Analysis
- max time kernel
81s - max time network
83s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260710-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
07/09/2026, 16:28
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Retrac_3.0.9_x64_en-US.msi
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
23 signatures
150 seconds
General
- Target Retrac_3.0.9_x64_en-US.msi
- Size 14.4MB
- Sample260907-tyz1dscq21
- SHA256 7ef021039fcc397f9cf378e995c448c4312f1f0ea13d05020d6f55a7749d12af
- MD5 2b940d52c3090f57c5cb6065884792f8
- SHA1 d33dacf38d0ef6de6af065e73e91806ee384da72
- SHA512 dcb767833910252fe75546d370215dd15da9d0066be728db14592ab431612a42ae129b861529831fb1ea244aa3dc54e0c3e8ec049d6395b86436b6cb20ee24e7
- SSDEEP 393216:hc6EI0Zn4/BgpsCIPRKeow3ujYOqXgTzkRNcIqP:+K0ZsqpEPweoTjYmkRKI
- TLSH T152E6330B7C859F20C8261D3786B7DB28076DBD206616F6633299B469FFF17C099328D9
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 1976 retrac.exe - Loads dropped DLL 1 IoCs
pid Process 1100 MsiExec.exe - Badlisted process makes network request 1 IoCs
Network request originating from process or tool commonly abused by malware.
flow pid Process 4 2944 msiexec.exe - Checks whether UAC is enabled 1 TTPs 1 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA retrac.exe - Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\D: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\D: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\G: msiexec.exe - Drops file in Program Files directory 2 IoCs
description ioc Process File created C:\Program Files\Retrac\retrac.exe msiexec.exe File created C:\Program Files\Retrac\Uninstall Retrac.lnk msiexec.exe - Drops file in Windows directory 14 IoCs
description ioc Process File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File created C:\Windows\SystemTemp\~DF46BAF37F9DC3F5DD.TMP msiexec.exe File created C:\Windows\Installer\{2B412EEC-4109-4D4E-A042-2CD347432CD3}\ProductIcon msiexec.exe File created C:\Windows\SystemTemp\~DFBBDFF461B851559A.TMP msiexec.exe File created C:\Windows\SystemTemp\~DF677E19C07962FAD9.TMP msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\SystemTemp\~DF13B74BDE43E127D0.TMP msiexec.exe File created C:\Windows\Installer\SourceHash{2B412EEC-4109-4D4E-A042-2CD347432CD3} msiexec.exe File opened for modification C:\Windows\Installer\MSI706E.tmp msiexec.exe File opened for modification C:\Windows\Installer\{2B412EEC-4109-4D4E-A042-2CD347432CD3}\ProductIcon msiexec.exe File created C:\Windows\Installer\e5a6b40.msi msiexec.exe File created C:\Windows\Installer\e5a6b3e.msi msiexec.exe File opened for modification C:\Windows\Installer\e5a6b3e.msi msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe - Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
pid Process 2944 msiexec.exe - Modifies trusted root certificate store through registry 1 TTPs 2 IoCs
A root certificate was added, modified, or removed in the trusted certificate store registry paths.
description ioc Process Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 5c0000000100000004000000001000001900000001000000100000002fe1f70bb05d7c92335bc5e05b984da60f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f63030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e814000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e6b000000010000002000000096bcec06264976f37460779acf28c5a7cfe8a3c0aae11a8ffcee05c0bddf08c620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827 retrac.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 6b000000010000002000000096bcec06264976f37460779acf28c5a7cfe8a3c0aae11a8ffcee05c0bddf08c614000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827 retrac.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe - Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 000000000400000085dc765dd76e689e0000000000000000000000000000000000000000000000000000000000000000000000000000000000001071020000000000c012000000000000000000000000270101000088380185dc765d0000000000001071020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d0830200000000006025c501000000000000000000000700010000e8410185dc765d000000000000d08302000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9c701000000000000050000000000000000000000070001000098d4e385dc765d00000000000030a9c7010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9cc0100000000000005000000000000000000000007000100009854e685dc765d00000000000030a9cc01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedgewebview2.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedgewebview2.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedgewebview2.exe - Modifies data under HKEY_USERS 3 IoCs
description ioc Process Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E msiexec.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27 msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28 msiexec.exe - Modifies registry class 46 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CEE214B29014E4D40A24C23D7434C23D\Language = "0" msiexec.exe Key created \REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\retrac retrac.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\retrac\shell\open\command msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\retrac\shell\open\command\ = "\"C:\\PROGRA~1\\Retrac\\retrac.exe\" \"%1\"" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CEE214B29014E4D40A24C23D7434C23D\InstanceType = "0" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\D39F67BF21D37C75581F63A03A3CC6BF\CEE214B29014E4D40A24C23D7434C23D msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CEE214B29014E4D40A24C23D7434C23D\SourceList\PackageName = "Retrac_3.0.9_x64_en-US.msi" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CEE214B29014E4D40A24C23D7434C23D\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\" msiexec.exe Set value (str) \REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\retrac\ = "URL:launcher.retrac.site protocol" retrac.exe Set value (str) \REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\retrac\URL Protocol retrac.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CEE214B29014E4D40A24C23D7434C23D msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CEE214B29014E4D40A24C23D7434C23D\SourceList\Net msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CEE214B29014E4D40A24C23D7434C23D\SourceList\Media msiexec.exe Key created \REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\retrac\shell retrac.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CEE214B29014E4D40A24C23D7434C23D\ProductName = "Retrac" msiexec.exe Key created \REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\retrac\shell\open\command retrac.exe Key created \REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\retrac\shell\open retrac.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\retrac\URL Protocol msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CEE214B29014E4D40A24C23D7434C23D\PackageCode = "A4C83CD460CAC744DA544CF3E1F1B387" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CEE214B29014E4D40A24C23D7434C23D\Version = "50331657" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CEE214B29014E4D40A24C23D7434C23D\Assignment = "1" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CEE214B29014E4D40A24C23D7434C23D\AdvertiseFlags = "388" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\retrac msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\retrac\shell\open\command msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\retrac\shell\open msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\CEE214B29014E4D40A24C23D7434C23D\Environment = "MainProgram" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CEE214B29014E4D40A24C23D7434C23D\AuthorizedLUAApp = "0" msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CEE214B29014E4D40A24C23D7434C23D\Clients = 3a0000000000 msiexec.exe Set value (str) \REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\retrac\DefaultIcon\ = "C:\\Program Files\\Retrac\\retrac.exe,0" retrac.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\retrac\DefaultIcon\ = "\"C:\\PROGRA~1\\Retrac\\retrac.exe\",0" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\retrac msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\CEE214B29014E4D40A24C23D7434C23D msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CEE214B29014E4D40A24C23D7434C23D\SourceList msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CEE214B29014E4D40A24C23D7434C23D\SourceList\Media\1 = ";" msiexec.exe Set value (str) \REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\retrac\shell\open\command\ = "\"C:\\Program Files\\Retrac\\retrac.exe\" \"%1\"" retrac.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\CEE214B29014E4D40A24C23D7434C23D\MainProgram msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\CEE214B29014E4D40A24C23D7434C23D\External msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\D39F67BF21D37C75581F63A03A3CC6BF msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CEE214B29014E4D40A24C23D7434C23D\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\" msiexec.exe Key created \REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\retrac\DefaultIcon retrac.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CEE214B29014E4D40A24C23D7434C23D\ProductIcon = "C:\\Windows\\Installer\\{2B412EEC-4109-4D4E-A042-2CD347432CD3}\\ProductIcon" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CEE214B29014E4D40A24C23D7434C23D\DeploymentFlags = "3" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\retrac\ = "URL: protocol" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\retrac\DefaultIcon msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\retrac\shell msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\CEE214B29014E4D40A24C23D7434C23D\ShortcutsFeature = "MainProgram" msiexec.exe - Modifies system certificate store 2 TTPs 1 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8 retrac.exe - Suspicious behavior: EnumeratesProcesses 24 IoCs
pid Process 3832 msiexec.exe 3832 msiexec.exe 1976 retrac.exe 1976 retrac.exe 1976 retrac.exe 1976 retrac.exe 1976 retrac.exe 1976 retrac.exe 1976 retrac.exe 1976 retrac.exe 1976 retrac.exe 1976 retrac.exe 1976 retrac.exe 1976 retrac.exe 1976 retrac.exe 1976 retrac.exe 1976 retrac.exe 1976 retrac.exe 1976 retrac.exe 1976 retrac.exe 1976 retrac.exe 1976 retrac.exe 1976 retrac.exe 1976 retrac.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs
pid Process 3136 msedgewebview2.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 2944 msiexec.exe Token: SeIncreaseQuotaPrivilege 2944 msiexec.exe Token: SeSecurityPrivilege 3832 msiexec.exe Token: SeCreateTokenPrivilege 2944 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 2944 msiexec.exe Token: SeLockMemoryPrivilege 2944 msiexec.exe Token: SeIncreaseQuotaPrivilege 2944 msiexec.exe Token: SeMachineAccountPrivilege 2944 msiexec.exe Token: SeTcbPrivilege 2944 msiexec.exe Token: SeSecurityPrivilege 2944 msiexec.exe Token: SeTakeOwnershipPrivilege 2944 msiexec.exe Token: SeLoadDriverPrivilege 2944 msiexec.exe Token: SeSystemProfilePrivilege 2944 msiexec.exe Token: SeSystemtimePrivilege 2944 msiexec.exe Token: SeProfSingleProcessPrivilege 2944 msiexec.exe Token: SeIncBasePriorityPrivilege 2944 msiexec.exe Token: SeCreatePagefilePrivilege 2944 msiexec.exe Token: SeCreatePermanentPrivilege 2944 msiexec.exe Token: SeBackupPrivilege 2944 msiexec.exe Token: SeRestorePrivilege 2944 msiexec.exe Token: SeShutdownPrivilege 2944 msiexec.exe Token: SeDebugPrivilege 2944 msiexec.exe Token: SeAuditPrivilege 2944 msiexec.exe Token: SeSystemEnvironmentPrivilege 2944 msiexec.exe Token: SeChangeNotifyPrivilege 2944 msiexec.exe Token: SeRemoteShutdownPrivilege 2944 msiexec.exe Token: SeUndockPrivilege 2944 msiexec.exe Token: SeSyncAgentPrivilege 2944 msiexec.exe Token: SeEnableDelegationPrivilege 2944 msiexec.exe Token: SeManageVolumePrivilege 2944 msiexec.exe Token: SeImpersonatePrivilege 2944 msiexec.exe Token: SeCreateGlobalPrivilege 2944 msiexec.exe Token: SeCreateTokenPrivilege 2944 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 2944 msiexec.exe Token: SeLockMemoryPrivilege 2944 msiexec.exe Token: SeIncreaseQuotaPrivilege 2944 msiexec.exe Token: SeMachineAccountPrivilege 2944 msiexec.exe Token: SeTcbPrivilege 2944 msiexec.exe Token: SeSecurityPrivilege 2944 msiexec.exe Token: SeTakeOwnershipPrivilege 2944 msiexec.exe Token: SeLoadDriverPrivilege 2944 msiexec.exe Token: SeSystemProfilePrivilege 2944 msiexec.exe Token: SeSystemtimePrivilege 2944 msiexec.exe Token: SeProfSingleProcessPrivilege 2944 msiexec.exe Token: SeIncBasePriorityPrivilege 2944 msiexec.exe Token: SeCreatePagefilePrivilege 2944 msiexec.exe Token: SeCreatePermanentPrivilege 2944 msiexec.exe Token: SeBackupPrivilege 2944 msiexec.exe Token: SeRestorePrivilege 2944 msiexec.exe Token: SeShutdownPrivilege 2944 msiexec.exe Token: SeDebugPrivilege 2944 msiexec.exe Token: SeAuditPrivilege 2944 msiexec.exe Token: SeSystemEnvironmentPrivilege 2944 msiexec.exe Token: SeChangeNotifyPrivilege 2944 msiexec.exe Token: SeRemoteShutdownPrivilege 2944 msiexec.exe Token: SeUndockPrivilege 2944 msiexec.exe Token: SeSyncAgentPrivilege 2944 msiexec.exe Token: SeEnableDelegationPrivilege 2944 msiexec.exe Token: SeManageVolumePrivilege 2944 msiexec.exe Token: SeImpersonatePrivilege 2944 msiexec.exe Token: SeCreateGlobalPrivilege 2944 msiexec.exe Token: SeCreateTokenPrivilege 2944 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 2944 msiexec.exe Token: SeLockMemoryPrivilege 2944 msiexec.exe - Suspicious use of FindShellTrayWindow 3 IoCs
pid Process 2944 msiexec.exe 2944 msiexec.exe 1976 retrac.exe - Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 2944 msiexec.exe 3832 msiexec.exe 1100 MsiExec.exe - Suspicious use of WriteProcessMemory 18 IoCs
description pid Process procid_target PID 3832 wrote to memory of 1100 3832 msiexec.exe 89 PID 3832 wrote to memory of 3324 3832 msiexec.exe 95 PID 2944 wrote to memory of 1976 2944 msiexec.exe 98 PID 1976 wrote to memory of 3136 1976 retrac.exe 99 PID 3136 wrote to memory of 1272 3136 msedgewebview2.exe 100 PID 3136 wrote to memory of 2956 3136 msedgewebview2.exe 101 PID 3136 wrote to memory of 2956 3136 msedgewebview2.exe 101 PID 3136 wrote to memory of 2956 3136 msedgewebview2.exe 101 PID 3136 wrote to memory of 2956 3136 msedgewebview2.exe 101 PID 3136 wrote to memory of 1332 3136 msedgewebview2.exe 102 PID 3136 wrote to memory of 2588 3136 msedgewebview2.exe 103 PID 3136 wrote to memory of 2588 3136 msedgewebview2.exe 103 PID 3136 wrote to memory of 2588 3136 msedgewebview2.exe 103 PID 3136 wrote to memory of 3424 3136 msedgewebview2.exe 104 PID 3136 wrote to memory of 3424 3136 msedgewebview2.exe 104 PID 3136 wrote to memory of 3424 3136 msedgewebview2.exe 104 PID 3136 wrote to memory of 3424 3136 msedgewebview2.exe 104 PID 3136 wrote to memory of 3424 3136 msedgewebview2.exe 104 - Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\Retrac_3.0.9_x64_en-US.msi1⤵
- Badlisted process makes network request
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2944 -
C:\Program Files\Retrac\retrac.exe"C:\Program Files\Retrac\retrac.exe"2⤵
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies trusted root certificate store through registry
- Modifies registry class
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1976 -
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=retrac.exe --webview-exe-version=3.0.9 --user-data-dir="C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --enable-features=MojoIpcz --lang=en-US --accept-lang=en-US --mojo-named-platform-channel-pipe=1976.4592.15149090828674231058 /pfhostedapp:fd0de7e5cefc9f8a2e2a61a11d5c8b08aabc87ca3⤵
- Enumerates system info in registry
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of WriteProcessMemory
PID:3136 -
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView /prefetch:4 /pfhostedapp:fd0de7e5cefc9f8a2e2a61a11d5c8b08aabc87ca --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x184,0x188,0x18c,0x160,0x194,0x7ffa30275fd8,0x7ffa30275fe4,0x7ffa30275ff04⤵PID:1272
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView" --webview-exe-name=retrac.exe --webview-exe-version=3.0.9 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1744 --field-trial-handle=1748,i,11415681393950693785,6987147208401456275,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:2 /pfhostedapp:fd0de7e5cefc9f8a2e2a61a11d5c8b08aabc87ca4⤵PID:2956
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView" --webview-exe-name=retrac.exe --webview-exe-version=3.0.9 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=1888 --field-trial-handle=1748,i,11415681393950693785,6987147208401456275,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:3 /pfhostedapp:fd0de7e5cefc9f8a2e2a61a11d5c8b08aabc87ca4⤵PID:1332
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView" --webview-exe-name=retrac.exe --webview-exe-version=3.0.9 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2284 --field-trial-handle=1748,i,11415681393950693785,6987147208401456275,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:fd0de7e5cefc9f8a2e2a61a11d5c8b08aabc87ca4⤵PID:2588
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView" --webview-exe-name=retrac.exe --webview-exe-version=3.0.9 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --autoplay-policy=no-user-gesture-required --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3320 --field-trial-handle=1748,i,11415681393950693785,6987147208401456275,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /pfhostedapp:fd0de7e5cefc9f8a2e2a61a11d5c8b08aabc87ca /prefetch:14⤵PID:3424
-
-
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3832 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding B0D623FC5C1EDC7E196A352C3C89C660 C2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1100
-
-
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵PID:3324
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
PID:6004
Network
MITRE ATT&CK Enterprise v16
Defense Evasion
Modify Registry
1Subvert Trust Controls
2Install Root Certificate
2System Binary Proxy Execution
1Msiexec
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Config.Msi\e5a6b3f.rbs
- Size 10KB
- SHA256 09a3f1c7ad4e099420b751fbe5486bcefdb55336cbcc9c9badbba40833b48adf
- MD5 c0cca9789df7bcd31047c8d4806a3698
- SHA1 5aa1140b66ba83ed8be30aef2823cb0777c1de22
- SHA512 b7b04a2cfae28669cb51d2fdb72a7a6d527f1465235eeca0c2e59a8730fe822991b84ae72449ba7ab2e1a2e05cfdf0622755004bdccdd24bc0380b6b337ea0b2
- SSDEEP 192:E5hZ47DMHZCOvqPG7qPuuzoX3WOiigpBY:E5X47DMHxqCqGCXY
- TLSH T1CB22EF42F70185D2E8835B38C7072B213F67D684C358634B47CDE834EE57BC66B6969A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Retrac\retrac.exe
- Size 26.0MB
- SHA256 8e659b326afa58276d95ae143af18786f3c47f9e45fa9f4bc9afdfcd10f99aef
- MD5 274a0ba53a9c1bf4af8843978c680dd5
- SHA1 b3006ef8c220ffa04308b4d58a8415c2b41e2d08
- SHA512 3fccdcc36f31e161e19dcec092d2a8b9962e0cdbc94131d72548f396e4256043739574434ac0a4eb81743a926562d1e068e755d164c8bf0b905b197fdf9d31bf
- SSDEEP 393216:+9hw3R8Vay7mii8lYMXKOsPAdaB+ld9qOwcB2U5:+9hr8y7NlIpPetxrp
- TLSH T17C575A207B9AA96CD19AC474834B4A725A7130DB1F35B9FF448492393F6DBF42F38258
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Retrac\Retrac.lnk
- Size 1KB
- SHA256 f202925a034a3c70be68943c064e0149216a0db2e7d0ed2c4e04c4e23f7e3f1c
- MD5 39714ef479e6ed446dbaca362a31e426
- SHA1 2265fa60924ac4cdeb3ec1fb5979e2432f29c0c7
- SHA512 1638ae12c22c6b52ce8f008739ddc3d62891a62df93a19ec2ca1fc2906a95962e476015d8f899504233fe2bd51bd7ec10be68e8894fa3eb0a0a4236df12221de
- TLSH T17041E0455BD5131BE373427A2EB64A358B32FC06D965CF2F41DA048A097CD40AA6CF3B
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Retrac\Retrac.lnk~RFe5a73ab.TMP
- Size 1KB
- SHA256 904919751251ecb28f5a3166b1c116ef476db14aab90c9d47a593cccc2327008
- MD5 26f5271eca2f2f3845612ad78292e410
- SHA1 fc8a49a986759d2100ae703c473f388df4604e1d
- SHA512 d3d43d62229012c395d5db4c2930362201a147c2423423690551106a7ed0294f800f5c085b635de38ebf1260313721977c7fcad7cb4d957ca2c621dedcb572ad
- TLSH T14A41AC455BD5031BE373527A2EB64A21CB36FC06D6658F2F41DA048A4978940AA6CF3B
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\MSI13B8.tmp
- Size 132KB
- SHA256 7f47d98ab25cfea9b3a2e898c3376cc9ba1cd893b4948b0c27caa530fd0e34cc
- MD5 cfbb8568bd3711a97e6124c56fcfa8d9
- SHA1 d7a098ae58bdd5e93a3c1b04b3d69a14234d5e57
- SHA512 860cbf3286ac4915580cefaf56a9c3d48938eb08e3f31b7f024c4339c037d7c8bdf16e766d08106505ba535be4922a87dc46bd029aae99a64ea2fc02cf3aec04
- SSDEEP 3072:Kx2YbpcgwmiTPJDnCO+DATkURBnrskNwPj2:XXgwmY1CPx2XG2
- TLSH T1DBD39D02B5D0C473D9BE09390870DB229F7EB930DF909EDB636856699E702C19E35A37
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView\Crashpad\settings.dat
- Size 280B
- SHA256 a7e731d4ac525ec8837f67e0740c9d288497d3528c197d3229f9d90109840f24
- MD5 f8e37957ae19939af82c9072943209f9
- SHA1 312c7922b32873d76740f238b33d704e25c42514
- SHA512 796c2c3f436b5c55994ff3074073cfe0544c88d06506a484c3d25ecbf95e9f20f15649e7268c5bdd9d966f5a92ed7e2791ba3b0111ff52dacdfcea3f0c25bee5
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView\Crashpad\settings.dat
- Size 280B
- SHA256 c10ed6321ed757dc7d0df7fa77f28dba0c0cc9bc9a4f06b896c7b4126507ded3
- MD5 fa284c9660226c6721354e114b67818d
- SHA1 ee0db2864f2b46628ca8ace816ed308a88764dd4
- SHA512 d2d87e560cf9c2f4c81ef5341062f12b640e4b5785465a07a83a4ff0450c1815a5bdcacef0d350aedeffafc4737f454afd4c21f33bd886e14a8cfd31e6ad9092
- TLSH T1F7D0121372024534C11024331053A2180E10C11B400642026C38C59D5E048501A06442
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView\Crashpad\throttle_store.dat
- Size 20B
- SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
- MD5 9e4e94633b73f4a7680240a0ffd6cd2c
- SHA1 e68e02453ce22736169a56fdb59043d33668368f
- SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView\Default\Code Cache\js\index-dir\the-real-index
- Size 72B
- SHA256 96fe95c0191904bde785c77729c1e36f4e6757d625b5223d456eb93a2b3dde73
- MD5 0d431a51ec6d4cbfae58ba19db63eb30
- SHA1 b010be213c2ba55f73cce8d3ab3b93e8c0bcb1c5
- SHA512 ad330f63bd124d73b5b6f1ec6efd71915a3d9cb46ee5221cc500ffed51f7dbd8e6c282d5e8c1277ad48f06e7f38ef03dcad565bd608676d33944852f59c69919
- TLSH T1ECA002B597810DD7C2308BB862F28B81B2384851526307119594C76B9D607414D41105
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView\Default\Code Cache\js\index-dir\the-real-index~RFe5ae66a.TMP
- Size 48B
- SHA256 b72a4fb72fe563264de9d3b086bf9879bcd59ccba6443a082857747e153ec290
- MD5 d1928157303a31b4191d07508376c7d0
- SHA1 e7277f6e03bd63fd71ea384361232266b2dbfc42
- SHA512 44e8e6d868380a697c84bc54789fe92eb1770efadae946acc139b92c048ad302245e0ca0da996156b968d968eac71bae69beb2afced1b3f096baa1021ee0a422
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView\Default\Extension Rules\CURRENT
- Size 16B
- SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
- MD5 46295cac801e5d4857d09837238a6394
- SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
- SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView\Default\Extension Rules\MANIFEST-000001
- Size 41B
- SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
- MD5 5af87dfd673ba2115e2fcf5cfdb727ab
- SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
- SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView\Default\Network\SCT Auditing Pending Reports
- Size 2B
- SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
- MD5 d751713988987e9331980363e24189ce
- SHA1 97d170e1550eee4afc0af065b78cda302a97674c
- SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView\GraphiteDawnCache\data_0
- Size 8KB
- SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
- MD5 cf89d16bb9107c631daabf0c0ee58efb
- SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
- SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
- SSDEEP 3:MsFl:/F
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView\GraphiteDawnCache\data_2
- Size 8KB
- SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
- MD5 0962291d6d367570bee5454721c17e11
- SHA1 59d10a893ef321a706a9255176761366115bedcb
- SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
- SSDEEP 3:MsHlDll:/H
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView\GraphiteDawnCache\data_3
- Size 8KB
- SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
- MD5 41876349cb12d6db992f1309f22df3f0
- SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
- SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
- SSDEEP 3:MsGl3ll:/y
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView\Local State
- Size 15KB
- SHA256 1da28f01ecc40b247adaf66be922a5099872d204fe81dff5c01faf3fe40a53e5
- MD5 803d4e1b50f5b9a62ea98c5947f9cc41
- SHA1 76979796a3b77395796e5fe95a38c321da95dc25
- SHA512 6192880239dcd04116213d8c036e49b44091ec774c95591a71372b42da3e830027a811739222db208c6577e74a36c482b6fbd1f31ac919fbce293dea0b10f945
- SSDEEP 384:Y+aQikB+z/xvxjg/qhE/NBShV5O2hFN9zu:X/UxvxjgC+Yl5Fu
- TLSH T136729F2B55697E2795F3E6147E49174BDBBA94B290C26EB48EBC0F0E07C32DC1342C16
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView\Local State
- Size 2KB
- SHA256 359c41803db8490b6fb011120ec5c58df348e21bba8ac258f8f2b0af2dcc10bf
- MD5 67c6aa4d57ddba45b6bbde31e8fbe7eb
- SHA1 302eb1b811cdb13a3673b3613d9068579d0e071b
- SHA512 87c589a01a706fbed14f6e63962edb02a0d715416fa53aa0c08daf72accd78811f1cf06881d7bdba4ea1fbd457559b7bb6a8d276627df93849d17b4ce9b074c7
- TLSH T17C51B4736855A737C5B2D218798B3B23DE3B9065A6522F10AADC0B0D42D768D3342C27
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView\Local State
- Size 3KB
- SHA256 5732da54813bbd721fdbc7e80126f72fec266f642c1fd0db46a5d7853d510558
- MD5 65761c6b08f17aec6a57ee7e7633e41c
- SHA1 fe5e0ffb71ffdd09cd28bcf1043411dccf28fe08
- SHA512 d34092ed6bf09962c78b6519fd9c180a839c4121613d2151c2d5c104528eb7e4040edb646190e2b0c514c0663aad606ad5d7aca0f31613d3100d9ade23069b02
- TLSH T11761A47669A5A6278AB2D605B9873B12BBA75027E5913F94DAEC0F0D02D728C2342C17
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView\Local State~RFe5a90b8.TMP
- Size 1KB
- SHA256 80ecbed721ad73c37fe7f5a2591d198296d6d5f91d8873342812ff6a17da677b
- MD5 d7deb493bf7e98fc8312aa654d11fd18
- SHA1 1cd73926ab2d6fc1f8c10ec2230a5bd55bc2ec17
- SHA512 dd333857e8c0f38e4653302ec1dcea67b62255c3efe93c6e59f2b476ddf95f54bbf9c7c4baa8631c4f555e16b249de65085a4f73992e856112cd64eeebf1378a
- TLSH T1D62195F2E8E61773E861E31A265BBB536E33506AC1118E00A4DD0B0E47E218EB212D32
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\Installer\e5a6b3e.msi
- Size 14.4MB
- SHA256 7ef021039fcc397f9cf378e995c448c4312f1f0ea13d05020d6f55a7749d12af
- MD5 2b940d52c3090f57c5cb6065884792f8
- SHA1 d33dacf38d0ef6de6af065e73e91806ee384da72
- SHA512 dcb767833910252fe75546d370215dd15da9d0066be728db14592ab431612a42ae129b861529831fb1ea244aa3dc54e0c3e8ec049d6395b86436b6cb20ee24e7
- SSDEEP 393216:hc6EI0Zn4/BgpsCIPRKeow3ujYOqXgTzkRNcIqP:+K0ZsqpEPweoTjYmkRKI
- TLSH T152E6330B7C859F20C8261D3786B7DB28076DBD206616F6633299B469FFF17C099328D9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
- Size 26.1MB
- SHA256 4c74c4d474f4d616617b154eaf0d04d4771a10c6ccadfe64f7530f7a211539da
- MD5 a7babc7efde96cad58e6e2c3a53daf43
- SHA1 1a8f430154defbb39c8e79326af52bb34ceb7c6e
- SHA512 319f7aad179a63347b561147011bf0dee545ad8e7d0ea9d21ca080372e56dba9f0d10290b626b9ab66e8fb45bf318e0596dbc667d486adc01295c6cc4060e270
- SSDEEP 24576:vFo3DMPwdoO/vvTL/yQAQiFAvLeqrLXzU9WCtNuYm1ua5nxg8IhWwpKx0uO:CHc
- TLSH T13957A52476F92200E7B79E3CA8F06A238D397D579C15DE8D45421B4E0922F71E872F6B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\Volume{5d76dc85-0000-0000-0000-d08302000000}\System Volume Information\SPP\OnlineMetadataCache\{c9f774af-5c24-48eb-8379-ec6485cb4c42}_OnDiskSnapshotProp
- Size 6KB
- SHA256 02e3980cf6e3480cd71ddf2fdf5f45d4835669bccc2adce64484655dbc4e0298
- MD5 3ba5dbbfce342ea0568a08b0258298d1
- SHA1 ee304fc820c71432bd6cf72fc5647eb1812413c6
- SHA512 44d2b735029a094c040e3d9ea207f93ef4319617f6e4e60fc07301e893814fb12db7adce56fc1c60c00a071d184a231bf51a36fe1313c369df9d162eac46fdd7
- SSDEEP 96:Fc+0fvc6DD84LTHzbOHXOHBlBRQn8Sc9XE56tOSVQpu:q7b++uVm
- TLSH T142D177085AE54711E2B3AB3128F14557A877B811EF33CB8E0198638F6671A10F975F6F
- MD5 SHA1 SHA512 SSDEEP TLSH