebview2.exe 108 PID 4488 wrote to memory of 6116 4488 msedgewebview2.exe 108 - Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\Retrac_3.0.8_x64_en-US.msi1⤵
- Badlisted process makes network request
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4060 -
C:\Program Files\Retrac\retrac.exe"C:\Program Files\Retrac\retrac.exe"2⤵
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies trusted root certificate store through registry
- Modifies registry class
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:5016 -
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=retrac.exe --webview-exe-version=3.0.8 --user-data-dir="C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --enable-features=MojoIpcz --lang=en-US --accept-lang=en-US --mojo-named-platform-channel-pipe=5016.2200.14242574109915256359 /pfhostedapp:fd0de7e5cefc9f8a2e2a61a11d5c8b08aabc87ca3⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of WriteProcessMemory
PID:4488 -
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView /prefetch:4 /pfhostedapp:fd0de7e5cefc9f8a2e2a61a11d5c8b08aabc87ca --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x184,0x188,0x18c,0x160,0x194,0x7ffe2a455fd8,0x7ffe2a455fe4,0x7ffe2a455ff04⤵PID:4056
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView" --webview-exe-name=retrac.exe --webview-exe-version=3.0.8 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1784 --field-trial-handle=1788,i,4834754582097178972,183751428155731471,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:2 /pfhostedapp:fd0de7e5cefc9f8a2e2a61a11d5c8b08aabc87ca4⤵PID:828
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView" --webview-exe-name=retrac.exe --webview-exe-version=3.0.8 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2244 --field-trial-handle=1788,i,4834754582097178972,183751428155731471,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:3 /pfhostedapp:fd0de7e5cefc9f8a2e2a61a11d5c8b08aabc87ca4⤵PID:1372
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView" --webview-exe-name=retrac.exe --webview-exe-version=3.0.8 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2284 --field-trial-handle=1788,i,4834754582097178972,183751428155731471,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:fd0de7e5cefc9f8a2e2a61a11d5c8b08aabc87ca4⤵PID:4832
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView" --webview-exe-name=retrac.exe --webview-exe-version=3.0.8 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --autoplay-policy=no-user-gesture-required --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=2916 --field-trial-handle=1788,i,4834754582097178972,183751428155731471,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /pfhostedapp:fd0de7e5cefc9f8a2e2a61a11d5c8b08aabc87ca /prefetch:14⤵PID:2756
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView" --webview-exe-name=retrac.exe --webview-exe-version=3.0.8 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2232 --field-trial-handle=1788,i,4834754582097178972,183751428155731471,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:fd0de7e5cefc9f8a2e2a61a11d5c8b08aabc87ca4⤵PID:6116
-
-
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3244 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding AB518732AFD5F4F3696DE5E1ECC51244 C2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2080
-
-
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵PID:5840
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
PID:2352
Network
MITRE ATT&CK Enterprise v16
Defense Evasion
Modify Registry
1Subvert Trust Controls
2Install Root Certificate
2System Binary Proxy Execution
1Msiexec
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Config.Msi\e5a0409.rbs
- Size 10KB
- SHA256 42417f8b5e2608a05155d1417ca8467da8aed8425cbb36e6f2d28ecbb7cd18c0
- MD5 03107498457c83b399b8e65cafbeb3ca
- SHA1 a66caa5d5a3a2111a44d8e7a60edd9302c588ede
- SHA512 1f9442f64a4bbdcf3d146e7f3cbf76cb3a6238e2c5909a3f1ebad60a5aa7f05a58a3447268adbdb0103ff9958517b12e20b7b1a10afbf09d7ddbcab5dbc3287f
- SSDEEP 192:I3mvcD7AyCpovuGvvuuTLbiIM4oWRiMupBCv:IWvcD7AkvhvnAbq
- TLSH T163220E42B740C6D2F9931B74DB0717263BB2DA988315674B0BCE75248F833D95E9A1CB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Retrac\retrac.exe
- Size 26.0MB
- SHA256 2550eee702fb10f576042a913674938b4a4becdcf9b887853dbaef46d6f90bd2
- MD5 789fb187c94581916bd728ce786ce972
- SHA1 aaacb9eeca073c4a727ec0b7a5264db1479bd7ec
- SHA512 4e333b330dd94204694c2355521dad82fc01dab2acdd90453c7dccd3e8e1fe1b3fc389bd1a22a0671e871741c515a0d77301f62891eb49ac39a12189c6f60cc1
- SSDEEP 393216:WYq62DqPMcqO0BwUdrsPAQK1Jmii8l/RlpLFo:WYq/O7BfPW1JNl/1
- TLSH T128575B207B9AA96DD05AC47483878A724A7130DB0B35B9FF44D496783F6DBF42F38258
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Retrac\Retrac.lnk
- Size 1KB
- SHA256 e32519d020c67bbfae607940313a79618bdfe6cde41993ef9113fcad86a73b26
- MD5 8cc6079ffd914f55370c07a6ec287ef3
- SHA1 02a9e577642525ae00deef7ebb3b6a1e5bbf936d
- SHA512 42ed9e7792ff61d68914678abaf8b6326c1ebab93d0407deb63c567021bc445c7c86df831bc4b4f3b5b2724b8fecdd60bcb85d39a6a679702cc24e9e9374dc2f
- TLSH T19141790127E01716F3634A79AEB90921DF31BC06B6218F6E428A42CB09B5981997CF2F
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Retrac\Retrac.lnk~RFe5a0fb1.TMP
- Size 1KB
- SHA256 6aeee34bdd61aacec599ce0646cdd0c8a3bb2747d15d4294f8020aa7cd712981
- MD5 5fe1545902e7a63bb6cf4e25eb7432c9
- SHA1 4d88673b3ba4b69ed18c5a986ac9e369c76055d2
- SHA512 a1849ddb85819143cad68d1bede781115ad187d5b818ef76483829df2a27d3ab3e948afeda1c4a6ebae6d62372f99a1297e228394281942cf115156a633245fd
- TLSH T1A5419D0127F01716F3634779AEB90921DF31BC02A6208F6E428642C70975A819978F2F
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\MSIA4B2.tmp
- Size 132KB
- SHA256 7f47d98ab25cfea9b3a2e898c3376cc9ba1cd893b4948b0c27caa530fd0e34cc
- MD5 cfbb8568bd3711a97e6124c56fcfa8d9
- SHA1 d7a098ae58bdd5e93a3c1b04b3d69a14234d5e57
- SHA512 860cbf3286ac4915580cefaf56a9c3d48938eb08e3f31b7f024c4339c037d7c8bdf16e766d08106505ba535be4922a87dc46bd029aae99a64ea2fc02cf3aec04
- SSDEEP 3072:Kx2YbpcgwmiTPJDnCO+DATkURBnrskNwPj2:XXgwmY1CPx2XG2
- TLSH T1DBD39D02B5D0C473D9BE09390870DB229F7EB930DF909EDB636856699E702C19E35A37
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView\Crashpad\settings.dat
- Size 280B
- SHA256 1b54b5a69e8fffa7184c7c6f6fdedc7d6adecafd02ed2c6b557be1654f0d1549
- MD5 83a1ea21cd2cdba4141a8d9b6e152e1d
- SHA1 d13e7691d30bc56e5d2dd7db12173482a238bf25
- SHA512 4bb62091a92874d6c37221e10cddba7f9f7d8375d7861388b931e1e542685424f424941207adba5b40fa1572a9dcf91d9400cb9f21d9ee64147f6bebb19a388d
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView\Crashpad\settings.dat
- Size 280B
- SHA256 3c87c28fd109a9dcf422f445db6927bd752eb2fa60c28f0b4af2eae11375dc2d
- MD5 166678500ffd90ca81c021c3c25831cd
- SHA1 0167c4c4da49a89163177c7c7dbffdea2516a9f1
- SHA512 9cddd0eede4aeab391f74339319447bf877312b6fc47f31b00e7865d68c999305ca25a592cb62126ecb6fd477918f83882a6335468f025968a1130a7dccf7fa8
- TLSH T150D0121232020138C03021731542B60D5442C11B40454040BC28852E5F440500A02451
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView\Crashpad\throttle_store.dat
- Size 20B
- SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
- MD5 9e4e94633b73f4a7680240a0ffd6cd2c
- SHA1 e68e02453ce22736169a56fdb59043d33668368f
- SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView\Default\Code Cache\js\index-dir\the-real-index
- Size 72B
- SHA256 b4673a2367bcbf2fbd09f5a54da151b2b94d16ac0616769fd0403a3fc04b0b09
- MD5 89559c70cb4fcd38694a277333b740e8
- SHA1 eec29f017bc39fe04cd437e580ee339bdbea1fe8
- SHA512 dd1bb7f9cf1812530e43f1adba515fd02d75b18ffff1714f7f969f0a4b9ffc0ca68bd867c2b76de61b426a12a00eb7c185d8fbb9492b2322202c137ba5709a10
- TLSH T12DA002101D442442F7462B7965D10957B2B94930839B16814DD14BEBC8797FD6216180
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView\Default\Code Cache\js\index-dir\the-real-index~RFe5a8b88.TMP
- Size 48B
- SHA256 4d0397cc4d1acc43e19a09199f793eae4ede21b345055471e8ae8356e6fe153f
- MD5 ea2b950294df349f5cdec20571a5ffc4
- SHA1 171ea31aab665d9d89e7048625a815001de0526b
- SHA512 1e40cecd1794ec28f58f679e301bc71d1fe20d1c877c1043e9b312dca69d673fe4c16a1980d44d2b9938f1d2f4dc83004a0f99db434c25f508e3ddc24c0bf251
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView\Default\Extension Rules\CURRENT
- Size 16B
- SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
- MD5 46295cac801e5d4857d09837238a6394
- SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
- SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView\Default\Extension Rules\MANIFEST-000001
- Size 41B
- SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
- MD5 5af87dfd673ba2115e2fcf5cfdb727ab
- SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
- SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView\Default\GPUCache\data_1
- Size 264KB
- SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
- MD5 f50f89a0a91564d0b8a211f8921aa7de
- SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
- SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
- SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView\Default\Network\Network Persistent State
- Size 821B
- SHA256 5ee5bcd805427bf3a0e6f999b7e0d26f3d0c388ece32ca943a13184b21ce9cc6
- MD5 d127c8470e6a7b35c1e03a39143abc5d
- SHA1 00e7be8f6750ef4d3418b6a80b593818c1eeb678
- SHA512 e5ba86da770c7a8eabec3e2769d499f5b5747d81a78e14b5fee97169d374325679988f517389f1dd9d10972541b46fbe0af7ad384285f512100196d3c4050236
- TLSH T1FA016BA6C3D4C67D8A4167E427347917CD2E0519A2282D26CEEAEBEA57E1076D11050F
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView\Default\Network\Network Persistent State~RFe5b4e5b.TMP
- Size 59B
- SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
- MD5 2800881c775077e1c4b6e06bf4676de4
- SHA1 2873631068c8b3b9495638c865915be822442c8b
- SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
- TLSH T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView\Default\Network\SCT Auditing Pending Reports
- Size 2B
- SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
- MD5 d751713988987e9331980363e24189ce
- SHA1 97d170e1550eee4afc0af065b78cda302a97674c
- SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView\Default\Preferences
- Size 6KB
- SHA256 ecc4e9642aba79823deef9e4b4b30d294d0539c5acde86f92b19ca6e0a62a351
- MD5 29a3c21ce3c908c2d657aa23b6f8068e
- SHA1 58784bf48284a978e56f762ac7e2ac46bfe6d534
- SHA512 591626f9d84413be3d92417140a6f9ff27bb9b9788ed3e74eff0bc0b72a2835e8f9f27a1125352430b5b259996d0ede5afb0a465511abfe625796ec30e8b1b7a
- SSDEEP 96:stn/dgFtSb9NkBo5h16Z0us7/x+6MhmuecJED1ejedK+gP+28XM1C7K:st/OCmonusV+FdEDQjnd+G6K
- TLSH T188D196025E3479BB4CCAF109BE29BB12E2F96072B0D51E58EBF8452C04DA6CD631790B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView\Default\Preferences~RFe5abe60.TMP
- Size 5KB
- SHA256 76e3552cf94082cef7d3b73100434f7a3bf7ad71fff9c61a8ac04dd39a614590
- MD5 ca6da62aa6e7304ee0494ee409ff7ea9
- SHA1 26bec824af4185762082e1bf6251a2a757c36870
- SHA512 2045845d817b7d14031df1c370de9ff39d6c6b9155f5d9e5a78a60f3a9e18ff6e83f0da3e9a64943b38d73f52d5bf5a4c5c17f84d4905613cda9514a941f86a1
- SSDEEP 96:rn/dgFtSb9Nkddo616Z0us7/x+6MhmuecJED1ejedK+gJ+28XM1C7K:r/OCOo6usV+FdEDQjnT+G6K
- TLSH T139C196025E3479BB4CCAF108FA29BB16E2F96472B1D52D58EBF8492C04DA5CD631790B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView\GraphiteDawnCache\data_0
- Size 8KB
- SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
- MD5 cf89d16bb9107c631daabf0c0ee58efb
- SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
- SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
- SSDEEP 3:MsFl:/F
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView\GraphiteDawnCache\data_2
- Size 8KB
- SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
- MD5 0962291d6d367570bee5454721c17e11
- SHA1 59d10a893ef321a706a9255176761366115bedcb
- SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
- SSDEEP 3:MsHlDll:/H
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView\GraphiteDawnCache\data_3
- Size 8KB
- SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
- MD5 41876349cb12d6db992f1309f22df3f0
- SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
- SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
- SSDEEP 3:MsGl3ll:/y
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView\Local State
- Size 3KB
- SHA256 51408888a6f25548d86211f3ab3c1e04998a01ff7a5d7ab5721f103f8a4ca53c
- MD5 8ca34ed3d9c39a01167e6e0a84d94015
- SHA1 abad37fa265b334e4c823136eee1bd28690f22a3
- SHA512 e3cd162a3dd4ac1ccbe7480f7b3f31489b35269ad71f7a5a7d072713751db146f42223cff45e1755d6038e80a577735ae8c78e9285e24c0cd3434dee043507e7
- TLSH T16E718423A974A9374DF6DA05BD863B12BB655023E5967FA8CAEC0F0C01D76CC1382817
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView\Local State
- Size 2KB
- SHA256 130a5afb6f2fb209b188dae72c236e54ce29fb120b9f35036ae793d222275051
- MD5 6e11b359351d051f712946d2244a551e
- SHA1 a1eaf1534cebd2e165f18d28e1612607c31991ee
- SHA512 3a24393643ad9fef7f9a77f92c521a8493efbc9209c7ae33dc1f678fa6bef7283e2b2cac2c81c4a3bd9d9e9a4c92057f2c52d409d01df1151cb0890c7ac7c9bb
- TLSH T18A517433A924AA7789F65A047D8A3B139E395073EA521F20CBED0F1C01D695C2352C37
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView\Local State
- Size 3KB
- SHA256 8acfa6389f28bd9ed32af357154399016b18e1f5339d0827b08d29fe7834a3e4
- MD5 140b122815babd456a1beddba0e60ddb
- SHA1 41f23b481d217ad41714689ab7b7f31b7f6359b8
- SHA512 b75e065c86a19be10598dc914f0afe52f8e7bc5e9bc205255a57522ba1642847ae3a40e3a28054bd7a5f16573919b71b70bd99445f36fcee0293740686e98dbe
- TLSH T14A618437A974E9778DF69A05BD862B16BBA95033E5823F64CAEC0F1C01D768C2352C17
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView\Local State
- Size 15KB
- SHA256 92665709f630808f003f41d7f2f78079683c9f505fead4aa8846df8eddfb83fb
- MD5 04b08239a37fdde37281c9a887544bd5
- SHA1 41bb984baacef2bc5845b124830ae62c7823bcfc
- SHA512 4dbc3b6d80729b98823d613bb9a040d50fd03573b06e910d8ff0854df7e1f16c0ed497a664ea0bf7f765f384e50e050604e402f7c3e25e8e85fbdd60af39af75
- SSDEEP 384:o+aQikB+z/xvxjg/qhEwNBS/YRW96Ndxck9zI:n/UxvxjgC+6172kFI
- TLSH T178729E2B95797E2395F7E6057D490B4BCEB994B291C26EB84EFD6F0C02C72D81342816
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView\Local State~RFe5a3903.TMP
- Size 1KB
- SHA256 8ce42d300aeda64b7259fe7c15082721fd438e86e287772e669d4c1a94f83d9a
- MD5 9e01e0421cb9c89e428b9ee1d9e45753
- SHA1 858c855a0c4dc4ca9a28dbd5c15e36a201e1a5b4
- SHA512 9366d2c05ae8462535bf40d8410352db5248359ab7a4a95508684146e170a6d402998e3b20752678a0f11847f41a7cb27d8b94887fdc78e7b029e81b5c9b0b1f
- TLSH T1652195B3D8749F32ACE966062552675B2E310037C3418F00DAED0F2C02D688C6576833
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\Installer\e5a0408.msi
- Size 14.4MB
- SHA256 f25ac4aed0f36abdb2f0ea2cdb67e4249d7d70467718f718445559cf4e0ffd89
- MD5 965f3d0bff58a004b2642bf6d637dedc
- SHA1 1c65936cb7545559f090173a494ff1bc2839f1eb
- SHA512 68baec2ebd5d6b4eecc6190eb02265572ed952f609423399d5cb5e3f7dd43c8c0e005491bd52be72fdb289f700cfcadee33caea80ca30bf7f5cd5b60fcd2f28d
- SSDEEP 393216:Xgwqa+Wmti6d4hGDOQ1X0ADGK/pC6HuAhUO2bJRA:wwc1fdMvFADZ/pCJAhUFN+
- TLSH T151E633873D96DB11C8A21D7A44BBC3A822387D400624D9A777DCB82DDEF23C095769DE
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
- Size 26.1MB
- SHA256 42f46a5f08a7e7f5250c76d8a5a46c562e7a87eb29be1350f9800ef84cbc34d3
- MD5 938084a8805ca46cca76f2ba48897180
- SHA1 b59b7e6ec6b84e1349a1425ddaeb0e5b240a6538
- SHA512 e61258e20434051167002c65887b2b26937b9b974af4065ce5f9d427b346e95e6d673a3a84685e711caa5cbf9813f41bee4ad109c565e56b4b65f7e6d2971667
- SSDEEP 24576:XFo3DMPgdoO/vvTL/yAjDilQP7eJY7Eg0+1xNudb1WtqJESTsIRmD6pin+3:WHU
- TLSH T1B157B31436F92200E7B79E3DB8F06A234D397D5BAC15DE8D45511B8E0822F71E872F6A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\Volume{c61fa831-0000-0000-0000-d08302000000}\System Volume Information\SPP\OnlineMetadataCache\{a8bdd3e5-a722-4284-b634-5b5286dd02e8}_OnDiskSnapshotProp
- Size 6KB
- SHA256 44ebc639bbbc2cf4d6b23ab7773d1e3fe95d2ca5b2d2fd847ff285b79960926b
- MD5 8427b650bb7e9f21695b9a0dfa2477ad
- SHA1 02a1baea52d0bead97ec66e1669cd9cf1f440ac2
- SHA512 8fe99ed9dc9e854095ccb9756ade25853094bee145ca71618737336445fc0fc19199c12f66c62e2fa369bd2e3ae6070a73dfc2b5c40628a9143cd77f1bcef437
- SSDEEP 96:FibxI+b0Ovc6DD84LTHzbOHXOHBlBRQn8Sc9XE56tOSVQpu:4xIXCb++uVm
- TLSH T1DBD188085AF54711E2B3AB3129F14557A877B911EF33CB8E0298238E6671910F875F6F
- MD5 SHA1 SHA512 SSDEEP TLSH